About MKozanic

MKozanic · ‎09-05-2022

Hi @brent_weaver, Just wondering what you ended up using and how it went?

MKozanic · ‎06-13-2022

@eregon , Did you figure this one out? I'm having the same issue with one of the instances I look after. Can curl OK - but get nothing when trying to run | rest command from SPL. Have not seen this issue before - haven't been able to determine the cause as yet.

MKozanic · ‎11-23-2021

@bowesmana You comment: "if you are up at 50k then the subsearch will have a 50k limit" Does this apply even to an append search where we are doing | inputlookup - ie because this is not main search, we are only appending the first 50K rows from the lookup?

MKozanic · ‎11-23-2021

We will run as a cluster at some point, but right now - no, this is just a single SH, and the instance I'm testing on is an all in one server so won't even be any lag with sync between SH and IDX. search is scheduled - runs every hr, initially all searches were set to run at the same time, but I have adjusted this and now they run 20mins apart.

MKozanic · ‎11-22-2021

Hi @bowesmana, The search was one that pre-existing my involvement and I'm just trouble shooting. Just a note, if I run the search without the output, the returned results are accurate for what should be written to the KV Store, and I think for that specific search result, the results are added. It's just that the next search that adds a different category of data seems to overwrite the updated results from the last search. I did think about just looking at adding new values and had tried doing a NOT in search, but this seemed to take a long time. I'll try your method tomorrow to see how that performs and let you know if resolves my issues.

MKozanic · ‎11-22-2021

Hi All, Hoping someone out there can help me unravel the mystery I'm currently facing. We have a KV Store that we use to hold MISP values which is checked against when running various security alerts. We have 3 searches that are querying MISP data source and based on the results should add any new entries into the KVStore. Basics of the search we run are below: | misp command to get new records in last 24hrs | bunnch of evals to format data | append [| inputlookup MispKVstore] | dedup | outputlookup append=false MispKVstore We have this running 3 times to get details for different types of values - but all are stored in the same KVstore. Issue we are having is, once we reach 50 rows in the KV Store, updates are not being made as expected. Each time the search runs, it will add new entries for that category, but seems to delete / discard the values added by the other searches. All column names are consistent between the searches, I have updated the Max_rows_per_query as we thought we might be being affected by the 50k limit, but this has not resolved the issue. Seeking any tips, tricks, troubleshooting advice anyone is able to give to help get this sorted. Thanks in advance 🙂

MKozanic · ‎11-11-2021

Hi @thippeshaj , Just wondering if you worked out a solution for this? I'm currently looking for something similar to be able to configure alerts based on previous indexing frequency

MKozanic · ‎10-28-2021

Hi All, I'm trying to work out best practice with regards to alert throttling and max time frames. Trying to determine whether if we where to throttle something for 2 weeks, would we actually be better off filtering in a different way, either by using a lookup or a subsearch. I'd like to know where the values that are used for throttling are stored, and what whether there is any performance considerations we need to account for when looking at throttling for longer periods.

MKozanic · ‎10-19-2021

Hi @richgalloway , I did find that list but last update was 2019 and for versions 6.5.5 and below. Have there veen no other security updates snice then?

MKozanic · ‎10-18-2021

Hi All, After a bit of googling I've come up empty with regards to being able to identify security issues that have been addressed as part of each Splunk Enterprise version update. Just wondering if there anyone has a link or can provide some details on where I can find this information? I have looked through the release notes pages, but these seem to only list functional improvements / fixes. Appreciate anyone that can help with this.

MKozanic · ‎07-30-2021

Thanks @richgalloway , While your advise was reverse to what I needed to do, it was correct. In my case I needed to set acceleration enforcement = True for the models I was trying to enable. However, due to a known issue version 6.0 (which we are on), I was not able to do this via the GUI and needed to run curl command to update via rest. curl -ku admin https://<ServerAddress>:8089/servicesNS/nobody/SplunkEnterpriseSecuritySuite/data/inputs/dm_accel_settings/<dataModelName> --data "acceleration=true&manual_rebuilds=true&output_mode=json"

MKozanic · ‎07-27-2021

I have tried to enforce acceleration on one model but am getting an error message: I just read this is a known bug with ES 6.0 (we are on 6.0.2) so assuming I will need to look at a work around to get this working.

MKozanic · ‎07-27-2021

Hi @richgalloway , Looking at the setting again, I noticed that enforcement is set to false - just wondering if this needs to be updated to True? Would this be the cause of it turning off once after it has been running for a while?

MKozanic · ‎07-27-2021

Hi @richgalloway, Thanks for the response, only we want to enable DMA - not disable. I did check under DMA Enforcement settings at Settings->Data Inputs->Datamodel Acceleration Enforcement, but all looked OK as best I could see. Will get some screen shots today and add to post

MKozanic · ‎07-26-2021

Hi All, I'm not that familiar with DMA as I have not had any exposure really to setting up data models so far but am currently having an issue atm with DMA not saying active. We had to disabled DMA on all ES data models where it was enabled due to an incident recently. Now that the issues have been resolved, we need to re-enable DMA. I have attempted to do this by following the below steps: 1. Go to the ES app 2. Click "Configure" -> "CIM Setup" 3. Check the checkbox next to the "Accelerate" then change the Summary Range to 7 days (- 7 days), then click Save. 4. To verify , click "Configure" -> "Content" -> "Content Management". 5. Filter the type to "Data Model" 6. Check the lightning icon next in the row of the data model if is coloured "yellow". This looked like it was working for a while, but after checking on it after a few hrs - all DMA had been disabled again. Not sure why DMA will not stay enabled - have checked settings, nothing obvious as to why this would be happening. Anyone else out there had this issue or got some idea on something I can check as to why this would be happening?

