About himapate

himapate · ‎04-14-2017

Am trying below query but its not Working: index=* (sourcetype=WinEventLog:System OR sourcetype=WinEventLog:Security) (EventCode=1102 OR EventCode=13 OR EventCode=1100) EventType=4 dvc="MS-FR4-EXM-008" <1100> | stats max(_time) as maxtime min(_time) as mintime | eval difference=maxtime-mintime | eval difference=strftime(difference,"%d:%H:%M:%S")

himapate · ‎02-19-2017

It worked thanks

himapate · ‎02-17-2017

HI , I have query for login failure followed with lockout i can search the data and run in the search and reporting app but i am unable to save it as a dashboard . The dashboard shows waiting for inputs . Below is the search string . earliest=-1d@d latest=@d index=wineventlog sourcetype=WinEventLog:Security EventCode="4740" | eval Account=mvindex(Account_Name, 1) | stats count, latest(_time) AS lastBlock by Account | eval modtime=lastBlock - 7200 | fields - count | map maxsearches=1000 search="search index=wineventlog sourcetype=WinEventLog:Security (EventCode="4625" OR EventCode="4768" OR EventCode="4771" OR EventCode="4776") earliest=$modtime$ latest=$lastBlock$ Account_Name=$Account$" | eval Account=case(EventCode="4740" OR EventCode="4625", mvindex(Account_Name, 1), EventCode="4768" OR EventCode="4771", Account_Name, EventCode="4776", Logon_Account, 1=1, "Click-on-me") | regex Account!="\\$" | eval errorMessages=case(EventCode="4768", (EventCode."; ".Result_Code), EventCode="4771", (EventCode."; ".Failure_Code), EventCode="4776", (EventCode."; ".Error_Code), 1=1, "Click-on-me") | stats count, latest(_time) AS lastFailure, values(Failure_Reason) AS failureReason, values(errorMessages) AS otherFailures by Account src_ip | convert ctime(lastFailure) | rename Account AS "Blocked Account", count AS LoginFailures The error is due to the token being passed which doest not work in dashboard can someone help.

himapate · ‎01-17-2017

How do i exclude paticular sourcetype from being indexed at my indexer end Or is there any method to stop them at forwarder end

himapate · ‎11-26-2016

I am required to build a search which will show the uptime of all my Splunk components over a period of one month. Also I am required to build a search for the host reporting to Splunk

himapate · ‎11-15-2016

I need to build a search for tracing logs cleared from /var/log/message/ or /var/log/secure/ .

himapate · ‎11-08-2016

Yes i am collecting for the nessus sourcetype below is the stanza for the same in inputs.conf [nessus://NessusPlugin] metric = nessus_plugin interval = 84600 url = https://:8834 access_key = secret_key = start_date = 2016/01/01 page_size = 1000 index = nessus batch_size = 0 start_by_shell = false

himapate · ‎11-08-2016

Managed to get all the scan data but plugin issue remains the same

himapate · ‎11-08-2016

Hi , I am not able to get the Nessus scan data ( Only informational Events ), whereas the Nessus result has medium and high count. Also, when I search for sourcetype=nessus:plugin , there is no result popping up.

himapate · ‎11-07-2016

Hi , I am having a log file , lets say Splunk.log which contains two type of logs written in it consider "internal" and "external" Is there any way to segregate this in inputs.conf while motoring the log file. The purpose is that i need to assign different sourcetype to each of them. Also, is this possible to be done at in rsyslog which is acting as my centralized syslog server. I have done the dynamic configuration of seperating it by hostname but is there any way to seperate by any message in the log incoming? Thankyou

himapate · ‎09-14-2016

Hi, When i try to search data using command sourcetype="WinEventLog:Security" there is no result for it. However when i run index="wineventlog" sourcetype="WinEventLog:Security" i get all my result. What shall i do i this case ? In my environment i have 1 indexer and 1 search head Thanks

himapate · ‎09-14-2016

No the hostname are different and this is the only concern. I want the hostname stanza to be present in the local directory of the TA. But when the client will phone home in the deployment app , where i can't configure the hostname for each server in the TA inputs.conf , it will override the inputs on all the clients and the host satnza would be removed

himapate · ‎09-14-2016

Hi , In our scenario we have the Mcafee manager and the Database hosted on 2 different servers. As per the document we need to open port 1433 for DB connect app to connect. Does this require the port to be open from Heavy forwarder and database or Heavy forwarder and manager, as the manager has the information form the DB Also, for syslog in order to configure inputs we need to configure it at the Mcafee manager or Database server to connect to Splunk. Thanks

himapate · ‎09-14-2016

Hi ESIX Found out the issue to be a bit diffrent. We deployed Splunk universal forwarder through tivoli which was pointing to the deployment server. On deploying it we found out that there is a inputs.conf getting created in local folder with only the hostname. We deployed Splunk-TA-Winodows through deployment server on all the host Using a batch file we appended the inputs.conf host data form system/local to Splunk-TA-Windows/local/inputs.conf and deleted the inputs.conf and restarted splunkd. All worked fine. Now we have the Splunk-TA-Winodws deployed through deployment servrer, when the client phones home it removes the hostname as there and keeps the conf file present in the deployment app? How can i add the host details in splunk without getting it override ? I have 100 servers in all and want the hostname of each present in the inputs.conf of the TA ? can you help out in this Thanks

himapate · ‎09-14-2016

Hi dmaislin , Thnaks for the response was a great hepl Manged to deploy it by tivoli However We deployed Splunk universal forwarder through tivoli which was pointing to the deployment server. On deploying it we found out that there is a inputs.conf getting created in local folder with only the hostname. We deployed Splunk-TA-Winodows through deployment server. Using a batch file we appended the inputs.conf host data form system/local to Splunk-TA-Windows/local/inputs.conf and deleted the inputs.conf and restarted splunkd. All worked fine. Now we have the Splunk-TA-Winodws deployed through deployment servrer, when the client phones home it removes the hostname as there and keeps the conf file present in the deployment app? How can i add the host details in splunk without getting it override ? I have 100 servers in all and want the hostname of each present in the inputs.conf of the TA ?

