Hi, I have a data model trained outside of Splunk using the K-means algorithm and sampled data-set. I haven't tried the built-in algorithms that come with the MLTK app in Splunk yet, as I am more familiar with using python scripts on my local computer for ML. Is there a way to import a trained model into Splunk which can then be used to "apply" on new data? We have Splunk Enterprise Version: 7.3.3. Any help would be appreciated. ... View more

Hi, So, I have set up an external lookup script, following the example of external_lookup.py that is shipped with Splunk by default. My external lookup script, however, calls another perl script that does a postgres DB lookup of the fields passed to it. The snippet of the external lookup script (mac_info.py written in python that calls "ip" which is written in perl) is: #!/usr/bin/env python import sys, os import csv import subprocess, datetime import string def hostlookup(ip): if ip is None: print >> sys.stderr, "ERROR No client_ip provided ..." return '' try: output = subprocess.check_output(['./ip',str(ip)]) # calls ip (perl script) #print "Inside try" #print output output= "".join(c for c in output if c not in ('"',',')) return output except: print >> sys.stderr, "ERROR unknown exec: " return '' The script works fine when run from the command line: $ /opt/splunk/bin/python mac_info.py host ip < input.csv host,ip Mac address: xx.xx.xx.xx.xx.xx ,192.168.z.y Mac address: yy.yy.yy.yy.yy.yy ,192.168.x.y But when called from the search head, it does not show any results for "host" field, also no errors pop up. Have read some posts in past saying that the Splunk python modules are limited and have to write some kind of wrappers to make it work. But don't really know what modules (perl/python) causing problems and how to get around to it. P.S: I have put the scripts (both perl n python) in /opt/splunk/etc/system/bin/ dir and added a parameter in transforms.conf like: [ip2mac] external_cmd = mac_info.py host ip fields_list = host, ip Any help appreciated. Thanks! ... View more

Hi, I am tired of making this filter work but unfortunately nothing worked. I have Windows Security events where there are two places where "Account Name" field appears . For ex (one under "Subject" and one under "New Logon" section): LogName=Security SourceName=Microsoft Windows security auditing. EventCode=4624 EventType=0 Type=Information ComputerName=comp-1 TaskCategory=Logon OpCode=Info RecordNumber=123456789 Keywords=Audit Success Message=An account was successfully logged on. Subject: Security ID: NULL SID Account Name: - Account Domain: - Logon ID: 0x0 Logon Type: 3 Impersonation Level: Impersonation New Logon: Security ID: XYZ\name1$ Account Name: name1$ Account Domain: XYZ Logon ID: 0xxxxxx Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x0 Process Name: - Network Information: Workstation Name: xyz Source Network Address: x.x.x.x Source Port: 60000 I want to filter any event that has a "$" character in the SECOND Account Name field because sometimes the first "Account Name" is empty and that's why I don't really care about that one. Hence tried following on Win Universal Forwarder's inputs.conf: #filtering win logs logis within the servers. [WinEventLog://Security] disabled = 0 index = test sourcetype = win blacklist1 = EventCode="4662" Message=”Object Type:\s+(?!groupPolicyContainer)” blacklist2 = EventCode="566" Message=”Object Type:\s+(?!groupPolicyContainer)” blacklist3 = 560,567,7035,7036,592,593,595,4656,4663 blacklist4 = Message="Account Name:\s*((.|\n)*)Account Name:\s+(.*\$)" blacklist5 = Message="Account Name:[\s]*(HealthMailbox.*)" The blacklist4 is the one I am trying to make work, to filter events with "$" sign in second "Account Name" field, but it doesn't work. I am pretty sure that the regex is correct as when I tried the same regex in other online regex checkers against the above event, it matches. Hence thinking, is there any special regex language that Splunk uses and hence the above regex won't work? Any help appreciated. Thanks, Fatema. ... View more

