Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About naqviah
naqviah
Explorer
Member since:
10-03-2016
06-05-2020
Community Statistics
| Posts | 24 |
| Solutions | 0 |
| Karma Given | 0 |
| Karma Received | 1 |
| Member Since | 10-03-2016 |
Activity Feed
- Got Karma for How to alert on modifications made to user role and capability?. 06-05-2020 12:48 AM
- Posted Cb Response App for Splunk: Error "Unknown error reading API Key" on All Apps and Add-ons. 12-22-2017 09:59 AM
- Tagged Cb Response App for Splunk: Error "Unknown error reading API Key" on All Apps and Add-ons. 12-22-2017 09:59 AM
- Tagged Cb Response App for Splunk: Error "Unknown error reading API Key" on All Apps and Add-ons. 12-22-2017 09:59 AM
- Posted Re: Can I use a diff command to compare which Windows host values are logging week over week? on Getting Data In. 08-25-2017 08:12 AM
- Posted Can I use a diff command to compare which Windows host values are logging week over week? on Getting Data In. 08-24-2017 12:06 PM
- Tagged Can I use a diff command to compare which Windows host values are logging week over week? on Getting Data In. 08-24-2017 12:06 PM
- Tagged Can I use a diff command to compare which Windows host values are logging week over week? on Getting Data In. 08-24-2017 12:06 PM
- Tagged Can I use a diff command to compare which Windows host values are logging week over week? on Getting Data In. 08-24-2017 12:06 PM
- Posted Support Splunk6.6 on All Apps and Add-ons. 07-19-2017 08:51 AM
- Tagged Support Splunk6.6 on All Apps and Add-ons. 07-19-2017 08:51 AM
- Posted Re: Splunk Add-on for Nessus: What SecurityCenter Permissions are required? on All Apps and Add-ons. 04-25-2017 06:23 AM
- Posted Re: Splunk Add-on for Tenable: Why am I getting error "REST ERROR[1021]: Fail to decrypt the encrypted credential information" after adding a new Nessus input? on All Apps and Add-ons. 04-24-2017 10:49 AM
- Posted Re: How to forward ONLY _internal logs from standalone Search Head to Indexer Cluster? on Deployment Architecture. 04-20-2017 11:50 AM
- Posted How to forward ONLY _internal logs from standalone Search Head to Indexer Cluster? on Deployment Architecture. 04-13-2017 11:22 AM
- Tagged How to forward ONLY _internal logs from standalone Search Head to Indexer Cluster? on Deployment Architecture. 04-13-2017 11:22 AM
- Tagged How to forward ONLY _internal logs from standalone Search Head to Indexer Cluster? on Deployment Architecture. 04-13-2017 11:22 AM
- Tagged How to forward ONLY _internal logs from standalone Search Head to Indexer Cluster? on Deployment Architecture. 04-13-2017 11:22 AM
- Posted Re: Disable SYSCALL events from auditd app on All Apps and Add-ons. 04-13-2017 08:20 AM
- Posted Disable SYSCALL events from auditd app on All Apps and Add-ons. 04-10-2017 10:37 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
12-22-2017
09:59 AM
I am try to use a process search feature in the CB-Response app. I am receiving the following error:
error: unknown error reading api key from credential storage: http 403 forbidden -- you (user=XXXXXXX) do not have permission to perform this operation (requires capability: list_storage_passwords).
I have already checked the following:
- Account permissions - set to admin
- capability (list_storage_passwords) already added to the role
- Permissions on the app directory recursively
Not sure what I am missing out.
Any help would be appreciated.
... View more
08-25-2017
08:12 AM
i just used this query:
| tstats latest(_time) as lastTime where index=windows* by host _time span=1w
| table _time host
| stats values(_time) as mytimes by host
| eventstats max(mytimes) as maxtime
| where mvcount(mytimes)<2
| rename COMMENT as "use this one to get the hosts which disappeared this week"
| where mytimes = maxtime
However, i still see hosts that are currently logging this week.
... View more
08-24-2017
12:06 PM
I am in need of assistance/guidance in creating a query that will compare the windows logging hosts from previous week against those that are logging this week. It will than output the host values that were not logging last week but are logging this week. I believe a diff command can be used here. Not sure if their are additional commands that can be used.
... View more
07-19-2017
08:51 AM
It looks like the app does not support Splunk 6.6. Will there be a update coming out soon?
... View more
04-25-2017
06:23 AM
Did this change ever work to get the logs to be ingested by Splunk?
