About andresito123

andresito123 · ‎03-08-2021

Ok, it seems that the issue is the incorrect timestamp as you mentioned. Thank you!

andresito123 · ‎03-08-2021

Hello Splunkers! I have set up a DNS analytical logging on a windows 2012 R2 server with the following configuration: [WinEventLog://Microsoft-Windows-DNSServer/Audit] sourcetype = MSAD:NT6:DNS disabled = 0 index = test start_from = oldest current_only = 0 evt_resolve_ad_obj = 1 checkpointInterval = 5 renderXml = false When I search the _internal logs, I do not see any errors but I get the following logs: 03-08-2021 12:26:25.609 +0200 INFO Metrics - group=per_sourcetype_thruput, series="msad:nt6:dns", kbps=0.029, eps=0.129, kb=0.908, ev=4, avg_age=1.000, max_age=1 However, I do not receive any logs for this sourcetype. Are there any clues why I cant see these logs?

andresito123 · ‎02-05-2021

Hello, Have you performed this workaround? It has worked? Thanks.

andresito123 · ‎01-06-2021

I see in inputs.conf of TA-mailclient the following option: **additional_folders** - This is an optional parameter containing a comma-separated list of additional folders to be indexed if IMAP is configured for the mailbox. Can I use this parameter and index only the folder, and not the (folder+root) as it is implied above? Thanks.

andresito123 · ‎04-30-2020

@codebuilder the majority are windows event logs, any ideas on how to archive them?

andresito123 · ‎04-27-2020

ok thanks, those workarounds make sense!

andresito123 · ‎04-24-2020

I have inherited a Splunk installation from the previous administrator where there is a heavy forwarder and a UF installed on the same machine. Since this is a bad practice in terms of performance, I am planning to remove the UF and copy the relevant inputs files to the Splunk Enterprise instance (which acts as a heavy forwarder). How can I avoid re-indexing the same logs when copying the inputs configuration from the HF to the UF (mainly Windows Events)? Thanks.

andresito123 · ‎03-30-2020

Thank you.

andresito123 · ‎03-30-2020

Hello, I have taken over a Splunk infrastructure from a colleague of mine, and I would like to verify that I have the current cluster key in my possession before the upgrade. Is there any light, non intrusive command (requiring authentication) that I can run and verify that I have the correct security key? Thanks.

andresito123 · ‎03-25-2020

No, in my initial question I have included information from props.conf. The -not working- "User login activity" dashboard included the string: "app=admin_audit" and not the "ncApp=admin_audit". I will try to delete the app and install it from scratch, maybe some update wasn't deployed correctly? Don't know.

andresito123 · ‎03-25-2020

Splunk Add-on for Nextcloud is at version 2.1.0 and Splunk App for Nextcloud is at version 2.6.1. I had to manually fix some dashboards because the "app" field name, which is used on many dashboards searches, does not get the right value.

andresito123 · ‎03-24-2020

Hello all, I am troubleshooting why "User login activity" of Nextcloud App is showing no results and by analyzing the results the dashboard query is: sourcetype=TERM(nextcloud-log) app=admin_audit action="Login successful" user="*" userAgent!=curl* | iplocation remoteAddr | timechart count by user When I dig further, I see that the "app" field value is always set to "nextcloud" and never gets the right app value from the nextcloud-log sourcetype (which are extracted from the script of the add-on). Then, I consulted the /opt/splunk/etc/apps/TA-nextcloud/default/props.conf and I see the following statement: EVAL-app = "nextcloud" What is the use of this statement? Is this a mistake/bug? Because I am considering overriding this value on the local directory.

andresito123 · ‎03-19-2020

ok thanks!

andresito123 · ‎03-19-2020

Hello Splunkers! Quick questions, is it ok to "jump" maintenance versions on the same release? For example: if I want to go to 7.3.4 from 7.3.2 can I follow the path #1 or path #2? 7.3.2 => 7.3.3 => 7.3.4 7.3.2 => 7.3.4 Thanks.

andresito123 · ‎09-10-2019

When I say "prolonged the expiration of an identity" I mean the act of editing identities.csv file and for example from expiration date pf 30/08/19 I alter it to 30/10/19. The triggered alert is "Activity from expired identity".

