Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- Find Answers
- :
- About mayler
mayler
Path Finder
Member since:
04-13-2010
11-18-2025
Community Statistics
| Posts | 31 |
| Solutions | 0 |
| Karma Given | 29 |
| Karma Received | 8 |
| Member Since | 04-13-2010 |
Activity Feed
- Karma Why "FormatMessage error" appears in indexed message for Windows security event logs? for mgaraventa_splu. 06-05-2020 12:47 AM
- Karma Re: Filter Input data from universalforwarder port_9514 for mwhite_splunk. 06-05-2020 12:46 AM
- Karma Re: Search pooling and alerting for ngholmieh. 06-05-2020 12:46 AM
- Karma Search pooling and alerting for ngholmieh. 06-05-2020 12:46 AM
- Karma Re: Cannot search using sourcetype but can search with index for araitz. 06-05-2020 12:46 AM
- Karma Cannot search using sourcetype but can search with index for KarunK. 06-05-2020 12:46 AM
- Karma Re: Filter Input data from universalforwarder port_9514 for Ayn. 06-05-2020 12:46 AM
- Karma Re: How do I create a Firewall Report with Both Destination IP and Destination Port? for fwilmot. 06-05-2020 12:46 AM
- Karma How do I create a Firewall Report with Both Destination IP and Destination Port? for jraquino. 06-05-2020 12:46 AM
- Karma Re: No fields to display for this search in GUI for dshakespeare_sp. 06-05-2020 12:46 AM
- Karma No fields to display for this search in GUI for dshakespeare_sp. 06-05-2020 12:46 AM
- Got Karma for Re: How does SPLUNK learn and correlate ?. 06-05-2020 12:46 AM
- Karma Re: How does Active Directory Monitoring Work? for mpatnode. 06-05-2020 12:45 AM
- Karma Re: Does index=_internal count against peak usage license? for benstraw. 06-05-2020 12:45 AM
- Karma Re: Can I run SplunkWeb on port 80 on Linux without running as root? for BunnyHop. 06-05-2020 12:45 AM
- Karma Re: Windows Event Log Collection on 11000 devices for jrodman. 06-05-2020 12:45 AM
- Karma Can splunk indexer or forwarder in trusted network reach out to servers in a DMZ to grab data? for beaudet. 06-05-2020 12:45 AM
- Karma Re: Can splunk indexer or forwarder in trusted network reach out to servers in a DMZ to grab data? for ftk. 06-05-2020 12:45 AM
- Karma Re: How do I create a Field for Mac Address? for ftk. 06-05-2020 12:45 AM
- Karma Re: IIS Log - Timezone for Genti. 06-05-2020 12:45 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 1 |
12-14-2018
02:12 PM
Same issue. UF is 7.1 and Indexer is 7.1.1. Opening Case.
... View more
04-25-2012
11:59 AM
Unfortunately, there is no answer to the issue I experienced.
Removed my splunk install completely and re-installed the latest version as a fresh install. I only kept my transforms and props.conf files. Everything else is brand new.
And the filter is working. I suspect Ayn was on the right track. Something in my configuration was not right. Thanks for the help!
... View more
04-25-2012
09:58 AM
I searched again, this time at /etc/* but still no joy. I really thought that might have been it this time! 🙂 So we all agree the syntax, etc. is good. And this did work in our test environment. But the test environment was brand new. I think I'll just backup my .conf files and install fresh. I'll update.
... View more
04-25-2012
08:17 AM
thank you for the suggestion. I grep -irn TRANSFORMS-wmi /opt/splunk/etc/system/*
only shows the one entry in /local/props.conf
... View more
04-24-2012
04:50 PM
I'm having a similar issue. How does splunk classify these logs as WinEvenLog? My previous, working, installation had
props.conf
[default]
TRANSFORMS-wmi=wminull
transforms.conf
[wminull]
REGEX=(?msi)^EventCode=(4768|4776|4769|4932|4933|5152|5158|4634|4672|5156|4662|4624|7036|5145|5140)D DEST_KEY=queue FORMAT=nullQueue
... View more
04-24-2012
04:49 PM
I'm having a similar issue. How does splunk classify these logs as WinEvenLog? My previous, working, installation had
props.conf
[default]
TRANSFORMS-wmi=wminull
transforms.conf
[wminull]
REGEX=(?msi)^EventCode=(4768|4776|4769|4932|4933|5152|5158|4634|4672|5156|4662|4624|7036|5145|5140)\D
DEST_KEY=queue
FORMAT=nullQueue
... View more
04-24-2012
04:46 PM
thank you for pointing that out. I tried using that earlier but no luck.
