Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About stmyers7941
stmyers7941
Path Finder
Member since:
09-18-2015
06-05-2020
Community Statistics
| Posts | 20 |
| Solutions | 2 |
| Karma Given | 7 |
| Karma Received | 4 |
| Member Since | 09-18-2015 |
Activity Feed
- Karma Splunk Add-on for Java Management Extension: ERROR - Failed to retrieve RMIServer stub for choehser. 06-05-2020 12:47 AM
- Karma Duplicate labels causing conflict for Joannelr. 06-05-2020 12:47 AM
- Karma Re: How to |addtotals on a |stats list result? for Runals. 06-05-2020 12:47 AM
- Karma Re: How do I join these two searches to display failed logins from Domain Admins? for MuS. 06-05-2020 12:47 AM
- Karma Re: How to correct timestamp recognition that is currently skewed due to result of class "java.util.logging.Logger" output for emiller42. 06-05-2020 12:47 AM
- Karma Re: Regex Help in splunk 6.1.3 for alacercogitatus. 06-05-2020 12:47 AM
- Karma Re: Why is the Splunk DB Connect 2.0.5 Health dashboard not populating data? for bworrellZP. 06-05-2020 12:47 AM
- Got Karma for Re: Sending rsyslog JSON format. 06-05-2020 12:47 AM
- Got Karma for Re: Sending rsyslog JSON format. 06-05-2020 12:47 AM
- Got Karma for Re: Generate an alert based off the results from a table or timechart. 06-05-2020 12:47 AM
- Got Karma for Re: How to change cell colors in a dashboard table based on the value?. 06-05-2020 12:47 AM
- Posted Re: How do I edit my single-machine deployments outputs.conf to send out data for only 1 index? on Getting Data In. 12-01-2015 10:42 AM
- Posted Re: How do I edit my single-machine deployments outputs.conf to send out data for only 1 index? on Getting Data In. 12-01-2015 08:31 AM
- Posted Re: How do I edit my single-machine deployments outputs.conf to send out data for only 1 index? on Getting Data In. 12-01-2015 07:56 AM
- Posted Re: Searching failed login data, how do I pull the timestamps into my search results? on Splunk Search. 10-28-2015 07:49 AM
- Posted Re: Searching failed login data, how do I pull the timestamps into my search results? on Splunk Search. 10-28-2015 06:39 AM
- Posted Re: How to change cell colors in a dashboard table based on the value? on Splunk Search. 10-27-2015 06:00 AM
- Posted Re: How do I join these two searches to display failed logins from Domain Admins? on All Apps and Add-ons. 10-26-2015 01:57 PM
- Posted Re: How to |addtotals on a |stats list result? on Splunk Search. 10-26-2015 01:51 PM
- Posted Re: How do I join these two searches to display failed logins from Domain Admins? on All Apps and Add-ons. 10-26-2015 12:20 PM
Topics I've Started
No posts to display.
12-01-2015
10:42 AM
What's your input on the heavy forwarder in question?
... View more
12-01-2015
08:31 AM
Have you tried Selective Indexing?
#
# Perform selective indexing and forwarding
#
# With a heavy forwarder only, you can index and store data locally, as well as
# forward the data onwards to a receiving indexer. There are two ways to do
# this:
# 1. In outputs.conf:
[tcpout]
defaultGroup = indexers
[indexAndForward]
index=true
selectiveIndexing=true
[tcpout:indexers]
server = 10.1.1.197:9997, 10.1.1.200:9997
# 2. In inputs.conf, Add _INDEX_AND_FORWARD_ROUTING for any data that you want
# index locally, and
_TCP_ROUTING=<target_group> for data to be forwarded.
[monitor:///var/log/messages/]
_INDEX_AND_FORWARD_ROUTING=local
[monitor:///var/log/httpd/]
_TCP_ROUTING=indexers
... View more
12-01-2015
07:56 AM
I believe you need a single stanza for [tcpout:alerts] with all the settings underneath it. With 2 stanzas, It's going to use the latest and ignore the former.
[tcpout]
deafultGroup = nothing
[tcpout:alerts]
server = 10.28.100.121:9998
indexAndForward = 1
#Forward data for the "alerts" index
forwardedindex.0.whitelist = alerts
... View more
10-28-2015
07:49 AM
You need to save your search as a dashboard panel on a new dashboard, then edit the dashboard to clone the panel and update the timerange options.
See: http://docs.splunk.com/Documentation/Splunk/6.3.0/SearchTutorial/Createnewdashboard
For the second issue, assuming MAPIEAGN.usps.gov is the mail relay, you need to use server=MAPIEAGN.usps.gov
... View more
10-28-2015
06:39 AM
Here's what I like to do....
Save this search as a panel on a dashboard and have it auto-refresh every x minutes looking back at the last x minutes (say, 5 minutes).
Clone this panel and save a new panel with auto-refresh every 5 minutes looking back at the last hour.
You can add a third showing last 24 hours. Now you have a dashboard that shows you all the logins in the last 5 minutes, last hour and last day, and the panels will auto-refresh so you can just keep your window open.
... View more
10-27-2015
06:00 AM
See updates in my answer - you need to adjust you CSS.
