Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About silasbarnesva
silasbarnesva
Explorer
Member since:
01-03-2016
06-05-2020
Community Statistics
| Posts | 10 |
| Solutions | 1 |
| Karma Given | 0 |
| Karma Received | 1 |
| Member Since | 01-03-2016 |
Activity Feed
- Got Karma for How to remove a comma from a field value?. 06-05-2020 12:47 AM
- Posted Re: How to remove a comma from a field value? on Splunk Search. 02-10-2016 08:07 PM
- Posted Re: How to remove a comma from a field value? on Splunk Search. 02-10-2016 07:12 PM
- Posted Re: How to remove a comma from a field value? on Splunk Search. 02-10-2016 06:16 PM
- Posted Re: Does someone have an example that shows how to ignore 2 or 3 domains for a Splunk Enterprise Security threat list? on Splunk Enterprise Security. 02-10-2016 05:34 PM
- Posted How to remove a comma from a field value? on Splunk Search. 02-10-2016 05:33 PM
- Tagged How to remove a comma from a field value? on Splunk Search. 02-10-2016 05:33 PM
- Tagged How to remove a comma from a field value? on Splunk Search. 02-10-2016 05:33 PM
- Tagged How to remove a comma from a field value? on Splunk Search. 02-10-2016 05:33 PM
- Posted Re: Upgrade Enterprise Security from 3.3.x to 4.0 hangs on "Disabling Apps" on Splunk Enterprise Security. 01-21-2016 02:32 PM
- Posted Re: Does someone have an example that shows how to ignore 2 or 3 domains for a Splunk Enterprise Security threat list? on Splunk Enterprise Security. 01-14-2016 05:25 PM
- Posted Does someone have an example that shows how to ignore 2 or 3 domains for a Splunk Enterprise Security threat list? on Splunk Enterprise Security. 01-14-2016 04:31 PM
- Tagged Does someone have an example that shows how to ignore 2 or 3 domains for a Splunk Enterprise Security threat list? on Splunk Enterprise Security. 01-14-2016 04:31 PM
- Tagged Does someone have an example that shows how to ignore 2 or 3 domains for a Splunk Enterprise Security threat list? on Splunk Enterprise Security. 01-14-2016 04:31 PM
- Tagged Does someone have an example that shows how to ignore 2 or 3 domains for a Splunk Enterprise Security threat list? on Splunk Enterprise Security. 01-14-2016 04:31 PM
- Posted Re: After upgrading Splunk Enterprise Security from 3.0.1 to 4.0.1, why does the "Notable Events by Urgency" dashboard display "No results found"? on Splunk Enterprise Security. 01-14-2016 04:26 PM
- Posted After upgrading Splunk Enterprise Security from 3.0.1 to 4.0.1, why does the "Notable Events by Urgency" dashboard display "No results found"? on Splunk Enterprise Security. 01-03-2016 09:20 PM
- Tagged After upgrading Splunk Enterprise Security from 3.0.1 to 4.0.1, why does the "Notable Events by Urgency" dashboard display "No results found"? on Splunk Enterprise Security. 01-03-2016 09:20 PM
- Tagged After upgrading Splunk Enterprise Security from 3.0.1 to 4.0.1, why does the "Notable Events by Urgency" dashboard display "No results found"? on Splunk Enterprise Security. 01-03-2016 09:20 PM
- Tagged After upgrading Splunk Enterprise Security from 3.0.1 to 4.0.1, why does the "Notable Events by Urgency" dashboard display "No results found"? on Splunk Enterprise Security. 01-03-2016 09:20 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 1 | |||
| 0 | |||
| 0 |
02-10-2016
08:07 PM
Thanks Jeremiah,
That works to extract the correct value into the field, but that damn comma still screws up the rest of the field values by throwing them off when they are extracted...for example, the File_Size field returns the User value and the Device_ID field returns the Domain value for affected records...