MKozanic · ‎07-09-2021

@osasfrancis, I have tested this config on my test instance and seems to work perfectly for me. Are you able to advise if there are any important details you may have missed about the set-up? Or, can you provide more detail on what your source logs look like? - perhaps provide some more examples?

MKozanic · ‎07-08-2021

@osasfrancis - Sorry, I miss read your question. looking more into this, it seems like what you have should be working. In your props you have [Test:system] does this match the sourcetype of the events you are trying to filter?

MKozanic · ‎07-08-2021

Hi @subspacefield , if that is exactly how you have in your search then there are 2 issues. for rex - you need to tell it what to look at: Rex works as you would read something - when extracting you need to extract in the order things appear in the data. Yours rex command: | rex "MessagesToConsume:(?P<MessagesToConsume>\d+) CurrentOffset:(?P<CurrentOffset>\d+)" Corrected rex command: | rex field=_raw "CurrentOffset:(?P<CurrentOffset>\d+) MessagesToConsume:(?P<MessagesToConsume>\d+)" When working with issue like this, regex101.com is your best friend: https://regex101.com/r/4CkJF0/1

MKozanic · ‎07-08-2021

If I read your question correctly AND if your second line is consistent - you could try this instead: transforms.conf [setnull] REGEX = .+maintenance.+ DEST_KEY = queue FORMAT = nullQueue FYI - regex101.com is your best friend for these sorts of issues: https://regex101.com/r/HSimiN/1

MKozanic · ‎07-08-2021

This doesn't really specify whether this can be run from UF. Most things I have read indicate that parsing on UF is limited to structured formats like csv and event line splitting. Given your knowledge, I'm happy to trust that you know what you are talking about, but it would be nice to have some supporting documentation that outlines exactly what can be done at UF and what needs to be done on HF / IDX.

MKozanic · ‎07-06-2021

Thanks @richgalloway , I wasn't sure if this would work as I couldn't find anything to say this would get picked up at the UF level, in fact most things I read suggested otherwise. From what I read, UF processes very little from Props / Transforms - do you know if there is any documentation that outlines what works at UF level and what needs to be done at HF / IDX?

MKozanic · ‎07-05-2021

Hi All, Have seen a few options for the issue I have, but wanted to know if Splunk can handle applying multiple props.conf settings to a specific feed. ISSUE: We have a sourcetype coming in that needs to have date format set - this part is easy. Complication is that feed is coming from servers in different timezones as well. PROPOSED SOLUTION: Wondering if I can have props stanza for sourcetype to configure date format but also a secondary stanza for hosts to define timezone. Something like: [broken_sourcetype] MAX_TIMESTAMP_LOOKAHEAD = 27 TIME_FORMAT = %Y-%m-%d %H:%M:%S,%3N TIME_PREFIX = ^ [host::UShost*] TZ = America/New_York [host::AUShost*] TZ = Australia/Sydney

MKozanic · ‎06-27-2021

Hi All, We have an issue with a number of our UFs where in they have stopped sending internal logs after a recent app update from Deployment server. UFs are still sending other events, there are no errors in the splunkd.log indicating why they are not sending internal logs and app changes from DS have nothing in them that should affect this (ie nothing like blacklist _internal etc). Have attempted restarting UF, but no change. Number of "other" events is not that high (one host is around 800 events for last 15mins) - so ruling out UF being overloaded and not sending Internal logs because of this. Looking for any advice or troubleshooting steps I can use to try and figure out why these clients are not longer sending internal logs. Thanks in advance.

MKozanic · ‎07-23-2019

Thank you so much @ccuadrad, You have saved my day. This was doing my head in and such a simple fix!

MKozanic · ‎04-30-2019

Thanks to those that looked at this for me. After spending some time with Splunk Support, turns out that my issue was more a limitation of Chrome rather than a Splunk issue. For some reason, Chrome is not allowing full scrolling of the rows within my table - not sure why this is as it works perfectly well in Firefox. One issue that I was having was that because the number of columns was wider than my open window, it was creating a second up/down scroll bar which was not obviously visible, but now even with the window at full screen and no secondary scroll bar, I'm still not able to scroll all the way to the bottom of my table. Not sure if this is something that needs to be fixed in Chrome or if the Lookup Editor can somehow be updated to resolve these issues - I suspect it would need to be the former. Until then - Firefox has me sorted.

Posts	28
Solutions	3
Karma Given	2
Karma Received	2
Member Since	‎03-28-2019

Online Status	Offline
Date Last Visited	‎09-06-2022 12:09 AM

Outputlookup not updating KV Store as expected

Alert Throttling - where are the throttled values ...

List of security issues address per update

Data model acceleration not sticking

Can we apply multiple time settings via props for ...

UF not sending Internal logs after DS app update

outputlookup limitiations??

Re: HEC HWF behind AWS Loadbalancer. ELB or ALB?

Re: Why is | rest command not returning any data w...

Re: Outputlookup not updating KV Store as expected

Re: Outputlookup not updating KV Store as expected

Re: Outputlookup not updating KV Store as expected

Outputlookup not updating KV Store as expected

Re: Logging frequency of my index,sourcetype and h...

Alert Throttling - where are the throttled values ...

Re: List of security issues address per update

List of security issues address per update

Re: Data model acceleration not sticking

Re: Data model acceleration not sticking

Re: Data model acceleration not sticking

Re: Data model acceleration not sticking

Data model acceleration not sticking

Re: Regex help

Re: Regex help

Re: Multiple rex expressions

Re: Regex help

Re: Can we apply multiple time settings via props ...

Re: Can we apply multiple time settings via props ...

Can we apply multiple time settings via props for ...

UF not sending Internal logs after DS app update

Re: Why is the triggered alert not logging event t...

Re: outputlookup limitiations??