About Pete_Bassill

Pete_Bassill · ‎10-17-2010

Any chance you could expand on the error? I am planning on a small patch release next week which might help, I think your problem resides in a missing link in the navigation xml. Pete

Pete_Bassill · ‎10-17-2010

Hi Josh Thanks for that, I will take a look and get that fixed. Pete

Pete_Bassill · ‎09-10-2010

Awfully sorry, my mistake. The web user was only enables for 3 concurrent searches. I have sorted this now, so you should be able to log in and get the full dashboards. Let me know if you still have a problem. Pete

Pete_Bassill · ‎08-13-2010

Hi I have a simple sub search working for IP addresses, source="/var/log/iptables.log" [search source="/var/log/iptables.log" SRC!=192.168.* | top SRC limit=1 | fields SRC] Is that pipe before your sub string causing the issue?

Pete_Bassill · ‎08-13-2010

You could use | uniq | stats count in a time constrainted search

Pete_Bassill · ‎08-12-2010

Hi I had the same problem while at .conf#10. The timeout were certainly random and would only occur when I was working on my local vmware images. The issue would not happen on my production instance. How to fix it? I synced the time on the vmware servers to the same NTP server as my corporate splunk instance. It seemed in my case that a time skew of a just over a minute was causing the problem. Good luck, hope you find the fix soon. Pete -Splunk Ronin

Pete_Bassill · ‎08-11-2010

Afternoon. Are you at the Splunk user conf? If you are come and find me and I will walk you through it. If not, can you be more specific on the errors you are encountering? The vast majority of the rules are inline rules within the XML views. All but one of the XML views use the simple XML syntax so that they can be easily edited as required. The only expection to this is the amMap module, which is an implementation of the amMap application. You will need to install the geoip app too, it is important for the location lookups and the amMap relies on it. I am hoping to get some docs around the app produced soon. If you can provide more information, I will do my best to help. Pete

Pete_Bassill · ‎08-11-2010

Hey Justin The format should be pretty straight forward. The structure of the file: rpos (Risk Position, used for creating the top 10 risk categories) rdetail (The guts of the Risk entry within the register) rimpact - This is the Risk Impact on a scale of 1 (little impact) to 5 (heavy impact) rprob - This is Risk Probability or the likelyhood of the risk occuring, again 1 to 5 rval - This is the Risk Value, a multiple of rimpact and rprob. Below is a head of the log file. I tend to store this as a monitored file in /var/log/srisk. rpos,rdetail,rimpact,rprob,rval 1,"Legacy systems, unsupported software being highly vulnerable to attack",5,4,20 Hope that helps, enjoy the User Conference. Pete

Pete_Bassill · ‎05-25-2010

Hi I need to extract a splunk app file (.spl) created in v4.1.2 onto a non splunk machine (linux workstation) to carry out some debugging of an app. I have tried renaming the app name.tar.gz from name.spl but I get the following error: gzip: name.tar.gz: not in gzip format tar: This does not look like a tar archive tar: -: Not found in archive tar: Exiting with failure status due to previous errors Anyone have any ideas? Ok, so the plot thickens. A fresh extract of the app from my 4.1.2 splunk server using ./splunk package app pci gives me the correct pci.spl file but when I try to re-import, it get the error: Failed to extract files from Application - Is it in tar.gz format? Weird? Possible bug in 4.1.2? Ta

Pete_Bassill · ‎04-14-2010

Hi Without wanting to sound too basic, have you checked that /opt/splunk/etc/myinstall/splunkd.xml exists? I have seen this error occur when the package did not decompress properly. You may want to check the permissions on the files too? Pete

Pete_Bassill · ‎04-14-2010

How would I go about running a search that compares the output to two searches and reports the difference between the two outputs? To expand on this a little: Search 1: tag=pci source=/var/log/messages | top host limit=0 | fields host Search 2: tag=pci source=/var/log/messages Aide | top host limit=0 | fields hosts I want to report on hosts that are in Search 1 but not in Search 2. How would I do this?

Posts	11
Solutions	2
Karma Given	0
Karma Received	4
Member Since	‎04-13-2010

Online Status	Offline
Date Last Visited	‎06-05-2020 02:02 AM

Extract .spl file from Splunk v4.1.2

Diff of 2 searches

Re: Problems with PCI app configuration

Re: Info Box not updating with data

Re: PCI online demo

Re: sub-search search query

Re: How can I get a running total of distinct user...

Re: Browser session timing out quickly and inconsi...

Re: Install Problem

Re: How do you form the CSV file for the risk regi...

Extract .spl file from Splunk v4.1.2

Re: Error starting Splunk after installation: Erro...

Diff of 2 searches