Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About tbavarva
tbavarva
Path Finder
Member since:
04-30-2019
02-18-2022
Community Statistics
| Posts | 25 |
| Solutions | 1 |
| Karma Given | 2 |
| Karma Received | 1 |
| Member Since | 04-30-2019 |
Activity Feed
- Got Karma for Field extractor for Firepower syslogs. 03-14-2021 01:39 PM
- Posted Re: Field extractor for Firepower syslogs on Splunk Enterprise Security. 07-16-2020 10:48 PM
- Posted Field extractor for Firepower syslogs on Splunk Enterprise Security. 07-16-2020 10:59 AM
- Karma "Brute Force Access Behavior Detected" from Microsoft domain controllers for dsuddu. 06-05-2020 12:49 AM
- Karma Splunk ISE TA fails when distributed via Cluster Master for bjoernhansen. 06-05-2020 12:48 AM
- Posted Re: Fine-tune Incident Review - Splunk ES on Splunk Enterprise Security. 12-23-2019 08:56 AM
- Posted Re: Fine-tune Incident Review - Splunk ES on Splunk Enterprise Security. 12-23-2019 07:10 AM
- Posted Fine-tune Incident Review - Splunk ES on Splunk Enterprise Security. 12-23-2019 02:03 AM
- Tagged Fine-tune Incident Review - Splunk ES on Splunk Enterprise Security. 12-23-2019 02:03 AM
- Tagged Fine-tune Incident Review - Splunk ES on Splunk Enterprise Security. 12-23-2019 02:03 AM
- Posted Re: splunk syntax search a subnet on Splunk Search. 12-21-2019 12:43 AM
- Posted Re: table on click change the row color in splunk html dashboard on Dashboards & Visualizations. 12-02-2019 06:42 AM
- Posted Re: table on click change the row color in splunk html dashboard on Dashboards & Visualizations. 12-02-2019 06:05 AM
- Posted Re: How to find a host which is missing a specific value? on Splunk Search. 12-02-2019 06:00 AM
- Posted Re: How to find a host which is missing a specific value? on Splunk Search. 12-02-2019 05:59 AM
- Posted Re: How do I take specific information from Case ()? on Splunk Search. 11-10-2019 06:22 AM
- Posted Re: Sophos Central App For Splunk Cloud on All Apps and Add-ons. 11-10-2019 06:11 AM
- Posted Make logs CIM compatible - Malware in Splunk ES on Knowledge Management. 10-23-2019 04:43 AM
- Tagged Make logs CIM compatible - Malware in Splunk ES on Knowledge Management. 10-23-2019 04:43 AM
- Tagged Make logs CIM compatible - Malware in Splunk ES on Knowledge Management. 10-23-2019 04:43 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 1 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
07-17-2020
05:44 AM
That splunkbase doesn't say an app is compatible with a certain version does not mean that app is not compatible with that version. It's possible the app simply has not been tested. Compatibility with Splunk 8 usually hinges on which Python version the app uses. If the app does not use any Python then compatibility should not be a problem. You can use one of the apps as a guide for building your own app.
... View more
12-23-2019
08:56 AM
Thanks a lot @richgalloway That is what I wanted to know. 🙂
... View more
12-02-2019
06:42 AM
Hi Santosh,
You can use drilldown feature in panel.
https://docs.splunk.com/Documentation/Splunk/8.0.0/Viz/DrilldownIntro
Regards,
Tejas
... View more
10-23-2019
07:15 AM
1 Karma
Hi Tejas,
It's not clear from your question, actually what help you need.
To make the data CIM compatible means, identify the fields from the data and name them as per the CIM rules.
Example,
- For IP address extraction, usually we the filed name ip_add, ip_location, etc...
- But to make it CIM compatible, the filed name should be src_ip or dest_ip.
Similarly eventtype or tag should be defined as per the naming convention of CIM rules.
In your case for MALWARE dashboard,
- check the datamodel or dataset being used in Malware dashboard
- identify the sourcetype/eventtype/tag for mail search query (means your data should be ingesting in splunk with this sourcetype/eventtype/tag value)
- identify the required fields and rename your extracted fields as per the fields in datamodel/dataset
Pivot is just a data visualization feature, the same thing you do with stats or other chart commands.
