Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About imarks004
imarks004
Path Finder
Member since:
10-16-2010
06-05-2020
Community Statistics
| Posts | 21 |
| Solutions | 1 |
| Karma Given | 1 |
| Karma Received | 10 |
| Member Since | 10-16-2010 |
Activity Feed
- Got Karma for Re: can splunk generate report based on destination ip address in ironport WSA reporting. 06-05-2020 12:46 AM
- Got Karma for Re: can splunk generate report based on destination ip address in ironport WSA reporting. 06-05-2020 12:46 AM
- Got Karma for Splunk for Microsoft Exchange App get-databasestats.ps1 Error. 06-05-2020 12:46 AM
- Got Karma for Re: Need to make advanced query for Cisco Ironport Logs. 06-05-2020 12:46 AM
- Got Karma for Re: Need to make advanced query for Cisco Ironport Logs. 06-05-2020 12:46 AM
- Karma Re: Transaction command in Oracle XML Logging for David. 06-05-2020 12:45 AM
- Got Karma for SplunkforSquid Logformat. 06-05-2020 12:45 AM
- Got Karma for Re: how to retrive data from symantec end point protection. 06-05-2020 12:45 AM
- Got Karma for Security Concern: Does Splunk Need A Shell. 06-05-2020 12:45 AM
- Got Karma for Extracting domain name out of a url. 06-05-2020 12:45 AM
- Got Karma for Extracting domain name out of a url. 06-05-2020 12:45 AM
- Posted Re: Possible incorrect lookup statement in Splunk App for AWS on All Apps and Add-ons. 11-17-2015 04:38 AM
- Posted Possible incorrect lookup statement in Splunk App for AWS on All Apps and Add-ons. 11-13-2015 11:16 AM
- Tagged Possible incorrect lookup statement in Splunk App for AWS on All Apps and Add-ons. 11-13-2015 11:16 AM
- Tagged Possible incorrect lookup statement in Splunk App for AWS on All Apps and Add-ons. 11-13-2015 11:16 AM
- Posted Re: Splunk Add-on for Cisco IPS: Why am I getting this error message trying to add a new Cisco IPS Sensor? on All Apps and Add-ons. 11-19-2014 06:32 AM
- Posted Re: SA-ldapsearch issue? on All Apps and Add-ons. 11-25-2013 04:56 PM
- Posted Re: SA-ldapsearch issue? on All Apps and Add-ons. 11-25-2013 02:09 PM
- Posted Re: dbquery and outputcsv limited to 10,000 results on Splunk Search. 11-19-2013 11:41 AM
- Posted dbquery and outputcsv limited to 10,000 results on Splunk Search. 11-18-2013 11:16 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 1 | |||
| 2 |
11-17-2015
04:38 AM
So no error, just the same behavior where region does not get populated. I am still running Splunk 6.2.2 (build 255606).
Example where no results come back.
index=aws sourcetype="aws:config" | lookup regions.csv region OUTPUT label as region | stats count by region
Example with the expected results.
index=aws sourcetype="aws:config" | lookup regions.csv region OUTPUT label as aa_region | stats count by aa_region
splunk_app_aws/lookups/regions.csv
region,location,lat,lon,label
ap-northeast-1,Tokyo,35.41,139.42,"Asia Pacific (Tokyo)"
ap-southeast-1,Singapore,1.37,103.8,"Asia Pacific (Singapore)"
ap-southeast-2,Sydney,-33.86,151.2,"Asia Pacific (Sydney)"
eu-central-1,Frankfurt,50.11,8.68,"EU (Frankfurt)"
eu-west-1,Ireland,53,-8,"EU (Ireland)"
sa-east-1,Sao Paulo,-23.34,-46.38,"South America (Sao Paulo)"
us-east-1,Virginia,38.13,-78.45,"US East (N. Virginia)"
us-west-1,California,41.48,-120.53,"US West (N. California)"
us-west-2,Oregon,46.15,-123.88,"US West (Oregon)"
... View more
11-13-2015
11:16 AM
I am not seeing certain dashboard panels load data in the Splunk App for AWS and I believe it is related to a bad lookup. The lookup is lookup regions.csv region OUTPUT label as region . I do not believe you can rename (AS) the output name back to the original source field name. If I do lookup regions.csv region OUTPUT label as new_region it works or lookup regions.csv region OUTPUT label | rename label AS region it works. Should this lookup work as-is or is it a bug?
... View more
11-19-2014
06:32 AM
I am also seeing this same error. Anyone found a work around or any useful information from Splunk support?
... View more
11-25-2013
04:56 PM
Sorry, I just short the name off the top of my head, I was talking about the SA-ldapsearch app. Do you see anything in your AD logs showing this app authenticating with the user you configured in local/ldap.conf file?
