Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- About adalbor
adalbor
Builder
Member since:
01-29-2019
02-25-2022
Community Statistics
| Posts | 172 |
| Solutions | 14 |
| Karma Given | 74 |
| Karma Received | 17 |
| Member Since | 01-29-2019 |
Activity Feed
- Got Karma for Re: Proofpoint Email Security Add-On: Issues with dashboard population and extractions. 01-09-2023 06:38 AM
- Got Karma for Proofpoint Email Security Add-On: Issues with dashboard population and extractions. 01-09-2023 05:52 AM
- Got Karma for Errors with Rapid7 InsightVM TA. 02-24-2022 06:08 PM
- Got Karma for Re: Microsoft Office 365 Reporting Add-on for Splunk is affected by stop supporting and retire Basic Authentication for. 01-18-2022 06:37 AM
- Karma Re: How to configure Splunk to extract XML fields from Windows security event 4698? for krishnarajapant. 07-12-2021 10:41 AM
- Posted Errors with Rapid7 InsightVM TA on All Apps and Add-ons. 06-15-2021 09:00 AM
- Karma Re: Splunk Add-on for Microsoft Cloud Services vs Microsoft Azure Add on for Splunk for grobendg. 06-14-2021 05:45 AM
- Karma Re: Splunk Add-on for Microsoft Cloud Services vs Microsoft Azure Add on for Splunk for venkatasri. 06-11-2021 11:18 AM
- Posted Re: Splunk Add-on for Microsoft Cloud Services vs Microsoft Azure Add on for Splunk on All Apps and Add-ons. 06-11-2021 11:15 AM
- Posted Splunk Add-on for Microsoft Cloud Services vs Microsoft Azure Add on for Splunk on All Apps and Add-ons. 06-10-2021 10:53 AM
- Posted Re: Splunk Logs to Azure Blob Storage on Getting Data In. 05-19-2021 10:20 AM
- Posted Re: Windows Eventlog field suppression in 8.1.1 on Getting Data In. 04-29-2021 06:45 AM
- Posted Windows Eventlog field suppression in 8.1.1 on Getting Data In. 04-29-2021 06:34 AM
- Karma Re: O365 message tracking logs for J_lo. 02-02-2021 07:58 AM
- Karma Re: ERROR lookup minemeldfeeds for scelikok. 02-01-2021 11:54 AM
- Karma Re: Splunk Permission Error for nickhills. 12-15-2020 11:23 AM
- Posted Calculate Bucket Thaw Time on Splunk Search. 12-15-2020 10:25 AM
- Posted Re: Ingesting logs from Microsoft Teams on All Apps and Add-ons. 12-15-2020 10:12 AM
- Got Karma for Re: Upgrade from 7.3.7 to 8.0.6. 10-08-2020 06:18 AM
- Got Karma for Upgrade from 7.3.7 to 8.0.6. 10-08-2020 06:18 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 1 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
11-12-2019
05:50 AM
That doesn't answer my question. Was looking for a script or an app that would allow me to list my available frozen indices and the date/timestamp in a human readable format. Something that would make validating the indices and thawing them easier.
... View more
11-11-2019
10:29 AM
Is there an app/script/mechanism out there that would allow you to list your available frozen indices by their human readable date/timestamps and allow you to move them back to thawed state and rebuild?
Thanks!
... View more
10-25-2019
07:52 AM
Thanks for the advice @gaurav_maniar. It spurred a thought process to check our proxy.
It was blocking the calls to the Dropbox API. Everything is working now, thanks!
... View more
10-24-2019
06:48 AM
Yeah its not a role issue, has to do with the fact that if you are using anything other than basic (insecure) auth it doesn't work.
... View more
10-24-2019
06:47 AM
Bumping the post
... View more
10-21-2019
10:24 AM
Hey All,
We have been experiencing issues with latency concerning Windows events being processed/indexed in Splunk.
After numerous escalations and calls with support they suggested we enable the below suppression settings in our inputs.conf to boost thruput and performance.
suppress_checkpoint = true
suppress_sourcename=true
suppress_keywords=true
suppress_type=true
suppress_task=true
suppress_opcode=true
suppress_text=true
It worked great to boost thruput but after awhile we noticed that field extractions stopped working for quite a bit of hosts.
