Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About sumit29
sumit29
Path Finder
Member since:
12-08-2014
03-18-2024
Community Statistics
| Posts | 21 |
| Solutions | 1 |
| Karma Given | 0 |
| Karma Received | 3 |
| Member Since | 12-08-2014 |
Activity Feed
- Got Karma for IBM Siteprotector as a data input. 06-05-2020 12:47 AM
- Got Karma for Splunk Add-on for Bit9 Carbon Black: Why is the Carbon Black Event Forwarder utility not getting started?. 06-05-2020 12:47 AM
- Got Karma for How to write a real-time search to alert if daily license usage reaches 70 GB or more?. 06-05-2020 12:47 AM
- Posted If we currently have 5 heavy forwarders sending logs to a single indexer, how can we centrally forward all raw logs to another SIEM/Log management solution? on Getting Data In. 06-03-2016 01:37 AM
- Tagged If we currently have 5 heavy forwarders sending logs to a single indexer, how can we centrally forward all raw logs to another SIEM/Log management solution? on Getting Data In. 06-03-2016 01:37 AM
- Tagged If we currently have 5 heavy forwarders sending logs to a single indexer, how can we centrally forward all raw logs to another SIEM/Log management solution? on Getting Data In. 06-03-2016 01:37 AM
- Tagged If we currently have 5 heavy forwarders sending logs to a single indexer, how can we centrally forward all raw logs to another SIEM/Log management solution? on Getting Data In. 06-03-2016 01:37 AM
- Posted Re: Query to capture distinct source IP who triggered multiple signatures on Splunk Search. 12-23-2015 03:51 PM
- Posted Re: Multiple Firewall Denies followed by an allow from the same source IP on Splunk Search. 12-23-2015 02:50 PM
- Posted Re: Query to capture distinct source IP who triggered multiple signatures on Splunk Search. 12-23-2015 02:49 PM
- Posted Query to capture distinct source IP who triggered multiple signatures on Splunk Search. 12-23-2015 10:32 AM
- Tagged Query to capture distinct source IP who triggered multiple signatures on Splunk Search. 12-23-2015 10:32 AM
- Posted How to write a real-time search to alert if daily license usage reaches 70 GB or more? on Splunk Search. 12-22-2015 07:03 AM
- Tagged How to write a real-time search to alert if daily license usage reaches 70 GB or more? on Splunk Search. 12-22-2015 07:03 AM
- Posted How to search for 5 failed logins followed by 1 successful login from one user to find brute force attacks? on Splunk Search. 12-21-2015 01:37 PM
- Tagged How to search for 5 failed logins followed by 1 successful login from one user to find brute force attacks? on Splunk Search. 12-21-2015 01:37 PM
- Tagged How to search for 5 failed logins followed by 1 successful login from one user to find brute force attacks? on Splunk Search. 12-21-2015 01:37 PM
- Tagged How to search for 5 failed logins followed by 1 successful login from one user to find brute force attacks? on Splunk Search. 12-21-2015 01:37 PM
- Posted How to search the list of devices that have sent logs the past 30 days, but not within the last 24 hours? on Splunk Search. 12-08-2015 04:23 PM
- Tagged How to search the list of devices that have sent logs the past 30 days, but not within the last 24 hours? on Splunk Search. 12-08-2015 04:23 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 0 |
06-03-2016
01:37 AM
Dear Experts,
We have a Distributed environment using around 5 heavy forwarders across various locations sending logs to a central indexer. Now we have a requirement to forward the raw logs to another log management/SIEM solution.
What do you guys recommend to forward the logs? We are looking for a way to centrally forwarding the logs,
Thanks in advance !
... View more
12-23-2015
02:50 PM
Same i am also looking for , Dear Experts kindly help 🙂
... View more
12-23-2015
02:49 PM
Thanks, But this query only gives signature count along with src , I require count of signature from single source.
Let say source 10.10.10.10 trigger signature name = x and another signature name =y . so this source triggered 2 distinct signature . This what i am looking
... View more
12-23-2015
10:32 AM
Dear Experts,
I require help to create the query.
I am creating the rule if single(unique) source triggered distinct signature(more than 2) . Than only we should get the result.
Fields involved src,signature,count
Thanks in advance
... View more
- Tags:
- splunk-enterprise
12-22-2015
07:03 AM
1 Karma
Hi Team
I need your help to write the search on the licence usage. Suppose I have a 100 GB license. My daily licence usage is 60 to 65 GB. I need to write a search to find if daily license usage suddenly reaches 70 GB or more. So, if I can run this search in real-time and license usage reaches 70 GB, it should throw an alert.
Thanks In Advance
... View more
12-21-2015
01:37 PM
Dear Experts,
Kindly help to create a search for 5 failed logins followed by 1 successful login from one user.