... View more
02-10-2016
07:12 PM
I think the problem here is that the offending comma doesn't actually populate in the extracted field so it's not able to be rex'd out - it's interpretered as a field separator.
To give a full example of a log entry:
2016-02-11 10:01:00,Minor,PC-Name,Continue, - Caller MD5=105202dad5dd174300xxxxxxxxxxxxxx,File Delete,Begin: 2016-02-11 10:01:00,End: 2016-02-11 10:02:00,Rule: Log files written to USB drives | [AC5-1.1] Log writing to USB drives,7100,C:/Program Files (x86)/Microsoft Office/Office14/EXCEL.EXE,0,No Module Name,D:/some_directory/somefile,somemore.xls,User: MrRobot,Domain: EvilCorp,Action Type: ,File size (bytes): 500000,Device ID: USBSTOR\Disk&Ven_Verbatim&Prod_&Rev_8.00\19120xxxxxxxxx&0
So we know that between Name, and ,User, it shouldn't matter how many commas appear - everything between those two identifiers should = filename.
... View more
02-10-2016
06:16 PM
No dice I'm afraid.
As stated in the question, I've already tried your Line 3 version to no avail. Just tried Line 2 but it doesn't remove those commas which results in other fields being polluted by false data from the field bleeds. Thanks for trying though 🙂
... View more
02-10-2016
05:34 PM
Will do, thanks!
... View more
02-10-2016
05:33 PM
1 Karma
Hi all,
We have a field in Splunk that is populated with filenames (e.g.)
G:/some_directory/somefile.txt
Everything works just fine unless users put a comma in as part of the filename:
G:/some_directory/somefile,somemore.txt
Is there a way to remove any commas in the field in question? I've tried the following with no luck:
sourcetype=somesource | rex mode=sed field=filename "s/,//" | table filename
thx!
... View more
01-21-2016
02:32 PM
We had the same issue - in the end we basically reinstalled:
Removed /opt/splunk
Installed Splunk Enterprise and configure (took about 30 minutes)
Installed Splunk ES 4.0.1 and configured (initial conf took about an hour, then a few days to get it just right)
When fresh, it worked without issue.
... View more
01-14-2016
05:25 PM
That sounds good to me - ideally you'd be able to configure granular ignore rules (like IGNORE if src_client=192.168.1.2 AND dst_domain=www.notsobad.com AND protocol=80/443) to override threat list entries as specifically as possible to ensure you don't miss out on relevant threat intel hits.
Not saying that threat list info is often wrong, but there are situations where you'd like to not be alerted to a specific scenario, but similarly you don't want to simply just ignore a domain or source completely.
Thanks,
S
... View more
01-14-2016
04:31 PM
So the threat lists that come with Splunk Enterprise Security are great, but sometimes we need to ignore a single domain.
The Configure Block Lists (http://docs.splunk.com/Documentation/ES/3.3.0/Install/Configureblocklists
) section in the Splunk docs describe the Ignore Regular Expression line for each threat list, but I was hoping that someone could provide an example that shows how to ignore two or three different domains (.e.g. good_domain1.com and good_domain2.com should be ignored).
Thanks!
... View more
01-14-2016
04:26 PM
Update: It seems as though our Splunk ES setup was not in a great working state, so we simply performed a fresh install of Enterprise followed by the latest ES and all is well.
This can be closed now.
... View more
01-03-2016
09:20 PM
Hi all,
Just upgraded Enterprise Security 3.0.1 to 4.0.1, all went well with the exception of one outstanding item. The Notable Events by Urgency dashboard listed under Security Posture remains unpopulated, listing No results found.
I know there are notable events there, as the remaining dashboards populate, and all events are listed under the Incident Review section.
Any suggestions as to where I should be looking to get this dashboard repopulated? I can't imagine it's a wait-to-fix scenario due to the upgrade as all the notable events are already there (and continuing to be created). Any tips much appreciated.
Thanks,
SB
... View more