himapate · ‎09-14-2016

Hi , We deployed Splunk universal forwarder through sccm which had the sendtoindexer app pointing to indexer and deployment server set. On deploying it we found out that there is a inputs.conf getting created in local folder with only the hostname. Using a batch file we appended the inputs.conf host data form system/local to Splunk-TA-Windows/local/inputs.conf and deleted the inputs.conf and restarted splunkd. All worked fine. Now we have the Splunk-TA-Winodws deployed through deployment servrer, when the client phones home it removes the hostname as there and keeps the conf file present in the deployment app? How can i add the host details in splunk without getting it override ? I have 100 servers in all and want the hostname of each present in the inputs.conf of the TA ?

himapate · ‎09-13-2016

Hi, I have 1 search head and 1 indexer, I configured the indexer as search peer and the status is up. However cannot search anything on the indexer. In DMC also cannot find the indexer setup

himapate · ‎09-12-2016

Hi , We are integrating McAfee ePO with Splunk where we require Splunk DB Connect to be installed. Went through the docs and found that DB Connect can be installed at the Search Head or Heavy forwarder: Splunk DB Connect on a heavy forwarder to support continual data gathering or output. Splunk DB Connect on a search head for more interactive use, including lookups, Which is the best location to install the app? We also have Splunk Enterprise Security and need these logs to be integrated.

himapate · ‎09-10-2016

Hi Guys, We are at a phase where we need to deploy universal forwarder setup through Tivoli Endpoint Manager (TEM) over multiple servers. However, for deploying through Tivoli, we need to create fixlets. Is there any way to get the batch file from the Splunk Universal Forwarder or is there any other method to give it a try?

himapate · ‎09-06-2016

Hi , I'm trying to integrate blue coat proxy with Splunk, however stuck at the below point. The bluecoat proxy is sending its log in squid format through syslog to my indexer which app should i use ( TA- Blue coat or TA - Squid ) in order to make it CIM compatible.

himapate · ‎09-02-2016

Hi , Thanks for your response, the solution provided seems to be helpful.However had a doubt regarding the license. The separate indexer has its own license and my cluster has a different license would that seem to be clashing or would be working respectively.

himapate · ‎09-01-2016

Hi , We are deploying Splunk in our environment and have been stuck up at a point. We have deployed Indexer cluster in one network it consist of the following details 2 search head 4 indexer Master node Deployment server Now our requirement is that we want to integrate one indexer present at a different site and network with the search head of the current cluster. Is it possible and if so how can it be done ?

himapate · ‎07-01-2016

Hi , I am planning to install ES in my environment. I have 3 indexer, 1 master node, 1 deployment server. Currently having 1 search head. Going through various Docs noticed that i need to install ES on a separate SH and it doesn't fit well with SH Clustering. So is it possible to deploy 1 search head with ES only and its add on and other search head with all the apps? How can it be done ? Thanks

himapate · ‎06-29-2016

Hi, Trying to build a parser, but facing the below issue. I extracted two fields from my logs: action_failed and action_success Later, I gave them a field alias as below: action_failed as action1 action_success as action1 linked them to a lookup: mylookup action1 OUTPUT action The issue is that only one field is parsed, and that is the first one in my case action_failed, the other field is not picked. Is there any solution for this?

himapate · ‎06-19-2016

Hi , Need to build a parser for two factor authentication what are the basic field i need to parse and what would my dashboard contain i.e fileds. Thanks

Posts	30
Solutions	0
Karma Given	0
Karma Received	2
Member Since	‎12-11-2015

Online Status	Offline
Date Last Visited	‎06-05-2020 02:04 AM

I am not being able to calculate time difference b...

Dashboard for login failure followed by lockout

Exclude Sourcetype from being indexed

How to build a search that shows the uptime of Spl...

How to write a search to trace if /var/logs/messag...

Splunk Add-on for Tenable: How to troubleshoot why...

Log Segregation ?

Search Issue

Deployment of Splunk TA for windows via deployment...

Splunk Deployment - Stanndalone

I am not being able to calculate time difference b...

Re: Dashboard for login failure followed by lockou...

Dashboard for login failure followed by lockout

Exclude Sourcetype from being indexed

How to build a search that shows the uptime of Spl...

How to write a search to trace if /var/logs/messag...

Re: Splunk Add-on for Tenable: How to troubleshoot...

Re: Splunk Add-on for Tenable: How to troubleshoot...

Splunk Add-on for Tenable: How to troubleshoot why...

Log Segregation ?

Search Issue

Re: Splunk Deployment - Stanndalone

Re: Integrating McAfee ePO with Splunk, do we inst...

Re: Splunk Deployment - Stanndalone

Re: How to deploy Splunk using a universal forward...

Deployment of Splunk TA for windows via deployment...

Splunk Deployment - Stanndalone

Integrating McAfee ePO with Splunk, do we install ...

How to deploy Splunk using a universal forwarder t...

Bluecoat proxy integration

Re: Splunk Deployment

Splunk Deployment

Splunk App for Enterprise Security Installation?

Why is my field alias only applied for 1 of 2 fiel...

Two factor authentication parser ?