... View more
11-25-2013
02:09 PM
Did you install and configure the standalone SA-LDAP app? If so, check your AD logs to see if the user you are using to bind with is even authenticating.
... View more
11-19-2013
11:41 AM
I am running version 1.1.1. So after just playing around with this a little more, it does not seem that outputcsv is limiting this, it is more likely the table command. If I run the ouputcsv right after the dbquery with a limit=1000000 set, it does dump everything. I am trying to use table command to filter just the fields I wanted passed to the CSV. I just updated the sql query to limit the results returned back and can now skip the table command.
... View more
11-18-2013
11:16 AM
I am trying to create a lookup file daily from data I am pulling with dbquery out of an Oracle Database. If I do the search out of the UI and set the limit=x, I get all the results back. If I do the same search piped to outputcsv, I only get 10,001 results. I am using outputcsv successfully with ldap search to output more 10,000 results, so I cannot see to figure out what is preventing this from working with dbquery.
Thank you.
... View more
11-18-2013
10:49 AM
Thank you, this search is way more efficient. I think I will wait until I can upgrade to 6.x and use some of the pivot features to to get the output looking the way I want. The current results now at least let me accurately export to Excel.
... View more
11-14-2013
10:23 AM
I am having a very difficult time trying to align fields after a transaction command that is using a lookup with multiple values.
I have a search that uses a transaction command based off an IP address and looks for more than one unique ID in the transaction. I then do a lookup against the unique ID to pull back additional fields like first name, last name, email, etc.
The result set I am trying to get should look something like this.
IP unique_id firstname lastname email
IP_1 id_1 id_1_firstname id_1_lastname id_1_email
id_2 id_2_firstname id_2_lastname id_2_email
id_3 id_3_firstname id_3_lastname id_3_email
What I am getting is the following where the fields in the rows do not match up to the corresponding uniq_id.
IP unique_id firstname lastname email
IP_1 id_1 id_2_firstname id_3_lastname id_1_email
id_2 id_3_firstname id_1_lastname id_3_email
id_3 id_1_firstname id_2_lastname id_2_email
I have tried using table, stats, and stats using the values function but cannot seem to get it correct.
Here is an example of what I have tried.
search … | transaction maxspan=6h ip keepevicted=t | where mvcount(unique_id)>1 | lookup local=t userlookup USER AS unique_id | stats values(unique_id) values(FIRSTNAME), values(LASTNAME), values(EMAIL) by ip
Any suggestions would be appreciated..
Thanks
... View more
The default WSA "access logs" do not include the destination IP. To add this field to your access logs, you would need to add a %k on your WSA under System Administration, Log Subscriptions, (the logs your sending to Splunk), custom fields. I have added the following three variables to my custom fields to get user-agent, destination and WBRS threat reason into the logs.
%u %k %XK
cs(User-Agent) = %u = User agent. This field is written with double-quotes in the access log
s-ip = %k = Data source IP address (server IP address)
x-wbrs-threat-reason = %XK = Web reputation threat reason
... View more
I finally got around to posting to Answers how I do this without the DLP license. Basic Cisco Ironport ESA DLP Monitoring Without DLP License
This ends up generating a single event into the cisco_esa sourcetype containing the original MID, signature (ie. credit_card_violation), sender, recipient, subject, attachment details, and a few other fields.
Having a single event makes the search much faster than using a transaction, but since it does show the original MID, it will show up in a single transaction search if you need additional data without needing a subsearch or join.
You might be able tweak the way the DLP event logs using the format from my example to get all the details in one event.
... View more
09-28-2011
05:57 AM
Thanks, adding the [long] in front of the variables fixed this issue.
... View more
09-02-2011
01:21 PM
1 Karma
Has anyone seen the below error with the fwd_exchange2007_store \bin\get-databasestats.ps1 powershell script? I see this on all for mailbox servers(2active/2passive). I am troubleshooting why some events are not populating back into my indexers and this looked like a good place to start. It seems like most of my Exchange data is populating correctly with just a few exceptions that I am trying to clean up.
09-02-2011 14:20:00.480 -0400 ERROR ExecProcessor - message from ""C:\Program Files\SplunkUniversalForwarder\etc\apps\fwd_exchange2007_store\bin\exchangepowershell.cmd" get-databasestats.ps1" The operation '[System.UInt64] / [System.UInt64]' is not defined.
