About teknet9

teknet9 · ‎05-03-2018

Thanks Xpac, so what would be your recommendation with limited budged ? I have finished all the Splunk free trainings + did my Splunk user certification. My aim is to go deep and have strong foundations (i also use Splunk at work + at home). Since Foundations2 course is expensive i am reading: Exploring Splunk SEARCH PROCESSING LANGUAGE (SPL) PRIMER AND COOKBOOK By David Carasso, Splunk’s Chief Mind + safarii book: Splunk 7 Essentials - Third Edition (both books are still covering a lot of basics which are pretty easy for me) What would you recommendation as the next steps ? Thanks,

teknet9 · ‎05-03-2018

Hello Team, Are the official Splunk courses the only way to get certified ? For example: https://www.splunk.com/en_us/training/courses/splunk-fundamentals-2.html Paying 2000 USD for the course which is relatively simple (especially for somebody who is having experience in Splunk) is a bit too much. Or maybe Splunk does support some partner organisations doing trainings and honour those courses also. For example: https://www.udemy.com/splunk-admin-architect-complete-tutorials-30-days-lab/ They claim to: "Once you have completed all course modules you will be able to clear Splunk Power User and Splunk Admin certification. !" Please help to clarify. Thanks,

teknet9 · ‎04-30-2018

Hello Team, I do have a pivot: | pivot xxxxx RootObject count(RootObject) AS "Count of admin_adminsearch_RMD578e1308ec259874c_at_1525123982_13769" SPLITROW User AS User FILTER User doesNotContain 'mmm' SORT 100 User ROWSUMMARY 0 COLSUMMARY 0 SHOWOTHER 1 I am using FILTER command to exclude all usernames which include mmm. But i need to exclude usernames which include quotation mark character: " How to do that ? Thanks, Michal

teknet9 · ‎04-16-2018

Hello Team, I have a sh script (alarm/action) which acts as a wrapper to python script. I have several problems with splunk python libraries, followed: https://answers.splunk.com/answers/8/can-i-add-python-modules-to-the-splunk-environment.html Did not help at all. But only: copy of /usr/local/lib/python2.7/dist-packages to /opt/splunk/lib/python2.7/site-packages/ Helped a bit. Now my python script fails on SSL connections with error: File "/opt/splunk/lib/python2.7/site-packages/requests/adapters.py", line 506, in send raise SSLError(e, request=request) requests.exceptions.SSLError: HTTPSConnectionPool(host='xxxx.com', port=443): Max retries exceeded with url: /incident.do?JSONv2 (Caused by SSLError("Can't connect to HTTPS URL because the SSL module is not available.",))' What can i do now ? I can execute my python script without any problems from SSH, it's just a problems when executed from Splunk.... Thanks,

teknet9 · ‎04-16-2018

Sorry, a small update, i had a typoo in my script, now i have: sourcetype="cisco:ios" | runshellscript create_inc.sh arg1 arg2 arg3 arg4 arg5 arg6 arg7 "/tmp/test.gz" Exiting with code 2. While if i execute from shell: ./create_inc.sh arg1 arg2 arg3 a4 a5 a6 a7 /tmp/test.gz Everything is working fine (my code is executed, file decopressed and so on). I have my script in /opt/splunk/bin/script code 2 suggest splunk can not find the script ? Why ?

teknet9 · ‎04-16-2018

Hello Team, Troubleshooting for few hours the most basic script executed as the action. Trying manually (search returning ~90 results): sourcetype="cisco:ios" | runshellscript create_inc.sh arg1 arg2 arg3 arg4 arg5 arg6 arg7 "/tmp/test" got the response: create_inc.sh exited with status code: 1 The script create_inc.sh content: cp $8 >/tmp/ttt (script is executable) I have /tmp/test readable by all. As a result i see /tmp/ttt created (it was not existing) but it's empty. Why ? I want to write mode advanced script like this one: https://answers.splunk.com/answers/149836/how-to-run-an-alert-script-on-field-values-generated-in-splunk.html But can not get the simplest script tested. I have followed troubleshooting guide: http://wiki.splunk.com/Community:TroubleshootingAlertScripts But it's not really helpful. Could you please help me with this most basic script ? Thanks, Michal

teknet9 · ‎10-08-2016

Thank you hunters ! I did not satisfy the 3rd condition, i had default udp/514 data input without sorcetype selected. Once selected syslog, Splunk identifies ISE syslogs correctly and my dashboards are working fine, thanks a lot !

teknet9 · ‎10-08-2016

Hello Team, I have installed Cisco WSA add on, receiving W3C syslogs from my WSA. Trying to configure this app in Splunk as per: http://docs.splunk.com/Documentation/AddOns/released/CiscoWSA/Configureinputsonforwarder And documentation is not clear, what is "\filename" ? Could you please help me ? I do also not understand where do i bind syslogs received from WSA to specific index/sourcetype/filename ? How my splunk instance would know that specific syslog message has been received from WSA and should be processed by WSA application/dashboard ? Thanks,

