Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About alemarzu
alemarzu
Motivator
Member since:
03-10-2014
10-14-2022
Community Statistics
| Posts | 320 |
| Solutions | 35 |
| Karma Given | 35 |
| Karma Received | 48 |
| Member Since | 03-10-2014 |
Activity Feed
- Got Karma for Re: How to find all the searches having "index=*" in the search or Alert or Reports. 05-25-2022 08:23 AM
- Got Karma for Re: How to find all the searches having "index=*" in the search or Alert or Reports. 04-11-2022 10:45 AM
- Got Karma for Re: How to find all the searches having "index=*" in the search or Alert or Reports. 01-06-2022 10:44 AM
- Posted Re: Windows Eventlog Blacklist Failing on Getting Data In. 06-09-2021 08:52 AM
- Posted Re: Using regex in field extraction on Splunk Search. 06-09-2021 08:40 AM
- Posted Re: CSVファイルのデータが一部文字化けして欠損する on Monitoring Splunk. 06-08-2021 02:43 PM
- Posted Re: Failed to load source for Event Timeline Viz visualization on Dashboards & Visualizations. 01-11-2021 12:38 PM
- Karma Re: ITSI Service Analyzer doesn't show anything for timothywatson. 01-11-2021 12:26 PM
- Got Karma for Re: Has anyone Splunked Trello data?. 01-04-2021 07:54 PM
- Got Karma for Re: Humans That Splunk: Meet Giuseppe Cusello. 01-04-2021 09:04 AM
- Posted Re: Humans That Splunk: Meet Giuseppe Cusello on Community Blog. 12-30-2020 09:27 AM
- Karma Humans That Splunk: Meet Giuseppe Cusello for sensitive-thug. 12-30-2020 09:21 AM
- Got Karma for Re: How to configure UF to send data to splunk stand alone instance?. 10-28-2020 03:02 AM
- Got Karma for Re: How to configure UF to send data to splunk stand alone instance?. 10-28-2020 02:57 AM
- Got Karma for Re: Clarification on search query to detect outliers. 10-26-2020 11:11 PM
- Posted Re: How can one change the ITSI status of multiple episodes at once? on Splunk Cloud Platform. 10-24-2020 02:27 AM
- Posted Re: Clarification on search query to detect outliers on Splunk Enterprise Security. 10-24-2020 12:40 AM
- Posted Re: help on where condition on Dashboards & Visualizations. 10-23-2020 06:28 PM
- Posted Re: How to configure UF to send data to splunk stand alone instance? on Splunk Enterprise. 10-23-2020 06:04 PM
- Posted Re: TA-DMARC scheme error on All Apps and Add-ons. 10-23-2020 05:44 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
06-09-2021
08:52 AM
Hi @pizzor Trying to filter WinEventLogs with more than EventCodes is limited by some key fields. Its not a free regex that you can drop there sort to speak. You can find this set of valid keys in here: https://docs.splunk.com/Documentation/Splunk/8.2.0/Admin/Inputsconf#Event_Log_allow_list_and_deny_list_formats Hope it helps.
... View more
06-09-2021
08:40 AM
@TheBravoSierra hello there. I believe you are having some issues with your regex. Without knowing your events I could suggest something like this. | rex field=TargetFilename "\.(?<file_extension>[^\.]+$)"
... View more
06-08-2021
02:43 PM
@JA8eginner Be aware that the CHARSET option must be set on the UF/input level. Can you share your props.conf?
... View more
01-11-2021
12:38 PM
@avollono Hello there, just try with an older version of the app, its weird but it happens.
... View more
12-30-2020
09:27 AM
1 Karma
Cheers to @gcusello ! I'm glad we have ppl like him on this community.
... View more
10-24-2020
02:27 AM
Hmm, perhaps through the Rest API's but I never tried it before, not in bulk at least. But due to the amount of episodes you want to delete I believe the best approach would be a script to iterate on each individual _key episode record. If you run this search you will have access to a list of episodes and their status, perhaps you could filter by them and making sure that all the episodes you want to keep are assigned and with other status than 1 (progress). So first get the keys for the episodes for deletion and export to .*txt or w/e. | inputlookup itsi_notable_group_user_lookup 1 - New 2 - In Progress 3 - Pending 4 - Resolved 5 - Closed Build a script to read the file and for each key execute, make sure this is the right path (I'm pretty tired) curl -k -u admin:password https://localhost:8089/servicesNS/nobody/SA-ITOA/event_management_interface/notable_event_group/\?filter\='\{"_key":"004b2eed-4551-481f-9487-9cf96b58e59d"\}' -X DELETE https://docs.splunk.com/Documentation/ITSI/4.6.0/RESTAPI/ITSIRESTAPIreference#event_management_interface.2F.26lt.3Bobject_type.26gt.3B
... View more
10-24-2020
12:40 AM
1 Karma
Hi @jogonz20 From a Splunk perspective the first stats is preparing the stage for the second stats to create additional statistics from it. Not an expert in the matter, so bear with me. For this type of things you often need more than an a count of logins per user so you have to find a way to enrich and/or clean your dataset in a way that it would help you detect the Outliers (a suspicious account behavior or brute force logging in this case), this is known as pre-processing your dataset before wrangling/modeling in ML. The fist stats does not only counts the amount of times a user has logged in per day it also gives you how many days a user accessed which is later used in the second stats but perhaps it's easy to miss due to a rather complex mix of functions in there. This is what's happening inside the second stats, just imagine you run this search for the last 30 days. num_data_samples: for each user counts how many days of the month logged in. recent_count: discretizes user activity in recent events or null if they exceed 24 hours, so you will end up with 2 values for 'count' and the max() function will keep the highest value between the two as 'recent_count'. If recent events are not found then "null". avg: it uses the relative_time() function to isolate oldest from recent events and calculates a login average of 'count' between the other 28 days. If previous records are not found then "null". stdev: it uses the relative_time() function to isolate oldest from recent events and calculates standard deviation of 'count' for each user between the other 28 days. if previous records are not found then "null". By doing this you synthesise extra features from the ones you have and end up with more dimensions that will help you find the outliers. As a sidenote, I believe the null's are missing their (). On the other hand I wouldn't use null() in there, fill the null values with "0" or apply some filtering to remove them. But pay attention to results whichever decision you choose. I hope it was helpful.
