Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About rhysjones
rhysjones
Path Finder
Member since:
10-27-2010
06-05-2020
Community Statistics
| Posts | 31 |
| Solutions | 1 |
| Karma Given | 0 |
| Karma Received | 2 |
| Member Since | 10-27-2010 |
Activity Feed
- Got Karma for Re: How to configure the Splunk Add-on for Sophos to properly recognize the EventTime field for incoming data?. 06-05-2020 12:47 AM
- Got Karma for Active Directory Password Expiry. 06-05-2020 12:46 AM
- Posted Re: Separating Search Heads and Database Access on All Apps and Add-ons. 11-26-2017 07:05 PM
- Posted Separating Search Heads and Database Access on All Apps and Add-ons. 11-26-2017 06:52 PM
- Tagged Separating Search Heads and Database Access on All Apps and Add-ons. 11-26-2017 06:52 PM
- Posted Re: Using regex to extract a string where the following string may or may not exist on Splunk Search. 10-12-2017 04:04 PM
- Posted Re: Using regex to extract a string where the following string may or may not exist on Splunk Search. 10-12-2017 03:31 AM
- Posted Re: Using regex to extract a string where the following string may or may not exist on Splunk Search. 10-11-2017 11:15 PM
- Posted Re: Using regex to extract a string where the following string may or may not exist on Splunk Search. 10-11-2017 10:25 PM
- Posted Re: Using regex to extract a string where the following string may or may not exist on Splunk Search. 10-11-2017 03:36 AM
- Posted Re: Using regex to extract a string where the following string may or may not exist on Splunk Search. 10-10-2017 10:38 PM
- Posted Re: Using regex to extract a string where the following string may or may not exist on Splunk Search. 10-10-2017 08:56 PM
- Posted Re: Using regex to extract a string where the following string may or may not exist on Splunk Search. 10-10-2017 08:04 PM
- Posted Using regex to extract a string where the following string may or may not exist on Splunk Search. 10-10-2017 07:53 PM
- Tagged Using regex to extract a string where the following string may or may not exist on Splunk Search. 10-10-2017 07:53 PM
- Tagged Using regex to extract a string where the following string may or may not exist on Splunk Search. 10-10-2017 07:53 PM
- Tagged Using regex to extract a string where the following string may or may not exist on Splunk Search. 10-10-2017 07:53 PM
- Tagged Using regex to extract a string where the following string may or may not exist on Splunk Search. 10-10-2017 07:53 PM
- Posted Re: Send SNMP using NetSNMP from an Alert on Splunk Search. 10-19-2016 03:16 PM
- Posted Re: Send SNMP using NetSNMP from an Alert on Splunk Search. 01-28-2016 01:29 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 0 |
11-26-2017
07:05 PM
Fantastic, thankyou. Look's like we will need to consume the data instead. That's a bit of a challenge but I think we can do it.
Thanks again.
Rhys
... View more
11-26-2017
06:52 PM
Hi,
We have a recently upgraded our Splunk implementation, and currently have the following (as relevant to the query below):
- A search head cluster
- A couple of indexers
- A separate Database Access server (DBConnect)
In general we allow the DBConnect server access to the databases, and pull relevant data into Splunk. This works well.
We now have a scenario where we would rather run a dbxquery directly against the database from a search head (ie not consume the data into Splunk). The question is, is there any way of doing this without deploying DBConnect to all the search heads and giving them access to the databases ? For example, can we get the dbxquery to run on the DBConnect server ?
I'm pretty sure the answer is no, but I thought I would ask the smart people out there !
Thankyou.
Rhys
... View more
10-12-2017
04:04 PM
cpetterborg, that was the missing bit !! Thankyou !
This now appears to be pulling the field in correctly in both cases.
Some Text 1\s+(?P .+?)(?:\sSome Text 2|\",)
Thankyou both for all you assistance. Very much appreciated !
... View more
10-12-2017
03:31 AM
Hi jincy_18,
Excellent question.
"Some Text 1" is always there. This works for records that do have text following the extracted field:
Some Text 1\s+(?P<my field 1>.+)\sSome Text 2
This works for records that do not have text following the extracted field:
Some Text 1\s+(?P<my field 1>.+)\",
This does not work
Some Text 1\s+(?P<my field 1>.+)(?:\sSome Text 2|\",)
This last one returns correct extracts for records that do not have text following the extracted field. For records that do have text following the extracted field it returns all the following text up to the next instance of the ", combination rather than stopping before the "Some Text 2" literal string.
Hope that makes sense.
... View more
10-11-2017
11:15 PM
So effectively, I can get it running correctly with either "match" by themselves, but if I put them in a non-capturing match group, only the second match is "hit". That means items that are at the end of the line already are correctly returned, but items that have "Some Text 2" are actually captured all the way until the ", combination is matched.
... View more
10-11-2017
10:25 PM
Hi jincy_18,
I did some more experimenting and unfortunately have the same issue. I can either extract "myfield1" when followed by ",
or I can extract "myfield1" when followed by a space then a "Some Text 2".
