About VijaySrrie

VijaySrrie · ‎09-13-2023

Hi Team, How to integrate proficio with splunk

VijaySrrie · ‎08-22-2023

Hi, Working on splunk capacity planning 1. splunk is in cloud 2. 100GB of data 3. 10 users 4. No use of splunk enterprise security How much license would be required? No. of indexers? search heads? Is there any site where I can get the exact details?

VijaySrrie · ‎08-16-2023

Hi, I could see duplicate data in splunk by using below query index="indexname" | stats count by _raw | where count >1 I checked 10 different indexes out of which 8 indexes are having duplicate logs

VijaySrrie · ‎08-01-2023

I wanted to show an example to my junior in practical setup

VijaySrrie · ‎08-01-2023

Hi All, How to find unwanted logs (noise) in crowdStrike Falcon logs? Do you know the details that can be filtered in crowdstrike falcon logs?

VijaySrrie · ‎04-20-2023

Hi All, Is there an option to see the working of Fish bucket in real time? Switching off the server? can we test it? If yes, please let me know how to do it in test server.

VijaySrrie · ‎03-01-2023

Hi I have extracted a field username and it has domain and user username= "google\\john" username="googleuser" username = "admin" I need calculated to be created in props.conf where google should go to domain and john should go to user field This domain field will be there only in certain logs So whatever is there before "\\" should be considered as domain and after "\\" is user In some cases domain wont be there, for those cases username to be tagged to user field All this should happeb at backend props.conf domain = google user= john user = googleuser user = admin

VijaySrrie · ‎02-26-2023

Hi @ITWhisperer , Thanks for the reply, I have pasted the answer that worked for me.

VijaySrrie · ‎02-26-2023

This answer worked for me https://community.splunk.com/t5/Splunk-Search/Matching-fields-from-different-indices-to-return-another-field/m-p/470361

VijaySrrie · ‎02-26-2023

index=_internal host=hoatname or IP

VijaySrrie · ‎02-26-2023

index=cat Name Place ID jack delhi 1 jill melbourne 2 index=dog Country number Australia 2 India 1 ID field in cat and number field in dog are same, I need below output Name Place ID Country jack delhi 1 India jill melbourne 2 Australia

VijaySrrie · ‎02-18-2023

Hi @bowesmana The query which you shared works fine. I am bit confused about the timing This query should run 60 mins once. cron_schedule = 01 * * * * dispatch.earliest_time = -60m dispatch.latest_time = now May I know the correct earliest and latest time?

VijaySrrie · ‎02-16-2023

Hi Team, We have a field called Status=Start and Status=Success OrderId is one field When orderId has the Status=start and if there is no Status=Success for 10 mins it should be considered as failure May i know how to write a condition for this?

VijaySrrie · ‎11-24-2022

Hi All, I have encrypted the user field with sha256 index=abc sourcetype=xyz | eval domain = sha256(User) | table domain I am able to see encrypted values under domain field Is there a splunk command to decrypt it?

VijaySrrie · ‎11-24-2022

@gcusello Below config worked Props [host::LIANS*] TRANSFORMS-change_index_abc_secure = change_index_abc_secure Transforms.conf [change_index_abc_secure] SOURCE_KEY = _MetaData:Index REGEX = os|os_secure DEST_KEY = _MetaData:Index FORMAT = abc_secure

VijaySrrie · ‎11-06-2022

Hi @gcusello This isn't working Not sure where am I going wrong

VijaySrrie · ‎11-03-2022

Hi @gcusello Yes, this is fine, also I want the logs only from the hostname LIANS* Will the below props and transforms work? props.conf [host=LIANS*] TRANSFORMS-change_index_abc_secure = change_index_abc_secure transforms.conf [change_index_abc_secure] SOURCE_KEY = MetaData:Index REGEX = os|os_secure DEST_KEY = MetaData:Index FORMAT = index::abc_secure

VijaySrrie · ‎11-01-2022

Hi Team, [host::1.(xx|xx).xx.xx(x|y)] TRANSFORMS-change_index_abc_secure = change_index_abc_secure [change_index_abc_secure] SOURCE_KEY = MetaData:Index REGEX = os, os_secure DEST_KEY = MetaData:Index FORMAT = index::abc_secure I need to route the logs from certain host to index=abc_secure (not all the logs only os and os_secure logs)

VijaySrrie · ‎09-04-2022

what happens when move_policy setting is not given in the batch config?

VijaySrrie · ‎09-01-2022

Hi All, What is the use of move_policy = sinkhole and on which scenario we will use batch (Batch will index the file and delete but in which application or server this should be used?)

VijaySrrie · ‎09-01-2022

Hi @dkeck What is the use of move_policy = sinkhole And In which scenario we go for batch ?

VijaySrrie · ‎07-07-2022

Hi Team, How to get OCI logging option under Data Inputs?

VijaySrrie · ‎07-04-2022

Hi, implementing Splunk for the very first time in a new project Need to do set up Splunk from the scratch Multi site clustered env 2 TB License How to calculate the number of Indexers and Search heads? Please let me know the end to end steps to take care of

VijaySrrie · ‎07-04-2022

Hi, Splunk On Splunk (SOS) app - Is this an old app? May I know the name of the new app?

VijaySrrie · ‎06-30-2022

Criminals gain access to the platform and install Ransomware that disrupts platform An employee deliberately or accidentally misusing their access to PII records Denial of service attack by criminals or state-sponsored actors flooding cloud resources, causing platform to become unavailable and inaccessible. Supply chain security is compromised and Ovo loses access to services it is provided Ineffective controls on endpoint devices, enabling unauthorised access by criminals or state-sponsored actors Criminals gain access to underlying cloud infrastructure and steal PII data Criminals gain access to exposed APIs and steal PII data Users could escalate privileges and/or move laterally in the platform to see data they shouldn't

Posts	246
Solutions	11
Karma Given	64
Karma Received	10
Member Since	‎02-22-2019

Online Status	Offline
Date Last Visited	a month ago

How to integrate proficio with splunk?

Splunk capacity planning: How much license, search...

Why am I seeing Duplicate data (_raw)?

How to find the noise in crowdstrike falcon logs?

Is there an option to see the working of Fish Buck...

How do I calculate field in props.conf?

Help with alert search with join or append?

How to write a condition for this?

Is there a Splunk command to decrypt encrypted val...

How to route the logs from certain host to index=a...

How to integrate proficio with splunk?

Splunk capacity planning: How much license, search...

Why am I seeing Duplicate data (_raw)?

Re: Is there an option to see the working of Fish ...

How to find the noise in crowdstrike falcon logs?

Is there an option to see the working of Fish Buck...

How do I calculate field in props.conf?

Re: alert query with join or append?

Re: alert query with join or append?

Re: Splunk Syslog

Help with alert search with join or append?

Re: Need alert query

How to write a condition for this?

Is there a Splunk command to decrypt encrypted val...

Re: How to route the logs from certain host to ind...

Re: How to route the logs from certain host to ind...

Re: How to route the logs from certain host to ind...

How to route the logs from certain host to index=a...

Re: Batch and move_policy = sinkhole

What is the use of batch and move_policy = sinkhol...

Re: Splunk forwarder oneshot continues to forward ...

How to get OCI logging option under Data Inputs?

Setting up Splunk from the scratch

Splunk On Splunk app (SOS)

Re: Splunk SOC rules