About coccyx

coccyx · ‎03-21-2019

You can look into mvexpand with your JSON array to explode each event into multiples. As an alternative, Cribl allows you to pre-process events in the ingestion pipeline and we include a function called JSON Unroll which allows you to create an event per entry an a JSON array.

coccyx · ‎02-01-2019

FYI, what you're looking to do is very easy to do in Cribl. You can point already cooked data at us and transform it how you see fit before delivering it out to syslog, or to any other system we support. https://cribl.io/

coccyx · ‎02-01-2019

I wondered why that post had popped back up. That approach is unsupported and a bit risky, but glad it's working for you.

coccyx · ‎01-30-2019

As the other posters have mentioned, you can forward out syslog messages to third party systems. However, you will lose the structure of the events. All events just get merged into one bytestream and so the destination system must be responsible for parsing again, and since you have multiple message types in one stream this can be very difficult. Cribl (https://cribl.io/) allows you to route events to multiple systems but maintain full metadata. In addition, you can be very selective about what goes where and you can reshape and enrich events as they're moving.

coccyx · ‎01-30-2019

As the other posters have mentioned, you can forward out syslog messages to third party systems. However, you will lose the structure of the events. All events just get merged into one bytestream and so the destination system must be responsible for parsing again, and since you have multiple message types in one stream this can be very difficult. Cribl (https://cribl.io/) allows you to route events to multiple systems but maintain full metadata. In addition, you can be very selective about what goes where and you can reshape and enrich events as they're moving.

coccyx · ‎11-29-2018

Splunk by default will stick on a given indexer for 30 seconds from a heavy forwarder before connecting to another. This can lead to inconsistent load balancing but there are things you can do to tune it better. Your concern about Netflow into Splunk also creating a lot of connections via Splunk isn't a valid concern. Splunk sends megabytes or gigabytes of data per TCP connection before establishing another connection. There may be thousands or millions of Netflow records in that stream. Splunk should not meaningfully add to your Netflow record count from HWF to Indexer. On the front side of the HWF, depending on the number of Universal Forwarders though, you could see a significant number of connections. Enough to be a meaningful percentage of your Netflow data.

coccyx · ‎11-02-2018

https://cribl.io/ Answers added a ) after the link, smart. No, Add-on for Linux will not help you send data to Elastic. It works well with Splunk though. Splunk Add-Ons are apps designed to help make data gathering for known systems easier. Elastic has their own set of data gatherers they call beats which help in that area.

coccyx · ‎11-02-2018

What app? This is a use case for my company's product, Cribl (https://cribl.io/). Without knowing what you're asking about though, can't say one way or another.

coccyx · ‎10-31-2018

As you can see, this type of ingestion time modification of data is tough in Splunk. This SEDCMD approach could work, but getting your configuration right will be a major pain. For what it's worth, not sure if you're amenable to a 3rd party solution, but this is something Cribl (https://cribl.io/) makes easy that's very hard to get right in props/transforms.

coccyx · ‎10-31-2018

Lookups will run for every event that's sent to them. In Splunk today, products like Enterprise Security use Data Model Acceleration to do lookups once and then bake the results into the accelerated data model. Unfortunately, it's not available in the regular search interface. You could write your own dnslookup custom search command which maintains state somewhere across invocations and throttles the number of DNS lookups. The downside to this is that you're going to get very inconsistent results with some events getting lookups and others not. My recommendation would be to do DNS enrichment at ingestion time. Unfortunately, it's not possible in Splunk, but it is something we do in Cribl (https://cribl.io/). These types of lookups can be done once at ingestion and added as an index time field to the event as its moving. This also has the benefit of having DNS resolution done closer to the time of the originating event rather than days or weeks later.

coccyx · ‎10-22-2018

Setting meta fields via inputs.conf does not work for modular inputs. Because modular inputs insert data after the typing queue, it's not possible to use inputs.conf or props/transforms.conf overrides to change meta fields. Modular inputs will always go to your default output group. As an aside, handling routing for any type of data is something our product does, if you want to check it out at https://cribl.io/. Fits natively into a heavyweight forwarder or indexer.

