Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About karlbosanquet
karlbosanquet
Path Finder
Member since:
10-23-2015
06-05-2020
Community Statistics
| Posts | 23 |
| Solutions | 1 |
| Karma Given | 3 |
| Karma Received | 3 |
| Member Since | 10-23-2015 |
Activity Feed
- Got Karma for Re: Splunk Add-on for Microsoft Windows: Why is timestamp extraction on Windows Event Logs failing?. 06-11-2020 10:11 AM
- Karma Re: Splunk Add-on for Microsoft Windows: Why is timestamp extraction on Windows Event Logs failing? for woodcock. 06-05-2020 12:48 AM
- Karma Re: Splunk 'Agree to terms' function for jstoner_splunk. 06-05-2020 12:48 AM
- Got Karma for Re: Splunk Add-on for Microsoft Windows: Why is timestamp extraction on Windows Event Logs failing?. 06-05-2020 12:48 AM
- Karma Re: How to set the site during Universal Forwarder installation for a Splunk 6.3 multisite indexer cluster? for maciep. 06-05-2020 12:47 AM
- Got Karma for How to encrypt password in app outputs.conf?. 06-05-2020 12:47 AM
- Posted Re: Extract data from JSON array on Splunk Search. 01-16-2019 02:55 PM
- Posted Extract data from JSON array on Splunk Search. 01-16-2019 02:42 PM
- Tagged Extract data from JSON array on Splunk Search. 01-16-2019 02:42 PM
- Tagged Extract data from JSON array on Splunk Search. 01-16-2019 02:42 PM
- Tagged Extract data from JSON array on Splunk Search. 01-16-2019 02:42 PM
- Tagged Extract data from JSON array on Splunk Search. 01-16-2019 02:42 PM
- Posted Re: Find events either side of a matched event on Splunk Search. 08-12-2018 07:22 AM
- Posted Re: Find events either side of a matched event on Splunk Search. 08-12-2018 07:13 AM
- Posted Find events either side of a matched event on Splunk Search. 08-12-2018 06:35 AM
- Tagged Find events either side of a matched event on Splunk Search. 08-12-2018 06:35 AM
- Posted Re: How to find all the searches having "index=*" in the search or Alert or Reports on Splunk Search. 04-01-2017 05:40 AM
- Posted Re: Splunk 'Agree to terms' function on Knowledge Management. 03-31-2017 01:19 PM
- Posted Re: Splunk Add-on for Microsoft Windows: Why is timestamp extraction on Windows Event Logs failing? on All Apps and Add-ons. 03-31-2017 01:11 PM
- Posted Splunk 'Agree to terms' function on Knowledge Management. 03-31-2017 01:00 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 0 |
01-16-2019
02:55 PM
Expected output examples;
Search 1 (table timestamp Stream Id 1_name 1_value 2_name 2_value)
||Timestamp||Stream||Id||1_name||1_score||2_name||2_score||
|2019-01-16 22:20:26.123|123456|789|0|34.56787|2|12.54863|
|2019-01-16 22:21:28.567|123456|790|12|54.78797|46|34.82632|
Search 2 (timechart values(score) by name)
||Timestamp||0||1||2||3||4||5||
|2019-01-16 22:20:26.123|34.56787|4.74287|12.54863|1.78916|3.35732|
|2019-01-15 12:21:34.244|2.34689|12.45211|21.24852|14.72412|2.28342|
... View more
01-16-2019
02:42 PM
I have some data which is along the following format;
{"event":
{
"Timestamp":"2019-01-16 22:20:26.123"
"Stream":"123456",
"Id":"789",
"Data": [
{
"name":"0",
"rank":"1",
"score":"34.56787"
},
{
"name":"1",
"rank":"3",
"score":"4.74287"
},
{
"name":"2",
"rank":"2",
"score":"12.54863"
},
{
"name":"3",
"rank":"4",
"score":"1.78916"
},
]
}
}
We get around 800,000 of these per day and have around 50 data elements in each one.
I am trying to find the best way to return the top 2 rank name and score for each event, e.g.;
1_name = 0
1_score = 34.56787
2_name = 2
2_score = 12.54863
And another search to timechart all scores by name
... View more
08-12-2018
07:22 AM
It would be good if the transaction command had the ability to look for a middle event, like startswith or endswith. Format could be something like this;
Feature request EXAMPLE, not a real use of transaction!
| transaction pivot=Match=Y maxbefore=1 maxafter=1 by SessionID
... View more
08-12-2018
07:13 AM
It is the next event after a match for SessionID 1.
