Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About mrtolu6
mrtolu6
Path Finder
Member since:
01-12-2015
01-18-2022
Community Statistics
| Posts | 45 |
| Solutions | 0 |
| Karma Given | 6 |
| Karma Received | 7 |
| Member Since | 01-12-2015 |
Activity Feed
- Karma Re: Has anyone used Palo Alto Networks MineMeld to send logs to Splunk? Can you help with configuration? for gmellini. 06-05-2020 12:49 AM
- Got Karma for What are the troubleshooting steps for handling a Bundle Replication error "http response code 401"?. 06-05-2020 12:49 AM
- Got Karma for Re: What could cause splunkd.log to be flooded with "ERROR HttpClientRequest - HTTP client error=Read Timeout while connecting to server"?. 06-05-2020 12:49 AM
- Got Karma for Can I remove a tag from already indexed data?. 06-05-2020 12:49 AM
- Karma Re: How to reset the password on one of my indexers? for jluo_splunk. 06-05-2020 12:48 AM
- Karma Re: Splunk 6.3.3 Search app hangs at "Loading..." in Chrome Version 49.0.2623.110 (64-bit) for bskrbec. 06-05-2020 12:48 AM
- Karma Re: creating a report that shows indexedtime vs logged time for each hour in percentage. for DalJeanis. 06-05-2020 12:48 AM
- Karma Re: After upgrading to Splunk 6.6, the splunkd.pid file is unreadable. How to fix "Permission denied" errors? for esix_splunk. 06-05-2020 12:48 AM
- Got Karma for How to reset the password on one of my indexers?. 06-05-2020 12:48 AM
- Karma Re: How to create and use a form input to run searches on data from multiple sources? for woodcock. 06-05-2020 12:47 AM
- Got Karma for How to create a custom message on the Login page for Splunk 6.2. 06-05-2020 12:47 AM
- Got Karma for How to create a custom message on the Login page for Splunk 6.2. 06-05-2020 12:47 AM
- Got Karma for How to create a custom message on the Login page for Splunk 6.2. 06-05-2020 12:47 AM
- Posted Re: How to resolve error "Waiting for requisite number of peers to join the cluster... Cluster has only 0 peers (waiting for 3 peers to join the cluster)"? on Deployment Architecture. 08-08-2019 10:56 AM
- Posted How do you reset a dashboard field after hitting the submit button? on Splunk Search. 12-21-2018 04:06 PM
- Posted Re: To check newely added host on Deployment Architecture. 11-26-2018 10:31 AM
- Posted Re: Can you help me extract fields from apache:access logs? on Splunk Dev. 10-17-2018 12:11 PM
- Posted Re: Can you help me extract fields from apache:access logs? on Splunk Dev. 10-17-2018 06:15 AM
- Posted Can you help me extract fields from apache:access logs? on Splunk Dev. 10-16-2018 12:14 PM
- Posted Re: What could cause splunkd.log to be flooded with "ERROR HttpClientRequest - HTTP client error=Read Timeout while connecting to server"? on Security. 08-20-2018 09:53 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 0 |
08-08-2019
10:56 AM
so the indexer connects for about 10 sec then goes down. What are some good troubleshoot steps to help me resolve this?
... View more
12-21-2018
04:06 PM
I have a dashboard form that uses free text inputs to write into a CSV file. How do I get the fields to reset after I hit the submit button?
Is it possible to create a dashboard using datepicker to select a date that would write into the lookup?
... View more
- Tags:
- splunk-enterprise
11-26-2018
10:31 AM
Try this
| metadata type=hosts index=_* OR index=* | where firstTime >= relative_time(now(), "-7d")
| convert timeformat="%Y-%m-%d %T" ctime(firstTime) as firstTime, ctime(lastTime) as lastTime, ctime(recentTime) as recentTime
| table host, firstTime, lastTime, recentTime, count index
... View more
10-17-2018
06:15 AM
that worked but it adds extra details in the uri_path fields. If i wanted to created additional fields called uri_query that would create a new field for anything after the "?", also would like to create a version field forhe HTTP1/1 called version.
