About ysouchon

ysouchon · ‎07-28-2014

Sorry to tell you, but it seems your answer doesn't work. The timestamp is still wrong (index time)...

ysouchon · ‎07-28-2014

Between McAfee inputs problems (http://answers.splunk.com/answers/147469/mcafee-ta-20-inputs-issues), and that problem, I'm worry if Splunk did QA testing before the release Entreprise Security 3.1 ?!? It seems Splunk did not !

ysouchon · ‎07-03-2012

I played a lot with Checkpoint integration....and to be honest, it does NOT work at all !!! Even Splunk says that they support OPSEC LEA for Checkpoint, it's wrong. More than 2 years they haven't updated anything. Loggrabber is old and nobody maintains it. If I can recommend you something and if you have a enterprise license, please ask and ask Splunk support about Checkpoint integration....maybe one day they will do something. Good luck !

ysouchon · ‎07-03-2012

I'm not sure if I understood your question, but you should try something like : sourcetype=srctype3 | join [ search sourcetype=srctype1 OR sourcetyp=srctype2 dstIP=1.1.1.1 OR dstIP=2.2.2.2 | fields + srcIP dstIP | stats count by srcIP ] | fields + Hostname | stats count by srcIP Hostname And see what you get. Let me know if it helps you.

ysouchon · ‎06-20-2012

Via inputs.conf (local): current_only = 1 or Via wmi.conf (remote) : current_only = 1

ysouchon · ‎12-09-2011

Do you know if Splunk supports event subscriptions ? It's a new feature on Windows 7 and Windows 2008 R2. It helps to centralize event logs from different Windows servers on one server. http://technet.microsoft.com/en-us/library/cc749183.aspx

ysouchon · ‎09-28-2011

Hi Josh, I have the same troubles than you. After a quick look, I think I found the mistake : File get_ips_feed.py : [...] 58 while 1: 59 try: 60 sdee.get() 61 except: [...] I do not know why, but the loop runs forever, there is no exit / break into this loop. We should ask Splunk why....maybe it's a bug. A quick and dirty fix, add a break at the end of the loop : 167 ### Commen/Uncomment to write to stdout 168 # print syslog_msg +"\n" 169 break It seems to work for me. Do not forget to change the "interval" option to 60 for example. Let me know if it works for you too.

ysouchon · ‎11-25-2010

Hello, I know quite good Splunk, at least the basic concepts. I have recently created a dashboard with few panels based on summary index searches. This dashboard helps me to get charts about a bunch of servers. Because I have different group of servers around the world, I would like to generate the same kind of dashboards, but based on different servers. It takes time to create all searches, and then the related dashboard. What is the best way to do the same for other group of servers ? Do I need to create everything manually ? Or does Splunk have another way based on templates to do the same ? I wish I can create a dashboard template and call it with several parameters (like the name of the other group of servers for example) to generate my dashboard. Thanks in advance for helping me to find the right way. Yann

Posts	8
Solutions	1
Karma Given	0
Karma Received	1
Member Since	‎11-25-2010

Online Status	Offline
Date Last Visited	‎06-05-2020 02:02 AM

Windows 2008 R2 event subscriptions

Dashboard templates

Re: McAfee TA 2.0 inputs issues

Re: ES3.1 install

Re: Checkpoint R75.40 and OPSEC LEA

Re: Search result as input to another search

Re: Universal Forwarder - Start collection without...

Windows 2008 R2 event subscriptions

Re: Splunk for Cisco IPS - connects to IPS every s...

Dashboard templates