Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About bworrellZP
bworrellZP
Communicator
Member since:
08-11-2015
06-07-2024
Community Statistics
| Posts | 104 |
| Solutions | 3 |
| Karma Given | 9 |
| Karma Received | 7 |
| Member Since | 08-11-2015 |
Activity Feed
- Posted Log ingestion with line level delete on Getting Data In. 06-04-2024 05:16 PM
- Karma Adding more fields that are in the CB Defense console to the splunk app? for pmac22. 06-05-2020 12:50 AM
- Karma carbon black add-on defense CIM support for OBsecurity. 06-05-2020 12:50 AM
- Karma Re: Dashboard visibility issue for mayurr98. 06-05-2020 12:49 AM
- Karma Re: Validate success versus failed logins for HeinzWaescher. 06-05-2020 12:49 AM
- Karma Cb Defense Add-On for Splunk: Typo in props.conf for wfjarrett538. 06-05-2020 12:49 AM
- Karma Re: How to create summary index to track count of records per index, per sourcetype, per day? for somesoni2. 06-05-2020 12:48 AM
- Got Karma for Trying to create a search that will use the results to feed another search and output the results in a table.. 06-05-2020 12:48 AM
- Got Karma for How to convert at geo map to a choropleth map?. 06-05-2020 12:48 AM
- Got Karma for Dashboard using base search with subsearches for panels.. 06-05-2020 12:48 AM
- Karma Re: Search for a field not containing a specific pattern. for somesoni2. 06-05-2020 12:47 AM
- Karma Re: Trying to create a graph that shows Combined stats and an average..... for somesoni2. 06-05-2020 12:47 AM
- Karma Re: Splunk DB Connect 2: Is there a way to tell how many records were imported per poll, and can we go back an import missing records? for Richfez. 06-05-2020 12:47 AM
- Got Karma for Why is the Splunk DB Connect 2.0.5 Health dashboard not populating data?. 06-05-2020 12:47 AM
- Got Karma for Re: Why is the Splunk DB Connect 2.0.5 Health dashboard not populating data?. 06-05-2020 12:47 AM
- Got Karma for Re: Why is the Splunk DB Connect 2.0.5 Health dashboard not populating data?. 06-05-2020 12:47 AM
- Got Karma for How to edit my Simple XML to pass time variables from one dashboard to another?. 06-05-2020 12:47 AM
- Posted Installing 8.0.1 on Fedora server. Have an error that I am just missing. on All Apps and Add-ons. 01-04-2020 02:44 PM
- Posted Re: Dashboard Permissions question on Security. 01-29-2019 12:00 PM
- Posted Re: Dashboard Permissions question on Security. 01-25-2019 09:43 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 0 |
06-04-2024
05:16 PM
This evening decided to setup a test Splunk box in my lab to goof around with. Been a while since I have done this part of the process. (Work cluster is up and going and has been for years now). As I was looking at my local test box, I noticed the hard drive was not likely the best size to use. So since I have a syslog server running on this as well, and I am pulling those files into Splunk (Splunk will not always be running, hence not sending data direct to Splunk), wanted to try doing a line level destructive read. I did see where others were using a monitor and deleting a file on ingestion, but did not see if line level was being done. So, question is, has anyone done that, and if so, do you have some hints or pointers? Thanks
... View more
Labels
- Labels:
-
inputs.conf
01-04-2020
02:44 PM
During the setup, when going to have Splunk run on boot up, I run this command (after editing /etc/init.d/splunk)
sudo /opt/splunk/bin/splunk enable boot-start -systemd-managed 0 -user splunk
But rather than it run correctly, I get the following.
execve: No such file or directory
while running command /sbin/chkconfig
At work, we use RedHat with Systemd disabled for Splunk. (Note we deployed to 7.0 and have updated over time, so the servers do have systemd now, just not using it for splunk, and the boot-start was there already). Testing on Fedora for a new QA server. First time dealing with it. I know its something stupid, but missing it.
Any help would be great.
... View more
01-29-2019
12:00 PM
In this scenerio, the roles are already created. Someone in SplunkDevOps1 creates a new dashboard. They do not have the option to give SplunkDevOps2 write access to this dashboard. They can give "Everyone" the ability to read (which is okay), but giving write access to "Everyone" is an issue.
This is the thing we are trying to figure out. How a person in a role can give read and write access to other roles, without having to use "everyone" or having the admin go alter the roles.
... View more
01-25-2019
07:10 AM
Howdy,
We have roles setup for our various splunk users. They are able to create dashboards. When they go to share it, they can only share with Everyone, or the group they are in.
Example
SplunkDevOps1
SplunkDevOps2
SplunkDevOps3
Each has the same base Index access, but higher levels have more index access. SplunkDevOps1 creates a dashboard for IIS data. They want to share with SplunkDevOps3.
Since they cannot see that group, is there a perm to add or a setting that would allow them to do this?