For example
10.10.10.04 - - [07/Oct/23:08:30:59 -0400] "POST /OndnForm/drag_Form?images/ HTTP/1.1" 400 226 "-" "Hello, People"
the uri_query=images/
version= HTTP/1.1
src=10.10.10.04
status=400
bytes=226
... View more
10-16-2018
12:14 PM
Regex Experts!
Need help in extracting src, http_method, uri_path, status field.
Below is an example of a log with the fields that I would like to extract :
"10.10.10.22 - - [12/Oct/2012:14:22:41 -0400] "GET /etc/team/transport/tRoom?serlet=jpsSSGenerator HTTP/1.1" 200 26494"
src=10.10.10.22, http_method=GET, uri_path= /etc/team/transport/Room?serlet=jpsSSGenerator
This is example of different types of logs that comes from apache access logs. I'm looking for a regex that can extract fields from the example below. Thanks in advance for any help.
example logs
127.0.0.1 - - [104/Oct/2018:11:22:47 -0700] "GET /directory/directory/test?seat=ShowPage&tese=calendar.js&IP=444.444.1.444 HTTP/1.1" 304 - "htttps://testwebsite.com/m/see/yup/Union?selpt=stepReportFilter.jsp" "Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko"
10.10.10.10 - - [10/Oct/2018:11:22:47 -0700] "POST /nba/nfl/nhl/ufc HTTP/1.1" 200 470 "-" "Mozilla/4.0 (Windows 8.1 6.3) Java/1.2.0_181" "10.10.10.02"
dnsname..cod.blackops.com:80 10.10.10.02 - - [16/Oct/2018:11:22:22 -0700] "GET /scripts/form_registry.js HTTP/1.1" 200 2504 "htttp://10.10.10.03lnba/cruisehtml?&swf_version=ezboard052614_1&serverUrl=110.10.10.03&boardId=19-153970030&isPreview=0&update052109=1" "Mozilla/5.0 (Windows NT 6.1; Trident/2.0; rv:11.0) like Gecko"
10.10.10.02 - - [12/Oct/2018:13:22:41 -0500] "POST /yup/zillow/server.php?a=c7355 HTTP/1.1" 200 - "-" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/515.2 (KHTML, like Gecko) Chrome/15.0.200.200 Safari/535.2"
10.10.10.02 - - [11/Oct/2018:13:22:41 -0500] "POST /yup/zillow/server.php?a=c7355 HTTP/1.1" 200 -
10.10.10.22 - - [12/Oct/2012:14:22:41 -0400] "GET /etc/team/transport/tRoom?serlet=jpsSSGenerator HTTP/1.1" 200 26494
... View more
- Tags:
- splunk-enterprise
Hi did you find out what caused this error?
... View more
06-28-2018
09:21 AM
Looking for a way to create a workflow action in ES, to research URL and IP addresses.
... View more
06-07-2018
11:14 AM
Any one know the answer to this question?
... View more
04-02-2018
08:46 AM
Hi Deepashri, looks like this wasn't a splunk issue, this was a vmware issue its fix and working now. Thanks.
... View more
03-30-2018
06:38 AM
1 Karma
What are the troubleshooting steps for handling the following message:
Bundle Replication: Problem replicating config (bundle) to search peer 0.0.0.0:8089 ', HTTP response code 401 (HTTP/1.1 401 Unauthorized). Call not properly authenticated
... View more
03-07-2018
01:59 PM
What are some troubleshooting steps I can take, if i don't see any of my custom lookup load in Splunk Threat Activity dashboard. For example I created a lookup up stored in threat_intel directory. The lookup file shows in Splunk Audit but it doesn't seem to load in Threat_Activity dashboard? Any suggestion will be helpful. Thanks.
... View more
01-09-2018
12:32 PM
thanks the search did work, but it didn't give me the info I'm looking for, Just looking to see who accelerated or disable data model acceleration.
... View more
01-08-2018
10:16 AM
I tried that and got the following error "REST Processor: Failed to fetch REST endpoint uri=https://127.0.0.1:8089/servicesNS///data/models?count=0 from server https://127.0.0.1:8089. Check that the URI path provided exists in the REST API."
