Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About fdarrigo
fdarrigo
Path Finder
Member since:
12-18-2014
10-19-2020
Community Statistics
| Posts | 43 |
| Solutions | 4 |
| Karma Given | 0 |
| Karma Received | 20 |
| Member Since | 12-18-2014 |
Activity Feed
- Got Karma for HTTP Event Collector: Is there a working example with cURL on Windows?. 06-20-2022 02:55 PM
- Posted CarbonBlack/Splunk Integration on Getting Data In. 09-23-2020 04:58 PM
- Posted Re: 3D Graph Network Topology Unknown search command fit on All Apps and Add-ons. 08-12-2020 06:46 PM
- Posted What is SRM.exe? on Deployment Architecture. 06-23-2020 11:40 AM
- Got Karma for HTTP Event Collector: Is there a working example with cURL on Windows?. 06-05-2020 12:48 AM
- Got Karma for Re: What is the best way to collect and monitor Windows 2008 R2 print server events?. 06-05-2020 12:48 AM
- Got Karma for Re: DBConnect v2 Hung Parsing Job. 06-05-2020 12:48 AM
- Got Karma for DBConnect v2 Hung Parsing Job. 06-05-2020 12:48 AM
- Got Karma for Re: HTTP Event Collector: Is there a working example with cURL on Windows?. 06-05-2020 12:48 AM
- Got Karma for Re: HTTP Event Collector: Is there a working example with cURL on Windows?. 06-05-2020 12:48 AM
- Got Karma for Re: HTTP Event Collector: Is there a working example with cURL on Windows?. 06-05-2020 12:48 AM
- Got Karma for Re: HTTP Event Collector: Is there a working example with cURL on Windows?. 06-05-2020 12:48 AM
- Got Karma for HTTP Event Collector: Is there a working example with cURL on Windows?. 06-05-2020 12:48 AM
- Got Karma for HTTP Event Collector: Is there a working example with cURL on Windows?. 06-05-2020 12:48 AM
- Got Karma for HTTP Event Collector: Is there a working example with cURL on Windows?. 06-05-2020 12:48 AM
- Got Karma for HTTP Event Collector: Is there a working example with cURL on Windows?. 06-05-2020 12:48 AM
- Got Karma for HTTP Event Collector: Is there a working example with cURL on Windows?. 06-05-2020 12:48 AM
- Got Karma for HTTP Event Collector: Is there a working example with cURL on Windows?. 06-05-2020 12:48 AM
- Got Karma for Multiple Fields with Same Name. 06-05-2020 12:48 AM
- Got Karma for Re: Why isn't the universal forwarder processing all the monitor stanzas in inputs.conf for multiple folders on a Kiwi syslog server?. 06-05-2020 12:47 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 1 | |||
| 0 | |||
| 0 | |||
| 8 |
09-23-2020
04:58 PM
I am having difficulty configuring the Cb Defense Add-On for Splunk on a heavy forwarder, which is forwarding to my Splunk cloud environment. I have followed the configuration guides and I have created a Carbon Black API, but I see the following errors in the ta-cb_defense-carbonblack_defense_.... log file. 2020-09-23 23:44:39,961 +0000 log_level=INFO, pid=11719, tid=MainThread, file=ta_config.py, func_name=set_logging, code_line_no=77 | Set log_level=INFO 2020-09-23 23:44:39,961 +0000 log_level=INFO, pid=11719, tid=MainThread, file=ta_config.py, func_name=set_logging, code_line_no=78 | Start CarbonBlack task 2020-09-23 23:44:39,962 +0000 log_level=INFO, pid=11719, tid=MainThread, file=ta_checkpoint_manager.py, func_name=_use_cache_file, code_line_no=76 | Stanza=CarbonBlack using cached file store to create checkpoint 2020-09-23 23:44:39,962 +0000 log_level=INFO, pid=11719, tid=MainThread, file=event_writer.py, func_name=start, code_line_no=28 | Event writer started. 2020-09-23 23:44:39,962 +0000 log_level=INFO, pid=11719, tid=MainThread, file=thread_pool.py, func_name=start, code_line_no=66 | ThreadPool started. 2020-09-23 23:44:39,963 +0000 log_level=INFO, pid=11719, tid=MainThread, file=timer_queue.py, func_name=start, code_line_no=39 | TimerQueue started. 2020-09-23 23:44:39,963 +0000 log_level=INFO, pid=11719, tid=MainThread, file=ta_data_loader.py, func_name=run, code_line_no=48 | TADataLoader started. 