... View more
04-24-2017
10:49 AM
Did this ever work to resolve the issue. I am seeing the same error messages. Please advise..
... View more
04-20-2017
11:50 AM
Do i have to configure the inputs.conf on the IDX clusters?
This is what i currently have, but there is a communication error between the SH and the IDX_Cluster:
[indexAndForward]
index = true
[tcpout]
defaultGroup = idx-indexers
forwardedindex.filter.disable = false
indexAndForward = 1
[tcpout]
forwardedindex.0.whitelist = .*
forwardedindex.1.blacklist = _.*
forwardedindex.2.whitelist = (_internal)
[tcpout:idx-indexers]
autoLBFrequency = 40
disabled = 0
server = :9997,:9997:9997
sslCertPath = $SPLUNK_HOME/etc/auth/server.pem
sslPassword =
sslRootCAPath = $SPLUNK_HOME/etc/auth/cacert.pem
sslVerifyServerCert = 0
useACK = 1
Anything im doing wrong here?
... View more
04-13-2017
11:22 AM
Can someone guide me on how to forward ONLY _internal logs from a standalone SH (Search Head) to an indexer cluster in a distributed environment?
... View more
04-13-2017
08:20 AM
That is correct. Syscall events are generating millions of events per day. Temporarily, i have blacklisted the type=syscall*. However, is there another method to disable them?
... View more
04-10-2017
10:37 AM
Hi,
Is there a way to disable logging of syscall events from the linux-auditd app? Syscall is generating thousands of events per minute and it is out of scope for me at the moment.
... View more
02-24-2017
04:43 AM
Thanks @somesoni2, but its generating 0 events, which i know is not true because there are number of users with delete_by_ capabilities.
... View more
02-23-2017
12:36 PM
The results doesn't tell me which users have the "delete_by_keyword" capability. It just shows me which role has the capability in it.
... View more
02-23-2017
12:11 PM
This returns the following error:
Error in 'where' command: The arguments to the 'mvfind' function are invalid.
... View more
Hi,
I am trying to find a way for Splunk to alert on any modifications made to user roles/capabilities that state whether a user has gained access to "delete". I have tried the following REST, but it does not alert when a user gains the delete capability. Any help would be appreciated.
| rest services/authorization/roles | search capabilities=delete_by_keyword
... View more
02-23-2017
05:25 AM
What is the best option to check whether a option in local.meta is being corrected defined or not, if not by btool?
... View more
02-08-2017
08:23 AM
What would be the best way to resolve this issue?
... View more
02-07-2017
08:06 AM
Is there a reason why "dmc_forwarder_assets" is not displaying the universal forwarders in DMC ? It was displaying it before but now it is not.
Thanks
... View more
02-06-2017
05:54 AM
What would be the best query to monitor SSH logins to the Splunk Server?
... View more
02-02-2017
05:41 PM
Yea I have followed those instructions. I
Am testing this without ES.
... View more
02-02-2017
06:30 AM
I have been trying to configure the Linux Auditd app to get it 100% functioning. Some of the panes are working and some are not. The app is not integrated with Splunk Enterprise Security (ES) and running on Splunk 6.5.1. Is this platform supported ? What would be the solution to fixing the errors below:
Error in 'PivotProcessor': Error in 'DataModelEvaluator': Data model 'Auditd' was not found.
Error in 'lookup' command: The lookup table 'posix_identities' does not exist or is not available.
The lookup table 'auditd_host_inventory' does not exist. It is referenced by configuration 'linux:audit'.
Please guide.
... View more
12-08-2016
09:01 AM
Is there a way to monitor Splunk server logon/logoff, basically trying to find the best way to audit access to Splunk servers via direct UI or SSH?
... View more
12-08-2016
06:04 AM
How would this work in a scenario where you are trying to monitor splunk users who are logging on/off using SSH? How can that be done?
... View more
10-05-2016
11:17 AM
I am still unable to add a COMMENT TEXT BOX for each event in the table. Also, I need to add a checkbox in front of each event. Please HELP!
... View more
10-03-2016
10:52 AM
Hi,
I am trying to create a KV Store that pulls events from an indexer. It should display the Event, Log Line, Domain, and IP. Additionally, it should have a comment box and name of the person who is adding the comment pulled from the user account making the change. The comment box should also have an audit trail since numerous users are able to input a comment for an event.
Can someone help me with this? How should i approach it? Any documentation that will allow me to do this?
Thanks
... View more