andresito123 · ‎09-05-2019

I have changed the identities.csv and prolonged the expiration of an identity. However, the alert keep getting triggered and stops only when I perform a splunk restart. Is this normal? Every time I want to change a csv file, do I have to restart the splunk application?

andresito123 · ‎09-05-2019

Create a table for your events, with columns IP, event time and event timestamp. The timestamp will help you calculate the time period between consecutive events (tip: use "eval") Sort this table by IP and then by event time. Use "streamstats" to handle your search results in a streaming manner. Add the option current = f (false) to handle every new event individually. Compare the new event's user and timestamp with your last kept event. - If the new IP is different from the previous IP, keep the event (remember that our table is primarily sorted by IP, so we deal with all requests from each IP at a time) - If the difference between the new event's timestamp and the last kept timestamp is more than 3600 seconds, keep the event. - If the last kept IP is null, it means we are dealing with our first event, so keep the event. - Drop all other events. Perform a count over your previous search to obtain the total number of visits. tip: keeping specific events with streamstats can be done using the "where" command

andresito123 · ‎04-08-2019

Hello, I have to create a report, similar to AWStat attribute of "Visits". AWStats defines the visits as: Number of visits made by all visitors. Think "session" here, say a unique IP accesses a page, and then requests three other pages within an hour. All of the "pages" are included in the visit, therefore you should expect multiple pages per visit and multiple visits per unique visitor (assuming that some of the unique IPs are logged with more than an hour between requests) Reference: https://awstats.sourceforge.io/docs/awstats_glossary.html In my logs, due to the load balancer in front, I cannot make a distinction by IP so I will do it with the username (you have to login in order to see this site). The question is how I can build up such a search, a search that will calculate the number of visits and if there is a gap of more than 1 hour per each user, the subsequent visit will be calculated as a "visit" as per AWStats definition.

andresito123 · ‎12-07-2018

Hello to the community! I have the following jboss log: [2018-12-07 14:17:23,661] [INFO] [xxx.common.ldap.connections.TimedAuthenticator] (default task-4) () Authentication succeeded for dn: CN=XXX,OU=YYY,DC=external,DC=ZZZ,DC=LLL Using the jboss app, I have the following field name and value: signature=Authentication succeeded for dn: CN=XXX,OU=YYY,DC=external,DC=ZZZ,DC=LLL How can I keep this value and on top of that create the following name/values: event=Authentication succeeded action=success user=XXX src_bunit=YYY My goal is to normalize the logs and map them to CIM in order to be parsed properly by Enterprise Security App. Any clues?

andresito123 · ‎07-16-2018

According to this page: https://docs.splunk.com/Documentation/AddOns/released/Sophos/ConfigureSophosEnterprise Splunk Add-on for Sophos is for Enterprise Console, not Sophos UTM.

