Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About stwong
stwong
Communicator
Member since:
05-02-2012
12 hours ago
Community Statistics
| Posts | 139 |
| Solutions | 0 |
| Karma Given | 28 |
| Karma Received | 8 |
| Member Since | 05-02-2012 |
Activity Feed
- Posted Error in Observability Cloud Service Jump Start Guided Example on Splunk Cloud Platform. yesterday
- Posted Palo Alto Networks Add-on PANOS compatibility on All Apps and Add-ons. 02-21-2024 05:43 PM
- Got Karma for Re: JSON timestamp parsing- When events are being fed from UF, the timestamp can't be extracted?. 01-30-2024 07:09 AM
- Posted Re: co-relate random events on Splunk Search. 08-04-2023 02:16 AM
- Karma Re: co-relate random events for yuanliu. 08-04-2023 02:16 AM
- Karma Re: co-relate random events for ITWhisperer. 08-04-2023 02:07 AM
- Posted co-relate random events on Splunk Search. 08-04-2023 12:57 AM
- Karma Re: Help with Regex in transaction endswith for woodcock. 04-10-2023 06:28 PM
- Posted Re: Regex in transaction endswith on Splunk Search. 04-05-2023 11:44 PM
- Posted Re: Regex in transaction endswith on Splunk Search. 04-05-2023 08:17 PM
- Karma Re: Regex in transaction endswith for javiergn. 04-05-2023 06:22 PM
- Posted Re: Regex in transaction endswith on Splunk Search. 04-04-2023 01:58 AM
- Posted Help with Regex in transaction endswith on Splunk Search. 04-04-2023 01:22 AM
- Posted Splunk Add-on for Microsoft Office 365 - failed to parse URL for IPv6 on Splunk Dev. 12-29-2022 08:01 PM
- Posted Re: JSON timestamp parsing- When events are being fed from UF, the timestamp can't be extracted? on Getting Data In. 12-20-2022 08:03 PM
- Karma Re: JSON timestamp parsing- When events are being fed from UF, the timestamp can't be extracted? for richgalloway. 12-20-2022 05:46 PM
- Karma Re: Pls help: JSON timestamp parsing for wmazur-splunk. 12-20-2022 05:46 PM
- Posted JSON timestamp parsing- When events are being fed from UF, the timestamp can't be extracted? on Getting Data In. 12-20-2022 01:40 AM
- Posted Re: Macro definition = () on Splunk Enterprise Security. 09-09-2021 11:29 PM
- Karma Re: Macro definition = () for isoutamo. 09-09-2021 11:28 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
05-21-2019
11:38 PM
seems need to put plaintext Splunk username/password in SplunkJS configurations.
... View more
05-21-2019
11:32 PM
Seems 2) suits our need while 1) doesn't accept parameter passing from the external web to the report.
Thanks for your help.
... View more
05-21-2019
08:53 PM
Hi, we've a simple web application in PHP that queries user's status from different sources (e.g. LDAP, Oracle DB, etc.). Possible to search Splunk by passing arguments like username, time selector, etc. to a predefined report, and gives result in html ?
Sorry for the newbie question. Thanks.
/stwong
... View more
01-21-2019
06:17 PM
Thanks. I have similar error on other add-on, which was fixed by adding following to /etc/hosts on corresponding Splunk instance host:
::1 localhost localhost.localdomain localhost6 localhost6.localdomain6
Maybe this case can also be fixed similarly.
Anyway, we switched to test the new add-on https://splunkbase.splunk.com/app/4055/ instead per support's advice.
Thanks for all responded.
... View more
12-20-2018
09:44 AM
Thanks. Found that it's done by a transform in the CIM add-on $SPLUNKE_HOME/etc/apps/Splunk_SA_CIM/default/props.conf.
Thanks a lot.
... View more
12-20-2018
09:40 AM
Thanks and agree. But when expanding the event fields on web interfrace, we can see that the "action" attribute is set to "success", not "login attempt".
... View more
12-20-2018
02:23 AM
Hi, thanks for your help.
I'm just interest to know which configuration makes Splunk changed value of "action" into something different to that stated in the events...
... View more
12-20-2018
12:31 AM
Hi,
We're looking for web GUI log in attempts from index=_audit. Note that for event like following:
Audit: [timestamp=12-20-2018 12:15:38.921, user=user123, action=login attempt, info=succeeded, src=12.34.56.78][n/a]
the "action" field is set to "success" instead of "login attempt".
Was it set somewhere? Sorry for the newbie question.
Thanks a lot.
Regards
EDIT: removed the ip address
... View more
11-04-2018
07:40 PM
Hi all,
We have a simple dashboard containing 3 panels with some charts and tables.
When we use the PDF schedule, the labels in the x-axis of the charts are overlapped. We tried to change the paper size to A3 and the paper layout to Landscape, but it didn't help — the chart doesn't aware of change its paper size/orientation.
We're using Splunk v7.0.
Would anyone please help?
Thanks and rgds
/st wong
... View more
- Tags:
- splunk-enterprise
10-23-2018
10:44 PM
Hi, not yet. We're waiting for updated version of the add-on... Thanks.
... View more
07-23-2018
08:14 PM
1 Karma
Thanks for the suggestions, that match with what we need. Will give them a try.
Thanks a lot.
... View more
07-17-2018
09:08 PM
Hi thanks. We also use this method for Splunk instance with few apps installed, but looking for ways to hide apps menu on per user/role basis. Fyi.
Thanks.
... View more
07-17-2018
04:56 AM
Hi all,
We're using Splunk 7.0. Recently we're being ordered by boss to open up Splunk web interface for a customer to do searching.