coccyx · ‎10-22-2018

It looks like you're using simple mode for modular input rather than xml: http://docs.splunk.com/Documentation/Splunk/7.2.0/AdvancedDev/ModInputsStream This is setup in your introspection in the tag: http://docs.splunk.com/Documentation/Splunk/7.2.0/AdvancedDev/ModInputsScripts

coccyx · ‎09-11-2018

Default interval is 60 seconds. Yes, if you want to generate one and only one copy, set the interval up to an impossibly high number. https://github.com/splunk/eventgen/blob/develop/splunk_eventgen/default/eventgen.conf#L22 It should be noted, you may find gogen to be a better experience and it supports the concept of ending after a number of intervals. https://github.com/coccyx/gogen

coccyx · ‎09-11-2018

As I recall (been a while since I wrote it), Eventgen doesn't have a concept of "ending", it will always keep generating new data. What is your interval and count set to? Eventgen will generate count events every interval. What you're seeing most likely is that it is generating multiple intervals of events. By default, count=0, which means to use the whole file. With that default, what you're seeing is that every interval it'll keep just putting the whole file out.

coccyx · ‎09-07-2018

As far as I'm aware, this does not exist. If you're looking to route data from the ingestion pipeline to third party systems, this is a use case we support in Cribl (https://www.cribl.io).

coccyx · ‎08-03-2018

I agree with you whole heartedly. A few friends on mine in the industry are pushing the idea that everything should be an event, encoded in JSON, very wide with lots high cardinality fields. We find that most of the time the person who needs to consume it and the person who writes it are different and so there's a need to sit in the middle and make the logs smarter through transformation and enrichment. You're confirming the need for such a thing. Perhaps Splunk should provide this out of the box, but after years of trying to convince them to do that from the inside we decided to build it on the outside :).

coccyx · ‎08-03-2018

RegEx is powerful but limited. Can't really comment on what "should be" doable in Splunk itself, only what is. Your other options at Search Time without third party products would be to build a custom search command. This could probably be done in 10 lines of python. The use case you're describing really requires being able to programmatically process the data.

coccyx · ‎08-03-2018

This is I think out of scope for this forum. This is a broader configuration management question of how do you take something out of your CI/CD pipeline and trigger Splunk configuration changes. There are a number of ways to accomplish this, with Puppet, Chef or SaltStack being probably the more popular.

coccyx · ‎08-03-2018

Yes, on a single instance of Splunk, this is easy. In a distributed install, not so much. There is, as far as I am aware, no way to get an authentication token that will authorize you to a whole Splunk cluster, so you must authenticate individually to each node. On the instance you're running your modular input on however, this is supported. If you look at the XML passed back to your modular input, there is a session token present. I'm not all that familiar with the python SDK, but it looks like maybe it's the get_scheme() method on splunklib.modularinput.Script . See: http://docs.splunk.com/Documentation/Splunk/7.1.2/AdvancedDev/ModInputsScripts#Define_a_scheme_for_introspection http://docs.splunk.com/Documentation/PythonSDK The token you receive from the modular input is passed to connect as the token parameter. http://dev.splunk.com/view/python-sdk/SP-CAAAEE4

coccyx · ‎08-03-2018

Why are you trying to count characters in your regex? This regex seems to do the trick: \s(?{.+})$. In general, I'd try to get your developers to clean up their logging to output just JSON rather than JSON in a log. Another option to prettify the logs at ingestion time. It's a use case we're working on at Cribl (https://www.cribl.io/) if you're interested.

Posts	27
Solutions	3
Karma Given	2
Karma Received	11
Member Since	‎07-04-2018

Online Status	Offline
Date Last Visited	‎06-05-2020 02:04 AM

Re: separate json payload to separate events

Re: Local processing of forwarded events on heavy ...

Re: Local processing of forwarded events on heavy ...

Re: forwarding logs to third party system

Re: forwarding logs to third party system

Re: How does Splunk forward events?

Re: Can one use this app to send data to Elastic S...

Re: Can one use this app to send data to Elastic S...

Re: How do you use SED on a heavy forwarder to dro...

Re: How can I limit the number of DNS requests don...

Re: _TCP_ROUTING for Heavy Forwarder

Re: How do I go about the parsing of Splunk modula...

Re: Using SA Eventgen App, how do I generate the e...

Re: Using SA Eventgen App, how do I generate the e...

Re: Has anyone successfully configured _HTTPOUT_RO...

Re: With regular expression how to auto extract JS...

Re: With regular expression how to auto extract JS...

Re: Update splunk inputs.conf in ECS container ins...

Re: Connecting to local Splunk instance from an ap...

Re: How to get the depth of one of nested json obj...