Thanks
... View more
04-13-2018
03:01 AM
Excellent, your suggestion was able to get me where I needed you go. Thank you
... View more
04-12-2018
04:25 AM
Okay, this is good, they (management) liked it. They had two questions. Can we add the amount of times the login was tried, and can we also add the ones that did login successfully, and show the failed counts for those.
I am going to try and mess with this some, as the distinct count option was not one I had thought of.
... View more
04-11-2018
08:08 AM
I was asked if we can run a report / create an alert to act on the following:
Accounts that have had failed logins, but never a successful login, within a defined time window. The goal is to determine is an account has ever been used successfully, and if it has not, then it can be sent to the access management team to review.
In my data, I have the default _time but also have a time field from the source of "LoginAttemptDateTime". For login status, I have a field called "LoginStatus", and of course user field of "User".
Looking at some of the Brute force posts offered ideas, but nothing that gave me exactly what I was asked for. Hoping someone has another idea.
Thanks in advance
... View more
- Tags:
- splunk-enterprise
01-17-2018
05:28 AM
Documentation has some errors and needs a few points of clarification.
Example. There is reference to changing the Port for the app, but nothing about how to change the port on Firepower to account for the change.
... View more
01-11-2018
12:47 PM
I believe I have found a bug. Test user is in a splunk group that comes from AD, (splunktier3sec), but also inherits some other roles. (User ends up with these roles - admin, power, splunktier3sec ) I had to add the searched indexes by default the indexes in use, to the admin role, even though they were in the splunkteir3sec role already. (Dashboard searches also had the indexes listed, so it should not have been needed anyway). Guess that role trumps all others.
Will test later with non-admin, with only one role. But at this point, I believe this to be the case.
... View more
01-11-2018
10:39 AM
So I had a dashboard that was in testing, so it was private. Since I have completed it, I changed it, made visible in the app (search app), set to everyone for read.
Then I logged in as a test user. The dashboard is there, all panels are visible. Issue is that everything says "no results found", If I click the spyglass, nothing shows in the statistics, yet there are events in the events tabs.
User that I was testing with is also an admin.
Thoughts on what to check and where?
... View more
- Tags:
- splunk-enterprise
01-11-2018
06:31 AM
This worked, without the need for the timewrap. Thank you.
... View more
01-11-2018
06:30 AM
This option still listed today in the list. Thank you for the suggestion though
... View more
01-11-2018
04:37 AM
I am trying to compare daily failed logins for a web app. The initial ask was they wanted to know how many failed Yesterday, as compared with the day before. Racking my head around the search, as no matter what I do, I seem to also get todays failed logins, which then does not show yesterday and the day before, but rather today and yesterday.
(index=web1 OR index=web2) AND LoginStatus=Failed
| stats first(*) as * by LoginAttemptID, index, _time
| table _time, date_wday, ClientID, UserIPAddress, GuarantorAccountEntry, tag, LoginAttemptID LoginStatus | eval earliestTime = relative_time(now(),"-2d@d")
| eval latestTime = relative_time(now(),"-0@d")
| where _time>=earliestTime AND _time<=latestTime
| timechart count as Total span="1d" fixedrange=false
I am sure its something silly, but any help is appreciated.
... View more
08-22-2017
07:33 AM
Hrm, thinking differently, could I use a lookup for that? And yes the goal is to move to a CIM compliance at some point, and use ES as well, though I believe that is a bit off still (team understaffed at the moment).
... View more
08-22-2017
06:58 AM
3no,
I thought about that, but as I understand the process, I would have to make an alias per sourcetype, for each alias. I was hoping there was a way to do a field alias or another alias, across all sourcetypes.
Thanks
... View more
08-22-2017
06:40 AM
Looking for the most effective way to "normalize" fields across multiple indexes and sourcetypes.
We have 30+ indexes with that many (or more) sourcetypes. Many of these are for internal applications that I pull data from SQL databases. This has caused issues with trying to search on all indexes for Source or Destination IP. Looking for a way to take this list (only a sample of the fields I have found so far), and to be able to group all Source IP's into a src_ip field. Same with Destination. (I will map each, method of mapping in Splunk is what I am looking for).
Anyone have a suggestion for an effective way to do this, rather than making a very complex search?
field
AdminIPAddress
ClientIP
Client_IP
Client_ip
ComputerIPAddress
Description
DestinationIPAddress
Framed_IP_Address
IP
IpAddress
Local_IP
NAS_IP_Address
NatIP
Nat_ip
Remote_ip
VserverServiceIP
Vserver_ip
X_MS_Forwarded_Client_IP
assigned_ip
c_ip
client_ip
dest_ip
dest_ipv6
dest_translated_ip
dst_ip
ip
nsica_session_client_ip
nsica_session_server_ip
s_ip
server_ip
src_ip
src_ipv6
src_public_ip
src_translated_ip
Thank you,
Brian
... View more
05-25-2017
07:09 AM
The issue I ran into, without the append I would only get one column, like this.
index=sophos sourcetype="sophos:threats" | regex FullFilePath!="eicar" | regex FullFilePath!="pagefile.sys" | eval _time=strptime(InsertedAt,"%Y-%m-%d %H:%M:%S.%N") |rename user as User |search (Status="Cleanable" OR Status="Not Cleanable" OR Status="Cleanup failed" OR Status="Threat type not cleanable") | stats count by ActionTaken, Status, _time |timechart span=1d count(Status) by ActionTaken
Adding the append gives me this.