... View more
08-12-2018
06:35 AM
I am trying to find the best way to identify the event before and after a matched event for each SessionID
Example data;
time | SessionID | UserID | Match | Data
12/08/2018 11:12:27 | 1 | 123 | Y | a
12/08/2018 11:12:28 | 1 | 123 | N | b
12/08/2018 11:12:29 | 2 | 789 | Y | c
12/08/2018 11:12:30 | 1 | 321 | N | d
12/08/2018 11:12:31 | 1 | 321 | Y | e
12/08/2018 11:12:32 | 2 | 987 | N | f
12/08/2018 11:12:33 | 1 | 123 | N | g
12/08/2018 11:12:34 | 1 | 321 | N | h
12/08/2018 11:12:35 | 2 | 987 | N | i
12/08/2018 11:12:36 | 1 | 321 | N | j
12/08/2018 11:12:37 | 1 | 321 | N | k
12/08/2018 11:12:38 | 2 | 987 | Y | l
12/08/2018 11:12:39 | 2 | 789 | N | m
12/08/2018 11:12:40 | 1 | 123 | N | n
12/08/2018 11:12:41 | 1 | 123 | N | o
12/08/2018 11:12:42 | 2 | 789 | N | p
12/08/2018 11:12:43 | 1 | 321 | N | q
12/08/2018 11:12:44 | 1 | 123 | Y | r
And the data i am trying to identify should look like this;
time | SessionID | UserID | Match | Data
12/08/2018 11:12:27 | 1 | 123 | Y | a
12/08/2018 11:12:28 | 1 | 123 | N | b
-------------------------------------------------------
12/08/2018 11:12:29 | 2 | 789 | Y | c
12/08/2018 11:12:32 | 2 | 987 | N | f
-------------------------------------------------------
12/08/2018 11:12:30 | 1 | 321 | N | d
12/08/2018 11:12:31 | 1 | 321 | Y | e
12/08/2018 11:12:33 | 1 | 123 | N | g
-------------------------------------------------------
12/08/2018 11:12:35 | 2 | 987 | N | i
12/08/2018 11:12:38 | 2 | 987 | Y | l
12/08/2018 11:12:39 | 2 | 789 | N | m
-------------------------------------------------------
12/08/2018 11:12:43 | 1 | 321 | N | q
12/08/2018 11:12:44 | 1 | 123 | Y | r
... View more
- Tags:
- splunk-enterprise
04-01-2017
05:40 AM
Just one thing to be aware of, each role or user may have different results when they search for index=* due to what indexes they are able to see and what they search as default.
E.g.
Admin role set to see all internal and external indexes searches index=* gets everything.
User role configured to only see main index searches index=* only sees main index results.
... View more
03-31-2017
01:19 PM
I can use that to publish links to usage documents and internal reference material, however I still need to find a function where a user has to accept a statement either before or after they log in.
I have searched through web.conf and splunkbase and not yet found anything available.
... View more
03-31-2017
01:11 PM
2 Karma
After discussing this with Splunk Professional Services, it has been highlighted that not all time extraction happens at the indexer.
WinMon is baked into Splunk and so the time extraction for [WinEventLog:...] is assigned as early as the Universal Forwarder, and CANNOT be changed.
... View more
03-31-2017
01:00 PM
Is there a function where a custom 'terms of use' can be displayed each time a user logs in, with the option to continue or log out?
... View more
02-08-2017
01:40 PM
Have you had a look at DELIMS in transforms.conf? Here is something that should work;
[comma_colon]
DELIMS = ",", ":"
... View more
02-07-2017
01:11 PM
1) Ok, I have spoken to Splunk to confirm if this is the case or not.
2) When a WinEventLog is archived, it renames the whole file and creates a new file for new events. The question was more around how Splunk UF handles this, or could an event(s) be missed when the file is renamed.
3) will do, I will also look at ingesting the archived evtx as an option.
4) As the UF needs to read the whole event log for processing, what is the optimum size for the windows event log to be. Max is 4GB, however it takes ages to load the log when it is nearly full. Too small file and it will roll quickly. What is the 'optimum' size of a Windows Event log for the Splunk Universal Forwarder.
... View more
02-07-2017
01:01 PM
My current solution is a script which pushes the pass4SymmKey password out to Universal Forwarders, then I deploy an empty app from the Deployment Server called 'restart' with the restart services flag checked which restarts the UF service on all of the UFs, which hashes the password.