... View more
04-24-2012
03:15 PM
First, thanks for taking the time to look at this. Hopefully I'll be able to provide all the information you need to help me out.
I have several extremely chatty windows servers (AD 2008) with a universal forwarder installed (4.3.1 build 119532). They're forwarding windows events to my Splunk Server(same version and build) over tcp 9514. So the Splunk Server is configured to receive on tcp_9514.
in /etc/system/local/props.conf
[default]
TRANSFORMS-wmi=wminull
in /etc/system/local/transforms.conf
[wminull]
REGEX=(?msi)^EventCode=(4768|4776|4769|4932|4933|5152|5158|4634|4672|5156|4662|4624|7036|5145|5140)
DEST_KEY=queue
FORMAT=nullQueue
The problem is I'm still indexing events mentioned in the regex. This configuration worked in our test environment. I'm not sure where to start troubleshooting this. I think it's all configured correctly.
metrics.log (one host)
INFO Metrics - group=tcpin_connections, 10.1.57.202:49328:9514, connectionType=cooked, sourcePort=49328, sourceHost=10.1.57.202, sourceIp=10.1.57.202, destPort=9514, _tcp_Bps=51043.12, _tcp_KBps=49.85, _tcp_avg_thruput=364.65, kb=1463.47, _tcp_Kprocessed=35517.31, _tcp_eps=36.85, build=119532, version=4.3.1, os=Windows, arch=x64, hostname=dccoslo2, guid=526275C8-DEC9-4F06-BD7B-30EFB3158043, fwdType=uf, ssl=false, lastIndexer=10.1.57.198:9514, ack=false
... View more
12-28-2011
12:25 PM
1 Karma
I'm not sure I can answer that question but figured I would add my 2cents. I asked the same question. I'm using splunk to monitor my networking equipment logs but I wanted to be notified when something abnormal happened. It took some experimenting but this is what I came up with.
I logged into my machine and counted the number of log entries that were created by simply logging in. It created about 10 lines (ssh, info, etc). But if I gave the equipment the wrong password a few times, it generated 20-30 lines of logs. So I created an alert that said if you see more than 15 lines in the last minute, alert me. Using that alert, I've found computer techs in other departments scanning the entire subnet with default snmp community strings!
So it's hard to create a baseline, but you can determine the average number of logs generated at any given time, and create alerts if that number exceeds the average. Hope that helps. I'm not sure what equipment you are logging.
... View more
04-26-2011
11:56 AM
I'm trying to get my snort data to splunk. I've installed the universalfowarder on the snort box,
monitoring /var/log/snort/snort.log
Here is some information from the Forwarder
etc/system/inputs.conf
[monitor:///var/log/snort/snort.log]
host = snort
sourcetype=snort_alert_full
etc/system/outputs.conf
[tcpout]
defaultGroup = 10.1.57.198_9514
disabled = false
[tcpout:10.1.57.198_9514]
server = 10.1.57.198:9514
[tcpout-server://10.1.57.198:9514]
netstat -a
tcp 0 0 snort.ntwk:59892 10.1.57.198:9514 ESTABLISHED
metrics.log
04-26-2011 11:48:05.026 -0700 INFO Metrics - group=tcpout_connections, index:10.1.57.198:9514:0, sourcePort=8089, destIp=10.1.57.198, destPort=9514, _tcp_Bps=587.97, _tcp_KBps=0.57, _tcp_avg_thruput=0.58, _tcp_Kprocessed=1461, _tcp_eps=0.70
Here is some information from the Receiver
/etc/apps/SplunkforSnort/local/inputs.conf
[splunktcp://9514]
sourcetype = snort
connection_host = dns
metrics.log
04-26-2011 11:48:33.427 -0700 INFO Metrics - group=tcpin_connections, 10.1.57.8:59891:9514,
connectionType=cooked, sourcePort=59891, sourceHost=snort.ntwk, sourceIp=10.1.57.8,
destPort=9514, _tcp_Bps=585.45, _tcp_KBps=0.57, _tcp_avg_thruput=0.56, kb=17.72, _tcp_Kprocessed=1401.00, _tcp_eps=0.74, build=98164, version=4.2.1, os=Linux, arch=i686, hostname=snort, guid=63421A46-231F-414F-A119-5D1482F5F32C, fwdType=uf, ssl=false, lastIndexer=10.1.57.198:9514, ack=false
But I'm not seeing anything in Splunk Web Search. Any help would be really appreciated. Thanks for looking.