2020-09-23 23:44:39,964 +0000 log_level=INFO, pid=11719, tid=Thread-2, file=scheduler.py, func_name=get_ready_jobs, code_line_no=100 | Get 1 ready jobs, next duration is 119.999002, and there are 1 jobs scheduling 2020-09-23 23:44:40,010 +0000 log_level=WARNING, pid=11719, tid=Thread-4, file=loader.py, func_name=_get_log_level, code_line_no=133 | [stanza_name="CarbonBlack"] The log level "" is invalid, set it to default: "INFO" 2020-09-23 23:44:40,016 +0000 log_level=INFO, pid=11719, tid=Thread-4, file=engine.py, func_name=start, code_line_no=36 | [stanza_name="CarbonBlack"] Start to execute requests jobs. 2020-09-23 23:44:40,016 +0000 log_level=INFO, pid=11719, tid=Thread-4, file=engine.py, func_name=run, code_line_no=219 | [stanza_name="CarbonBlack"] Start to process job 2020-09-23 23:44:40,016 +0000 log_level=INFO, pid=11719, tid=Thread-4, file=engine.py, func_name=_get_checkpoint, code_line_no=189 | [stanza_name="CarbonBlack"] Checkpoint not specified, do not read it. 2020-09-23 23:44:40,016 +0000 log_level=INFO, pid=11719, tid=Thread-4, file=http.py, func_name=request, code_line_no=165 | [stanza_name="CarbonBlack"] Preparing to invoke request to [https://defense-prod05.conferdeploy.net/integrati$ 2020-09-23 23:44:40,325 +0000 log_level=INFO, pid=11719, tid=Thread-4, file=http.py, func_name=_decode_content, code_line_no=36 | [stanza_name="CarbonBlack"] Unable to find charset in response headers, set it to default "utf-8" 2020-09-23 23:44:40,325 +0000 log_level=INFO, pid=11719, tid=Thread-4, file=http.py, func_name=_decode_content, code_line_no=39 | [stanza_name="CarbonBlack"] Decoding response content with charset=utf-8 2020-09-23 23:44:40,325 +0000 log_level=INFO, pid=11719, tid=Thread-4, file=http.py, func_name=request, code_line_no=169 | [stanza_name="CarbonBlack"] Invoking request to [https://defense-prod05.conferdeploy.net/integrationServices/$ 2020-09-23 23:44:40,335 +0000 log_level=INFO, pid=11719, tid=Thread-4, file=engine.py, func_name=_on_post_process, code_line_no=164 | [stanza_name="CarbonBlack"] Skip post process condition satisfied, do nothing 2020-09-23 23:44:40,335 +0000 log_level=INFO, pid=11719, tid=Thread-4, file=engine.py, func_name=_update_checkpoint, code_line_no=178 | [stanza_name="CarbonBlack"] Checkpoint not specified, do not update it. I am curious if the lack of a checkpoint reference is preventing the API from returning data to the TA, but I didn't find any documentation related to the checkpoint or how to debug the TA log file. Where do I go from here?
... View more
Labels
- Labels:
-
heavy forwarder
08-12-2020
06:46 PM
I have the same problem
... View more
06-23-2020
11:40 AM
Does anyone know what c:\program files\splunkuniversalforwarder\bin\srm.exe is? Our AV has flagged the file as suspicious and I want to confirm it's a valid Splunk provided executable. Frank
... View more
Labels
- Labels:
-
universal forwarder
02-18-2020
05:01 AM
Thanks. I will keep it in mind.
... View more
02-18-2020
05:01 AM
MuS- Changing from fast mode to verbose solved the problem
anthonymelita - thanks for the tip. I will keep it in mind.
... View more
02-17-2020
02:36 PM
I am ingesting JSON data via the HEC on a HeavyForwarder, but when I query the data in SplunkCloud, I have different results depending on which app I am using to query the data.
For example, in the search and reporting app, the json data creates an event with fields "ping.jitter" and "ping.latency". However, when I query using a custom app, the event is not created and the fields "ping.jitter" and "ping.latency" are not created nor are they populated with data.
Any ideas why?
... View more
- Tags:
- json
08-18-2018
08:06 AM
I never ran into this problem before, but I hope someone has..
I have a python script which calls a REST API and passes the JSON to Splunk via the HEC.
The fields are single-valued, however, Splunk converts them to multi-value.
Does anyone know why this is happening and how to fix it?
