Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About staparia
staparia
Explorer
Member since:
01-21-2019
11-07-2021
Community Statistics
| Posts | 18 |
| Solutions | 0 |
| Karma Given | 2 |
| Karma Received | 0 |
| Member Since | 01-21-2019 |
Activity Feed
- Posted 1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number on Splunk Enterprise. 11-07-2021 11:51 AM
- Karma Re: Splunk unable to read specific files even though it can when started from the command line for bosburn_splunk. 09-07-2021 01:34 AM
- Karma Re: Search for the events with the same IP with two different field names from the two different index for richgalloway. 06-05-2020 12:50 AM
- Posted Re: how do i calculate the average of logs received from a sourcetype over last 30 days and compare FOR EACH SOURCETYPE if percentage of dip is more than 70% in last 24 hours when compared to average logs for that particular sourcetype on Splunk Enterprise Security. 02-06-2020 09:08 PM
- Posted Re: how do i calculate the average of logs received from a sourcetype over last 30 days and compare FOR EACH SOURCETYPE if percentage of dip is more than 70% in last 24 hours when compared to average logs for that particular sourcetype on Splunk Enterprise Security. 02-06-2020 08:40 PM
- Posted how do i calculate the average of logs received from a sourcetype over last 30 days and compare FOR EACH SOURCETYPE if percentage of dip is more than 70% in last 24 hours when compared to average logs for that particular sourcetype on Splunk Enterprise Security. 02-05-2020 12:15 AM
- Tagged how do i calculate the average of logs received from a sourcetype over last 30 days and compare FOR EACH SOURCETYPE if percentage of dip is more than 70% in last 24 hours when compared to average logs for that particular sourcetype on Splunk Enterprise Security. 02-05-2020 12:15 AM
- Tagged how do i calculate the average of logs received from a sourcetype over last 30 days and compare FOR EACH SOURCETYPE if percentage of dip is more than 70% in last 24 hours when compared to average logs for that particular sourcetype on Splunk Enterprise Security. 02-05-2020 12:15 AM
- Tagged how do i calculate the average of logs received from a sourcetype over last 30 days and compare FOR EACH SOURCETYPE if percentage of dip is more than 70% in last 24 hours when compared to average logs for that particular sourcetype on Splunk Enterprise Security. 02-05-2020 12:15 AM
- Tagged how do i calculate the average of logs received from a sourcetype over last 30 days and compare FOR EACH SOURCETYPE if percentage of dip is more than 70% in last 24 hours when compared to average logs for that particular sourcetype on Splunk Enterprise Security. 02-05-2020 12:15 AM
- Tagged how do i calculate the average of logs received from a sourcetype over last 30 days and compare FOR EACH SOURCETYPE if percentage of dip is more than 70% in last 24 hours when compared to average logs for that particular sourcetype on Splunk Enterprise Security. 02-05-2020 12:15 AM
- Posted how do i calculate the average of logs received from a sourcetype over last 30 days and then compare if percentage dip is is more than 70% in last 24 hours on Splunk Enterprise Security. 01-30-2020 12:12 PM
- Tagged how do i calculate the average of logs received from a sourcetype over last 30 days and then compare if percentage dip is is more than 70% in last 24 hours on Splunk Enterprise Security. 01-30-2020 12:12 PM
- Tagged how do i calculate the average of logs received from a sourcetype over last 30 days and then compare if percentage dip is is more than 70% in last 24 hours on Splunk Enterprise Security. 01-30-2020 12:12 PM
- Tagged how do i calculate the average of logs received from a sourcetype over last 30 days and then compare if percentage dip is is more than 70% in last 24 hours on Splunk Enterprise Security. 01-30-2020 12:12 PM
- Tagged how do i calculate the average of logs received from a sourcetype over last 30 days and then compare if percentage dip is is more than 70% in last 24 hours on Splunk Enterprise Security. 01-30-2020 12:12 PM
- Tagged how do i calculate the average of logs received from a sourcetype over last 30 days and then compare if percentage dip is is more than 70% in last 24 hours on Splunk Enterprise Security. 01-30-2020 12:12 PM
- Posted calculate the difference between current time and Last event time and then display the difference in days on Splunk Enterprise Security. 01-28-2020 08:58 PM
- Tagged calculate the difference between current time and Last event time and then display the difference in days on Splunk Enterprise Security. 01-28-2020 08:58 PM
- Tagged calculate the difference between current time and Last event time and then display the difference in days on Splunk Enterprise Security. 01-28-2020 08:58 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
11-07-2021
11:51 AM
Hi Guys, I am getting this error in splund.log ERROR TcpInputProc - Error encountered for connection from src=my_searchhead_ip:36786. error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number. Using Splunk 7.3.3 Enterprise version We are trying to send logs from one splunk instance (7.3.3) in one geography to another geography (Splunk enterprise security)over the internet. Splunk shows we have established a successful connection between 2 geographies, but data/logs are not getting sent. We assume that this is the error which is not letting us send the data from one instance to another over the internet. Any help would be very useful. let me know if you need more info on the same
... View more
Labels
- Labels:
-
using Splunk Enterprise
02-06-2020
09:08 PM
I like the concept.. the only thing which is varying is Event Count is less than days average.