The below Splunk App may help to understand CIM compliance better.
https://splunkbase.splunk.com/app/1621/
Let me know if any other details are required.
Accept and upvote the answer if it helps.
Happy splunking........!!!!!!
... View more
10-21-2019
01:37 AM
Hi,
I hope below link will give you an idea.
https://answers.splunk.com/answers/152131/filter-windows-eventcode-using-blacklist-and-whitelist.html
Regards,
Tejas
... View more
10-17-2019
02:08 AM
Hi bhsakarchourasiya_acct,
Did you check permission of splunkd.log, metrics.log and other log files whether splunk user has permission to read all of them?
Regards,
Tejas
... View more
10-17-2019
01:24 AM
As requested a single event looks like as below.
x,xx.xxx.xx.x,xx.xxx.x.x,xxxxx,xxx,T,O,A,B,,,,","xxxxxxxxxx,xx.xxx.xx.x,xx.xxx.x.x,xxxxx,xxx,T,O,A,E,,,,","xxxxxxxxxx,xx.xxx.xx.x,xx.xxx.x.x,xxxxx,xxx,T,O,A,B,,,,","xxxxxxxxxx,xx.xxx.xx.x,xx.xxx.x.x,xxxxx,xxx,T,O,A,E,,,,","xxxxxxxxxx,xx.xxx.xx.x,xx.xxx.x.x,xxxxx,xxx,T,O,A,B,,,,","xxxxxxxxxx,xx.xxx.xx.x,xx.xxx.x.xx,xxxxx,xxxx,T,O,A,B,,,,","xxxxxxxxxx,xx.xxx.xx.x,xx.xxx.xxx.xxx,xxxxx,xxxx,T,O,A,E,,,,","xxxxxxxxxx,xx.xxx.xx.x,xx.xxx.x.x,xxxxx,xxx,T,O,A,E,,,,","xxxxxxxxxx,xx.xxx.xx.x,xx.xxx.x.x,xxxxx,xxx,T,O,A,B,,,,","xxxxxxxxxx,xx.xxx.xx.x,xx.xxx.x.x,xxxxx,xxx,T,O,A,E,,,,","xxxxxxxxxx,xx.xxx.xx.x,xx.xxx.x.x,xxxxx,xxx,T,O,A,B,,,,","xxxxxxxxxx,xx.xxx.xx.x,x.xx.xx.xxx,xxxxx,xxxx,T,O,A,B,,,,","xxxxxxxxxx,xx.xxx.xx.x,xx.xxx.x.x,xxxxx,xxx,T,O,A,E,,,,","xxxxxxxxxx,xx.xxx.xx.x,xx.xxx.x.x,xxxxx,xxx,T,O,A,B,,,,","xxxxxxxxxx,xx.xxx.xx.x,xx.xxx.x.x,xxxxx,xxx,T,O,A,E,,,,","xxxxxxxxxx,xx.xxx.xx.x,x.xx.xx.xxx,xxxxx,xxxx,T,O,A,E,,,,","xxxxxxxxxx,xx.xxx.xx.x,xx.xxx.x.xx,xxxxx,xxxx,T,O,A,E,,,,"]}]}]}},{"time":"xxxx-xx-xxTxx:xx:xx.xxxxxxxZ","systemId":"bxxxexxx-xfxx-xbxe-becx-xxdfxxxxxxxx","macAddress":"xxxDxAxEExCx","category":"NetworkSecurityGroupFlowEvent","resourceId":"/SUBSCRIPTIONS/XXxXXXx-XXXx-xxxx-Xxxx-xXxxxxXXxXxX/RESOURCEGROUPS/MCSPUSxNETWORK/PROVIDERS/MICROSOFT.NETWORK/NETWORKSECURITYGROUPS/USxPORINDI","operationName":"NetworkSecurityGroupFlowEvents","properties":{"Version":x,"flows":[{"rule":"UserRule_servicechecks","flows":[{"mac":"xxxDxAxEExCx","flowTuples":["xxxxxxxxxx,xx.xxx.x.xxx,xx.xxx.xx.x,xxxxx,xxx,T,I,A,E,x,xxx,x,xxx","xxxxxxxxxx,xx.xxx.x.xxx,xx.xxx.xx.x,xxxxx,xxx,T,I,A,B,,,,","xxxxxxxxxx,xx.xxx.x.xxx,xx.xxx.xx.x,xxxxx,xxx,T,I,A,E,x,xxx,x,xxx","xxxxxxxxxx,xx.xxx.x.xxx,xx.xxx.xx.x,xxxxx,xxx,T,I,A,B,,,,","xxxxxxxxxx,xx.xxx.x.xxx,xx.xxx.xx.x,xxxxx,xxx,T,I,A,E,x,xxx,x,xxx","xxxxxxxxxx,xx.xxx.x.xxx,xx.xxx.xx.x,xxxxx,xxx,T,I,A,B,,,,","xxxxxxxxxx,xx.xxx.x.xxx,xx.xxx.xx.x,xxxxx,xxx,T,I,A,E,x,xxx,x,xxx","xxxxxxxxxx,xx.xxx.x.xxx,xx.xxx.xx.x,xxxxx,xxx,T,I,A,B,,,,","xxxxxxxxxx,xx.xxx.x.xxx,xx.xxx.xx.x,xxxxx,xxx,T,I,A,E,x,xxx,x,xxx","xxxxxxxxxx,xx.xxx.x.xxx,xx.xxx.xx.x,xxxxx,xxx,T,I,A,B,,,,","xxxxxxxxxx,xx.xxx.x.xxx,xx.xxx.xx.x,xxxxx,xxx,T,I,A,E,x,xxx,x,xxx","xxxxxxxxxx,xx.xxx.x.xxx,xx.xxx.xx.x,xxxxx,xxx,T,I,A,B,,,,","xxxxxxxxxx,xx.xxx.x.xxx,xx.xxx.xx.x,xxxxx,xxx,T,I,A,E,x,xxx,x,xxx","xxxxxxxxxx,xx.xxx.x.xxx,xx.xxx.xx.x,xxxxx,xxx,T,I,A,B,,,,","xxxxxxxxxx,xx.xxx.x.xxx,xx.xxx.xx.x,xxxxx,xxx,T,I,A,E,x,xxx,x,xxx","xxxxxxxxxx,xx.xxx.x.xxx,xx.xxx.xx.x,xxxxx,xxx,T,I,A,B,,,,"]}]},{"rule":"DefaultRule_AllowVnetOutBound","flows":[{"mac":"xxxDxAxEExCx","flowTuples":["xxxxxxxxxx,xx.xxx.xx.x,xx.xxx.xx.xx,xxxxx,xxxx,T,O,A,B,,,,","xxxxxxxxxx,xx.xxx.xx.x,xx.xxx.x.x,xxxxx,xxx,T,O,A,B,,,,","xxxxxxxxxx,xx.xxx.xx.x,xx.xxx.x.x,xxxxx,xxx,T,O,A,E,,,,","xxxxxxxxxx,xx.xxx.xx.x,xx.xxx.x.x,xxxxx,xxx,T,O,A,B,,,,","xxxxxxxxxx,xx.xxx.xx.x,xx.xxx.x.x,xxxxx,xxx,T,O,A,E,,,,","xxxxxxxxxx,xx.xxx.xx.x,xx.xxx.x.x,xxxxx,xxxxx,T,O,A,E,,,,","xxxxxxxxxx,xx.xxx.xx.x,xx.xxx.x.x,xxxxx,xxx,T,O,A,E,,,,","xxxxxxxxxx,xx.xxx.xx.x,xx.xxx.xx.xx,xxxxx,xxx,T,O,A,E,,,,","xxxxxxxxxx,xx.xxx.xx.x,xx.xxx.x.x,xxxxx,xxx,T,O,A,E,,,,","xxxxxxxxxx,xx.xxx.xx.x,xx.xxx.x.x,xxxxx,xxx,T,O,A,E,,,,","xxxxxxxxxx,xx.xxx.xx.x,xx.xxx.x.x,xxxxx,xxx,T,O,A,B,,,,","xxxxxxxxxx,xx.xxx.xx.x,xx.xxx.x.xx,xxxxx,xxxx,T,O,A,B,,,,","xxxxxxxxxx,xx.xxx.xx.x,xx.xxx.x.x,xxxxx,xxx,T,O,A,B,,,,","xxxxxxxxxx,xx.xxx.xx.x,xx.xxx.x.x,xxxxx,xxx,T,O,A,E,,,,","xxxxxxxxxx,xx.xxx.xx.x,xx.xxx.xxx.xx,xxxxx,xxxx,T,O,A,E,,,,","xxxxxxxxxx,xx.xxx.xx.x,xx.xxx.x.x,xxxxx,xxx,T,O,A,E,,,,","xxxxxxxxxx,xx.xxx.xx.x,xx.xxx.x.x,xxxxx,xxx,T,O,A,E,,,,","xxxxxxxxxx,xx.xxx.xx.x,xx.xxx.x.x,xxxxx,xxx,T,O,A,B,,,,","xxxxxxxxxx,xx.xxx.xx.x,xx.xxx.x.x,xxxxx,xxx,T,O,A,E,,,,","xxxxxxxxxx,xx.xxx.xx.x,xx.xxx.x.x,xxxxx,xxx,T,O,A,E,,,,","xxxxxxxxxx,xx.xxx.xx.x,xx.xxx.x.x,xxxxx,xxx,T,O,A,B,,,,","xxxxxxxxxx,xx.xxx.xx.x,xx.xxx.xxx.xxx,xxxxx,xxxx,T,O,A,B,,,,","xxxxxxxxxx,xx.xxx.xx.x,xx.xxx.x.x,xxxxx,xxx,T,O,A,B,,,,","xxxxxxxxxx,xx.xxx.xx.x,xx.xxx.x.x,xxxxx,xxx,T,O,A,E,,,,","xxxxxxxxxx,xx.xxx.xx.x,xx.xxx.x.x,xxxxx,xxx,T,O,A,B,,,,","xxxxxxxxxx,xx.xxx.xx.x,x.xx.xx.xxx,xxxxx,xxxx,T,O,A,B,,,,","xxxxxxxxxx,xx.xxx.xx.x,xx.xxx.x.xx,xxxxx,xxxx,T,O,A,E,,,,","xxxxxxxxxx,xx.xxx.xx.x,xx.xxx.x.x,xxxxx,xxx,T,O,A,E,,,,"]}]}]}},{"time":"xxxx-xx-xxTxx:xx:xx.xxxxxxxZ","systemId":"bxxxexxx-xfxx-xbxe-becx-xxdfxxxxxxxx","macAddress":"xxxDxAxEExCx","category":"NetworkSecurityGroupFlowEvent","resourceId":"/SUBSCRIPTIONS/XXxXXXx-XXXx-xxxx-Xxxx-xXxxxxXXxX/RESOURCEGROUPS/MCSPUSxNETWORK/PROVIDERS/MICROSOFT.NETWORK/NETWORKSECURITYGROUPS/USxPORINDI","operationName":"NetworkSecurityGroupFlowEvents","properties":{"Version":x,"flows":[{"rule":"UserRule_servicechecks","flows":[{"mac":"xxxDxAxEExCx","flowTuples":["xxxxxxxxxx,xx.xxx.x.xxx,xx.xxx.xx.x,xxxxx,xxx,T,I,A,E,x,xxx,x,xxx","xxxxxxxxxx,xx.xxx.x.xxx,xx.xxx.xx.x,xxxxx,xxx,T,I,A,B,,,,","xxxxxxxxxx,xx.xxx.x.xxx,xx.xxx.xx.x,xxxxx,xxx,T,I,A,E,x,xxx,x,xxx","xxxxxxxxxx,xx.xxx.x.xxx,xx.xxx.xx.x,xxxxx,xxx,T,I,A,B,