Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About wgawhh5hbnht
wgawhh5hbnht
Communicator
Member since:
01-08-2019
06-21-2023
Community Statistics
| Posts | 57 |
| Solutions | 3 |
| Karma Given | 60 |
| Karma Received | 1 |
| Member Since | 01-08-2019 |
Activity Feed
- Posted Re: How can I use a variable from a lookup in a search? on Splunk Search. 06-21-2023 06:38 AM
- Karma Re: How can I use a variable from a lookup in a search? for isoutamo. 06-21-2023 06:38 AM
- Posted Re: How can I use a variable from a lookup in a search? on Splunk Search. 06-21-2023 06:22 AM
- Posted How can I use a variable from a lookup in a search? on Splunk Search. 06-21-2023 05:37 AM
- Posted Enterprise Security - Correlation Search - Notable - "default owner" missing users on Splunk Enterprise Security. 03-21-2023 07:32 AM
- Karma Re: Monitoring Console often shows multiple hosts as unknown for marend_umg. 05-05-2022 12:02 PM
- Posted Re: How to set up shared datamodels on Splunk Enterprise Security. 12-28-2021 06:19 AM
- Got Karma for How to set up shared datamodels. 12-23-2021 12:36 PM
- Posted Re: count for multiple fields with values after initial count with where clause on Splunk Enterprise. 10-06-2021 08:43 AM
- Karma Re: count for multiple fields with values after initial count with where clause for ITWhisperer. 10-06-2021 08:42 AM
- Posted Re: count for multiple fields with values after initial count with where clause on Splunk Enterprise. 10-06-2021 06:01 AM
- Karma Re: count for multiple fields with values after initial count with where clause for ITWhisperer. 10-06-2021 05:14 AM
- Posted count for multiple fields with values after initial count with where clause on Splunk Enterprise. 10-05-2021 12:19 PM
- Karma Re: Tuning ES to environment for gcusello. 08-31-2021 06:01 AM
- Posted Tuning ES to environment on Security. 08-31-2021 05:46 AM
- Posted Re: nullQueue not working on Getting Data In. 08-13-2021 05:58 AM
- Posted Re: nullQueue not working on Getting Data In. 08-12-2021 08:26 AM
- Posted Re: nullQueue not working on Getting Data In. 08-12-2021 07:01 AM
- Posted Re: nullQueue not working on Getting Data In. 08-12-2021 04:31 AM
- Posted Re: nullQueue not working on Getting Data In. 08-11-2021 12:21 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 0 |
06-21-2023
06:38 AM
That was it! Thank you for your help!
... View more
06-21-2023
06:22 AM
1. Thank you for the response. I'm getting the following error when using the map command: Unable to run query '(index=a "<REDACTED>") OR (index=b "<REDACTED>")' I don't see anything in the search.log that is causing errror and I've tried specifying fields for both variables. If I only search one index with one variable I get a similar error. SEARCH: | inputlookup "username2userid.csv" |search username=a
| table username, userid
| map search="index=a $userid$" ERROR: Unable to run query 'index=hyperion "<REDACTED>"' 2. I'm unsure what you mean by "Switch the order to reverse and use sub queries to get those username and userid". May I have an example please?
... View more
06-21-2023
05:37 AM
I have a lookup table that contains usernames and userids. I want to use this to match a username to userid & vice versa. I want to take the output from said lookup and search across multiple indexes for the username OR the userid. It would look ruffly something like this: |inputlookup username2userid.csv
| search username=a@a.com
| table username userid
| search (index=a $username$) OR (index=b $userid$) If I manually replace either variable with the actual values the search works. Is it not possible to pass a variable from a lookup into a search? Thank you in advance!
... View more
Labels
- Labels:
-
lookup
03-21-2023
07:32 AM
I'm attempting to auto-assign users to certain types of Notable events under "Default Owner". For some reason only 20/24 users are showing up as options. The users that are missing from the drop down have accounts with the same role as the other users and they have logged into Enterprise Security before.
