About kbrown_splunk

kbrown_splunk · ‎06-15-2018

We had the same issue but after a few minutes those messages cleared without any action on our part.

ferozkhanpeermo · ‎03-09-2019

You just have to add the SPlunk_TA_Cisco-esa add on your HWF [if you are collecting the data in your HWF] & to all your indexer nodes in your cluster and to your Search Head Cluster. If you are having a dedicated SearchHead for your Splunk ES module, you need to add the add-on there also. Only then the events coming from Cisco-ESA appliance will be transformed when you do the search in Splunk ES module

dbcase · ‎08-09-2016

You can get the failed ones like this: index=os process=sshd eventtype=failed_login

agehring4823 · ‎08-23-2016

I checked the acceleration on my install, as well. It was only at 32% so I started a rebuild. when the rebuild reached ~75% the other dashboards starting working; However, it is now at 98.63% and the other dashboards have stopped working again...

tmuth_splunk · ‎06-28-2016

I know this doesn't actually answer your question, but I think it's important to note that DBX 1.x is no longer supported in 1 month: https://splunkbase.splunk.com/app/958/ Note: This Add-on will reach the end of its support lifecycle on July 29, 2016. Please see DB Connect v2 at https://splunkbase.splunk.com/app/2686/ .

woodcock · ‎10-18-2016

If the job is timing out it is because you have a huge number of events being returned. When you run the search, click on the "jobs" menu and select "Send job to background" and give it an email address to send you an email when it is done. This will keep the job from timing out.

kbrown_splunk · ‎06-02-2016

I duplicate your example and then changed the IP's and customer names. The below regex works unless your events change format. I ran a test with your example data as sometimes the rex does not work the same as regex101.com You highlighted "abc" as the customer name. The Splunk auto extract of the field=value pair does not properly work with your data as demonstrated with the below search index=main | rex "START\:\s(?((\d{1,3}\.){3}\d{1,3}))\s.*?customer_name\=(?[a-zA-Z\d\s:]+)" | table _time customer_name cust_name ipaddr

mcronkrite · ‎04-04-2016

Turn everything on if you want all the dashboards in ES to light up. Adjust the interval if you need to calm down the data rates. [monitor:///var/log] disabled = false [monitor:///etc] disabled = false [monitor:///home/.../.bash_history] disabled = false [monitor:///Library/Logs] disabled = false [monitor:///root/.bash_history] disabled = false [monitor:///var/adm] disabled = false [script://./bin/bandwidth.sh] disabled = false [script://./bin/cpu.sh] disabled = false [script://./bin/df.sh] disabled = false [script://./bin/hardware.sh] disabled = false [script://./bin/interfaces.sh] disabled = false [script://./bin/iostat.sh] disabled = false [script://./bin/lastlog.sh] disabled = false [script://./bin/lsof.sh] disabled = false [script://./bin/netstat.sh] disabled = false [script://./bin/openPorts.sh] disabled = false [script://./bin/openPortsEnhanced.sh] disabled = false [script://./bin/package.sh] disabled = false [script://./bin/passwd.sh] disabled = false [script://./bin/protocol.sh] disabled = false [script://./bin/ps.sh] disabled = false [script://./bin/rlog.sh] must be super user to run disabled = true [script://./bin/selinuxChecker.sh] disabled = false [script://./bin/service.sh] disabled = false [script://./bin/sshdChecker.sh] needs /etc/ssh/sshd_config disabled = false [script://./bin/time.sh] disabled = false [script://./bin/top.sh] disabled = false [script://./bin/update.sh] disabled = false [script://./bin/uptime.sh] disabled = false [script://./bin/usersWithLoginPrivs.sh] disabled = false [script://./bin/version.sh] disabled = false [script://./bin/vmstat.sh] disabled = false [script://./bin/vsftpdChecker.sh] disabled = false [script://./bin/who.sh] disabled = false

Posts	15
Solutions	1
Karma Given	0
Karma Received	3
Member Since	‎08-24-2015

Online Status	Offline
Date Last Visited	‎06-05-2020 02:04 AM

Is there documentation on best practice for which ...

Re: Splunk fixup tasks pending stuck in generation...

Re: Getting Cisco Ironport ESA data into the Commo...

Re: How can I monitor successful and failed logins...

Re: Palo Alto Networks App for Splunk: Why are all...

Re: Splunk DB Connect 1: Why are events from our O...

Re: How to use a delete command in splunk...?

Re: How to extract the IP and customer_name field ...

Re: Is there documentation on best practice for wh...