Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Are you a member of the Splunk Community?
Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- Find Answers
- :
- About nbonner
nbonner
Explorer
Member since:
12-08-2015
02-18-2025
Community Statistics
| Posts | 13 |
| Solutions | 0 |
| Karma Given | 5 |
| Karma Received | 0 |
| Member Since | 12-08-2015 |
Activity Feed
- Posted Re: Forwarder Management UI error on new install 9.4.0 on Splunk Enterprise. 02-06-2025 01:48 PM
- Karma First Login Phantom returns 500: Server Error for damindragunatil. 06-05-2020 12:51 AM
- Karma Re: [Smartstore]Is maxVolumeDataSizeMB relevent for mixed local and remote index cluster for srajarat2. 06-05-2020 12:50 AM
- Karma Getting all IP addresses from guests in VMware vCenter for bensec01. 06-05-2020 12:49 AM
- Karma Re: Slack Alerts via Web Proxy for ziegfried. 06-05-2020 12:49 AM
- Karma How to specify which data collector nodes handle jobs for specific netapp filers in hydra framework? for splunkben. 06-05-2020 12:47 AM
- Posted Re: First Login Phantom returns 500: Server Error on Security. 02-20-2020 03:07 PM
- Posted Re: How to configure Splunk to index NetApp CIFS logs in XML format? on Getting Data In. 08-15-2018 12:44 PM
- Posted Slack Alerts via Web Proxy on All Apps and Add-ons. 05-07-2018 06:02 PM
- Tagged Slack Alerts via Web Proxy on All Apps and Add-ons. 05-07-2018 06:02 PM
- Posted Re: How to configure Splunk to index NetApp CIFS logs in XML format? on Getting Data In. 09-05-2017 08:26 AM
- Posted Splunk Add-on for Microsoft IIS compatability with Splunk App for Web Analytics data on All Apps and Add-ons. 09-05-2017 08:23 AM
- Tagged Splunk Add-on for Microsoft IIS compatability with Splunk App for Web Analytics data on All Apps and Add-ons. 09-05-2017 08:23 AM
- Tagged Splunk Add-on for Microsoft IIS compatability with Splunk App for Web Analytics data on All Apps and Add-ons. 09-05-2017 08:23 AM
- Tagged Splunk Add-on for Microsoft IIS compatability with Splunk App for Web Analytics data on All Apps and Add-ons. 09-05-2017 08:23 AM
- Posted Re: How to configure Splunk to index NetApp CIFS logs in XML format? on Getting Data In. 06-07-2016 02:54 PM
- Posted Re: How to configure Splunk to index NetApp CIFS logs in XML format? on Getting Data In. 03-30-2016 10:18 AM
- Posted How to configure Splunk to index NetApp CIFS logs in XML format? on Getting Data In. 03-29-2016 06:24 PM
- Tagged How to configure Splunk to index NetApp CIFS logs in XML format? on Getting Data In. 03-29-2016 06:24 PM
- Tagged How to configure Splunk to index NetApp CIFS logs in XML format? on Getting Data In. 03-29-2016 06:24 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
02-06-2025
01:48 PM
We also have this issue after upgrading to 9.4.0. Deployment server still works at deploying apps so we have been ignoring it. A solution would be nice though.
... View more
02-20-2020
03:07 PM
I'll add that I am running into this same issue. The vmdk is thick provisioned in my case. Installed the phantom-4.8.23319.ova & have not been able to get past the /eula screen.
... View more
08-15-2018
12:44 PM
NetApp filers create a log volume that we expose as a CIFS share. We monitor these shares with a Heavy Forwarder.
... View more
05-07-2018
06:02 PM
Is there a way to configure the Slack Alerts App to use a web proxy? The search head is in a data center where internet access is restricted unless it goes through a web proxy. The only settings I have found in Splunk are for sending all Splunkd communications through a proxy which is not ideal. The search head is running on windows server 2012R2 so I did attempt to set the windows proxy but it does not seem like Splunk picks up on that for 80/443 connections. Anyone know how to get this working?
Thanks
... View more
09-05-2017
08:26 AM
We ended up doing something similar. Our logs roll after they reach 512MB & we only have Splunk ingest the rolled files.
... View more
09-05-2017
08:23 AM
Most of my web data is brought in with the Splunk Add-on for Microsoft IIS using the ms:iis:auto sourcetype. I am attempting to get the Splunk App for Web Analytics to work with this data. So far I have done the following:
updated the apps web eventtype to include the ms:iis:auto sourcetype
Configured a few sites
Ran the lookups (pages gets data but sessions does not)
None of the dashboards of populating as expected. What other steps should I take to allow the Splunk App for Web Analytics to work with the Splunk Add-on for Microsoft IIS?
... View more
06-07-2016
02:54 PM
I am actually having the same issue with Splunk ingesting the logs multiple times.
... View more
03-30-2016
10:18 AM
I am able to successfully get Splunk to identify individual events using the following props.conf:
[NetApp:Audit]
KV_MODE = xml
TIME_PREFIX = <TimeCreated SystemTime=
MAX_TIMESTAMP_LOOKAHEAD=300
SHOULD_LINEMERGE=true
BREAK_ONLY_BEFORE=^<Event>
Field extraction of the xml is still not working. This file is on our Search Head & Indexers. Is there further configuration needed for field extraction of XML?
Thanks
... View more
03-29-2016
06:24 PM
I am having issues configuring Splunk to Index NetApp CIFS logs in XML format.
