Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- Find Answers
- :
- About vin02
vin02
Path Finder
Member since:
10-03-2016
06-05-2020
Community Statistics
| Posts | 35 |
| Solutions | 0 |
| Karma Given | 0 |
| Karma Received | 5 |
| Member Since | 10-03-2016 |
Activity Feed
- Got Karma for Getting error messages after Splunk Enterprise Security upgrade from 4.5.2 to 4.7.1.. 06-05-2020 12:49 AM
- Got Karma for what is the command for checking indexer cluster status and search head cluster status as non root user?. 06-05-2020 12:49 AM
- Got Karma for How to change password using CLI in splunk. 06-05-2020 12:48 AM
- Got Karma for Not creating notable event in incident review. 06-05-2020 12:48 AM
- Got Karma for Re: Keeping Apps up to date. 06-05-2020 12:45 AM
- Posted Re: How to write a query when two users are logged in from the same terminal? on Security. 08-03-2018 12:02 AM
- Posted How to write a query when two users are logged in from the same terminal? on Security. 08-02-2018 10:41 AM
- Tagged How to write a query when two users are logged in from the same terminal? on Security. 08-02-2018 10:41 AM
- Tagged How to write a query when two users are logged in from the same terminal? on Security. 08-02-2018 10:41 AM
- Tagged How to write a query when two users are logged in from the same terminal? on Security. 08-02-2018 10:41 AM
- Posted Re: user changed his password and successfully logged in after password change. How can i get list successful logged in user using search query? on Security. 07-26-2018 09:04 PM
- Posted Re: user changed his password and successfully logged in after password change. How can i get list successful logged in user using search query? on Security. 07-26-2018 09:11 AM
- Posted How to track if assigned role has been changed for any user? on Security. 07-26-2018 08:40 AM
- Tagged How to track if assigned role has been changed for any user? on Security. 07-26-2018 08:40 AM
- Tagged How to track if assigned role has been changed for any user? on Security. 07-26-2018 08:40 AM
- Posted user changed his password and successfully logged in after password change. How can i get list successful logged in user using search query? on Security. 07-26-2018 08:33 AM
- Tagged user changed his password and successfully logged in after password change. How can i get list successful logged in user using search query? on Security. 07-26-2018 08:33 AM
- Tagged user changed his password and successfully logged in after password change. How can i get list successful logged in user using search query? on Security. 07-26-2018 08:33 AM
- Posted Re: Password Security: Can you reset password in splunk through secret question or any other password management scenario? on All Apps and Add-ons. 02-21-2018 04:58 AM
- Posted Password Security: Can you reset password in splunk through secret question or any other password management scenario? on All Apps and Add-ons. 02-21-2018 03:25 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 1 | |||
| 0 |
08-09-2025
06:16 AM
Even then, the HISTCONTROL variable has to be set before running the command you don't want showing in history. Also, contrary to what I keep reading from Google results, this variable doesn't seem to be automatically set, or at least not on the various Linux distros I've used.
... View more
08-03-2018
12:02 AM
user has created new user from splunk UI and logged in with new user in UI console.
... View more
07-26-2018
10:16 AM
Hello there,
you can see the action, who did it and which user was modified like this:
index = _audit sourcetype = audittrail action=edit_user operation=edit info=granted
| stats values(user) as who_did_it values(object) as user_changed by _time
hope it helps
... View more
05-14-2020
12:03 PM
last command is correct with just a small correction
instead of
index=_audit user=username "action=password change"
it should be
index=_audit user=username action="password change"
... View more
02-21-2018
05:06 AM
http://docs.splunk.com/Documentation/Splunk/7.0.2/Security/SetupuserauthenticationwithLDAP
Note: this assumes you already have some LDAP directory in your organization which can be used as the authentication mechanism and that directory system also offers some password reset functionality.
... View more
12-11-2017
07:07 AM
There are a number of switches/options available within the savedsearches.conf for correlation searches that were previously in the correlationsearches.conf file. If you look at your savedsearches.conf file in DA-ESS-EndpointProtection/default/ (for example) you will see saved searches that are used for reports v correlation searches and the different options that correlation searches use including a number of action.notable and action.risk options, cron_schedule amongst others.