... View more
Labels
12-28-2021
06:19 AM
Answering my own question after opening a case w/ support. To accomplish this you need to: 1) Yes, set the acceleration.source_guid on ES per data model you want to accelerate. Don't do this in the [default] as there will be data models specific to only ES. 2) For me, these changes reside in "splunk/etc/apps/Splunk_SA_CIM/default/datamodels.conf" because the deployer is pushing them out to the cluster. 3) Didn't get an answer to this one. Additionally, if you add additional fields in the SHC, they won't show up in the ES data models because the data model json doesn't update. On one of the SHC you will need to manually copy .json datamodel file you made a change to (/opt/splunk/etc/apps/Splunk_SA_CIM/local/data/model/) and move that over to ES. You can't use the deployer for this natively as the deployer doesn't update the .json files. If you wanted to a custom app would.
... View more
10-06-2021
08:43 AM
Thank you for the explanation, that makes sense! Much appreciated!!!
... View more
10-06-2021
06:01 AM
Thank you @ITWhisperer! This is exactly what I was attempting to do! What does the "!" do in this eval commands? | eval DescriptionCount = DescriptionCount."!".Description The docs only show it being used for !=, nothing else is coming up when I search, and when I run it by itself then I get the count before the Description with a ! between, e.g.: 4!Success & then later it appears as though you're removing the ! with the mvindex? I'm very confused on how you got this to work
... View more
10-05-2021
12:19 PM
I'm attempting to get a count for multiple fields Description and ActionDescription with the values for them AFTER counting by another field with a where clause over a period of time. This is what I'm wanting: UserName Description DescriptionCount ActionDescription ActionDescriptionCount Count _time Andy SSO Send to home update password 1 1 1 1 Sign in Sign in successful 1 1 4 10/5/2021 15:00 Bob Authentication Successful Sending to SecondFactor Sent token via SMS Successfully Authorized 1 2 1 3 1 Sign in Sign in successful Sign in failed 1 1 2 8 10/5/2021 17:00 This is the closest I've got but there are times where either the DescriptionCount or ActionDescriptionCount has missed a count for the Description or the ActionDescription: index=foo source=bar | bin _time span=1h | fillnull value="0" | eventstats count by UserName _time | where count > 500 | rename count as UserNameCount | eventstats count by Description | rename count as DescriptionCount | eventstats count by ActionDescription | rename count as ActionDescriptionCount | stats values(ActionDescription) as ActionDescriptionValues values(ActionDescriptionCount) as ActionDescriptionCount values(Description) as Description values(DescriptionCount) as DescriptionCount values(_time) as "Time Frame(s)" count by UserName | convert ctime("Time Frame(s)")
... View more
08-31-2021
05:46 AM
How are you tuning ES to your environment? Are you overwriting the correlation searches that ship with ES or are you making copies of them and modifying the copies? When there is an update for ES, are you having to go correlation search by correlation search, line by line to comparing them to see what changed? What about ES Content Updates?
... View more
Labels
- Labels:
-
other
08-13-2021
05:58 AM
Neither [source://lsof] nor [script://./bin/lsof.sh] worked either. After pushing the cluster I also did a rolling restart to make sure, still getting both splunk user & splunkd command logs.
... View more
08-12-2021
08:26 AM
updated props, same outcome. [lsof] TRANSFORMS-null = null_splunk_user, null_splunk_command, null_splunk, lsof_normal_queue
... View more
08-12-2021
07:01 AM
Updated my props and transforms (see below) and restarted splunk service on indexers and still getting events from splunk (user) and splunkd (command). props.conf: [lsof] TRANSFORMS-null = lsof_normal_queue, null_splunk_user, null_splunk_command, null_splunk transforms.conf: [null_splunk_user] REGEX = (?m)^\S+\W+\d+\W+splunk\W+ DEST_KEY = queue FORMAT = nullQueue [null_splunk_command] REGEX = (?m)^splunkd\W+\d+\W+splunk DEST_KEY = queue FORMAT = nullQueue [null_splunk] REGEX = (?m)^splunkd DEST_KEY = queue FORMAT = nullQueue [lsof_normal_queue] REGEX = . DEST_KEY = queue FORMAT = indexQueue
... View more
08-12-2021
04:31 AM
Regulations require that we monitor and alert on all activity on our splunk environment, including the indexers. Since we run splunk on linux, Splunk_TA_nix was the solution we came up with. We're getting the data in but now unfortunately we're over our license. I'm attempting to drop some events (noise) just to get us down below our license. I'm not finding anything on how to filter cooked data, or for that fact why the data is cooked on the indexer. Maybe you could help me out and to make sure we're on the same page. The inputs.conf is on splunkindexer01, as well as the props.conf and the transforms.conf. Shouldn't the data that is being ingested on splunkindexer01 go through the normal filtering process before it is sent to the index cluster? All the other props and transforms are working, why not the nullQueue?
