About cgekoski

cgekoski · ‎05-04-2015

I think the part that is breaking the search string is where i am doing a chart count by 2 fields; dest_ip and src_port. so when i do a "where count>X" im guessing it doesnt know which field to use? The ideal goal is to get a breakdown of IP addresses sending traffic over mail ports (Src_ports).

cgekoski · ‎05-04-2015

Unfortunately the where count>500 doesnt seem to work. I have tried to modify >1 and even that breaks the statistics window.

cgekoski · ‎05-04-2015

whenever i add "where count > any number" the statistics do not show up. I even tried > 1 to see if that works and even that breaks it.

cgekoski · ‎05-01-2015

I have a search string that is working perfectly but i want to create an email alert that triggers whenever a results exceeds 500. Below is the search string, i tried to create a search string and then create an alert that said to run every hour and count > 500 but it doesnt seem to work. The amount of time doesnt really matter im more focused on the end results of getting alerted whenever something is over 500. The "x.x.x.x" portion was an IP address i removed just for the question but is email servers that we expect such traffic from so i was excluding them from the search. index=firewalls NOT "x.x.x.x" NOT "x.x.x.x" NOT "x.x.x.x" NOT "x.x.x.x" NOT "Deny" NOT "No matching connection" NOT "Teardown" | regex src_port="^25$|^110$|^465$|^995$|^143$|^993$|^2525$" | chart count by dest_ip src_port | sort -count | rename dest_ip AS Source results show up as statistics Source Port 110 Port 143 Port 25 Port 993 10.90.100.5 5 600 4 50 10.91.100.56 0 0 500 0 10.91.105. 560 0 0 0

cgekoski · ‎03-17-2015

I have been searching with no luck, probably because i do not know exactly how to phrase the question. I basically have a search looking against our firewall logs for outbound destination mail ports; 25, 110,143,993,etc. then piped to a chart count by source ip and destination port and it generates a stats panel with the source ip first, then each port respectively across the rows. What i want to be able to do then is have a search field box on the dashboard that when i click an IP from the columns it places it inside the field, which then starts populating other panels within my dashboard. Right now i have it to where i have to manually type in the IP into the field, Not a big deal but wanted the ease of clicking for other admins and help desk techs. right now my other panels in the dashboard have a search string with the extra piece of src_ip="$field1$" within the search string. Also FYI, very fresh with splunk so please answer in lamans terms if possible Thanks, Cory

cgekoski · ‎06-12-2014

Hey David, Can you share how you added the JS to your dashboard, also, did you ever get this working. I am currently looking at a way to change our dashboards to use something like; www.chartsjs.org I found an article explaining somewhat how to implement but really new to splunk and java. This may be the answer you were looking for also on how to get your data to use java and 3rd party visuals. http://dev.splunk.com/view/webframework-splunkjsstack/SP-CAAAERK Any help would be greatful, Cory

cgekoski · ‎06-03-2014

Looking for a little bit more guidance to use something like; http://www.chartjs.org but this should get me started. Basically want to modify the standard bar chart to be more like the doughnut option from charts.js. Thanks

cgekoski · ‎05-30-2014

Hello, I would like to get into the visuals of splunks but having a hard time getting things to change, such as background color, etc. Probably jumping in the deep-end but i found a nice js file at www.chartjs.org and was wondering if there is a way to turn my standard pie chart into the chart.js doughnut Chart? Thanks, Cory

cgekoski · ‎05-09-2014

Thanks Martin. Powerful search string once i added a time range to my dashboard.

cgekoski · ‎05-09-2014

New to the splunk community and still learning the way of searches. In a nutshell i want to do a search against a cisco IPS sensor for top 5 signatures over 24hours. Easy to do but how can i then take that result and say top signature show me the top src_ip's. I was thinking that i could pipe the results into another top limit=5 src_ip but no luck. Ive even tried doing top limit=1 signature. Thinking something with append maybe? host=IPSSensor1 | top limit=5 signature sig count percent 5474 9289 86.304934 3653 1114 10.350274 1208 116 1.077766 1204 66 0.613212 11020 60 0.557465 Thanks, Cory

cgekoski · ‎04-15-2014

The issue was missing directories within the Flowfix app. Just create nfdump-binary directory along with nfdump-ascii and works like a charm. Just wanted to point out it works with version 6.0.3 of splunk, and current universal forwarder on linux redhat x64.

