About aportela_work

aportela_work · ‎10-02-2013

Thanks... good info. First and last tips work and are helpful. But, do you have code that would mimic search page results, left hand margin, "Selected Fields" or "Interest in Fields"? Here, Splunk (by default) provides a list of fields and respective # of distinct values. Click on one, and can see the % info of each value per field, and % not-null of entire field. Regardless, previous info is useful and helps with the data profiling effort.... Thanks again!

aportela_work · ‎10-02-2013

Does anyone know how to generate a report listing all fields (from an index) and their respective info (example follows)? % not null of each field, different values of each field, % of each field per value. This would be like the information seen in the Search page, on the left hand side, that shows "selected fields" and "Interesting Fields". However, instead of being interactive (like in Search Page), it would be a search query that can run to generate a report. And, the report could be in table format or csv file or just regular output. Any and all help would be much appreciated. Cheers... Al

aportela_work · ‎09-19-2013

Forget to elaborate: Can find/delete this Correlated Search like any regular search; from the "Searches and Reports" page of the Manager UI.

aportela_work · ‎09-19-2013

Thanks for looking into this.

aportela_work · ‎09-19-2013

hey, we found the solution, and below explains the process: . If the Correlated Search was called "Non-standard Access Detect" ... and was created/configured with the "Access" domain assigned ... the search will part of the SA-AccessProtection app ... ... So, will want to look for a search title that appends the domain and search names. That is where we found a place to delete the specific Correlated Search. Hurrah 🙂

aportela_work · ‎09-19-2013

Hi - Am having problems removing a "correlation search". Have tried this via the SE UI from inside the editor and within the "correlation searches" list/page. Can't find a delete or remove button or anything else. Am on Splunk 5.02 with ES 2.4 app. Any ideas? Thanks... Al

aportela_work · ‎09-18-2013

Yep, that's what I thought (based on the install guide, which mentioned Windows 7 & 8, but not XP). Also, the hardware requirements for search head seemed pretty hefty, which makes sense for Splunking thru mass quantities of data. Appreciate the feedback, and will pass on to others in my organization, who want us to convert our laptops into development environments (including search heads). Cheers... Al

aportela_work · ‎09-18-2013

Thanks for the 5.0.4 tip. And, i think that the system owners will eventually get there, it may just take several months.

aportela_work · ‎09-16-2013

Was requested that I do development on my laptop, and to install Splunk ES 2.4 on my laptop (along with Splunk Enterprise 5.02, SideView Utility 1.35). Laptop is on Windows XP SP3 and has only 2 GB of ram. Is Splunk ES 2.4 even supported on this hardware platform? Fyi, i did install the aforementioned, but my laptop started to shutdown (hard) intermittently and abruptly. At times, staying on for a few minutes, other times shutting down as soon as rebooted and logged in. Hence, i had to deinstall. Booted up without loggin in; had the admin guy remote into my laptop & disable the Splunk processes via MS-Services; then I logged in and uninstalled all things Splunk. Laptop is now working great, and I can still develop via my web browser going to the Linux based search head. However, would have been better if could get Splunk ES running on my laptop. Some other data points: 1) I just need to perform correlated searches from my laptop. 2) Search head would be on laptop pointing to existing indexers. 3) Had successfully installed/configured Splunk Enterprise 5.02 (w/out ES). 4) And was performing non-correlated distributed searches. 5) (using existing linux based search heads). Any and all feedback would be appreciated. yep, basically just trying to understand if a laptop with XP can handle Splunk ES app. Many thanks... Al

aportela_work · ‎09-16-2013

Belated thanks for your response, which did help us test regex from "Splunk Search". We were able to tweak as follows and successfully tested in our env: REGEX=_raw=(?msi).*Logon\sType:\s*3\D . However, we were still having issues with the actual regex configuration, where had done the following on the the heavy forwarder, but still could not filter out events. props.conf [source::WinEventLog:Security] TRANSFORMS-nullq=Remove_Logon_Type_3 transform.conf [Remove_Logon_Type_3] REGEX=(?msi).*Logon\sType:\s*3\D DEST_KEY=queue FORMAT=nullQueue Please let me know if any of the config info looks out of palce. And, feel free to post and additional comments, ideas, etc. Thanks again... Al

Posts	10
Solutions	0
Karma Given	0
Karma Received	1
Member Since	‎09-04-2013

Online Status	Offline
Date Last Visited	‎06-05-2020 02:04 AM

Data Discovery of Index Fields

ES (Enterprise Security) | Correlation Searches |...

Splunk Enterprise Security on Windows XP Laptop?

Re: Data Discovery of Index Fields

Data Discovery of Index Fields

Re: ES (Enterprise Security) | Correlation Search...

Re: ES (Enterprise Security) | Correlation Search...

Re: ES (Enterprise Security) | Correlation Search...

ES (Enterprise Security) | Correlation Searches |...

Re: Splunk Enterprise Security on Windows XP Lapto...

Re: Splunk Enterprise Security on Windows XP Lapto...

Splunk Enterprise Security on Windows XP Laptop?

Re: REGEX to filter out event records