If I try to have both in a match group I get the one followed by ", extracted correctly, and all the other rows extract until they get to a ", combination.
I might try a different tack.
Thanks again.
... View more
10-11-2017
03:36 AM
Thankyou jincy_18. I will have a go when I get to the office tomorrow.
I was experimenting using the rex command, but mostly in the field extraction wizard. Effectively I am only trying to extract "my field 1" and I am identifying it based on the fact it is preceded by the literal string "Some Text 1" and a space, and followed immediately by either "Some Text 2" OR the ", combination.
I discovered in another extract I was doing that in the event that was immediately followed by the combination
","text3
I had to use the following regex :
Some Text 1\s+(?P<my field 1>.+)\.{7}text3
This kind of made me think I had a Unicode issue.
Thankyou for the hint. I'll check it out tomorrow.
... View more
10-10-2017
10:38 PM
Thankyou.
Yes, I discovered the requirements for no spaces (apologies, my "sample" didn't convey that). I did play around with just using the space character too. I think I ill go home and start tomorrow with fresh eyes !
Thankyou for the suggestions. You have started me on a couple of new paths of testing so much appreciated. I'll update here if I find a solution.
... View more
10-10-2017
08:56 PM
Spot on. 5 Matches regardless of whether there is a string following, or a ", following.
That construct does not appear to be working in Splunk (or in my dataset). For example, if I put the \s inside the match brackets then it seems to be ignored and that side of the match fails.
... View more
10-10-2017
08:04 PM
I am partly wondering if the ".+" may be part of the issue. Given the content of can be varied and contain spaces and special characters I am not sure how to get around that.
... View more
10-10-2017
07:53 PM
Hi,
I am trying to extract some fields which are generally bound by other strings (eg Some Text 1 Some Text 2). I have a situation where a field may or may not have anything following it.
For example, with this data set :
1 Some Text 1 <my field 1> Some Text 2
2 Some Text 1 <my field 1>",
3 Some Text 1 <my field 1> Some Text 2
4 Some Text 1 <my field 1> Some Text 2
5 Some Text 1 <my field 1>",
This regex partly works in that is extracts correctly items 1, 3, and 4:
Some Text 1\s+(?P<my field 1>.+)\s(Some Text 2|\",)
This regex partly works in that is extracts correctly items 2 and 5, but extracts the entirety of items 1, 3, and 4.
Some Text 1\s+(?P<my field 1>.+)(Some Text 2|\",)
The difference is the "\s". I can't seem to include that in the match group, only before it.
I am sure I am missing something obvious but can't seem to see it. Any help much appreciated.
Thankyou.
... View more
10-19-2016
03:16 PM
I finally got a chance to revisit this and discovered I had started one document too far .... I have switched from parameters to environment variables and it's all good !!
http://docs.splunk.com/Documentation/Splunk/6.1.4/Alert/Configuringscriptedalerts
... View more
01-28-2016
01:29 PM
Hello,
Thankyou for the response. I basically just followed this article : http://wiki.splunk.com/Community:Sending_SNMP_Traps_On_Windows
I use a standard "alert" and get it to run a script. The script is a cmd file that runs Net-SNMP with a set of parameters, including some of the content send to it by the Splunk alert.
... View more
01-27-2016
08:56 PM
Hi,
I have successfully configured Splunk to send SNMP alerts using NetSNMP via a cmd script file. All good there.
The scenario I have is that I manufacture a node-up / node-down alert based on contents of log files. The log files tell me if a certain component of the software being monitored is functional. This alert works correctly when sent as an email, I effectively return a node-up or node-down as appropriate.
The issue I am having is that the search I run is fairly lengthy and has numerous commas and so forth in it. When I pass it out to the script, because the full script is passed, I am having issues with what actually gets generated for NetSNMP. I am therefore trying to work out a good way of generating a "useful" SNMP trap to send. Instead what I get is bits of the query separated by commas.
I have done a bunch of reading, but haven't actually managed to work out if there is a way I can successfully do this. I considered passing the .gz file, but its location doesn't appear in the text that is output to the command line (it appears in the Splunk event logs, just not in the debug output from the cmd batch script). I am guessing it is because of a length limitation maybe?
Any thoughts? Should I be going to Perl?
Thank you for any hints.
... View more
01-19-2016
03:22 PM
Just added another sourcetype. Events are coming in correctly now.
Thankyou again. Much appreciated.
... View more
01-19-2016
03:00 PM
Thankyou, sadly already had the "=" in there. I have this set in the local\props.conf
[sophos:firewall]
TIME_PREFIX = EventTime=
TIME_FORMAT = %Y-%m-%d %H:%M:%S
MAX_TIMESTAMP_LOOKAHEAD = 78
So, interestingly, I tried again this morning and I think I found the issue, or possibly it's a fluke. I wanted to try again today as the indexers/search head do a staged restart early in the morning. I am thinking that perhaps the changes on the forwarder were ok but the same props.conf changes on the indexer/search head had not been picked up. When I tried with a different set of data today the EventTime and _Time were correct.