I created role for the user to restrict search terms and indexes, and create app cloned from search app by removing some menu items like Datamodel, Alerts. As we've lot of apps/add-on installed, it's tedious to update permission for all one by one. However, unable to hide the App navigation drop down menu. How can we do that? Or will it be any better way to create accounts/roles/apps in a multi-tenant environment?
Thanks a lot.
Regards
/ST wong
... View more
- Tags:
- splunk-enterprise
06-22-2018
01:35 AM
Noted and thanks. Will try it out.
... View more
06-21-2018
07:34 PM
It should be on heavy forwarder or indexer
Got it. Will this overrides host part for all data with sourcetype=syslog?
Chances are we hope to use host_segments for syslog data on some UF, while keep using host in log content for some other UF.
Sorry to bother again.
Thanks a lot.
... View more
06-21-2018
05:53 AM
stupid me. sorry for the newbie mistake...
Just put following in props.conf but seems no effect.
[source::/ssd///cyrus.log]
TRANSFORMS =
TRANSFORMS-host =
splunk btools props list shows the setting is correct. Would you help? Thanks again.
... View more
06-21-2018
04:52 AM
tried but seems not working - still gets hostname from log content. My inputs.conf looks like following:
[monitor:///ssd///cyrus.log]
ignoreOlderThan=1d
disabled = false
TRANSFORMS =
TRANSFORMS-host =
host_segment = 3
index = test
sourcetype = cyrus
Did I miss anything?
Thanks and rgds
... View more
06-21-2018
04:24 AM
Got it. Thanks a lot.
... View more
06-20-2018
11:52 PM
Hi all,
Seems we have to override the sourcetype to sourcetype other than 'recognized' ones (e.g. syslog) in order to make host_segment work. e.g.
[monitor:///ssd/*/*/cyrus.log]
disabled = false
host_segment = 3
index = test
sourcetype = cyrus
However, for some cases, we hope to make use of sourcetype from Splunk (e.g. syslog) but use host_segment instead of host parsed in the log content for that particular sourcetype. Possible to do that at inputs.conf without touching other config files like props.conf or transform.conf?
Sorry for the newbie question.
Thanks and regards
... View more
05-20-2018
06:50 PM
Update:
We tried on another Splunk 7.0 installation without IPv6 support. The same error didn't occur.
... View more
05-20-2018
06:50 PM
Update:
We tried on another Splunk 7.0 installation without IPv6 support. The same error didn't occur.
... View more
05-20-2018
06:41 PM
Hi,
Thanks for the reply. The input file looks like following, which was created by the Add-On's GUI:
----------------- cut here ----------------
[MS_AAD_signins://Azure_AD_Signins]
interval = 5
start_date = 2018-05-01 00:00:00
tenant_domain = mytenant.onmicrosoft.com
[MS_AAD_audit://Azure_AD_Audit]
interval = 5
start_date = 2018-05-01 00:00:00
tenant_domain = mytenant.onmicrosoft.com
----------------- cut here ----------------
Regarding the Sign-On URL, we just follow instruction at https://docs.microsoft.com/en-us/azure/active-directory/active-directory-reporting-api-prerequisites-azure-portal, to put https://localhost there:
c. In the Sign-on URL textbox, type https://localhost.
I wonder if "localhost" resolves to ::1 as our heavy forwarder runs dual IPv4 and IPv6 stack.
Thanks a lot.
Regards,
... View more
05-18-2018
01:32 AM
Hi all,
We installed latest Microsoft Azure Active Directory Reporting Add-on for Splunk on our installation running 7.0.
We configured inputs for Signing and Audit data. However, there is no data received. Found same error in logs of each input:
2018-05-18 16:29:34,344 ERROR pid=14469 tid=MainThread file=base_modinput.py:log_error:307 | Traceback (most recent call last):
File "/opt/splunk/etc/apps/TA-MS-AAD/bin/ta_ms_aad/modinput_wrapper/base_modinput.py", line 113, in stream_events
self.parse_input_args(input_definition)
File "/opt/splunk/etc/apps/TA-MS-AAD/bin/ta_ms_aad/modinput_wrapper/base_modinput.py", line 152, in parse_input_args
self._parse_input_args_from_global_config(inputs)
File "/opt/splunk/etc/apps/TA-MS-AAD/bin/ta_ms_aad/modinput_wrapper/base_modinput.py", line 170, in _parse_input_args_from_global_config
global_config = GlobalConfig(uri, session_key, global_schema)
File "/opt/splunk/etc/apps/TA-MS-AAD/bin/ta_ms_aad/splunktaucclib/global_config/__init__.py", line 51, in __init__
port=splunkd_info.port,
File "/opt/splunk/etc/apps/TA-MS-AAD/bin/ta_ms_aad/solnlib/net_utils.py", line 129, in wrapper
'Illegal argument: {}={}'.format(arg, value))
ValueError: Illegal argument: host=::1
I wonder if it's caused by the Sign-on URL to https://localhost as mentioned in the link about "prerequisites to access the Azure AD reporting API.", while our system runs IPv4 and IPv6. Seems the v6 localhost address ::1 is invalid.
Would anyone please help?
Thanks a lot.
/ST Wong
... View more
05-08-2018
09:46 PM
Hi, we want to block malicious IP address in firewall as alert action. We run python script to block such IP address through REST api. It seems okay.
However, we're requested to unblock such blocked IP address automatically after blocking for 15 minutes. Is it possible to do so through Splunk?
Besides, shall we use webhook instead of running external scripts ?
We're using Splunk 7.0.
Thanks a lot.
Regards,
/ST Wong
... View more
- Tags:
- splunk-enterprise