... View more
08-11-2021
12:21 PM
the data is from the indexer cluster and it is being set to that same index cluster.
... View more
08-11-2021
07:20 AM
Here is my setup. inputs.conf: [script://./bin/lsof.sh] interval = 600 sourcetype = lsof source = lsof props.conf: [script://./bin/lsof.sh] #also tried[lsof] & [source::lsof] TRANSFORMS-null = null_splunk_user, null_splunk_command, null_splunk, lsof_normal_queue transforms.conf: [null_splunk_user] REGEX = ^\S+\W+\d+\W+splunk\W+ DEST_KEY = queue FORMAT = nullQueue [null_splunk_command] REGEX = ^splunkd\W+\d+\W+splunk DEST_KEY = queue FORMAT = nullQueue [null_splunk] REGEX = ^splunkd DEST_KEY = queue FORMAT = nullQueue [lsof_normal_queue] REGEX = . DEST_KEY = queue FORMAT = indexQueue sample of data: splunkd 52507 splunk cwd DIR 202,1 4096 2 / splunkd 52507 splunk rtd DIR 202,1 4096 2 / splunkd 52507 splunk txt REG 202,1 76073192 409182 /opt/splunk/bin/splunkd python2.7 53347 splunk cwd DIR 202,1 4096 2 / splunk 53347 splunk rtd DIR 202,1 4096 2 / splunk 53347 splunk txt REG 202,1 577688 411002 /opt/splunk/bin/splunk splunkd 887 root cwd DIR 259,1 4096 2 / splunkd 887 root rtd DIR 259,1 4096 2 / splunkd 887 root txt REG 259,1 76073192 401488 /opt/splunk/bin/splunkd On the indexer you can see that the props & transforms rules: /opt/splunk/bin/splunk cmd btool props list --debug | grep lsof /opt/splunk/etc/slave-apps/Splunk_TA_nix/local/props.conf [lsof] /opt/splunk/bin/splunk cmd btool transforms list --debug | grep null_splunk /opt/splunk/etc/slave-apps/Splunk_TA_nix/local/transforms.conf [null_splunk] /opt/splunk/etc/slave-apps/Splunk_TA_nix/local/transforms.conf [null_splunk_command] /opt/splunk/etc/slave-apps/Splunk_TA_nix/local/transforms.conf [null_splunk_user] /opt/splunk/etc/slave-apps/Splunk_TA_nix/local/transforms.conf [lsof_normal_queue] I've tried multiple iterations of regexes/props/transforms. I've been restarting the index clusters after each update to no avail. The majority of the data I'm attempting to drop is on the indexers themselves, splunk monitoring splunk.
... View more
Labels
- Labels:
-
props.conf
-
transforms.conf
06-16-2021
06:02 AM
You're correct @gjanders , the empty directories got me. Thank you for your help. Those looking for the doc: https://docs.splunk.com/Documentation/Splunk/8.2.0/Indexer/IndexerclusteroperationsandSmartStore For example, if the cluster has a replication factor of 3, three peer nodes continue to maintain metadata information, along with populated or empty directories, for each bucket. By maintaining metadata for each bucket on the replication factor number of peer nodes, the cluster simplifies the process of fetching the bucket when it is needed, in the case of any interim peer node failure.
... View more
06-14-2021
12:06 PM
There isn't a way to set RF for different buckets, right? e.g. hot RF 2, cold no RF We're using smartstore, therefor S3 is handling cold bucket replication and it would drastically reduce the storage cost if we could only have RF for hot buckets. I've see this post, but it's been a few years.
... View more
Labels
09-04-2020
09:12 AM
What's everyone doing for collecting both Windows Event Logs & Sysmon? Are you collecting all Even IDs or only a small subset? What Sysmon config are you using? Have you tuned it to your environment or just using something like SwiftOnSecurity's Sysmon config? I ask because our Windows license has grown from ~120G to ~250G and I need to reduce our license but don't want to miss anything.
... View more
Labels
- Labels:
-
Windows
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-21-2023
09:58 AM
|
Karma given to
