Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About monteirolopes
monteirolopes
Communicator
Member since:
04-13-2016
06-05-2020
Community Statistics
| Posts | 52 |
| Solutions | 1 |
| Karma Given | 35 |
| Karma Received | 0 |
| Member Since | 04-13-2016 |
Activity Feed
- Karma Re: License Usage - Previous 30 days - no results are found for dgrubb_splunk. 06-05-2020 12:49 AM
- Karma Re: Trying to get SNMP data into Splunk... for jkat54. 06-05-2020 12:48 AM
- Karma Re: Alert - Time interval for gcusello. 06-05-2020 12:48 AM
- Karma Re: Is there a way to optimize my join search? for somesoni2. 06-05-2020 12:48 AM
- Karma Re: How do I table 3 distinct values within the same event if all values share the same field name? for sundareshr. 06-05-2020 12:48 AM
- Karma Re: How do I table 3 distinct values within the same event if all values share the same field name? for sundareshr. 06-05-2020 12:48 AM
- Karma Why are there duplicate entries of my PC in Forwarder management, and how can I remove them? for tmontney. 06-05-2020 12:48 AM
- Karma Re: Running a scheduled search and saving the results to a summary index, how do I view the results as a table? for somesoni2. 06-05-2020 12:48 AM
- Karma Re: How to edit my scripted input to collect and index data from scripts installed on forwarders? for hunters_splunk. 06-05-2020 12:48 AM
- Karma Re: SNMP Modular Input: I created an input stanza to capture traps, but why is the data not getting indexed in Splunk? for Damien_Dallimor. 06-05-2020 12:48 AM
- Karma Re: "Failed to properly initialize the key-value parser for transform_name 'REPORT-wf'. You must define least one delimiter." for gcusello. 06-05-2020 12:48 AM
- Karma Tcpout Processor: The TCP output processor has paused the data flow. Forwarding to output group production has been blocked for 10 seconds for ankitcharolia09. 06-05-2020 12:48 AM
- Karma How do I ingest Cisco Advanced Malware Protection (AMP) for endpoint logs into Splunk? for kiran331. 06-05-2020 12:48 AM
- Karma How do I set different source types on one data input? for noybin. 06-05-2020 12:47 AM
- Karma Re: Why am I getting an unresponsive setup screen trying to install Cisco Security Suite on Splunk 6.3? for _smp_. 06-05-2020 12:47 AM
- Karma Re: Why am I getting an unresponsive setup screen trying to install Cisco Security Suite on Splunk 6.3? for kearaspoor. 06-05-2020 12:47 AM
- Karma How to route data from a single input to multiple indexes? for jrobinson3661. 06-05-2020 12:47 AM
- Karma Re: How to route data from a single input to multiple indexes? for masonmorales. 06-05-2020 12:47 AM
- Karma Splunk DB Connet 2: Why are my DBinputs getting disabled automatically? for SrinivasaC. 06-05-2020 12:47 AM
- Karma Re: How do I set different source types on one data input? for MuS. 06-05-2020 12:47 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
05-17-2018
12:59 PM
I solved the problem.
The problem was on the REGEX, I changed to REGEX=message_info:"Address spoofing" and no more events with that message was showed
Thanks for your help!
... View more
05-17-2018
12:39 PM
Hi Solarboyz
I deployed props.conf and transforms.conf (folder "C:\Program Files\Splunk\etc\system\local\") on the indexer with your recommendation, but the events still indexing...
props.conf:
[checkpoint:syslog]
TRANSFORMS-null=setnullCheckpoint
transforms.conf
[setnullCheckpoint]
REGEX=message_info=Address spoofing
DEST_KEY=queue
FORMAT=nullQueue
Follow example of the event that I want to ignore, you can see the "message_info" near in the end of event:
May 17 16:24:14 192.168.63.61 1 2018-05-17 16:24:12 ngse CheckPoint 16009 - [action:"Detect"; flags:"393216"; ifdir:"inbound"; ifname:"eth5"; loguid:"{0x0,0x0,0x0,0x0}"; origin:"x.x.x.x"; originsicname:"CN=test,O=srv-test..pn95kt"; sequencenum:"6"; time:"1526585052"; version:"5"; __policy_id_tag:"product=VPN-1 & FireWall-1[db_tag={375400D5-214D-9B4A-A0D3-A1947AFD59A0};mgmt=test;date=1526490675;policy_name=name]"; dst:"x.x.x.x"; message_info:"Address spoofing"; product:"VPN-1 & FireWall-1"; proto:"6"; s_port:"80"; service:"49153"; src:"x.x.x.x"; ]
... View more
05-17-2018
11:48 AM
Hi,
Someone can help me in filtering logs from Checkpoint before they are indexing?
I tried following that link: https://answers.splunk.com/answers/378972/how-to-filter-out-certain-events-from-checkpoint-d.html
but I think my REGEX doesn't work.
I need to ignore all events that the "message_info" field is equal to "Address spoofing", here is my props.conf and transforms.conf
props.conf:
[checkpoint:syslog]
TRANSFORMS-null= setnullCheckpoint
transforms.conf:
[setnullCheckpoint]
REGEX = message_info=Address spoofing
DEST_KEY = queue
FORMAT = nullQueue
Thank you!
... View more
10-04-2017
10:29 AM
Could you tell me if it is works to "index" too?
... View more
09-26-2017
05:57 AM
Do you know if this issue has been solved?
... View more
08-24-2017
05:25 AM
It works! The RolloverSummary event had not yet been created.