09-02-2011 14:20:00.480 -0400 ERROR ExecProcessor - message from ""C:\Program Files\SplunkUniversalForwarder\etc\apps\fwd_exchange2007_store\bin\exchangepowershell.cmd" get-databasestats.ps1" At C:\Program Files\SplunkUniversalForwarder\etc\apps\fwd_exchange2007_store\bi
09-02-2011 14:20:00.480 -0400 ERROR ExecProcessor - message from ""C:\Program Files\SplunkUniversalForwarder\etc\apps\fwd_exchange2007_store\bin\exchangepowershell.cmd" get-databasestats.ps1" n\powershell\get-databasestats.ps1:32 char:45
09-02-2011 14:20:00.480 -0400 ERROR ExecProcessor - message from ""C:\Program Files\SplunkUniversalForwarder\etc\apps\fwd_exchange2007_store\bin\exchangepowershell.cmd" get-databasestats.ps1" + $EdbDriveFree = ($EdbDriveInfo.FreeSpace / <<<< $EdbDriveInfo.Size)
09-02-2011 14:20:00.480 -0400 ERROR ExecProcessor - message from ""C:\Program Files\SplunkUniversalForwarder\etc\apps\fwd_exchange2007_store\bin\exchangepowershell.cmd" get-databasestats.ps1" * 100.00
... View more
05-31-2011
12:53 PM
I am trying to figure out how to pull the data around the following event that matches on the second MID.
Tue May 31 14:16:21 2011 Info: MID 47539682 was generated based on MID 47539681 by notify-copy filter 'notify_subject_line'
The events associated with the second MID contains all of the relevant data that triggered this event. I am using the Cisco_esa_addon to handle the extractions so MID is getting extracted twice for this event. I created a another extraction to just extract the second MID as trigger_mid. Is it possible to use a transaction to match trigger_mid to mid or is this going to require a subsearch?
sourcetype=cisco_esa notify_subject_line | rex "based on MID (?<trigger_mid>\S+)"| transaction ???
Thank you
... View more
- Tags:
- Cisco Security Suite
03-28-2011
05:45 PM
I am trying to do a search that matches on the term of commit, then use the transaction statement to tie it back to everything that has the same OS_Process field but since every event does not contain the term commit, it does not show all the events. Is this possible?
This is search "sourcetype=oracle_xml_* commit | transaction OS_Process | table Sql_Text | reverse"
... View more
- Tags:
- transactions
01-06-2011
07:20 PM
1 Karma
I was wondering if it is really necessary for the Splunk account to have a shell (/bin/bash)? I have set up a couple of test instances with the the splunk account set to nologin (/sbin/nologin) and have not noticed any impact. It is generally a best practice to not give a shell unless it is really needed and it would also be really nice to easily exclude this as a non-interactive account to our auditors. Does anyone know of a specific reason that a shell is required? I do not have any external scripts running on my test machines and that is the only reason I could think of for having a shell.
... View more
- Tags:
- security
01-04-2011
10:46 PM
1 Karma
From the SEP management console, click on Admin, then select Local Site. You should then see an option for Configure External Logging. From the Configure External Logging option you should be able specify a syslog server or send directly to your Splunk server.
... View more
12-30-2010
03:13 PM
Hi Patrik, Here is an example of a sourcetype=squid search.
1293720507.168 322 10.163.4.75 TCP_MISS/200 6631 CONNECT xmlrpc.rhn.redhat.com:443 - DIRECT/209.132.183.44 -
1293720553.568 488 10.7.0.13 TCP_MISS/200 4594 CONNECT update-manifests.ironport.com:443 - DIRECT/204.15.82.17 -
1293720553.589 17 10.7.0.13 TCP_MISS/200 9609 GET http://updates.ironport.com/ibrs/1.1/ip/ips1g/1293720247.inc - DIRECT/184.84.247.25 text/plain
... View more
12-29-2010
03:14 AM
1 Karma
Is there a specific logging format that I should set in the SplunkforSquid app to get the proper field extraction? I am running Squid 2.6 with the following logformat which does not seem to match up with the extractions in this app:
logformat squid %ts.%03tu %6tr %>a %Ss/%03Hs %<st %rm %ru %un %Sh/%<A %mt
... View more
10-16-2010
09:12 PM
2 Karma
I am trying to field extraction working for just domains accessed on my Ironport WSAs but am having an issue extracting just the domain piece out of a url.
For example, if I do a search by top s_hostname I get the following:
0.4.channel.facebook.com
0.52.channel.facebook.com
0.57.channel.facebook.com
0.chstatic.cvcdn.com
0.gvt0.com
0.media.dorkly.cvcdn.com
0.media.todaysbigthing.cvcdn.com
0.r.msn.com
0.tqn.com
0.track.ning.com
I am trying to get a regex working to strip everything out to the left of the domain name so I would only see facebook.com and not 0.4.channel.facebook.com. I am not having any luck coming up with a regex to handle this.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:02 AM
|