Instead Event count should be number of logs received over a time (example- time picker lets say 30 days)
and Days_avg should be average of event count of 30 days divided by 30 (eventcount/30)
percentage change should be number of events received in last 24 hours should a dip of more than 70 percent when compared with Days_avg
... View more
02-06-2020
08:40 PM
@to4kawa Overage count of logs(events) received over a specific time
... View more
02-05-2020
12:15 AM
| metadata type=sourcetypes index=* group by index
| search sourcetype=*
| where lastTime < (now() - 86400)
| eval Duration=tostring(now() - lastTime,"duration")
| search Duration="*"
| fields sourcetype lastTime Duration
| sort - lastTime
| eval lastTime = strftime(lastTime,"%Y/%m/%d %H:%M" )
| rex field=Duration "(?(\d+))+"
... View more
01-30-2020
12:12 PM
how do i calculate the average of logs received from a sourcetype over last 30 days and then compare if percentage dip/drop is more than 70% in last 24 hours
... View more
01-28-2020
08:58 PM
I have the below query to calculate events not reporting for last 24 hours. I want to calculate the difference between current time and Last event time and then display the difference in days. This is the query i have. Somehow it diff field is empty. Please help
| metadata type=sourcetypes index=*
| search sourcetype!=*too_small
| where lastTime < (now() - 86400)
| convert ctime(lastTime) as Last_Time timeformat="%Y/%m/%d %H:%M" | eval diff=tostring(now() - Last_Time,"duration")
| fields sourcetype Last_Time diff
| sort -Last_Time
... View more
07-23-2019
08:27 PM
Done. Now request you to please help on tstats and datamodel query
... View more
07-23-2019
01:54 PM
@jawaharas Hey .. thanks this works. Hoever to further optimize this using tstats and datamodel..
I wrote the following query .. and it didnt work :
| tstats max(_time) AS _time summariesonly=t allow_old_summaries=t count from datamodel=Web.Web WHERE web.category="none"
| drop_dm_object_name("Web")
| search [| tstats max(_time) AS _time summariesonly=t allow_old_summaries=t count from datamodel=Web.Web WHERE web.category="Malicious Sources/Malnets" GROUPBY Web.dest
| drop_dm_object_name("Web") ]
| table dest
Could you please let me know .. where am i wrong in this one...
... View more
07-19-2019
05:20 AM
@richgalloway ,
@renjith.nair
thanks for responding. This didnt yield the result as expected.
I would want same URL/dest having categories="Malicious Sources/Malnets" and "none". Please note events with "Malicious Sources/Malnets" category will be a different log and events with "none" category will be a different event/log
... View more
07-17-2019
09:55 PM
thanks for responding. This didnt yield the result as expected.
I would want same URL/dest having categories="Malicious Sources/Malnets" and "none". Please note "Malicious Sources/Malnets" category will be a different log and "none" category will be a different event/log
... View more
07-17-2019
01:42 AM
Hi,
I would request a query where if a log source has stopped sending an event to splunk for a specific time period, it should alert me.
Example index=proxy sourcetype=test_5 not giving any result for last 15 mins.
... View more
07-17-2019
01:36 AM
Hi Guys,
Problem Statement : i would want to search the url events in index=proxy having category as "Malicious Sources/Malnets" for last 30 days. Also using the same url from the above result, i would want to search in index=proxy having category="none"
This is the query i thought of :
index=proxy category="none"
[| search index="proxy"
category="Malicious Sources/Malnets"
| stats values(cs_host) as dest] | stats count by dest
but it doesnt execute. Could you please help?
... View more
02-11-2019
09:15 PM
i did. didnt show the results as expected.
suppose index=proxy AND s_ip="some value"
index=ips AND d_ip="some value"
now i would seek raw logs with all the fields (containing both the indexes) matching the values of s_ip and d_ip
suppose if i enter 10.10.10.10 (be it s_ip or d_ip), it gives me results of all the logs present in the index -->proxy and index--> ips
... View more
01-21-2019
10:37 PM
(index=intrusion attack_signature=MS-Executable-File destination_port=80 direction=Outbound result_status=Inconclusive) OR (index=proxy x_exception_id!=IT-HotSpot-Denied AND cs_host!="testrating.webfilter.bluecoat.com" cs_host!="help.tower.shanhu99.com" cs_categories="none" url=*.php) | eval ip=coalesce(dest_ip, r_ip) | stats count by ip
It is giving me results of the values of the IP which is present in in both the indexes.. but not looking at the condition where i want dest_ip=r_ip
... View more
01-21-2019
07:36 AM
I would seek results wherein r_ip=dest_ip . Example r_ip=10.10.10.10 and dest_ip=10.10.10.10 . So i would want only those results when these two fields have same values
... View more
01-21-2019
06:51 AM
Hello,
i wanted all the events in such a manner where if dest_ip = 10.10.10.10 and r_ip = 10.10.10.10...
Both the values are same and matching
... View more
01-21-2019
06:48 AM
Hello, the stas query is giving me entire set of results. Whereas i wanted a query where if an IP 10.10.10.10 is involved --> it should return results in such a manner this particular IP (10.10.10.10) is present in both search queries ; that is
Query 1 --> (index=intrusion dest_ip=)
Query 2 --> (index=proxy r_ip=)
where r_ip and dest_ip = 10.10.10.10
... View more
01-21-2019
05:35 AM
(index = intrusion dest_ip) OR (index = proxy r_ip)
dest_ip should always be equal to r_ip
... View more
- Tags:
- match
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
11-07-2021
08:04 PM
|
