Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About darkwall
darkwall
New Member
Member since:
01-28-2019
06-05-2020
Community Statistics
| Posts | 10 |
| Solutions | 0 |
| Karma Given | 0 |
| Karma Received | 0 |
| Member Since | 01-28-2019 |
Activity Feed
- Posted Re: Tonight i got a new host appear by mistake... on Getting Data In. 10-16-2019 11:55 AM
- Posted Tonight i got a new host appear by mistake... on Getting Data In. 10-16-2019 06:48 AM
- Tagged Tonight i got a new host appear by mistake... on Getting Data In. 10-16-2019 06:48 AM
- Tagged Tonight i got a new host appear by mistake... on Getting Data In. 10-16-2019 06:48 AM
- Posted Estreamer index goes into main how to change it... on All Apps and Add-ons. 06-12-2019 05:54 AM
- Tagged Estreamer index goes into main how to change it... on All Apps and Add-ons. 06-12-2019 05:54 AM
- Tagged Estreamer index goes into main how to change it... on All Apps and Add-ons. 06-12-2019 05:54 AM
- Posted Re: Splunk host shows the hostname of my Syslog server instead of the real hostname from the ASA on All Apps and Add-ons. 06-11-2019 10:20 AM
- Posted Splunk host shows the hostname of my Syslog server instead of the real hostname from the ASA on All Apps and Add-ons. 06-11-2019 06:03 AM
- Tagged Splunk host shows the hostname of my Syslog server instead of the real hostname from the ASA on All Apps and Add-ons. 06-11-2019 06:03 AM
- Tagged Splunk host shows the hostname of my Syslog server instead of the real hostname from the ASA on All Apps and Add-ons. 06-11-2019 06:03 AM
- Tagged Splunk host shows the hostname of my Syslog server instead of the real hostname from the ASA on All Apps and Add-ons. 06-11-2019 06:03 AM
- Tagged Splunk host shows the hostname of my Syslog server instead of the real hostname from the ASA on All Apps and Add-ons. 06-11-2019 06:03 AM
- Posted Re: How can i parse syslog barracuda email security gateway in splunk 7.2 Barracuda Spam/Virus Firewall Add-onsupport 6.5... on All Apps and Add-ons. 03-14-2019 11:52 AM
- Posted Re: How can i parse syslog barracuda email security gateway in splunk 7.2 Barracuda Spam/Virus Firewall Add-onsupport 6.5... on All Apps and Add-ons. 02-13-2019 11:15 AM
- Posted Re: How can i parse syslog barracuda email security gateway in splunk 7.2 Barracuda Spam/Virus Firewall Add-onsupport 6.5... on All Apps and Add-ons. 02-12-2019 10:25 AM
- Posted How can i parse syslog barracuda email security gateway in splunk 7.2 Barracuda Spam/Virus Firewall Add-onsupport 6.5... on All Apps and Add-ons. 02-12-2019 08:18 AM
- Tagged How can i parse syslog barracuda email security gateway in splunk 7.2 Barracuda Spam/Virus Firewall Add-onsupport 6.5... on All Apps and Add-ons. 02-12-2019 08:18 AM
- Tagged How can i parse syslog barracuda email security gateway in splunk 7.2 Barracuda Spam/Virus Firewall Add-onsupport 6.5... on All Apps and Add-ons. 02-12-2019 08:18 AM
- Tagged How can i parse syslog barracuda email security gateway in splunk 7.2 Barracuda Spam/Virus Firewall Add-onsupport 6.5... on All Apps and Add-ons. 02-12-2019 08:18 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
10-16-2019
11:55 AM
If i try to delete another host everything work fine. But not this one.
And if a make a search with that host nothing show . When I go in the summary from the splunk at the date and time the events occured it won't show up for some reason.
I think that issue and the delete of the is related.
Thanks
... View more
10-16-2019
06:48 AM
here is the host but when i try to search for it nothing...
host="\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x"
How i can delete that kind i stufff when i try this
host="\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x" | delete
nothing is delete...????????
... View more
06-12-2019
05:54 AM
Hi,
By default if we do nothing eStreamer eNcore data and information goes directly into the main index
How can i change that in a cluster environnement.
Thanks
... View more
06-11-2019
10:20 AM
Hi Giuseppe,
Thank for your quick answer... after reading the docuement.
Yes i need to read the host in the logs after checking the links that you send me everything looks fine now
create/modify transforms.conf and props.conf the make it work.
Thanks a lot...
DarkWall
... View more
06-11-2019
06:03 AM
The host shows the hostname of my Syslog server instead of the real hostname from the ASA.
When I try keephostname(yes) in syslog0ng nothing changes...
I try the hostsegment=4 No difference.
Any help would be appreciated.
Inputs.conf in /opt/spl.../etc/system/local.conf
[default]
host = XXXXXSYSLOG
[monitor:///var/log/splunk/barracuda.log}
sourcetype=barracuda:spamfw
index = barracuda
[monitor:///var/log/splunk/asa.log}
sourcetype = cisco:asa
index = asa
**host_segment = 4**
SYSLOG-NG Config
options {
flush_lines(100);
time_reopen(10);
log_fifo_size(1000);
chain_hostnames(yes);
use_dns(no);
use_fqdn(yes);g
create_dirs(yes);
keep_hostname(yes);
threaded(yes);
};
Thank you.
... View more
03-14-2019
11:52 AM
Hi Mussab
In fact some of the feature work but when i try to check the field REASON and ACTION didn't work only REASON_ID and ACTION_ID work So it's look the transform.conf did not work so What i've done is to create a custom app to make it work like I want.
The field REASON and ACTION dont work at all
In fact it's look like the transform.conf not working everything else look fine.
With the custom appp i can make it work.
Thanks
... View more
02-13-2019
11:15 AM
Hi I've tested the add-on and it works but not all the field are extrated some field like reason code, Barracuda process, info, etc...
Thanks
... View more
02-12-2019
10:25 AM
I've got no error on the installation of the add-on and it's look like everything work fine for now.
I'll monitore for the next few days and will see.
Thanks
... View more
02-12-2019
08:18 AM
How can i parse syslog barracuda email security gateway in splunk 7.2
The Barracuda Spam/Virus Firewall Add-on support Splunk Versions: 6.5, 6.4, 6.3, 6.2 Is there an other APPS/ADD-on?
Or any how to that will help us will be great?
Thanks
... View more
02-01-2019
07:50 AM
Cisco network apps version 2.5.6 default dashboard don't work anymore in historical mode but in real-time mode everything work fine after an update to 2.5.6 I install TA-Cisco version 2.5.4...
When I hit inspect search i got an error messages.. here is the information provide...
This search has completed in 9.419 seconds, but did not match any events. The terms specified in the highlighted portion of the search:
None | tstats values(nodename) AS nodename count FROM datamodel=Cisco_IOS_Event WHERE Cisco_IOS_Event.product IN (IOS) index IN (*) BY host index
over the time range:
31/01/2019 10:00:00.000 - 01/02/2019 10:22:18.000
did not return any data. Possible solutions are to:
relax the primary search criteria
widen the time range of the search
check that the default search indexes for your account include the desired indexes
In the search none is highlight...
Any help would be appreciate
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:04 AM
|