cgekoski · ‎04-15-2014

My first step was to send netflow from our Core 6500 cisco switch over port 9996. I then Created a Linux Redhat x64 VM and installed the UniversalForwarder, dropped the "TA" netflow app inside the /etc/apps (Splunk Add-on for Netflow). Setup a listener on port 9996 with a name of netflow. Ran the configure.sh option 1 and setup a forward to our splunk server to port 9996 as well. Went on our Splunk GUI, which is a windows server 2008 R2 and setup a Receiver for port 9996 on the manager and not getting any data. on the Linux machine i checked the /opt/splunkforwarder/bin/splunk list forward-server and shows active. Im assuming it should be forward-server and not search-server. I even tried just setting up a port UDP 9996 and confirmed i was getting data but it was unreadable and said something about data "Cooked v3". I'm sure its missing something small. inside the bin file the Linux_x86_64_core2 folder is being used. Here is a short grep from the splunkd.log. I searched everywhere for this nfdump-binary but its not there, i wasnt sure if the app should be creating it if its not present. I also know the app is deprecated but was told it should still work. Did not want to get a 3rd party piece if not necessary such as netlogic. 04-14-2014 21:31:32.380 -0400 ERROR ExecProcessor - message from "/opt/splunkforwarder/etc/apps/Splunk_TA_flowfix/bin/flowfix.sh" stat() failed on /opt/splunkforwarder/etc/apps/Splunk_TA_flowfix/nfdump-binary: No such file or directory 04-14-2014 21:31:32.384 -0400 ERROR ExecProcessor - message from "/opt/splunkforwarder/etc/apps/Splunk_TA_flowfix/bin/flowfix.sh" find: /opt/splunkforwarder/etc/apps/Splunk_TA_flowfix/nfdump-binary': No such file or directory 04-14-2014 21:31:32.386 -0400 ERROR ExecProcessor - message from "/opt/splunkforwarder/etc/apps/Splunk_TA_flowfix/bin/flowfix.sh" find: /opt/splunkforwarder/etc/apps/Splunk_TA_flowfix/nfdump-binary': No such file or directory 04-14-2014 21:31:56.434 -0400 WARN TcpOutputFd - Connect to 10.90.100.222:9996 failed. Connection refused 04-14-2014 21:31:56.434 -0400 ERROR TcpOutputFd - Connection to host=10.90.100.222:9996 failed Thanks in advance for any assistance,

cgekoski · ‎04-10-2014

I recently downloaded and setting up splunk for a POC and we would like to include our Cisco IPS Sensors which use SDEE. I have found forums related to setup via old splunk versions and cannot seem to find a valid working IPS App or configuration guide with Splunk6. Any assistance to configuring this or getting the logs into splunk would be appreciated. Thanks Cory

Posts	13
Solutions	1
Karma Given	3
Karma Received	2
Member Since	‎04-03-2014

Online Status	Offline
Date Last Visited	‎06-05-2020 02:04 AM

statistics greater than 500 count only

How to create a drilldown where a value clicked in...

Chart.js for Dashboard

Cisco IPS Top Signature by top hosts

Splunk app for Netflow Issue

Setting up Cisco IPS Sensors

Re: statistics greater than 500 count only

Re: statistics greater than 500 count only

Re: statistics greater than 500 count only

statistics greater than 500 count only

How to create a drilldown where a value clicked in...

Re: Implementing JS chart with splunk

Re: Chart.js for Dashboard

Chart.js for Dashboard

Re: Cisco IPS Top Signature by top hosts

Cisco IPS Top Signature by top hosts

Re: Splunk app for Netflow Issue

Splunk app for Netflow Issue

Setting up Cisco IPS Sensors