My suggestion would be to use these correlation searches as a template so that when you click on it, it will populate appropriately. Alternatively, you could use the Configure->Content Management and click Create New Content->Correlation Search, specify your app and create the conditions and notable from there.
... View more
12-12-2017
06:31 AM
must be frustrating. What do you have so far, and what are you seeing? I have verified the end part of my query if I assume that the value for "d" has already been calculated. I am not able to share a picture, but the query results in a chart like this:
date pct
Sun 9
Mon 22
Tue 20
Wed 20
Thu 20
Fri 17
Sat 12
(admittedly, pct is not really percent in my case though) which visualizes into a bar chart by weekday
... View more
11-06-2017
01:55 AM
2 Karma
Hope you mean by "non-root" as non-admin user?
For Indexer cluster, you need to run on the Cluster Master via CLI
$SPLUNK_HOME/bin/splunk show cluster-bundle-status
For SH Cluster, you need to run on Search Head member via CLI
$SPLUNK_HOME/bin/splunk show shcluster-status
... View more
10-16-2017
11:49 AM
ES App added new option called allow_skew. Adding allow_skew will increase the performance.
Searches offset by allow_skew always run over their scheduled time ranges. For example, if a search that is scheduled to run over the past 5 minutes every 5 minutes is supposed to run at 2:05 p.m. but is offset such that it actually runs at 2:07 p.m., it will still search over 2:00:00 p.m. to 2:04:59 p.m.
Basically what it is saying is that there won't be any data missed, because it will still run in 5 mins interval, expect running at 5 min on the dot it will run after that. So even for critical alerts, it won't miss any data because it is still going over that time period, expect it's just starting a little later.
... View more
11-22-2017
07:32 AM
We had this same issue after upgrade to 4.7.0 - Splunk Support advised it was a bug in this version and provided the following fix, which worked for us -
Edit splunk/etc/apps/DA-ESS-ThreatIntelligence/bin/configuration_checks/confcheck_failed_threat_download.py as below:
--- confcheck_failed_threat_download.old.py
+++ confcheck_failed_threat_download.py
@@ -33,7 +33,7 @@
messages = []
- job = splunk.search.dispatch(search_string, sessionKey=session_key, earliest=earliest)
+ job = splunk.search.dispatch(search_string, sessionKey=session_key, earliest_time=earliest)
while elapsed < srch_timeout:
if job.isDone:
if job.resultCount > 0 or job.eventCount > 0:
... View more
08-21-2017
06:12 PM
If you need help with Linux commands, you could start with the AWS Linux documentation
https://aws.amazon.com/premiumsupport/knowledge-center/linux-command-basics/
You could also use any reference for Cento OS, and that is the base for AWS Linux
... View more
08-15-2017
06:22 AM
the above steps are in Splunk UI. So please log to UI and do the Monitoring Console steps
... View more
08-09-2017
12:42 AM
did yo check the ip tables with iptables -vL
what is the error you get
can you connect to port 8443
... View more
08-03-2017
04:35 AM
How to use iptables prerouting to forward request coming on port 443 to port 8443?
... View more
07-13-2017
04:53 AM
I'm not sure what you mean by patching. You mean upgrading Splunk to a newer version?
Splunk versions come in entirety not in small patches
Update complexity varies depending if your system is standalone or clustered
please follow http://docs.splunk.com/Documentation/Splunk/6.5.3/Installation/HowtoupgradeSplunk
... View more
05-03-2017
05:51 AM
Hi Vin02,
Obviously, your captain is down or has not been initialized in your shc. You must designate a cluster member - any instance - as the captain, which is responsible for orchestrating replication activities across your cluster. For instructions on bringing up the cluster captain, please following the steps here in the documentation:
http://docs.splunk.com/Documentation/Splunk/6.6.0/DistSearch/SHCdeploymentoverview#5._Bring_up_the_cluster_captain
Hope this helps.
Thanks!
Hunter
... View more
04-26-2017
02:31 AM
Go to
Setting--> data models
select the respective accelerated datamodel and under the dropdown u will find the Acceleration with (Rebuild)
... View more
06-11-2017
10:52 PM
1 Karma
Is it possible to create a dashboard for the new update for app and maintain the alert in the environment?
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:04 AM
|