Reference: http://docs.splunk.com/Documentation/Splunk/6.6.2/Admin/AboutSplunksLicenseUsageReportView
"These panels all use data collected from license_usage.log, type=RolloverSummary (daily totals). If your license master is down at its local midnight, it will not generate a RolloverSummary event for that day, and you will not see that day's data in these panels."
... View more
08-23-2017
12:43 PM
Now my indexers are receiving machine 1 internal logs, however, no results are found in report "License Usage - Previous 30 days".
Is there any specific configuration missing?
... View more
08-23-2017
08:14 AM
Hi,
I'm running the "License Usage - Previous 30 days" report and no results are found!
When I run the "License Usage - Today" report, information is displayed.
In the filter it is possible to view the pools, however, no information is displayed.
Is there any specific configuration missing?
In my environment, I have 3 instances:
Machine 1: search head, deployment server, license master
Machine 2: Indexer 1
Machine 3: Indexer 2
I use the distributed search architecture.
Reference link: https://answers.splunk.com/answers/113466/license-usage-past-30-days-dont-work.html
Thanks.
... View more
08-16-2017
05:47 AM
I found this log in my temp folder:
"unable to write 'random state'
e is 65537 (0x10001)
writing RSA key"
... View more
08-16-2017
05:27 AM
Is there a specific keyword for the search? I running procmon but I do not understand much about processes
... View more
08-15-2017
05:03 PM
I've used a local administrator and / or a domain administrator, and the problem still persists.
... View more
08-15-2017
05:03 PM
I've used a local administrator and / or a domain administrator, and the problem still persists.
Can the issue be related to the disc type?
... View more
08-15-2017
12:09 PM
Hi,
I am trying to install Splunk 6.6.2 on Windows 2012 R2 x64 on disk 😧 (empty) and I getting error "Splunk Enterprise Setup Wizard ended prematurely". If I choose disk C: the installation works!
I tried some answers (https://answers.splunk.com/answers/232400/why-am-i-getting-error-splunk-enterprise-setup-wiz-2.html) but it doesn't work.
My user is admin.
Best regards,
Lopes.
... View more
08-02-2017
12:13 PM
Splunk is monitoring a file every 11 minutes.
An alert was created to receive an email for each event that matches.
Follow the alert's setting:
Alert type
Scheduled
Run on cron schedule
earliest: -11m@m
latest: -1s@s
cron expression: */11 * * * *
Trigger condition
Trigger alert when "Number os results" is greater than 0 results
Trigger: "for each result"
I don't know why, but I am receiving only one mail. In my case, two events matched.
Is the setup right?
Obs; The Throttle feature is not checked
Best regards,
Lopes.
... View more
05-29-2017
05:46 AM
Hi,
I created a sourcetype (props.conf) to parse my json files. A local input (index once) was created only to test the props.conf and it works fine!
When I tried to create a continuously monitor file the events didn't appear in Splunk. I tried to monitor the entire folder (*.json) and a specific json file.
Has anyone had something similar?
follow my props.conf
[json_mention]
TRUNCATE = 0
BREAK_ONLY_BEFORE_DATE = false
SHOULD_LINEMERGE = false
LINE_BREAKER = ({\s+"location":)
MUST_BREAK_AFTER = {\s+"location":
TIME_FORMAT=%Y-%m-%d %H:%M:%S
TIME_PREFIX=({\s+"collected_at":\s+")
MAX_TIMESTAMP_LOOKAHEAD=20
Best regards,
... View more
05-15-2017
09:06 AM
Hi,
I would like to monitor pastes from pastebin by keywords. For example, every time that my keyword is mentioned,
the entire publication would be indexed in Splunk.
Does anyone have any suggestions on how I can monitor these events?
Best regards,
Lopes.
... View more
05-03-2017
01:58 PM
Hi,
I would to like to index a log in xml format and I would to like to parse it so that the content of each event was what was inside the tags, as shown below:
Event1 = content 1
Event2 = content 2
How can I do this? Is there a regular expression for the above example?
Best regards,
Lopes.
... View more
10-11-2016
12:21 PM
My script was wrong, Now Its work!
Thanks!
... View more
10-11-2016
10:35 AM
On Deployment Server:
E:\Program Files\Splunk\etc\deployment-apps_server_app_roi
Server Class is created: roi
I using Splunk Deployment - Basic
Phone home: a few seconds ago
On forwarder:
C:\Program Files\SplunkUniversalForwarder\etc\apps_server_app_roi
Best regards,
... View more
10-11-2016
10:04 AM
Hi,
I created a script input to collect data from scripts installed on forwarders and Splunk is not indexing.
Follow my steps to create a data input:
1.Forwarded inputs » Data inputs » Script » Add new
2.Create a server class.
3.
Script Path: $SPLUNK_HOME\bin\scripts
Command: $SPLUNK_HOME\bin\scripts\script.ps1
Interval: 60.0
Inputs.conf
[script://$SPLUNK_HOME/etc/apps/_server_app_rois/bin/script.ps1]
disabled = false
index = rois
interval = 60.0
sourcetype = rois
Whats wrong with my input?
Best regards,
Lopes.
... View more
10-07-2016
07:00 AM
Have you tried edit your file app.conf?
is_configured = true
... View more
10-06-2016
01:13 PM
Same problem here.
What did you do to repair the problem?
... View more
10-06-2016
11:41 AM
It does not work in real-time , the
amount of events is incremental.
Alert scheduling (60 login in 60
seconds) doesn't configure brute
force attack.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:04 AM
|
Karma given to