andresito123 · ‎07-13-2018

Hello to the community! I am trying to alter the indexed value of a Sophos UTM logs in order to get mapped to CIM (https://docs.splunk.com/Documentation/CIM/4.11.0/User/NetworkTraffic). Sophos UTM uses "accept" and "drop" and I want to change them respectively to "allowed" and "blocked" in order to get mapped to correctly to allowed and blocked traffic of the CIM. Below you may find a sample of those logs: 2018:07:13-16:18:31 sophosutm-1 ulogd[6773]: id="2002" severity="info" sys="SecureNet" sub="packetfilter" name="Packet accepted" action="accept" fwrule="123" initf="eth1" outitf="eth2.665" srcmac="ec:bd:1d:71:26:31" dstmac="00:1a:8c:f0:ae:61" srcip="52.112.128.78" dstip="10.28.4.21" proto="6" length="40" tos="0x00" prec="0x00" ttl="117" srcport="50609" dstport="5061" tcpflags="ACK" 2018:07:13-16:18:31 sophosutm-1 ulogd[6773]: id="2002" severity="info" sys="SecureNet" sub="packetfilter" name="Packet accepted" action="accept" fwrule="68" initf="eth0" outitf="eth1" srcmac="00:26:99:14:b7:bf" dstmac="00:1a:8c:f0:ae:60" srcip="10.25.10.10" dstip="8.8.8.8" proto="17" length="70" tos="0x00" prec="0x00" ttl="126" srcport="53257" dstport="53" 2018:07:13-17:00:49 sophosutm-1 ulogd[6773]: id="2001" severity="info" sys="SecureNet" sub="packetfilter" name="Packet dropped" action="drop" fwrule="65" initf="eth2.667" outitf="eth1" srcmac="60:57:18:ae:a3:8f" dstmac="00:1a:8c:f0:ae:62" srcip="10.28.1.222" dstip="13.107.24.5" proto="17" length="58" tos="0x00" prec="0x00" ttl="127" srcport="64549" dstport="53" I have the following configuration on my indexer: /opt/splunk/etc/system/local/props.conf [source::udp:514] TRANSFORMS-null = setnullSOPHOSUTM,setnull_connection_refused_logs TRANSFORMS-overrideDrupalLogs = override_for_drupal_logs TRANSFORMS-overrideESXiLogs = override_for_esxi_logs # alter accept to allowed and drop to blocked for utm logs # in order to get mapped to CIM SEDCMD-accept-to-allowed = s/action\=\"accept\"/action=\"allowed\"/g SEDCMD-drop-to-blocked = s/action\=\"drop\"/action=\"blocked\"/g However the results are not indexed as instructed in SED command. Can you imagine where is the issue? Thanks, Andreas

andresito123 · ‎07-06-2018

Thank you very much for your answer! One more question: how I can offload the indexer from the SH tasks? Delete enterprise security?

andresito123 · ‎07-06-2018

Hello to the community! I was wondering if there is any best practices regarding the removal of Search Head role from an indexer and moving it to a new server. I have started as a "demo" installation with a machine with indexer and SH role, so I need to remove all activities of the SH and move them to the new machine. Is there any documentation on performing such task? The SH also contains Enterprise Security App. Thanks, Andreas

andresito123 · ‎05-15-2018

I used the pattern you mention in EXTRACT but it didn't work. I read that it might be better to use the fields in the "EXTRACT-". I didn't use the Splunk addons because the data I have are different from the data SPLUNK addons process...

andresito123 · ‎05-15-2018

Does it matter in which props.conf those definitions are?

Posts	60
Solutions	3
Karma Given	2
Karma Received	4
Member Since	‎04-03-2016

Online Status	Offline
Date Last Visited	‎03-09-2021 03:03 AM

Cannot find MSAD:NT6:DNS data

Index only folder in TA-mailclient

Splunk Enterprise & UF on the same machine

Verify Cluster Security Key

User login activity - Nextcloud Addon

Upgrade Paths on maintenace releases

Activity from expired identity keeps triggered alt...

Visits on IIS (Sharepoint Server)

Split field value into multiple field names and va...

SOPHOS UTM Firewall Logs

Re: Cannot find MSAD:NT6:DNS data

Cannot find MSAD:NT6:DNS data

Re: Splunk Add-on for Tenable: Support for Nessus ...

Index only folder in TA-mailclient

Re: Splunk Enterprise & UF on the same machine

Re: Splunk Enterprise & UF on the same machine

Splunk Enterprise & UF on the same machine

Re: Verify Cluster Security Key

Verify Cluster Security Key

Re: User login activity - Nextcloud Addon

Re: User login activity - Nextcloud Addon

User login activity - Nextcloud Addon

Re: Upgrade Paths on maintenace releases

Upgrade Paths on maintenace releases

Re: Activity from expired identity keeps triggered...

Activity from expired identity keeps triggered alt...

Re: Visits on IIS (Sharepoint Server)

Visits on IIS (Sharepoint Server)

Split field value into multiple field names and va...

Re: SOPHOS UTM Firewall Logs

SOPHOS UTM Firewall Logs

Re: Remove Search Head roles from an Indexer

Remove Search Head roles from an Indexer

Re: Mutliple field extractions in props.conf of on...

Re: Mutliple field extractions in props.conf of on...