Hi, I have Splunk Universal Forwarder running on my BRO-IDS sensor machine and monitoring a log directory where Bro rotates the files every hour and the rotated files are kept elsewhere in a other dir in gz format. The rotation happens at the end of every hour and the log file name never changes (i.e, conn.log, http.log etc will remain conn.log, http.log in the directory that Splunk is monitoring, but will have new data for that hour). I was happily indexing some of my Bro log files thinking that Splunk will know whenever the log files will get rotated and starts reading the new file (with the same name) from the beginning when it will calculate checksum for that file. When I searched the events in my search head corresponding to the Bro logs, every entry had 12 duplicated indexed events with weird time stamps (look at the unix ts in event) in the events like : 14689504660 C8129F2JOKFPessVv4 119.255.39.66 1117 xxx.xx.xxx.xxx 14330 tcp - 3.015041 0 0 S0 F T 0 S 2 104 0 0 (empty) 14689504660 C8129F2JOKFPessVv4 119.255.39.66 1117 xxx.xx.xxx.xxx 14330 tcp - 3.015041 0 0 S0 F T 0 S 2 104 0 0 (empty) 14689504660 C8129F2JOKFPessVv4 119.255.39.66 1117 xxx.xx.xxx.xxx 14330 tcp - 3.015041 0 0 S0 F T 0 S 2 104 0 0 (empty) 14689504660 C8129F2JOKFPessVv4 119.255.39.66 1117 xxx.xx.xxx.xxx 14330 tcp - 3.015041 0 0 S0 F T 0 S 2 104 0 0 (empty) ....... ....... ..... So on up to 12 events This exceeded our per day license usage (ofc ourse if Splunk is re-indexing same file, that is ~12GB, 12 times, it is going to exceed the license). Hence I turned off the monitoring of my Bro logs to trouble shoot the issue, and couldn't figure out why Splunk is doing this. Also looked into the Splunkd logs on forwarder which looked kind of normal (log files got read every hour): $ less splunkd.log | grep '/mnt/ssd/bro/spool/manager/conn.log' | grep '07-19-2016' | more 07-19-2016 00:16:42.532 -0400 INFO WatchedFile - Will begin reading at offset=0 for file='/mnt/ssd/bro/spool/manager/conn.log'. 07-19-2016 01:14:21.794 -0400 INFO WatchedFile - Will begin reading at offset=0 for file='/mnt/ssd/bro/spool/manager/conn.log'. 07-19-2016 01:14:21.794 -0400 WARN TailReader - Enqueing a very large file=/mnt/ssd/bro/spool/manager/conn.log in the batch reader, with bytes_to_read=359045778, reading of other large files could be delayed 07-19-2016 02:39:12.090 -0400 INFO WatchedFile - Will begin reading at offset=0 for file='/mnt/ssd/bro/spool/manager/conn.log'. 07-19-2016 02:39:12.115 -0400 WARN TailReader - Enqueing a very large file=/mnt/ssd/bro/spool/manager/conn.log in the batch reader, with bytes_to_read=479827021, reading of other large files could be delayed 07-19-2016 03:00:15.088 -0400 INFO WatchedFile - Will begin reading at offset=0 for file='/mnt/ssd/bro/spool/manager/conn.log'. 07-19-2016 04:00:15.306 -0400 INFO WatchedFile - Will begin reading at offset=0 for file='/mnt/ssd/bro/spool/manager/conn.log'. 07-19-2016 05:00:24.703 -0400 INFO WatchedFile - Will begin reading at offset=0 for file='/mnt/ssd/bro/spool/manager/conn.log'. 07-19-2016 06:00:15.284 -0400 INFO WatchedFile - Will begin reading at offset=0 for file='/mnt/ssd/bro/spool/manager/conn.log'. 07-19-2016 06:56:11.571 -0400 INFO WatchedFile - Will begin reading at offset=0 for file='/mnt/ssd/bro/spool/manager/conn.log'. 07-19-2016 07:02:49.600 -0400 INFO WatchedFile - Will begin reading at offset=0 for file='/mnt/ssd/bro/spool/manager/conn.log'. 07-19-2016 08:54:35.995 -0400 INFO WatchedFile - Will begin reading at offset=0 for file='/mnt/ssd/bro/spool/manager/conn.log'. 07-19-2016 08:54:36.191 -0400 INFO TailReader - Will retry path="/mnt/ssd/bro/spool/manager/conn.log" after deferring for 10000ms, initCRC changed after being queued (before=0xcb0d087403c5153a, after=0x33c7d5dc84662354). File growth rate must be higher than indexing or forwarding rate. 07-19-2016 08:54:46.193 -0400 INFO WatchedFile - Will begin reading at offset=0 for file='/mnt/ssd/bro/spool/manager/conn.log'. 07-19-2016 08:54:46.213 -0400 WARN TailReader - Enqueing a very large file=/mnt/ssd/bro/spool/manager/conn.log in the batch reader, with bytes_to_read=1013010522, reading of other large files could be de layed 07-19-2016 09:10:36.385 -0400 INFO WatchedFile - Will begin reading at offset=0 for file='/mnt/ssd/bro/spool/manager/conn.log'. 07-19-2016 09:10:36.406 -0400 WARN TailReader - Enqueing a very large file=/mnt/ssd/bro/spool/manager/conn.log in the batch reader, with bytes_to_read=215379268, reading of other large files could be del ayed 07-19-2016 10:00:18.237 -0400 INFO WatchedFile - Will begin reading at offset=0 for file='/mnt/ssd/bro/spool/manager/conn.log'. 07-19-2016 11:00:14.982 -0400 INFO WatchedFile - Will begin reading at offset=0 for file='/mnt/ssd/bro/spool/manager/conn.log'. Not sure what is causing the re-indexing (approx 12 times) of the same file in Splunk. Any help would be greatly appreciated. Thanks. ... View more

So after spending a lot of time googling this issue, finally I get some mixed comments. Hence thought of asking the question here to get the clarification on the issue. Starting with the environment, I have an indexer cluster of 3 indexers, two independent search heads, and one Universal forwarder. My question is where the BRO IDS app goes and how it works? What I have done is - I have installed the app on both of my search heads (as per general convention while dealing with apps), and my Universal Forwarder is monitoring the Bro log directory (yes I have installed UF on my Bro sensor machine). I am getting the monitored Bro logs in my indexers and am able to search them via search heads, but the app is just sitting there doing nothing it seems. The documentation I have read so far says that you need to install app on the heavy forwarder that is monitoring your log dir and have to set the inputs path in the app instead of heavy forwarder's input. (So I think it's stupid for the people who just want to have a forwarder installed on their bro sensor for just forwarding bro logs and for that we need to install heavy forwarder with the app, and that too app will be doing all the forwarding and parsing and heavy forwarder will be just sitting there providing Python support to the app to do its stuff). So my question is: is my above configuration even workable with Bro IDS add-on or do I have to just chuck the idea of using the add-on because I don't want to run a heavy forwarder on my Bro machines? Any comments would be greatly appreciated, as I have already wasted a lot of time dealing with this issue. Thanks, Fatema. ... View more