Here is an example of 3 events:
<Events xmlns="http://www.netapp.com/schemas/ONTAP/2007/AuditLog">
<Event><System><Provider Name="Netapp-Security-Auditing"/><EventID>4656</EventID><EventName>Open Object</EventName><Version>101.3</Version><Source>CIFS</Source><Level>0</Level><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><Result>Audit Success</Result><TimeCreated SystemTime="2016-03-24T17:00:18.275811000Z"/><Correlation/><Channel>Security</Channel><Computer>4cf616e5-deec-11e5-9347-00a0988f86b6/e64ece12-df28-11e5-9348-00a0988f86b6</Computer><Security/></System><EventData><Data Name="SubjectIP" IPVersion="4">10.10.10.10</Data><Data Name="SubjectUnix" Uid="0" Gid="1" Local="false"></Data><Data Name="SubjectUserSid">S-9-9-99-9999999999-999999999-9999999999-9999</Data><Data Name="SubjectUserIsLocal">false</Data><Data Name="SubjectDomainName">DOMAIN</Data><Data Name="SubjectUserName">admin</Data><Data Name="ObjectServer">Security</Data><Data Name="ObjectType">Directory</Data><Data Name="HandleID">0000000000041f;00;00000040;5e1fd3f6</Data><Data Name="ObjectName">(name);/</Data><Data Name="AccessList">%%4423 %%1541 </Data><Data Name="AccessMask">10080</Data><Data Name="DesiredAccess">Read Attributes; Synchronize; </Data><Data Name="Attributes">Open a directory; </Data></EventData></Event>
<Event><System><Provider Name="Netapp-Security-Auditing"/><EventID>4656</EventID><EventName>Open Object</EventName><Version>101.3</Version><Source>CIFS</Source><Level>0</Level><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><Result>Audit Success</Result><TimeCreated SystemTime="2016-03-24T17:00:18.276812000Z"/><Correlation/><Channel>Security</Channel><Computer>4cf616e5-deec-11e5-9347-00a0988f86b6/e64ece12-df28-11e5-9348-00a0988f86b6</Computer><Security/></System><EventData><Data Name="SubjectIP" IPVersion="4">10.10.10.10</Data><Data Name="SubjectUnix" Uid="0" Gid="1" Local="false"></Data><Data Name="SubjectUserSid">S-9-9-99-9999999999-999999999-9999999999-9999</Data><Data Name="SubjectUserIsLocal">false</Data><Data Name="SubjectDomainName">DOMAIN</Data><Data Name="SubjectUserName">admin</Data><Data Name="ObjectServer">Security</Data><Data Name="ObjectType">Directory</Data><Data Name="HandleID">0000000000041f;00;00000040;5e1fd3f6</Data><Data Name="ObjectName">(name);/</Data><Data Name="AccessList">%%4423 %%1541 </Data><Data Name="AccessMask">10080</Data><Data Name="DesiredAccess">Read Attributes; Synchronize; </Data><Data Name="Attributes"></Data></EventData></Event>
<Event><System><Provider Name="Netapp-Security-Auditing"/><EventID>4656</EventID><EventName>Open Object</EventName><Version>101.3</Version><Source>CIFS</Source><Level>0</Level><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><Result>Audit Success</Result><TimeCreated SystemTime="2016-03-24T17:00:18.561808000Z"/><Correlation/><Channel>Security</Channel><Computer>4cf616e5-deec-11e5-9347-00a0988f86b6/e64ece12-df28-11e5-9348-00a0988f86b6</Computer><Security/></System><EventData><Data Name="SubjectIP" IPVersion="4">10.10.10.10</Data><Data Name="SubjectUnix" Uid="0" Gid="1" Local="false"></Data><Data Name="SubjectUserSid">S-9-9-99-9999999999-999999999-9999999999-9999</Data><Data Name="SubjectUserIsLocal">false</Data><Data Name="SubjectDomainName">DOMAIN</Data><Data Name="SubjectUserName">admin</Data><Data Name="ObjectServer">Security</Data><Data Name="ObjectType">Directory</Data><Data Name="HandleID">0000000000041f;00;00000040;5e1fd3f6</Data><Data Name="ObjectName">(name);/</Data><Data Name="AccessList">%%4423 %%1541 </Data><Data Name="AccessMask">10080</Data><Data Name="DesiredAccess">Read Attributes; Synchronize; </Data><Data Name="Attributes">Open a directory; </Data></EventData></Event>
I've attempted to create a props.conf with KV_MODE = xml, but haven't had any success yet.
Any assistance would be appreciated.
Thanks.
... View more
03-07-2016
10:19 AM
"Service" is the destination port in Check Point logs. The logs record whatever you have configured as the object name for that service.
... View more
12-22-2015
06:16 AM
This ended up being close to the correct query. Thank you for the assistance.
... View more
12-10-2015
01:32 PM
Ah yes I left that out.
ChangeType2 is always correlated with UID2
... View more
12-08-2015
10:33 AM
I am looking to build a dashboard where a user can submit a session number & retrieve the entire history of a session with one catch: the session id isn’t on the last event but there is a UID that links one of the events to the last event. This pertains to Check Point SmartWorkflow if that helps anyone.
The relevant events would look something like this:
SessionID1 user1 changeType1 UID1
SessionID1 user1 changeType2 UID2
SessionID1 user1 changeType3 UID3
SessionID1 user1 changeType4 UID4
NoSessionID user2 changeType5 UID2
It would be nice to just use the session id but I also need the extra event that includes UID2 with no session id. This is probably a simple query but I haven’t quite figured it out.
Thanks!
... View more
- Tags:
- splunk-enterprise