... View more
10-23-2020
06:28 PM
Hi @jip31 Have you tried without using boolean operators outside parenthesis, like this? | inputlookup lookup_xx where TYPE="Ind" (DOMAIN=I OR DOMAIN=B OR DOMAIN=W)
... View more
10-23-2020
06:04 PM
2 Karma
Hi @Ashwini008 Make sure your forwarder can also resolve your standalone FQDN, if not replace it for the IP on your outputs.conf. Theres also something weird about config files locations. Can you please verify if thats correct? Usually, the UF path for these config files would be something like /opt/splunkforwarder/... but you have opt/app/splunk/splunk/etc/system/local
... View more
10-23-2020
05:44 PM
Hi @amyers16 There must be a python version compatibility issue, read the docs from the app and make sure is compatible with your Splunk version. Also, if you are running Splunk v8.x, check which python version is enabled on your $SPLUNK_HOME/etc/system/local/server.conf under the [general] stanza. Like this [general] serverName = hostname python.version = python3
... View more
10-23-2020
05:31 PM
Hi @keesling Have you tried by holding shift and left-click over them to multi-select?
... View more
10-23-2020
04:42 PM
Hi @roderickjones, can you share an event sample? Something like this perhaps? your_base_search
| rex "\]: (?<caseCount>\d+)[\w\s]+(?<importCount>\d+)[^\:]+:\s(?<fileName>[^\s]+)"
| timechart sum(caseCount) as totalCases, sum(importCount) as totalImports span=1d Sidenote, replace the `sum` function for `values` if you only have 1 file per day.
... View more
10-22-2020
11:26 AM
1 Karma
Hi @tomawest Any plan to upgrade/compatible with Splunk 8.x and Python v3? Thx in advance. Best regards
... View more
09-16-2020
02:46 PM
Hi @P01YOGESHC Give this a try, and make sure your other server can resolve your splunk instance DNS, if not use the IP. Also, check SSL on url (http or https) and replace HEC token. curl -k "http://DNS_OR_IP:8088/services/collector" -H "Authorization: Splunk C*****4-3**9-4**5-A**C-3**********7" -d '{"event": "Hello, world!", "sourcetype": "manual"}'
... View more
09-16-2020
02:25 PM
Hi @cboillot I guess you could, I've done something similar with other evtx files just add a new input stanza in your local directory, like so. [WinEventLog://setup]
sourcetype = WinEventLog
source = WinEventLog:Setup
index = <your_index>
disabled = 0
...
... View more
09-16-2020
02:15 PM
Hi there, Doble check your ldap configuration and credentials. Add group filters in case you have tons of users/groups. Vlidate OU structures with an LDAP browser. Reload authentication config. This may also help. https://docs.splunk.com/Documentation/Splunk/8.0.6/Security/TestyourLDAPconfiguration
... View more
09-16-2020
01:55 PM
Hi there @yshen Im not sure if this is what you are looking for tho. Assuming that your timestamps are the same as your Time field. ...base search...
| eval varLoc=Location."-".Type
| chart values(Temperature) as Temperature over varLoc by _time Hope it helps.
... View more
12-16-2019
11:12 AM
Hello there,
I'm trying to integrate VMAX with Splunk at the moment but something weird is happening.
At some point according to docs (VMAX for Splunk Sizer), you should navigate to the VMAX TA folder containing the sizer script and configuration file which is .../etc/apps/TA-DellEMC-VMAX/bin/sizer to edit the following file vmax_splunk_sizer_config.ini
But theres no sizer folder nor configuration file when you download the add-on.
Any clues?
Kind regards,
AM.
... View more
06-04-2019
10:58 AM
I see, u should probably have to apply that settings over your source rather than sourcetype.
[source::PATH_FILE]
CHECK_METHOD = entire_md5
... View more
06-04-2019
07:35 AM
props.conf in the UF
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
10-14-2022
11:22 AM
|
Karma from
Karma given to
