Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About neiowe
neiowe
Path Finder
Member since:
10-02-2015
06-05-2020
Community Statistics
| Posts | 23 |
| Solutions | 0 |
| Karma Given | 5 |
| Karma Received | 4 |
| Member Since | 10-02-2015 |
Activity Feed
- Karma Re: Easiest way to exclude ingestion of events for a specific IP address from a SourceType for mayurr98. 06-05-2020 12:49 AM
- Karma Re: Easiest way to exclude ingestion of events for a specific IP address from a SourceType for 493669. 06-05-2020 12:49 AM
- Karma Re: How to use the _time field from the results of one search to run another search on another host and sourcetype? for cmerriman. 06-05-2020 12:48 AM
- Karma Re: Searching EventCodes for logon and logoff events, LOGON_ID includes 0x0 before actual LOGON_ID. How do I exclude the 0x0? for Richfez. 06-05-2020 12:47 AM
- Karma Re: Searching EventCodes for logon and logoff events, LOGON_ID includes 0x0 before actual LOGON_ID. How do I exclude the 0x0? for jsven7. 06-05-2020 12:47 AM
- Got Karma for Report on how log a user was logged on?. 06-05-2020 12:47 AM
- Got Karma for Searching EventCodes for logon and logoff events, LOGON_ID includes 0x0 before actual LOGON_ID. How do I exclude the 0x0?. 06-05-2020 12:47 AM
- Got Karma for Searching EventCodes for logon and logoff events, LOGON_ID includes 0x0 before actual LOGON_ID. How do I exclude the 0x0?. 06-05-2020 12:47 AM
- Got Karma for Re: Searching EventCodes for logon and logoff events, LOGON_ID includes 0x0 before actual LOGON_ID. How do I exclude the 0x0?. 06-05-2020 12:47 AM
- Posted Re: Easiest way to exclude ingestion of events for a specific IP address from a SourceType on Splunk Search. 01-06-2018 05:44 AM
- Posted Re: Easiest way to exclude ingestion of events for a specific IP address from a SourceType on Splunk Search. 01-06-2018 05:40 AM
- Posted Re: Easiest way to exclude ingestion of events for a specific IP address from a SourceType on Splunk Search. 01-05-2018 01:32 PM
- Posted Re: Easiest way to exclude ingestion of events for a specific IP address from a SourceType on Splunk Search. 01-05-2018 01:26 PM
- Posted Re: Easiest way to exclude ingestion of events for a specific IP address from a SourceType on Splunk Search. 01-05-2018 12:47 PM
- Posted Re: Easiest way to exclude ingestion of events for a specific IP address from a SourceType on Splunk Search. 01-05-2018 12:45 PM
- Posted Re: Easiest way to exclude ingestion of events for a specific IP address from a SourceType on Splunk Search. 01-05-2018 12:32 PM
- Posted Re: Easiest way to exclude ingestion of events for a specific IP address from a SourceType on Splunk Search. 01-05-2018 12:25 PM
- Posted Re: Easiest way to exclude ingestion of events for a specific IP address from a SourceType on Splunk Search. 01-05-2018 08:27 AM
- Posted Easiest way to exclude ingestion of events for a specific IP address from a SourceType? on Splunk Search. 01-05-2018 06:42 AM
- Tagged Easiest way to exclude ingestion of events for a specific IP address from a SourceType? on Splunk Search. 01-05-2018 06:42 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 2 | |||
| 1 |
01-06-2018
05:44 AM
@mayurr98, thank you very much for all your assistance! You original solution worked perfect, I just had the wrong sourcetype in the transforms as pointed out by @micahkemp below. Thanks to you both for helping be resolve this.
... View more
01-06-2018
05:40 AM
Bingo! That was the problem. I checked my inputs.conf and the sourcetype was being set to palo:log. I change the sourcetype to palo:log in the transforms and it's working perfect now. Thank you very much!
... View more
01-05-2018
01:26 PM
Yes, I am still get real-time events. Just a side questions: Does a change to transform.conf require a restart of Splunk? I have been doing it but just want to confirm that it is necessary.
... View more
01-05-2018
12:47 PM
This doesn't show the \ but they are there.
... View more
01-05-2018
12:45 PM
I actually do have 10.3.30.35 but for some reason it didn't show up above when I copied the editor. I am looking at real-time events.
... View more
01-05-2018
12:32 PM
Jan 5 15:11:18 ISG-5020-FW1 1,2018/01/05 15:11:17,007701002549,TRAFFIC,drop,1,2018/01/05 15:11:17,10.3.30.35,172.31.155.128,0.0.0.0,0.0.0.0,Rule 43,aca\sa_qualsys,,not-applicable,vsys1,inside,DMZ31,ethernet1/2,,ISG-LOG,2018/01/05 15:11:17,0,1,7712,12374,0,0,0x4000,udp,deny,60,60,0,1,2018/01/05 15:11:18,0,any,0,1892346490,0x0,10.0.0.0-10.255.255.255,172.16.0.0-172.31.255.255,0,1,0,policy-deny,12,0,0,0,,ISG-5020-FW1,from-policy
I already have a setnull but I can change to setnull2 if you think it will make a difference.