,,,","xxxxxxxxxx,xx.xxx.x.xxx,xx.xxx.xx.x,xxxxx,xxx,T,I,A,E,x,xxx,x,xxx","xxxxxxxxxx,xx.xxx.x.xxx,xx.xxx.xx.x,xxxxx,xxx,T,I,A,B,,,,","xxxxxxxxxx,xx.xxx.x.xxx,xx.xxx.xx.x,xxxxx,xxx,T,I,A,E,x,xxx,x,xxx","xxxxxxxxxx,xx.xxx.x.xxx,xx.xxx.xx.x,xxxxx,xxx,T,I,A,B,,,,","xxxxxxxxxx,xx.xxx.x.xxx,xx.xxx.xx.x,xxxxx,xxx,T,I,A,E,x,xxx,x,xxx","xxxxxxxxxx,xx.xxx.x.xxx,xx.xxx.xx.x,xxxxx,xxx,T,I,A,B,,,,","xxxxxxxxxx,xx.xxx.x.xxx,xx.xxx.xx.x,xxxxx,xxx,T,I,A,E,x,xxx,x,xxx","xxxxxxxxxx,xx.xxx.x.xxx,xx.xxx.xx.x,xxxxx,xxx,T,I,A,B,,,,","xxxxxxxxxx,xx.xxx.x.xxx,xx.xxx.xx.x,xxxxx,xxx,T,I,A,E,x,xxx,x,xxx","xxxxxxxxxx,xx.xxx.x.xxx,xx.xxx.xx.x,xxxxx,xxx,T,I,A,B,,,,","xxxxxxxxxx,xx.xxx.x.xxx,xx.xxx.xx.x,xxxxx,xxx,T,I,A,E,x,xxx,x,xxx","xxxxxxxxxx,xx.xxx.x.xxx,xx.xxx.xx.x,xxxxx,xxx,T,I,A,B,,,,","xxxxxxxxxx,xx.xxx.x.xxx,xx.xxx.xx.x,xxxxx,xxx,T,I,A,E,x,xxx,x,xxx"]}]},{"rule":"DefaultRule_AllowVnetOutBound","flows":[{"mac":"xxxSxAxSSxVx","flowTuples":["xxxxxxxxxx,xx.xxx.xx.x,xx.xxx.x.x,xxxxx,xxx,T,O,A,B,,,,","xxxxxxxxxx,xx.xxx.xx.x,xx.xxx.x.x,xxxxx,xxx,T,O,A,E,,,,","xxxxxxxxxx,xx.xxx.xx.x,xx.xxx.x.x,xxxxx,xxx,T,O,A,B,,,,","xxxxxxxxxx,xx.xxx.xx.x,xx.xxx.xx.xx,xxxxx,xxx,U,O,A,B,,,,","xxxxxxxxxx,xx.xxx.xx.x,xx.xxx.xx.xx,xxxxx,xxx,T,O,A,B,,,,","xxxxxxxxxx,xx.xxx.xx.x,xx.xxx.x.x,xxxxx,xxx,T,O,A,E,,,,","xxxxxxxxxx,xx.xxx.xx.x,xx.xxx.x.x,xxxxx,xxx,T,O,A,B,,,,","xxxxxxxxxx,xx.xxx.xx.x,xx.xxx.x.x,xxxxx,xxx,T,O,A,B,,,,","xxxxxxxxxx,xx.xxx.xx.x,xx.xxx.x.x,xxxxx,xxxxx,T,O,A,B,,,,","xxxxxxxxxx,xx.xxx.xx.x,xx.xxx.x.x,xxxxx,xxx,T,O,A,B,,,,","xxxxxxxxxx,xx.xxx.xx.x,xx.xxx.x.x,xxxxx,xxx,T,O,A,B,,,,","xxxxxxxxxx,xx.xxx.xx.x,xx.xxx.x.x,xxxxx,xxx,T,O,A,B,,,,","xxxxxxxxxx,xx.xxx.xx.x,xx.xxx.x.x,xxxxx,xxx,T,O,A,B,,,,","xxxxxxxxxx,xx.xxx.xx.x,xx.xxx.x.x,xxxxx,xxx,T,O,A,B,,,,","xxxxxxxxxx,xx.xxx.xx.x,xx.xxx.x.x,xxxxx,xxx,T,O,A,B,,,,","xxxxxxxxxx,xx.xxx.xx.x,xx.xxx.x.x,xxxxx,xxx,T,O,A,B,,,,","xxxxxxxxxx,xx.xxx.xx.x,xx.xxx.x.x,xxxxx,xxx,T,O,A,B,,,,","xxxxxxxxxx,xx.xxx.xx.x,xx.xxx.x.x,xxxxx,xxxxx,T,O,A,B,,,,","xxxxxxxxxx,xx.xxx.xx.x,xx.xxx.x.xx,xxxxx,xxxx,T,O,A,B,,,,","xxxxxxxxxx,xx.xxx.xx.x,xx.xxx.x.x,xxxxx,xxx,T,O,A,B,,,,","xxxxxxxxxx,xx.xxx.xx.x,x.xx.xx.xxx,xxxxx,xxxx,T,O,A,E,,,,","xxxxxxxxxx,xx.xxx.xx.x,xx.xxx.x.x,xxxxx,xxx,T,O,A,E,,,,","xxxxxxxxxx,xx.xxx.xx.x,xx.xxx.x.x,xxxxx,xxx,T,O,A,B,,,,","xxxxxxxxxx,xx.xxx.xx.x,xx.xxx.x.x,xxxxx,xxx,T,O,A,E,xxx,xxxxx,xxx,xxxxxx","xxxxxxxxxx,xx.xxx.xx.x,xx.xxx.x.x,xxxxx,xxx,T,O,A,E,x,xxx,x,xxx","xxxxxxxxxx,xx.xxx.xx.x,xx.xxx.x.x,xxxxx,xxx,T,O,A,B,,,,","xxxxxxxxxx,xx.xxx.xx.x,xx.xxx.x.x,xxxxx,xxx,T,O,A,E,,,,","xxxxxxxxxx,xx.xxx.xx.x,xx.xxx.x.x,xxxxx,xxx,T,O,A,B,,,,","xxxxxxxxxx,xx.xxx.xx.x,xx.xxx.x.x,xxxxx,xxx,T,O,A,E,xx,xxxx,xx,xxxxx","xxxxxxxxxx,xx.xxx.xx.x,xx.xxx.x.x,xxxxx,xxxxx,T,O,A,E,xx,xxxx,xx,xxxxx","xxxxxxxxxx,xx.xxx.xx.x,xx.xxx.x.x,xxxxx,xxx,T,O,A,E,xx,xxxxx,xx,xxxxx","xxxxxxxxxx,xx.xxx.xx.x,xx.xxx.x.x,xxxxx,xxx,T,O,A,E,xx,xxxx,xx,xxxxx","xxxxxxxxxx,xx.xxx.xx.x,xx.xxx.x.x,xxxxx,xxx,T,O,A,E,,,,","xxxxxxxxxx,xx.xxx.xx.x,xx.xxx.x.x,xxxxx,xxx,T,O,A,B,,,,","xxxxxxxxxx,xx.xxx.xx.x,xx.xxx.xxx.xxx,xxxxx,xxxx,T,O,A,B,,,,","xxxxxxxxxx,xx.xxx.xx.x,xx.xxx.x.x,xxxxx,xxx,T,O,A,E,,,,","xxxxxxxxxx,xx.xxx.xx.x,xx.xxx.x.x,xxxxx,xxx,T,O,A,B,,,,","xxxxxxxxxx,xx.xxx.xx.x,xx.xxx.x.x,xxxxx,xxx,T,O,A,E,,,,","xxxxxxxxxx,xx.xxx.xx.x,xx.x.xx.xxx,xxxxx,xxx,T,O,A,B,,,,","xxxxxxxxxx,xx.xxx.xx.x,xx.xxx.x.x,xxxxx,xxx,T,O,A,E,,,,","xxxxxxxxxx,xx.xxx.xx.x,xx.xxx.xxx.xx,xxxxx,xxxx,T,O,A,B,,,,","xxxxxxxxxx,xx.xxx.xx.x,xx.xxx.x.xx,xxxxx,xxxx,T,O,A,E,,,,","xxxxxxxxxx,xx.xxx.xx.x,xx.xxx.x.x,xxxxx,xxx,T,O,A,E,,,,"]}]}]}},{"time":"xxxx-xx-xxTxx:xx:xx.xxxxxxxZ","systemId":"bxxxexxx-xfxx-xbxe-becx-xxdfxxxxxxxx","macAddress":"xxxSxSxXXxCx","category":"NetworkSecurityGroupFlowEvent","resourceId":"/SUBSCRIPTIONS/XXxXXXx-XXXx-xxxx-Xxxx-xXxxxxXXxXxX/RESOURCEGROUPS/MCSPUSxNETWORK/PROVIDERS/MICROSOFT.NETWORK/NETWORKSECURITYGROUPS/USxXXXXXXX","operationName":"NetworkSecurityGroupFlowEvents","properties":{"Version":x,"flows":[{"rule":"UserRule_servicechecks","flows":[{"mac":"xxxDxAxEExCx","flowTuples":["xxxxxxxxxx,xx.xxx.x.xxx,xx.xxx.xx.x,xxxxx,xxx,T,I,A,B,,,,","xxxxxxxxxx,xx.xxx.x.xxx,xx.xxx.xx.x,xxxxx,xxx,T,I,A,E,x,xxx,x,xxx","xxxxxxxxxx,xx.xxx.x.xxx,xx.xxx.xx.x,xxxxx,xxx,T,I,A,B,,,,","xxxxxxxxxx,xx.xxx.x.xxx,xx.xxx.xx.x,xxxxx,xxx,T,I,A,E,x,xxx,x,xxx","xxxxxxxxxx,xx.xxx.x.xxx,xx.xxx.xx.x,xxxxx,xxx,T,I,A,B,,,,","xxxxxxxxxx,xx.xxx.x.xxx,xx.xxx.xx.x,xxxxx,xxx,T,I,A,E,x,xxx,x,xxx","xxxxxxxxxx,xx.xxx.x.xxx,xx.xxx.xx.x,xxxxx,xxx,T,I,A,B,,,,","xxxxxxxxxx,xx.xxx.x.xxx,xx.xxx.xx.x,xxxxx,xxx,T,I,A,E,x,xxx,x,xxx","xxxxxxxxxx,xx.xxx.x.xxx,xx.xxx.xx.x,xxxxx,xxx,T,I,A,B,,,,","xxxxxxxxxx,xx.xxx.x.xxx,xx.xxx.xx.x,xxxxx,xxx,T,I,A,E,x,xxx,x,xxx","xxxxxxxxxx,xx.xxx.x.xxx,xx.xxx.xx.x,xxxxx,xxx,T,I,A,B,,,,","xxxxxxxxxx,xx.xxx.x.xxx,xx.xxx.xx.x,xxxxx,xxx,T,I,A,E,x,xxx,x,xxx","xxxxxxxxxx,xx.xxx.x.xxx,xx.xxx.xx.x,xxxxx,xxx,T,I,A,B,,,,","xxxxxxxxxx,xx.xxx.x.xxx,xx.xxx.xx.x,xxxxx,xxx,T,I,A,E,x,xxx,x,xxx","xxxxxxxxxx,xx.xxx.x.xxx,xx.xxx.xx.x,xxxxx,xxx,T,I,A,B,,,,"]}]},
... View more
10-04-2019
01:15 AM
Thanks a lot Rich.
Your comment helped me to upgrade credential package of UF.
The steps you followed sound correct. Try again, but this time extract splunkclouduf.spl into the UF's apps directory instead of copying it from the HF. Use tar -zxf splunkclouduf.spl -C /opt/splunkforwarder/etc/apps to extract the app.
Regards,
Tejas
... View more
09-20-2019
11:43 AM
Hey Xavier,
Sorry I did not try your suggestion yet.
I will do and let you know the results.
Regards,
Tejas
... View more
06-21-2019
03:21 AM
Thanks a lot Frank 🙂 and other folks Vijeta and paramagurukarthikeyan for your answers.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
02-18-2022
11:02 AM
|