... View more
12-09-2010
04:47 PM
1 Karma
The mac address format for all of my logs is xx:xx:xx:xx:xx:xx
AUTHORIZATION-SUCCESS: user: airport; mac: e8:06:88:8a:17:97; author reason: new session; ssid: slo_airport; AP 32/1
AUTHORIZATION-SUCCESS: user: airport; mac: 00:1c:b3:be:08:2c; author reason: new session; ssid: slo_airport; AP 32/2
I'm trying to " my search string " | stats distinct_count(mac)
I would think that the mac address would be a "pre-built" field.
Thanks.
... View more
12-07-2010
10:22 PM
I'm going to assume you are using some type of log forwarder to send these logs to splunk. I am using Snare on my windows servers. It allows me to tell it to send logs on any port I choose. For my DHCP Server, I'm having it send logs to splunk using port 516. On Splunk, I've configured a Data Input, UDP port 516, SourceType: from list, Windows Snare Syslog.
It formats it perfectly. I guess you could do that for each Server.
... View more
12-07-2010
10:16 PM
if you set it to 1, wouldn't it only index the new data? setting it to 0 would index the old data and new data. no?
... View more
12-07-2010
01:18 AM
Well, I looked around a little and it seems that you can do a few things in Manager, User Interface...but it looks like you need to bust out some XML. There must be an easier way.
... View more
http://www.splunk.com/base/Documentation/latest/Admin/Changedefaultvalues
So admin/changeme didn't work?
See that guide, it has some tips for you. Good luck and let us know if you get in.
... View more
12-06-2010
10:13 PM
Did gkanapathy mean:
http://splunkurl/app/search/flashtimeline?q=savedsearch
or
http://splunkurl/app/search/flashtimeline?s=savedsearch
Are you ok with using Reports? Or would that be too much work...
... View more
12-06-2010
09:47 PM
I'd agree with Mick. Wouldn't nocostk just need to add a new data input, file, source: monitor file or directory, /path/to/file, make sure "follow tail" is de-selected.
... View more
04-20-2010
06:00 PM
Just checked my data input (because i'm doing the same thing) and turns out...there is a radio button for DNS.
Navigate to Admin/Manager..whatever (from web ui), Data Inputs, UDP, Your UDP 515 or other port, make sure "Set Host" has DNS selected.
... View more
04-20-2010
05:56 PM
I think that the system hosting splunk needs to be configured to do dns lookups for this new port. I could be wrong...but check this out:
options {
sync (0);
time_reopen (10);
log_fifo_size (1000);
long_hostnames (off);
use_dns (yes);
use_fqdn (yes);
use_time_recvd (yes);
create_dirs (yes);
keep_hostname (yes);
};
==============
SOURCES
==============
source s_sys {
file ("/proc/kmsg" log_prefix("kernel: "));
unix-stream ("/dev/log");
internal();
# udp(ip(0.0.0.0) port(514));
};
source s_net {
udp(ip(0.0.0.0) port (514));
};
This is from my syslog-ng.conf file. Maybe adding the following will help?
source s_net {
udp(ip(0.0.0.0) port (515));
};
... View more
04-16-2010
04:19 PM
1 Karma
try service --status-all when it goes down next time. Make sure apache is running? You can also view the web_access.log in your splunk/var/log/splunk dir.
... View more
04-15-2010
07:26 PM
1 Karma
Are your other boxes using syslog to send to your ARD machine? How is your input configured? Port or File/Dir? If port, port 514?
... View more
04-13-2010
09:05 PM
What about:
range marker
charting.chart.RangeMarker
http://www.splunk.com/base/Documentation/4.1/Developer/ChartReference
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
11-18-2025
12:53 PM
|
Karma given to
