About nicolociraci

nicolociraci · ‎04-09-2019

I'm trying to read a json file generated by a ps1 script on Windows, but the UF keep truncating the json as soon it finds a valid timestamp. Removing the timestamp 'fixes' the problem, but I need the timestamps. I've a similar script running on unix machine and the issues is not appearing there. My props is the following: [sourcetype_name] TRUNCATE = 0 BREAK_ONLY_BEFORE_DATE = false DATETIME_CONFIG = NONE MAX_TIMESTAMP_LOOKAHEAD = 0 INDEXED_EXTRACTIONS = JSON I'm starting to think that it's a bug on Windows UFs.

nicolociraci · ‎09-12-2018

Hello, I'm unable to get field validation in a Custom Adaptive Response Action in Splunk Enterprise Security. What I would like to achieve is a field validation that obliges the user to fill the field (required field) but I can't get even the simplest validation working. When I click on the run button in the adaptive actions modal view on the incident, I get no validation but a message saying "action has been dispatched". Furthermore which field should I put in alert_actions.conf.spec and savedsearched.conf.spec? The documentation I have read is quite vague. Thanks!

nicolociraci · ‎05-08-2018

I can't post the real data, but I will post the props.conf (with thelatest configuration) and censored data. [MailboxAuditDisabled] FIELD_HEADER_REGEX = ^\s*("Name.*) PREAMBLE_REGEX = ^#TYPE.* Data #TYPE Selected.Microsoft.Exchange.Data.Directory.Management.Mailbox "Name","Alias","ServerName","AuditEnabled" "foo","bar","server-foo","False" "foobar","bar2","server-foo2","False" "foofoo","barbar","server-foo","False" "foo3","bar2","server-foo3","False" Note that the data is splitted in multiple events. In my installation I've two indexer (the configuration is deployed on both of them).

nicolociraci · ‎05-08-2018

I'm already aware of that, and it's not the issue.

nicolociraci · ‎05-02-2018

So, my comment went into review and never get posted. By the way, I'm in option 3 but your solution is not working. Actually no solution is working, it seems like Splunk is ignoring my config. Where should I put the config? For now I've only tried in the Indexer.

nicolociraci · ‎04-24-2018

Does not work.

nicolociraci · ‎04-23-2018

I've a CSV file like the one reported below, and on my UF I've added the following props but on the search heads the events are not parsed. props.conf [sourcetype] FIELD_HEADER_REGEX=#LineAboveHeader\n(.*) FIELD_DELIMITER=, CSV example #LineAboveHeader "Header1","Header2","Header3","Header4" "Field1", "Field2", "Field3", "Field4" "Field1", "Field2", "Field3", "Field4" "Field1", "Field2", "Field3", "Field4" What I would like is that splunk sees the headers and import the field names, and then create an event for each line.

Posts	7
Solutions	0
Karma Given	0
Karma Received	0
Member Since	‎03-28-2018

Online Status	Offline
Date Last Visited	‎06-05-2020 02:04 AM

JSON is truncated as soon a timestamp is found

How can I achieve a field validation in a Custom A...

How to import this kind of CSV data?

JSON is truncated as soon a timestamp is found

How can I achieve a field validation in a Custom A...

Re: How to import this kind of CSV data?

Re: How to import this kind of CSV data?

Re: How to import this kind of CSV data?

Re: How to import this kind of CSV data?

How to import this kind of CSV data?