Has anyone else enabled these settings and seen the same issue with extractions?
... View more
10-18-2019
07:48 AM
Appreciate the info but that unfortunately only gives me a rough starting point. I wouldn't even know where to begin to fetch that info. Was hoping there was an API out there or something easier.
... View more
10-17-2019
10:54 AM
I recently setup the Splunk App for Dropbox on a HF in our environment.
I saved the Oauth token and configured the index as needed on my indexer cluster.
I am seeing this error in the _internal logs for that app though and no data is being populated.
10-17-2019 12:41:50.271 -0500 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/splunk-app-dropbox/bin/dfb.py" ValueError: No JSON object could be decoded
Any suggestions to resolve?
... View more
10-10-2019
08:54 AM
1 Karma
If you have the app installed on a HF like us, you will need to push a copy of the indexes.conf out to them also.
This ensures that in any apps that use a dropdown for your indexes, it will populate with a list of all your indexes.
We actually have two indexes.conf, one we push only to our IDX's (in case IDX specific settings need to be there) then one copy we push to our HF's.
... View more
Hey All,
Kind of an off the wall question here. Does anyone know of an API or a way to query our Splunk support portal accounts to pull ticket information? Would love to be able to create a dashboard on-prem detailing open tickets, then if possible pull open/close timestamps and overlay that onto a visualization showing potential event drops during the time span of the case being open.
Thanks,
Andrew
... View more
09-18-2019
08:51 AM
Thanks for the info jconger but the issue resides with the fact that if you use conditional access policies or any other proper security controls, you are unable to access your message tracking logs via this add-on.
There needs to be a better way to access this while still being able to secure your environment.
... View more
09-17-2019
10:29 AM
In the table command? Or for the time picker?
This is what I have right now.
Proofpoint Email Search
Search by sender, recipient, subject or rule name.
<input type="time" searchWhenChanged="true">
<label>Select a time:</label>
<default>Last 24 hours</default>
</input>
<input type="text" token="from" searchWhenChanged="true">
<label>Sender:</label>
<default>*</default>
</input>
<input type="text" token="to" searchWhenChanged="true">
<label>Recipient:</label>
<default>*</default>
</input>
<input type="text" token="subject" searchWhenChanged="true">
<label>Subject:</label>
<default>*</default>
</input>
<input type="text" token="rule" searchWhenChanged="true">
<label>Rule:</label>
<default>*</default>
</input>
<panel>
<table>
<title>Emails</title>
<search>
<query>index=proofpoint | transaction message_session_id | search from=$from$ to=$to$ rule=$rule$ subject=$subject$ | table _time from to subject file_name rule</query>
<earliest>$earliest$</earliest>
<latest>$latest$</latest>
</search>
<option name="count">25</option>
<option name="refresh.display">progressbar</option>
<option name="rowNumbers">true</option>
</table>
</panel>
... View more
09-17-2019
10:04 AM
Tried tabling with _time but that didn't work either. It exhibited odd behavior and when I did a 15 min search it returned right results. If I did a 60 min search for some reason it wouldn't return the most recent few mins of results but all the results after around 10 mins and then some
... View more
09-06-2019
08:20 AM
I understand on a large data set it would be slow but on the time ranges I am using it is actually pretty quick.
I am using transaction as Proofpoint creates multiple events for a single email being processed so you could end up with 10 events relating to the processing of a single email.
If I run the search operators before my transaction command it doesn't return any data when testing with * searches hence why I placed my search later on.
... View more
09-06-2019
07:34 AM
Hey all,
I am working on a dashboard to do a basic email search through Proofpoint logs and am using the transaction command to stitch together the events with the same message_session_id.
The query currently looks like this: index=proofpoint | transaction message_session_id | search from=$from$ to=$to$ rule=$rule$ subject=$subject$ | table from to subject file_name rule
My question is how would I table the time of the first event as a time column?
If I just run: index=proofpoint | transaction message_session_id it appears that it is just grabbing that first events timestamp and using that as the time.
Thanks!