Interesting fields = user(Username) , action(Success Or Failed)
index=* | ....
Thanks in advanced
... View more
12-08-2015
04:23 PM
Dear Experts,
I am looking to find the difference in the devices sending logs in the last 24 hour with devices which sent logs 30 days back.
Search:
| tstats values(host) AS Host dc(host) as count by sourcetype,index | eval sourcetype=sourcetype." - ".count | stats list(sourcetype) as "sourcetype-hostCount" by index, Host
Lets say for the ast 24 hours, it list 40 devices, and for last 30 days it list 60 devices.
I need an output of the difference which should list the 20 devices which are not sending logs from the past 1 day.
... View more
- Tags:
- difference
- search
- time
11-23-2015
06:21 AM
Dear Experts ,
I have created the Lookup Hostname.csv(Contain only one field Hostname) which contain 100 number of hosts. I need to write a search to compare the hostname.csv with current search(List of unique hostname ) to get the new hostname come to network comparing with hostname.csv.
Lets say 101 , a new host came to network . Need to compare with hostname.csv . Display in search output
... View more
08-17-2015
09:53 PM
1 Karma
Dear Experts ,
I have installed the Splunk Add-on for Bit9 Carbon Black and I have installed the Carbon Black Event Forwarder utility on the Carbon Black Server. Issue is that agent is not getting started. The page mentioned below doesn't give you proper information.
https://github.com/carbonblack/cb-event-forwarder
If anyone has configured this successfully, Kindly help
Thanks in advance ..
... View more
07-29-2015
07:44 AM
Dear Experts,
Facing challenge to integrate the Mcafee Epo with splunk enterprise .
We have installed the DB Connect 2 and following the steps as mention in the splunk docs. We have configured the parameters DB Input (Validated the connection :Successful) and DB Ouput , we are are able to the see Mcafee EPO database table row and columns. Have saved the configuration.
Challenge we are facing , Under Health connection dbinput get failed , Transaction type py_dbinput , Status False .
Why its getting failed , As when we validate the connection , Its show the successful and we are able to query the database.
Database : MS SQL 2012
Thanks in advance
... View more
- Tags:
- dbconnect
05-25-2015
01:19 AM
Dear Experts,
I need to write the custom search where user x can login from 5 sources , I am thinking to use lookup( 5 allowed Source IP) , Suppose if user login not from this lookup table(alloweduser) where field name IP. I should get a alert .
... View more
- Tags:
- lookup
05-23-2015
09:27 PM
Thanks rphillips,
I haven't tried the query as its weekend .will try on Monday
@woodcock - can u extend ur help in writing the query .Thanks
... View more
05-22-2015
05:29 AM
Dear Experts,
I am creating the custom search in ES app ,
| tstats allow_old_summaries=true dc(Authentication.src) as "Source",dc(Authentication.user) as "User" from datamodel=Authentication where nodename=Authentication.Successful_Authentication by "Authentication.user","Authentication.src" | rename "Authentication.user" as "User","Authentication.src" as "Source" | Where User="x" AND Source!="a" AND Source!="b" AND Source!="c"
Result : Above query is not working as expected.
I have a User=x which can be authenticated from 3 source.
I need to create the alert if user login from other than this 3 source , I should get the alert . Kindly help to enhance the query.
... View more
- Tags:
- es
01-22-2015
06:10 AM
Hi All,
I need help , We have installed universal forwarder in around 20 machines and provided the deployment , Indexder IP . Logs are forwarder to the test server . Now we want to change the test indexer IP to Production IP
Kindly guide us when we create the Custom app for windows , Where we can define the indexer IP . So that we can push the same app in the all servers , Route the traffic to the production .
Thanks in Advance
... View more
- Tags:
- deployment-server
12-26-2014
03:15 PM
1 Karma
Hi All,
I need to integrate the IBM siteprotector with splunk to collect the IDS/IPS logs . Which is best method to do that. Any one has steps to forward the logs to splunk. Add On Created for the same . Will be helpful .
... View more
- Tags:
- ibm
- Splunk for IMAP
12-08-2014
01:29 PM
Hi , Thanks for the quick reply .
I did netstat on indexer and its listening on the UDP 514 port .
Windows firewall is disabled .
I have downloaded the snare agent also to forward the logs to indexer there also no luck,
Version running splunk 6.2
Kindly help go stuck .
... View more
12-08-2014
11:22 AM
Hi All,
I have configure the UDP port in data input on port 514 but still no luck in receiving any syslog data from network devices ,
We have configured neat about 20 devices to forward the logs via udp(514) to our splunk indexer but none are shown under search data summery.
Splunk Enterprise running on Windows Server 2012 .
Kindly help it to get it resolved.
Thanks in advanced.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
03-18-2024
10:17 PM
|