... View more
- Tags:
- splunk-cloud
12-08-2016
10:55 AM
1 Karma
I decided to take a different approach. I used the wevtutil command to export the Print Event Log to an XML file. I appended the current date/time stamp the file and ran wevtutil again to clear the Windows Event Log
set hh=%time:~0,2%
set hh=%hh: =0%
set dt=%date:~10,4%%date:~4,2%%date:~7,2%_%hh%%time:~3,2%%time:~6,2%
wevtutil qe Microsoft-Windows-PrintService/Operational /q:"*[System[((EventID=307))]]" >c:\splunkevents\PrintEvents\PrintEvents_%dt%.xml
wevtutil cl Microsoft-Windows-PrintService/Operational
Using Windows Task Scheduler, I configured a task to run every 5 minutes, which produced this:
<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-PrintService' Guid='{747EF6FD-E535-4D16-B510-42C90F6873A1}'/><EventID>307</EventID><Version>0</Version><Level>4</Level><Task>26</Task><Opcode>11</Opcode><Keywords>0x4000000000000840</Keywords><TimeCreated SystemTime='2016-12-07T19:35:07.193302100Z'/><EventRecordID>11653591</EventRecordID><Correlation/><Execution ProcessID='1236' ThreadID='7800'/><Channel>Microsoft-Windows-PrintService/Operational</Channel><Computer>SVRPRINT.xxxx.com</Computer><Security UserID='S-1-5-21-1418215022-461469287-1537874043-18922'/></System><UserData><DocumentPrinted xmlns:auto-ns3='http://schemas.microsoft.com/win/2004/08/events' xmlns='http://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/events'><Param1>116</Param1><Param2>DOC120716-12072016141658.pdf</Param2><Param3>someuser</Param3><Param4>31AI2UA4121W48W</Param4><Param5>ITHINSGeneralBW4</Param5><Param6>10.17.48.14</Param6><Param7>850573</Param7><Param8>5</Param8></DocumentPrinted></UserData></Event>
I imported the file into Splunk and used spath to extract the "params" into usable fields
...|eval DocumentName=spath(_raw,"Event.UserData.DocumentPrinted.Param2") ,
User=spath(_raw,"Event.UserData.DocumentPrinted.Param3") ,
ComputerName=spath(_raw,"Event.UserData.DocumentPrinted.Param4"),
PrinterName=spath(_raw,"Event.UserData.DocumentPrinted.Param5") ,
PrinterIP=spath(_raw,"Event.UserData.DocumentPrinted.Param6"),
Bytes=spath(_raw,"Event.UserData.DocumentPrinted.Param7") ,
Page_Count=spath(_raw,"Event.UserData.DocumentPrinted.Param8")
Which gives me:
One last note: I created a nightly task scheduler job to delete the day's XML files
... View more
12-07-2016
06:07 AM
It looks like we are receiving all the print events. In other words, every time someone submits a print job, we receive events in splunk. The data in each event is correctly populated, except for the pages printed (sometimes it is correct for some people, most of the time is incorrect). I watched the Windows print queue and I can confirm the queue shows the correct number of pages printed, so for whatever reason, Splunk is not able to always query the print queue.
... View more
12-06-2016
10:36 AM
Hi. What do you mean by "dodgy events"?
... View more
12-06-2016
07:25 AM
I'd like to track print events from a Windows 2008 R2 print server. I have configured my Universal Forwarder (UF) via this blog: http://blogs.splunk.com/2014/04/21/windows-print-monitoring-in-splunk-6/ and I am receiving print event data, but the page print metrics are inconsistent. I am capturing page counts for some users, but most user page counts are zero.
My Splunk configuration is : Print Server UF (6.5) ->Heavy Forwarder->SplunkCloud
I have also tried this configuration: Print Server UF(6.5)->SplunkCloud
Both exhibit the same problem.
How do you monitor print events?
... View more
12-05-2016
07:32 AM
Hi. Do you know if this issue has been fixed? I configured my Windows 2008 R2 print server and I am receiving print events, however the page count metrics are wrong:
operation=add
type=PrintJob
printer="AMHMEMGeneralBW2"
machine="00ABMXV00402T1W"
user="fdarrigo"
document="Microsoft Word - Document1"
notify_name="fdarrigo"
JobId=58
data_type="RAW"
print_processor="hpcpp170"
parameters=
driver_name="HP Universal Printing PCL 5 (v5.9.0)"
status="spooling"
priority=1
total_pages=1
size_bytes=0
submitted_time="12/05/2016 15:09:16.951"
page_printed=0
This was for a 2 page Word document.
... View more
08-02-2016
07:01 AM
1 Karma
I am importing AD data which can contain multiple Organizational Units (OU). Splunk only creates a field for the first instance, therefore I cannot query on all OUs.
For example, this is my sample input data
sn = D'Arrigo
givenName = Frank
department = Information Technology
sAMAccountName = fdarrigo
EmailAddress = fdarrigo@nyaaa.com
Enabled = True
LastLogonDate = 8/1/2016 9=49=40 PM
DistinguishedName = D'Arrigo Frank
OU=USB_Enabled
OU=User_Accounts
DC=nyaaa
DC=com
DC=com
Notice, I have two OUs: USB_Enabled; User_Accounts
I am looking for suggestions what allow me query using either/both OU as a filter.
index=myindex sourcetype=mysourcetype OU=USB_Enabled AND OU=User_Accounts
Am I better off combining all OU values as a single MV field? (i.e. OU=USB_Enabled,User_Accounts)
... View more
- Tags:
- activedirectory
07-20-2016
05:03 AM
1 Karma
SOLVED!
