About fwilmot

fwilmot · ‎04-23-2012

Hey JR- one way to do that is to do a statistical count of destination ports and destination IPs that have been denied, then chart a sum by the destination ports and destination IPs as they apply. sourcetype="firewall" action=deny | stats count by dst dstport | chart sum(count) by dst dstport. the fields will depend on your extracted fields, but give that a shot, it should do the trick.

fwilmot · ‎01-28-2012

In a recent example, we also installed the S.o.S TA on a heavy forwarder as a means to understand network throughput and ingestion rate. We made the forwarder a search peer of the search head which had the S.o.S application installed, and it worked very well. We were not indexing and forwarding, and we also did not attempt with a universal forwarder. Give it a shot if you need to troubleshoot a specific forwarder.

fwilmot · ‎11-03-2010

http://answers.splunk.com/questions/6513/compressed-data-from-forwarder-to-indexer lists what your inputs.conf and outputs.conf might look like so you will know where to enable compression, and what the command syntax is.

fwilmot · ‎04-05-2010

I wouldn't recommend more than 1000 tags, I have seen degradation linked to applications loading a specific amount of tags and neglecting tags that correlate to the same numbers of hosts beyond the 1000 mark. Though they don't have any impact on indexing, search can be more meaningful with better direction of your catagories through eventtypes. This can also be associated with hosts r sources, as opposed to matching a case in an event.

Posts	4
Solutions	0
Karma Given	0
Karma Received	2
Member Since	‎04-05-2010

Online Status	Offline
Date Last Visited	a month ago

Re: How do I create a Firewall Report with Both De...

Re: Best practices to deploy the S.o.S app in a di...

Re: compression from a forwarder to an indexer

Re: How many tags is too many tags?