I will try again later with another sourcetype just to make sure. If that is the case, then it was the MAX_TIMESTAMP_LOOKAHEAD = 78 that most likely resolved it. Il will let you know later today or tomorrow.
Thankyou !!!
... View more
01-18-2016
03:45 PM
I may have another try tomorrow. I altered the lookahead to 78 and the following was the result (forwarder restarted to send data on 19th Jan at around 10:30am local time):
1/18/16
8:17:11.000 AM
InsertedAt=2016-01-17 21:12:44; EventID=1277; EventTime=2016-01-17 21:12:43; EventTypeID=; EventType=; Name=; ReportingName=; UserName=NT AUTHORITY\SYSTEM; ActionID=; Action=; SubTypeID=; SubType=; Role=; FileName=; FilePath=; FileVersion=; FileChecksum=; CommandLine=; Session=; Desktop=; Location=; ProtocolID=; Protocol=; DirectionID=; Direction=; LocalAddress=; RemoteAddress=; LocalPort=; RemotePort=; ComputerName=MYCOMP; ComputerDomain=MYDOM; ComputerIPAddress=99.99.99.99
1/18/16
8:17:11.000 AM
InsertedAt=2016-01-17 21:11:38; EventID=1276; EventTime=2016-01-17 21:11:38; EventTypeID=; EventType=; Name=; ReportingName=; UserName=NT AUTHORITY\SYSTEM; ActionID=; Action=; SubTypeID=; SubType=; Role=; FileName=; FilePath=; FileVersion=; FileChecksum=; CommandLine=; Session=; Desktop=; Location=; ProtocolID=; Protocol=; DirectionID=; Direction=; LocalAddress=; RemoteAddress=; LocalPort=; RemotePort=; ComputerName=MYCOMP; ComputerDomain=MYDOM; ComputerIPAddress=99.99.99.99
1/18/16
8:17:11.000 AM
InsertedAt=2016-01-17 21:11:34; EventID=1275; EventTime=2016-01-17 21:11:33; EventTypeID=; EventType=; Name=; ReportingName=; UserName=NT AUTHORITY\SYSTEM; ActionID=; Action=; SubTypeID=; SubType=; Role=; FileName=; FilePath=; FileVersion=; FileChecksum=; CommandLine=; Session=; Desktop=; Location=; ProtocolID=; Protocol=; DirectionID=; Direction=; LocalAddress=; RemoteAddress=; LocalPort=; RemotePort=; ComputerName=MYCOMP; ComputerDomain=MYDOM; ComputerIPAddress=99.99.99.99
... View more
01-18-2016
03:26 PM
Will do, thankyou !
... View more
01-17-2016
02:33 PM
Raw records below (raw view in Splunk Search) with appropriate fields obsfucated. The _time entry for all 3 of these is :
1/6/16
11:56:20.000 AM .
InsertedAt=2016-01-06 00:52:05; EventID=1247; EventTime=2016-01-06 00:52:04; EventTypeID=; EventType=; Name=; ReportingName=; UserName=NT AUTHORITY\SYSTEM; ActionID=; Action=; SubTypeID=; SubType=; Role=; FileName=; FilePath=; FileVersion=; FileChecksum=; CommandLine=; Session=; Desktop=; Location=; ProtocolID=; Protocol=; DirectionID=; Direction=; LocalAddress=; RemoteAddress=; LocalPort=; RemotePort=; ComputerName=COMPNAM; ComputerDomain=THEDOM; ComputerIPAddress=99.99.99.99
InsertedAt=2016-01-04 02:17:47; EventID=1246; EventTime=2016-01-04 02:17:47; EventTypeID=; EventType=; Name=; ReportingName=; UserName=NT AUTHORITY\SYSTEM; ActionID=; Action=; SubTypeID=; SubType=; Role=; FileName=; FilePath=; FileVersion=; FileChecksum=; CommandLine=; Session=; Desktop=; Location=; ProtocolID=; Protocol=; DirectionID=; Direction=; LocalAddress=; RemoteAddress=; LocalPort=; RemotePort=; ComputerName=COMPNAM; ComputerDomain=THEDOM; ComputerIPAddress=99.99.99.99
InsertedAt=2016-01-04 02:17:41; EventID=1245; EventTime=2016-01-04 02:17:41; EventTypeID=; EventType=; Name=; ReportingName=; UserName=NT AUTHORITY\SYSTEM; ActionID=; Action=; SubTypeID=; SubType=; Role=; FileName=; FilePath=; FileVersion=; FileChecksum=; CommandLine=; Session=; Desktop=; Location=; ProtocolID=; Protocol=; DirectionID=; Direction=; LocalAddress=; RemoteAddress=; LocalPort=; RemotePort=; ComputerName=COMPNAM; ComputerDomain=THEDOM; ComputerIPAddress=99.99.99.99
... View more
01-14-2016
01:17 AM
Hi,
Thankyou. Will do next week when I have access again. I'm also going to have another go in my test environment.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:02 AM
|