... View more
01-05-2018
12:25 PM
This doesn't appear to be working for me. I tried for just the one IP address first. Here's what I added to the transforms/props on my indexers. I also restarted Splunk on the indexers. What am I missing?
In transforms.conf
[palo_setnull]
REGEX = 10.3.30.35
DEST_KEY = queue
FORMAT = nullQueue
In props.conf
[pan:traffic]
TRANSFORMS-set = palo_setnull
... View more
01-05-2018
08:27 AM
Thanks. I will give this a try. One additional question: If I was to use add a second IP address range, i.e. 10.10.0.0/16, how would I do that?
... View more
01-05-2018
06:42 AM
I am looking to not ingest events from a specific IP address. I have an IP address that once a week generates a LOT of firewall traffic and which is causing me to exceed my license. What's the easiest/best way to exclude these events. The firewall logs are being sent to a SYSLOG server that is running a Universal Forwarder that sends all logs to my Indexer. I am assuming I will need to use the PROPS/TRANSFORM files to send these to the NULL Queue, but not sure of the proper stanza's to accomplish this. Anyone done this and can provide a sample or suggest a better way to exclude these events?
... View more
Labels
- Labels:
-
other
12-01-2016
06:02 AM
Thanks. I wish it was that easy. That 10 digit number is the process number and is included on each process entry. However, there are most time multiple processes that make up what I am wanting to be a single event. The text "Information Message: Processing file:" on the second line is what indicates that a new file is being processed. I want to include all processes below that until the next "Information Message: Processing file:" into a single event.
I can use "Information Message: Processing file:" as the pattern and that gets me close, but I need the line right before "Information Message: Processing file:" to be included in the event also.
... View more
11-30-2016
12:43 PM
Hi all,
I am trying to determine the RegEx pattern for the Event Break. Below is an example event. A new event starts on the line preceding the "Information Message: Processing file:" text. The process number and the timestamp varies on the first line as does the info that follows "Information Message: Processing file:" until the next event starts.
1050746893 2016-11-25 05:36:02,518 [7] DEBUG DealerTrackImageDecoder, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null -
Information Message: Processing file: C:\dealertrack\contracts\0C075017-0-1899123053557contract.xml
Thanks in advance for any help,
Neil
... View more
10-17-2016
12:42 PM
Thanks. That works great too. The only change I had to make was to add search inside the open bracket. I like this command since the output includes both the fields from the initial search.
... View more
10-17-2016
12:40 PM
Thanks. The Map command does the trick.
... View more
10-17-2016
11:32 AM
I am looking to take the results of the following search:
sourcetype="cisco:asa" AND dest_ip=10.3.10.12 AND dest_port=22 | table _time, src_ip, src_port, dest_ip, dest_port
and use the _time field from the results and then search the following host/sourcetype:
sourcetype="WinEventLog:Security" host=dc001-sd502v
for all events within +/_ 2.5 secs of the _time from the first search. Would I use a subsearch to accomplish this? If so, can someone guide me on what the outer search would look like? Is there a better way to accomplish this?
... View more
08-18-2016
01:43 PM
Thanks for the response but I am not seeing a docs directory in the download. I also can not find and documentation on the hytrust.com website.
... View more
08-18-2016
10:38 AM
Does anyone have install/config instruction for the HyTrust CloudControl App?
I have downloaded and installed it in my test environment, but there are no details about how to configure it.
... View more
10-22-2015
04:18 PM
Got it working guys. Thanks for the help!
... View more
10-21-2015
08:01 AM
So it seems my issue now may be with determining the SessionLength. Rich's solution does seem to remove the 0x0 but my sessionlength is not working correctly. ANy thoughts on what's the best way to determine the time difference between to two events with the same Logon_ID?
... View more
10-21-2015
06:59 AM
I get the exact smae results with or without the | rex mode=sed field=Logon_ID "s/^0x0//" in the search. The screen shots I posted below shows the Logon_IDs. It appears there may be a CR between the 0x0 and the Logon_ID for the 4624 events that would match the Logon_ID for the 4634 event.
... View more
10-21-2015
06:40 AM
1 Karma
Actually, this is what it looks like:
It looks like there are two IDs for the 4624 events. 0x0 and the other one below it.
... View more
10-20-2015
10:41 AM
2 Karma
I am trying to build a report that shows how long a user was logged on. To do this, I am trying to match LOGON_IDs for the logon and logoff events. Here's my search code:
((EventCode=4624) OR (EventCode=4634)) AND (Account_Name="ADnowens") |Transaction Logon_ID startswith=4624 endswith=4634 | eval SessionLength= tostring(round(duration/1000,0), "duration") | search SessionLength!="00:00:00" | table host Account_Name SessionLength _time
The problem I am having is that many of the LOGON_IDs have 0x0 before the actual LOGON_ID on the 4624 events. The logoff 4634 doesn't have these so they don't match and the report is not catching them. Any idea how to exclude the 0x0 in the comparison?
... View more
10-08-2015
07:46 AM
1 Karma
I am trying to generate a report that show how long users stayed logged on. I can do a search and find the users and event codes I am interested in but is there a way of comparing event times and generating a timeframe between events? In other words, is the a way to subtract the time that event code 4624 happened from event code 4634 for Account_Name=XXXX?
Using Splunk 6.3 on Lynx getting events from Wineventlog_security.
... View more