... View more
10-26-2015
01:57 PM
Check the Search Inspector to see what your inputlookup command is adding to the search to make sure it's working correctly.
http://docs.splunk.com/Documentation/Splunk/6.3.0/Knowledge/ViewsearchjobpropertieswiththeJobInspector
... View more
10-26-2015
01:51 PM
I tested this method and added the addtotals command...it works well enough:
index="Test"
| stats count by "Event Category", "Threat Type"
| stats sum(count) as Total list("Threat Type") as "Threat Type" list(count) as Count by "Event Category"
| addtotals col=t fieldname=Total label=TOTAL labelfield="Event Category"
| table "Event Category" "Threat Type" "Count" "Total"
... View more
10-26-2015
12:20 PM
You can use a subsearch to add the results of the ldapsearch to your initial search query:
eventtype=msad-failed-user-logons (host="*") [| ldapsearch domain=xxxxxxx.xxx search="(&(objectclass=group)(cn=Administrators))"|ldapgroup|table member_name, member_domain] |fields _time,signature,src_ip,src_host,src_nt_host,src_nt_domain,user,Logon_Type, Logon_Account, Source_Workstation | ip-to-host |stats count by user,src_nt_domain |where count>=5 |sort -count |rename user as "Username", src_nt_domain as "Domain"
Use the search inspector to see how this adds the data from the ldapsearch to the base search.
... View more
10-26-2015
12:06 PM
Setup the Linux server as a forwarder, and configure the outputs to point to the Windows Splunk instance.
Output.conf on Linux Splunk instance:
[tcpout:windows_indexer]
server=<windows_host/IP>:9997
Also configure the Windows Splunk instance with a Splunk TCP input:
Inputs.conf on Windows Splunk index:
[splunktcp://9997]
Don't forget about firewall on the Windows host, and also any indexes required for apps on the Linux instance will need to be installed on the Windows. Basically, TAs go on Linux, app goes on Windows (if you don't plan on using the Linux front end).
... View more
10-26-2015
11:54 AM
You're doing a count over a time frame so if you add a timestamp, it will make the count always be 1 because only 1 failure happened at that time...but you can do it:
eventtype=failed_login | stats count by username, host, _time | search count > 3
If you want to keep the count over the timeframe you are searching you can show the latest or earliest timestamp for the count of events like this:
eventtype=failed_login | stats latest(_time), count by username, host | search count > 3
EDIT:
cleanup the timestamp using convert:
eventtype=failed_login | stats latest(_time) AS time, count by username, host | search count > 3 | convert ctime(time)
... View more
10-26-2015
10:38 AM
You didn't specify an event-field for person_id1.
See:
https://answers.splunk.com/answers/135646/lookup-command-multiple-input-fields.html
Note - the wording changed from 6.2 to 6.3 in the docs and local-field is no referred to as event-field.
... View more
10-26-2015
10:18 AM
1 Karma
I'm assuming based on the JS that the values for the 'PrimaryRunning' field are either the string YES or NO, so your if statements need to be like:
if (value === 'YES' ) {
$td.addClass('range-cell').addClass('range-severe');
}
else if (value === 'NO' ) {
$td.addClass('range-cell').addClass('range-low');
}
Also, post your CSS if this doesn't help...that needs to match up too.
Update:
Your CSS selector names need to match the id:
#health td.range-low {
color: #C0D9D9 !important;
}
#health td.range-elevated {
background-color: #ffc57a !important;
font-weight: bold;
}
#health td.range-severe {
background-color: #d59392 !important;
font-weight: bold;
... View more
10-21-2015
01:03 PM
Have you considered the Nmon app? You may be able to accomplish what you're looking for and more vs the nix app.
... View more
10-14-2015
01:37 PM
1 Karma
Ok, update your Alert search with by adding | search Result1="Error" OR Result2="Error" and then change the Trigger Condition to number of results greater than 0.
Also, make sure the alert is set Trigger Once, not For Each Result. Let's say you're scheduled the alert for every 5 minutes looking back at the last 5 minutes...with "For Each Result" set, if your search returns 20 events below 40%, you'll get 20 alert messages. If you set to "Trigger Once", you'll get 1 alert if the search returns any events below 40% within the last 5 minutes. This way, at most you'll get 1 alert every 5 minutes, but only if Result1 or Result2 went below 40% once within the last 5 minutes.
... View more
10-14-2015
10:22 AM
Is this a distributed environment? Is DBConnect running on your search head?
... View more
10-14-2015
10:00 AM
From the search, click Save As --> Alert, set trigger condition to Custom, and set value to search Depth<=70 . Schedule your search to run on a regular interval (ie every hour) and have it search for the past hour.
If you want "real-time" you can do a real-time alert, but that's costly. Instead, set schedule to 5 minutes (run on cron schedule as */5 * * * * ), set your earliest to -6m@m and latest to -1m@m . This will run a search every 5 minutes for the last 5 full minutes of events (with 1 minute buffer to ensure events are all processed) and the alert will trigger if the field "Depth" is greater than or equal to 70.
From there, just decide what you want the action to be.
... View more
10-14-2015
09:04 AM
Click the "RPC Service: Up" icon from the menu, which will launch a search for errors in RPC, dbx2 and dbx_health. Make sure you have values for dbx_health.
... View more
10-14-2015
05:42 AM
2 Karma
I did this with a similar situation where a syslog header was added to the front of XML events. In props.conf , make a LINE_BREAKER setting for the sourcetype (or whatever) and add the regex for the syslog header, and end with the opening of your JSON (XML in my example):
`[sam:xml]
# Strips syslog header and makes events pure XML
LINE_BREAKER = (\d\s\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}-\d{2}:\d{2}\s[\w_-]+\s[\w-_]+\s\d+\s-\s-\s)
SHOULD_LINEMERGE = false`
Obviously, your regex will vary. Post a sample event if you need help with the regex.
... View more
10-13-2015
08:51 AM
The indexer needs to have an inputs.conf with [splunktcp://9997] stanza. You can check to see if your indexer is listening with netstat (assuming nix):
~ $ netstat -tnlp | grep 9997
tcp 0 0 0.0.0.0:9997 0.0.0.0:* LISTEN 24504/splunkd
... View more