... View more
01-26-2017
10:24 AM
I have a WinEventLog://System log which rolls to archive every hour or so. I have 4 questions;
1) is the Splunk Universal Forwarder (UF) clever enough to ingest archived files based on the default [WinEventLog://System] input or does it only ingest the data in the current log?
2) Does the UF catch all events in the log or is there a chance some events could be lost at the point when the log rolls?
3) if either the UF or Index layer are unavailable for a period of time (possibly days), will all of the logs be lost until the connection is re-established?
4) what is Splunk's recommended optimum file size for a WinEventLog source?
... View more
01-24-2017
09:38 AM
Still unable to resolve this. The data is being collected by a Universal Forwarder with the Splunk Windows TA installed, could this be causing issues?
The TA is also installed on indexers and search heads, however as stated the logbinder app is unable to change the _time value.
I also ran btool on the indexers and the results show it should be using the values from the logbinder app for this sourcetype.
... View more
01-18-2017
11:01 PM
Is there a search that can be run to identify replicated data size and how often this happens? I need a volumetric profile of our WAN load.
... View more
01-18-2017
01:55 PM
both are 2.
Indexer 1 = Site 1
Indexer 2 = Site 2
Search Head 1 = Site 1
Search Head 2 = Site 1
Search Head 3 = Site 2
... View more
01-18-2017
01:38 PM
The format in the original question was a misprint by me, the app has the correct format as you stated.
No heavy forwarders, just Universal Forwarder direct to Index Cluster Master, then to Indexers.
... View more
01-18-2017
01:31 PM
I have a multisite Indexer Cluster and Search Head Cluster and I want to identify what is the volume of data being replicated/sent over the WAN between each host, what would be the best way to do this?
... View more
01-18-2017
01:27 PM
I have a clustered environment with Splunk Add-on for Microsoft Windows deployed to Indexers, Search Heads and Universal Forwarders.
I have an additional application deployed to Indexers and Search Heads to handle the Logbinder WinEventLog. The contents of $SPLUNK_HOME/etc/slave_apps/logbinder/local/props.conf is;
[WinEventLog:LOGbndSP]
TIME_PREFIX = Occurred:\s
TIME_FORMAT = %Y/%m/%d %H:%M:%S
I have also created a $SPLUNK_HOME/etc/slave_apps/logbinder/metadata/meta.local with the following;
[]
export=system
The format of the log is the standard WinEventLog format with the following in the Message details;
Occurred: 2016/12/01 19:00:59
I have ran btool on the Indexers, where the time parsing happens, and the the results show that the TIME_PREFIX and TIME_FORMAT are being picked up, however the value being populated into _time is the Windows Event time, not the time specified starting with Occurred.
... View more
02-17-2016
01:53 PM
https://answers.splunk.com/answers/43339/alert-on-deleted-data.html
Specifically;
Put a crazy string in your search, like so:
index=_audit "action=search" search=*delete* NOT dfsdkljwkwtw
This will prevent your search from showing up in the results.
You might want to refine it a big using a regex to look for | delete, |delete, | delete , etc.
... View more
10-28-2015
06:35 AM
1 Karma
I am deploying Indexer Cluster settings in an app to multiple Universal Forwarders via the Deployment Server. The issue I have is that they require the Indexer Cluster password to be sent in the /local/outputs.conf file.
App deployment works fine and a new outputs.conf is created on the Universal Forwarder under $SPLUNK_HOME/etc/system/local with the required stanza and encrypted password.
The issue is that the password exists in clear text in 2 places;
Deployment Server - $SPLUNK_HOME/etc/deployment_apps/app_name/local/outputs.conf
Universal Forwarder - $SPLUNK_HOME/etc/apps/app_name/local/outputs.conf
Is there a way for the password to be encrypted at all locations?
... View more
10-26-2015
03:43 PM
Creating an outputs.conf with just the general stanza and site flag in an app which I push from a deployer did the trick.
I am using a multi site index cluster so the outputs.conf created in a barebones install points to the index cluster master which requires site details. The process above means I can deploy a barebones forwarder to any server and update all the required settings via the app deployment process.
... View more
10-26-2015
05:56 AM
I am deploying Universal Forwarders by either Puppet or SCCM to multiple hosts. They will be forwarding to a 6.3.0 multisite indexer cluster.
Is there a way to set site=site0 in the system/local/server.conf to save having to log into each server to update this flag?
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:04 AM
|