Andrew
... View more
08-21-2019
05:55 AM
Bumping the post
... View more
08-19-2019
07:12 AM
Hey All,
Our Splunk environment is deployed in the Azure cloud as an "on-prem" installation and we are trying to use blob storage as our cold storage. We were able to mount the blob storage using blobfuse and the associated libs. We setup our indexers to mount the storage on boot to ensure we always have access to the storage. We also setup a SSD temp location required by blob for write of the cold index before its put on blob. After all of this setup I created a test index and specified the required locations in indexes.conf for this temp mount which will then write to blob. After setup I did see Splunk write the colddb directory and the index directory underneath that.
The question I have surrounds the index/filesystem validation splunk performs on service start/restart. I know it uses the locktest utility as specified in this document https://docs.splunk.com/Documentation/Splunk/7.3.1/Troubleshooting/FSLockingIssues
I don't really feel comfortable totally disabling the filesystem check all together. What confuses me is how Splunk can write the directories with no issues proving the filesystem is ok but then fail on this check. Anyone have any insight in how this utility works?
The temp mount we write to is a splunk approved filesystem (xfs).
Just trying to figure out if its possibly to not fully disable this filesystem check while continuing to use our setup for cold storage.
Thanks,
Andrew
... View more
08-16-2019
08:58 AM
I ended up using this and it worked....for the most part lol. We still have some events matching this blacklist coming in but we saw a reduction from 76mil events to right over 2mil events.
blacklist7 = EventCode="4674" Message=".*[\S\s]*Account\sName:\s:.+ACCOUNT.+Process\sName:.+\Windows\SysWOW64\wbem\WmiPrvSE.exe|.+\Windows\System32\wbem\WmiPrvSE.exe"
... View more
08-13-2019
01:27 PM
So if we wanted to deploy to the HF's we would just use the default paths then?
... View more
08-13-2019
12:27 PM
1 Karma
Hey All,
I have a question surrounding the best way to deploy the indexes.conf in our environment.
We currently have our indexes.conf deployed to our indexers, heavy forwarders, and ES. We deploy to our HF's as we have different data inputs on them and need the index information there for the config options to show in the GUI.
Today I setup a cold path that only the indexers have access to and deployed the new indexes.conf with that path specified to everything. Upon doing that the Splunk service complained about the path not existing on the HF's and wouldn't start back up during its initial check.
Whats the best way to ensure the HF's get the indexes.conf without running into the path issue? Once I configure the cold path for all of our indexes it will throw the same error message.
We manage all of this through server classes on our deployment server. The indexes.conf is in its own app that is assigned to server classes for the indexers, HF's and ES box.
Thanks,
Andrew
... View more
08-13-2019
07:33 AM
Opened a ticket with support as I am unsure why I can't get this to work. The first regex they suggested which also matched in a regex editor didn't work either. Still searching for a solution
... View more
08-08-2019
06:30 AM
Thanks for the help Jacob but there are some issues with your regex statements.
Yes I have my blacklists setup sequentially in the inputs.conf. I was also using examples from the Splunk_TA_windows inputs.conf.
The first one says it should be both processes which it technically should be one of the two.
Your second one puts an OR in between the account name and the process name which wouldn't work either.
I just tried the below without capture groups:
blacklist7 = EventCode="4674" Message="Account Name:.+slwprdadmin.+Process Name:.+\Windows\SysWOW64\wbem\WmiPrvSE.exe|.+\Windows\System32\wbem\WmiPrvSE.exe"
Still doesn't work
I have these other blacklists that work fine so this doesn't make any sense to me.
blacklist5 = EventCode="4688" Message="(?:New Process Name:).+(?:SplunkUniversalForwarder\bin\splunk.exe)|.+(?:SplunkUniversalForwarder\bin\splunkd.exe)|.+(?:SplunkUniversalForwarder\bin\btool.exe)|.+(?:Splunk\bin\splunk.exe)|.+(?:Splunk\bin\splunkd.exe)|.+(?:Splunk\bin\btool.exe)|.+(?:Agent\MonitoringHost.exe)"
... View more
08-07-2019
12:39 PM
This by all knowledge appears it should work but it doesnt. Any ideas?
blacklist7 = EventCode="4674" Message="(?:Account Name:.+ACCOUNT).+(?:Process Name:).+(?:\Windows\SysWOW64\wbem\WmiPrvSE.exe)|.+(?:\Windows\System32\wbem\WmiPrvSE.exe)"
This matches most of the message in 2 regex tools.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
02-25-2022
07:48 AM
|
Karma from
Karma given to