Since this is my first time trying the base search option, I am completely open to suggestions and other options.
I will adjust my searches with your suggestions, thank you for them.
Edit. The other reason for the second search was to add the action, looking to see how many were blocked.
... View more
05-25-2017
04:28 AM
1 Karma
Hello, New to using base searches, and could not find the answer to my issue.
I am trying to convert a Antivirus dashboard used by the desktop team to a base search, in hopes to improve performance and be less of a hit on the search heads. Dashboard takes data from two products, gives a near real time refresh of status.
The issue I am experiencing is one of the panels is a graph for the desktop lead. By itself its fine, the base search, then sub search misses one catagory, but when going to the search on that panel, the catagory is there in the chart.
Here is the base search I am using.
<search id="baseSearch">
<query>index=sophos sourcetype="sophos:threats" | regex FullFilePath!="eicar" | regex FullFilePath!="pagefile.sys" | eval _time=strptime(InsertedAt,"%Y-%m-%d %H:%M:%S.%N") |rename user as User |search (Status="Cleanable" OR Status="Not Cleanable" OR Status="Cleanup failed" OR Status="Threat type not cleanable") </query>
<earliest>-10d@d</earliest>
<latest>-0d@d</latest>
Here is the sub search.
<search base="baseSearch">
<query> |stats count by ActionTaken, Status, _time |timechart span=1d count(Status) by ActionTaken | append [ search (Status="Cleanable" OR Status="Not Cleanable" OR Status="Cleanup failed" OR Status="Threat type not cleanable") |stats count by ActionTaken, Status, _time |timechart span=1d count(Status) by Status ]|
timechart first(*) as *</query>
</search>
Here is what the dashboard panel looks like.
Here is what I get when I search. (via the dashboard panel)
I am sure its something simple I am missing. Thanks in advance
... View more
- Tags:
- splunk-enterprise
05-12-2017
06:49 AM
Awesome, thank you,
... View more
05-12-2017
04:20 AM
Ugh, could not reply in Edge, had to jump to another browser.
With the Tstats, I get indexes like _audit, that I do not want. Any way to exclude those in a tstats? (using index!=_audit did not work)
... View more
05-11-2017
11:57 AM
I can try tstats. If I was asked to compare daily volumes, monthly, and year over year, would this still be the best way, versus some type of summary? We are averaging 7 billion events a week, at 70 gig daily average.
... View more
05-11-2017
11:29 AM
Our auditors asked a question, that caused the need to know how many records we log, per device, per sourcetype, per day.
To run the search each day would be killer on the search heads and indexers, based on our volume. So it was suggested that we create and populate a summary index, and then run searches, and perhaps a dashboard, from there.
This search gives me the output I need.
index=* | eval date=strftime(_time,"%Y-%m-%d") | stats count by host index sourcetype date | table host, index, sourcetype, date, count |sort index, sourcetype
How would I convert this to a summary index, where I could get something like this as an output. Allowing me to search by server, sourcetype, index, or date.
host index sourcetype date count
Server001 app1_iis iis 5/8/2017 13671
Server001 app2_iis iis 5/8/2017 448838
Server001 app3_iis iis 5/8/2017 24
Server001 app4_iis iis 5/8/2017 35890
Server001 windows WinRegistry 5/8/2017 2314924
Server001 wineventlog WinEventLog:Security 5/8/2017 75489
Using Splunk Enterprise 6.5.1
Thank you in advance
... View more
03-31-2017
06:36 AM
Okay, through some trial and error I figured out the issues and have it working now.
Documentation about this could use some additional updates.
That said, is there a way to hide the input boxes on the detailed dashboard?
... View more
03-30-2017
12:10 PM
Using what you presented, I added this in the source to my table (starting the testing with just the index)
<drilldown>
<set token="myIndex">patient_portal_login</set>
<link>https://splunksearch:8000/en-US/app/search/client?form.limit=$myIndex$</link>
</drilldown>
That takes me to the second page, and in the address bar, I see the proper index name, though nothing occurs on the second page (not sure what I am missing, have one other app where I pass a click value through, that works, though set it up in Splunk 6.3, so its been a while).
Here is the code for the second page.
<form>
<label>Drill down</label>
<row>
<table id="master">
<title>Master</title>
<search>
<query>index=$myIndex$ earliest=-1d@d latest=-0d@d </query>
<earliest>-1d@d</earliest>
<latest>-0d@d</latest>
</search>
</table>
</row>
</form>
Thanks
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-07-2024
05:12 PM
|
Karma given to