teknet9 · ‎10-08-2016

Hello Team, I have installed: Splunk Add-on for Cisco Identity Services Splunk for Cisco Identity Services (ISE) I do received all syslogs from my ISE server, can see it with search host=1.2.3.4, but i do not have sourcetype: sourcetype=cisco:ise:syslog My syslogs from ISE are of generic sourcetype=udp:514 (i have a lot of hosts sending udp/514 syslogs to splunk) As a result my application/dashboard does not show any logs, i guess it's configured to search for "sourcetype=cisco:ise:syslog". Question: Should not the application ask me to configure that ? How to fix it, without breaking what i do have currently ? Do i need to create manually that sourcetype ? When going to sourcetypes i do not see it (the only sourcetype with string "cisco" is for asa), but when trying to create "cisco:ise:syslog" i do receive error that source type already exists. Why ? One more: i have clicked "Set up" for "Splunk Add-on for Cisco Identity Services" - but all the settings on that page are for remediation and pxgrid protocol - i do not need that. Just clicked save. I hope that i am not forced to konfigure pxgrid to have a basic ISE dashboard working ? I have also checked i can see multiple event types which are related to ISE, but i do see only one search related to ISE: "Lookup - Locations" - i guess it's not enough - is not it ? Why ? Thanks,

teknet9 · ‎08-29-2016

Hi Martin, I do not see that option in UI, is that possible because of the fact that i have free/trial version in the lab ? (while full/entrprise in the production) ? Can i still do it via conf files in CLI ? Thanks,

teknet9 · ‎08-28-2016

Hello Team, I have a search which is returning statistics (not events). I would like to generate alert and call custome bash script only in case where i have at least 1 statistic result like this: While i do not want to call external script when having 0 statistic results like this: Please keep in mind that for both we do have 1 event found - and that is irrelevant. I have read: http://docs.splunk.com/Documentation/Splunk/6.4.3/Alert/Configuringalertsinsavedsearches.conf And can see: "Alerts use a saved search to look for events". But in my case i am not interested in events but statistics. Possible ? How to launch external script easily in case i have a match and statistic data is produced ? Thanks, Michal

teknet9 · ‎08-27-2016

Sorry it was my typoo, it looks like stats command arguments are case sensitive, so instead of EndPointMACAddress had to use EndpointMacAddress - working fine now 🙂

teknet9 · ‎08-27-2016

Hi Renjith.Nair I can not since then mysql column name is different, so my real query has to remane this field: host="10.62.140.64" MACAddress NOT [dbxquery query="SELECT mac FROM pc.pc" connection=MYSQL shortnames=true | fields mac | rename mac as MACAddress ] But what i find interesting is that it looks like dbxquery is searching only for 100 000 entries ? (while i have 171K) ? But when i try to: add "search MACAddress=00:50:B6:11:EA:CE" to my dbxquery that entry is being returned correctly. Let me paste dbquery results: We can see that mac, while the combined search still returns that record while it should not: So maybe it is the issue with max 100k records ? Can i change it somehow ? Thanks, Michal

teknet9 · ‎08-27-2016

Thank you Somesoni2, It does not work for me. My final search: host="10.62.140.64" CISE_Profiler EndpointMatchedPolicy=Workstation NOT [|dbxquery query="SELECT mac FROM endpoints . endpoints " connection="MYSQL" shortnames=true | fields - _* | rename mac as EndPointMACAddress | table EndPointMACAddress] The first part: "host="10.62.140.64" CISE_Profiler EndpointMatchedPolicy=Workstation" is returning syslog message with "EndpointMacAddress=00:50:B6:11:EA:CE". The second part "|dbxquery query="SELECT mac FROM endpoints . endpoints " connection="MYSQL" shortnames=true | fields - _* | rename mac as EndPointMACAddress | table EndPointMACAddress" is returning the table with EndPointMACAddress column and one of the values is 00:50:B6:11:EA:CE. Why is that happening ? The search like this: host="10.62.140.64" CISE_Profiler EndpointMatchedPolicy=Workstation NOT [00:50:B6:11:EA:CE] is working fine. So it is something wrong with dbxquery conjunction.... Thanks, Michal

teknet9 · ‎08-26-2016

Hello, I want to: - run a search for specific syslog messages - filter out all those which have a corresponding field in mysql table column I wanted to do subsearch like: host="10.62.140.64" Field1 NOT [] and put inside [] my |dbxquery But then noticed that dbxquery is not returning any events which could be used for subsearch but statistics only. Can i use dbquery for subsearch ? (to filter out my main syslog search) ? Could you provide any example ? Thanks, Michal

Posts	18
Solutions	1
Karma Given	0
Karma Received	0
Member Since	‎08-16-2016

Online Status	Offline
Date Last Visited	‎06-05-2020 02:04 AM

Certification: do i need to attend official Splunk...

Pivot FILTER exclude quotation mark character

Action: script python: problem with libraries and ...

Can not run a simple action script

Cisco WSA sourcetype and logpath ?

Splunk ISE add on - no sourcetype=cisco:ise:syslog

Alerts searching for statistics - not events

dbxquery returns statistics instead of events for ...

Map search did not find value for required atribut...

Subsearch NOT with dbxquery

Re: Certification: do i need to attend official Sp...

Certification: do i need to attend official Splunk...

Pivot FILTER exclude quotation mark character

Action: script python: problem with libraries and ...

Re: Can not run a simple action script

Can not run a simple action script

Re: Splunk ISE add on - no sourcetype=cisco:ise:sy...

Cisco WSA sourcetype and logpath ?

Splunk ISE add on - no sourcetype=cisco:ise:syslog

Re: Alerts searching for statistics - not events

Alerts searching for statistics - not events

Re: Map search did not find value for required atr...

Re: Subsearch NOT with dbxquery

Re: dbxquery returns statistics instead of events ...

dbxquery returns statistics instead of events for ...