About jakewalter

jakewalter · ‎11-11-2016

Our Check Point firewall environment seems to be a little more verbose than what the Splunk add-on expects, resulting in 1 hour plus delays in logging. In version 3.x.x of the OPSEC LEA add-on, we used fw1-loggrabber.conf to set SPLUNKRESTSTATUS_COMMIT="100000", which allowed the logs to be indexed at near real-time. With version 4.x.x, these settings are no longer available. Is there an equivalent setting that could be tweaked in either a conf file, or directly within a python script?

jakewalter · ‎12-03-2015

The urldecode function has issues with certain characters, so many of them need to be escaped (specifically any with hex starting with 0, 1, 8, 9, or any letter...). I built this eval statement that can be used as a calculated field: urldecode(replace(replace(substr(packet, -packet_len*2), "([A-Fa-f0-9][\d\w])", "%\1"), "%[\D0-18-9]\w", "."))

jakewalter · ‎02-11-2015

I was able to solve this by adding splunk_server=local to the Threalists - Threatlist Inventory - Lookup Gen scheduled search in SA-ThreatIntelligence, so the full search would look like this: | rest /services/data/inputs/threatlist splunk_server=local | where target="threatlist" AND disabled=0 | rename title as name | table name weight | outputlookup threatlist_names

jakewalter · ‎11-13-2014

That's all well and good, but to focus on the main point of my question, what causes the metadata displayed in the Data Summary to sometimes be affected after delete (e.g. sourcetypes or hosts are removed completely), but other times partial counts for the "deleted" data remain? I know that this was a bug in older versions of Splunk, but I do not see references to this in the latest.

jakewalter · ‎11-13-2014

After running the delete command to remove some incorrectly indexed data, the data is indeed gone from the index, but the Data Summary window in the Search app will sometimes show a count for the deleted data. This doesn't happen every time, and I can't speak to any differences between syntax when data metadata is fully deleted, versus when the metadata leaves an active count. Is there something in Splunk that needs to be reset?

Posts	5
Solutions	1
Karma Given	5
Karma Received	5
Member Since	‎06-06-2013

Online Status	Offline
Date Last Visited	‎06-05-2020 02:04 AM

How to configure the Splunk Add-on for Check Point...

Re: How to convert Hex to Ascii in Splunk?

Re: Splunk for Enterprise Security 3.2: Why is lo...

Re: Why are the counts inconsistent for metadata u...

Why are the counts inconsistent for metadata under...