I opened a ticket with Splunk Support. Randy Morlen grabbed the ticket and asked for a diag. After investigating, he found the following error:
HTTPError: HTTP 402 Payment Required -- In handler 'shclusterconfig': Requires license feature='DistSearch'
After a little back and forth, Randy provided a 1-byte license for my HF . DBX2 immediately parsed the SQL and connected. Data is now flowing from my SQL server to Splunk.
Thanks Randy. I appreciate your help
Note for Splunk Dev: Please add a check for the appropriate license during the DBX setup to avoid this issue in the future.
... View more
07-18-2016
07:26 AM
1 Karma
All,
DBConnect v2 is hanging when parsing the job during configuration. I am adding a new DB Input, which uses a SQL connection to a SQL Server. The identity is a local SQL account with read permissions in the database. I can log into SQL as the DBConnect identity user and I can run a query against the table, so the SQL permissions are correct.
I have tried the following Database Types:
MS_SQL Server using jTDS Driver;
MS_SQL Server using jTDS Driver with Windows Authentication
MS-SQL Server Using Generic Driver
MS-SQL Server Using Generic Driver with Windows Authentication.
The connection passes the validation step.
Steps to reproduce issue
Click Operations>DB Inputs> Select Input (i.e. TestDBInput)> Make sure its enabled ("Valid Connection" displays)>Continue>Choose and Preview Table> "Parsing job..." indicator spins> Make sure I have specified the correct catalog, schema, table>Set Max Rows to 100.
Clicked Simple Query Mode drop down >(in the advanced query editor)>confirm the sql is correct.
I am running DBConnect v2 on a 6.3.3 Heavy Forwarder.
JRE Status
JRE Installation Path /usr/lib/jvm/java-8-oracle
JVM Options: -Xmx1024m -XX:+UseConcMarkSweepGC
RPC Server Port 9998
RPS Server SSL Disbaled
Any ideas what would cause this?
... View more
06-07-2016
05:17 AM
The Palo Alto app was just vetted for Splunk Cloud. Now, if I could just find step by step directions for configuring it for the Cloud.
... View more
04-14-2016
07:59 AM
I'm looking for a way to to implement a motion chart and small multiples with my Splunk data. I know the D3 library supports motion charts and I was hoping someone has already figured out the integration steps with Splunk.
If you're not familiar with Motion Charts, you can see a terrific example here: https://www.youtube.com/watch?v=jbkSRLYSojo
... View more
04-05-2016
07:37 AM
same results for
en-US/info an hit the "Static resource cache control" - same error?
AND
try to hit (on the same page ) "EAI object refresh"
Since this is the free version, it doesnt support user accounts or roles, so I can't explicitly add myself to a splunk admin role.
... View more
04-05-2016
07:24 AM
I am trying to bump a local Splunk instance using : https:///en-US/_bump
but I receive the following:
<response> <messages> <msg type="ERROR">Forbidden</msg> </messages> </response>
This looks like an authentication/authorization error.
I am running Splunk 6.4 (Free license)
What am I doing wrong?
... View more
02-25-2016
06:14 AM
4 Karma
For a more complete understanding of the http-event-collector, check out the links I referenced above.
... View more
02-24-2016
07:46 AM
8 Karma
I've started experimenting with the HTTP event collector recently, and I like what I have seen so far.
There are a few great articles online describing the HTTP architecture with simple examples of using cURL to POST data to an HTTP event collector. However, there are nuances using cURL on Windows and posting multiple values in an event, which are best explained via working code.
The following example posts two events: "Breakfast Order" (simple event) and an event with three breakfast items (more complex event) to a Splunk indexer via the HTTP collector.
curl -k https://10.19.16.101:8088/services/collector/event -H "Authorization: Splunk 982D05B0-8603-4311-A1AF-32462BA47C9F" -d "{\"event\":\"Breakfast Order\"} {\"event\":{\"coffee\":\"double cream double sugar\",\"muffin\":\"blueberry\",\"juice\":\"none\"}}"
{"text":"Success","code":0}
Windows errors when you use the single quotes ' so, change them to double quotes " and escape the other double quotes \"
Thanks goes to:
Glenn Block for this article http://blogs.splunk.com/2015/10/06/http-event-collector-your-direct-event-pipe-to-splunk-6-3/
And whomever wrote this article: http://dev.splunk.com/view/event-collector/SP-CAAAE7F
... View more
01-19-2016
08:52 AM
I would like to identify data ex filtration through my Cisco ASA firewalls. Is this possible? Can you provide a sample query?
... View more
01-02-2016
04:32 PM
3 Karma
I would like to query an app's macros and return the macro attributes such as the name and the definition. Can someone point me in the right direction?
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
10-19-2020
11:44 AM
|
Karma from