... View more
01-08-2018
09:25 AM
whats a good search to run to see if any change was done to a datamodel. For example if I want to see if someone enable or disable datamodel acceleration. what search can I run to see what user change the datamodel and which datamodel was changed?
... View more
11-09-2017
11:53 AM
I'm trying to create a field alias for Enterprise Security so that the category field will generate correctly in the IDS Center in Splunk
My data source has a field name category that gives category on URL events and it also has a threat_category that gives details on the threat category. I'm trying to set up a field alias that would allow the CIM to pick up the threat_category so that it will will generate in Enterprise security and will ignore the original category which will only give the url category. What would be the best way to do this?
... View more
10-31-2017
10:50 AM
1 Karma
Is it possible to remove a tag from indexed data? Fox example if I have an app named 'TA-App' and it had a tag for #dhcp, #dns and #email, would I be able to remove the #email tag using the gui by disabling that tag? Or do I need to disable it then delete the index data to remove the tag?
... View more
10-04-2017
11:07 AM
Has anyone ever sent intel to Splunk using MineMeld? If so how? I currently have access to MineMeld, but I was looking for away to set up the config to send the intel to Splunk.
... View more
09-26-2017
10:19 AM
I'm looking to find matching field (lets call this field action) from 2 different host with the same sourcetype.
example Sourcetype=pan host=1 and host=2
I'm looking to create a ta table that would show the matching field for field action (I only want the matching field to generate result)
so if host 1 has action=allowed and host 2 has action=allowed. I want to create a table that would include the time, action, src, dest.
... View more
07-10-2017
10:59 AM
I would like to create a dashboard where i can get the result from one panel (query 1) and insert the results into Panel 2 and 3. This dashboard should be in form format where type an IP address in a box, then add the the IP address to query 1. Query 1 results will then be inserted into query 2 and 3 which will display the result on each panel.
query 1 sourcetype=name app=http-proxy $token1$| stats count by src_ip
I would like to add the result from query 1 and insert the result to query 2 and 3.
query 2
index=name2 $tokenResultfromQuery1$ | rename user AS User clientip AS "Client IP Address" assigned_ip AS "Assigned IP Address" vpn AS VPN reason AS Reason | table User "Client IP Address" "Assigned IP Address" Group VPN "Start Time" | sort-_time
query 3
sourcetype="WinEventLog:Security" $tokenResultfromQuery1$ | stats count by user, src_ip
... View more
07-10-2017
05:54 AM
none of these seems to work.
... View more
07-06-2017
01:01 PM
This, seems to run slow when i run this, do you know another search i can run to get the IP addressw
... View more
07-06-2017
09:36 AM
I'm trying to do a search that will show me only IP address for the field url,
example = sourcetype=fakename url=(only field that has IP address in it 1.1.1.1 or 1.1.1.1/index)
Do you know what i can use for the url field that will only give me ip address?
... View more
06-29-2017
01:24 PM
I'm trying to do a stats command to find a count of any value less than 2 counts and display all the other fields. I only want a stats count on one field, but I want to display all the field that is generated with that stats count result.
This is my search query
sourcetype="sourcenamet" search string | stats count by field1 | where count<2 | | table field1 field 2 field3 field4
... View more
- Tags:
- splunk-enterprise
06-09-2017
08:30 AM
I want to create a chart separated by hours (24hours) and grouped by the sourcetype that shows the number of data that took more than 2 mins to be indexed (indextime-time) and converted into percent. The percent would be the total event that took over 2mins to be indexed divided by the total number of events for that hour.(for that 1 hour span). The result shold be grouped by the sourcetype
This is the basic search I'm using to calculate the events over 2mins
earliest=-24h@h latest=@h index=nameoftheindex
| eval GT2=if(_indextime-_time>=120,1,0)
| bin _time span=1h
| stats avg(GT2) as PctGT2 by _time
... View more
- Tags:
- splunk-enterprise
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
01-18-2022
04:46 PM
|
Karma given to
