Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About naqviah
naqviah
Explorer
Member since:
10-03-2016
06-05-2020
Community Statistics
| Posts | 24 |
| Solutions | 0 |
| Karma Given | 0 |
| Karma Received | 1 |
| Member Since | 10-03-2016 |
Activity Feed
- Got Karma for How to alert on modifications made to user role and capability?. 06-05-2020 12:48 AM
- Posted Cb Response App for Splunk: Error "Unknown error reading API Key" on All Apps and Add-ons. 12-22-2017 09:59 AM
- Tagged Cb Response App for Splunk: Error "Unknown error reading API Key" on All Apps and Add-ons. 12-22-2017 09:59 AM
- Tagged Cb Response App for Splunk: Error "Unknown error reading API Key" on All Apps and Add-ons. 12-22-2017 09:59 AM
- Posted Re: Can I use a diff command to compare which Windows host values are logging week over week? on Getting Data In. 08-25-2017 08:12 AM
- Posted Can I use a diff command to compare which Windows host values are logging week over week? on Getting Data In. 08-24-2017 12:06 PM
- Tagged Can I use a diff command to compare which Windows host values are logging week over week? on Getting Data In. 08-24-2017 12:06 PM
- Tagged Can I use a diff command to compare which Windows host values are logging week over week? on Getting Data In. 08-24-2017 12:06 PM
- Tagged Can I use a diff command to compare which Windows host values are logging week over week? on Getting Data In. 08-24-2017 12:06 PM
- Posted Support Splunk6.6 on All Apps and Add-ons. 07-19-2017 08:51 AM
- Tagged Support Splunk6.6 on All Apps and Add-ons. 07-19-2017 08:51 AM
- Posted Re: Splunk Add-on for Nessus: What SecurityCenter Permissions are required? on All Apps and Add-ons. 04-25-2017 06:23 AM
- Posted Re: Splunk Add-on for Tenable: Why am I getting error "REST ERROR[1021]: Fail to decrypt the encrypted credential information" after adding a new Nessus input? on All Apps and Add-ons. 04-24-2017 10:49 AM
- Posted Re: How to forward ONLY _internal logs from standalone Search Head to Indexer Cluster? on Deployment Architecture. 04-20-2017 11:50 AM
- Posted How to forward ONLY _internal logs from standalone Search Head to Indexer Cluster? on Deployment Architecture. 04-13-2017 11:22 AM
- Tagged How to forward ONLY _internal logs from standalone Search Head to Indexer Cluster? on Deployment Architecture. 04-13-2017 11:22 AM
- Tagged How to forward ONLY _internal logs from standalone Search Head to Indexer Cluster? on Deployment Architecture. 04-13-2017 11:22 AM
- Tagged How to forward ONLY _internal logs from standalone Search Head to Indexer Cluster? on Deployment Architecture. 04-13-2017 11:22 AM
- Posted Re: Disable SYSCALL events from auditd app on All Apps and Add-ons. 04-13-2017 08:20 AM
- Posted Disable SYSCALL events from auditd app on All Apps and Add-ons. 04-10-2017 10:37 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
12-22-2017
09:59 AM
I am try to use a process search feature in the CB-Response app. I am receiving the following error:
error: unknown error reading api key from credential storage: http 403 forbidden -- you (user=XXXXXXX) do not have permission to perform this operation (requires capability: list_storage_passwords).
I have already checked the following:
- Account permissions - set to admin
- capability (list_storage_passwords) already added to the role
- Permissions on the app directory recursively
Not sure what I am missing out.
Any help would be appreciated.
... View more
08-25-2017
08:12 AM
i just used this query:
| tstats latest(_time) as lastTime where index=windows* by host _time span=1w
| table _time host
| stats values(_time) as mytimes by host
| eventstats max(mytimes) as maxtime
| where mvcount(mytimes)<2
| rename COMMENT as "use this one to get the hosts which disappeared this week"
| where mytimes = maxtime
However, i still see hosts that are currently logging this week.
... View more
08-24-2017
12:06 PM
I am in need of assistance/guidance in creating a query that will compare the windows logging hosts from previous week against those that are logging this week. It will than output the host values that were not logging last week but are logging this week. I believe a diff command can be used here. Not sure if their are additional commands that can be used.
... View more
07-19-2017
08:51 AM
It looks like the app does not support Splunk 6.6. Will there be a update coming out soon?
... View more
04-25-2017
06:23 AM
Did this change ever work to get the logs to be ingested by Splunk?
... View more
04-24-2017
10:49 AM
Did this ever work to resolve the issue. I am seeing the same error messages. Please advise..
... View more
04-20-2017
11:50 AM
Do i have to configure the inputs.conf on the IDX clusters?
This is what i currently have, but there is a communication error between the SH and the IDX_Cluster:
[indexAndForward]
index = true
[tcpout]
defaultGroup = idx-indexers
forwardedindex.filter.disable = false
indexAndForward = 1
[tcpout]
forwardedindex.0.whitelist = .*
forwardedindex.1.blacklist = _.*
forwardedindex.2.whitelist = (_internal)
[tcpout:idx-indexers]
autoLBFrequency = 40
disabled = 0
server = :9997,:9997:9997
sslCertPath = $SPLUNK_HOME/etc/auth/server.pem
sslPassword =
sslRootCAPath = $SPLUNK_HOME/etc/auth/cacert.pem
sslVerifyServerCert = 0
useACK = 1
Anything im doing wrong here?
... View more
04-13-2017
11:22 AM
Can someone guide me on how to forward ONLY _internal logs from a standalone SH (Search Head) to an indexer cluster in a distributed environment?
... View more
04-13-2017
08:20 AM
That is correct. Syscall events are generating millions of events per day. Temporarily, i have blacklisted the type=syscall*. However, is there another method to disable them?
... View more
04-10-2017
10:37 AM
Hi,
Is there a way to disable logging of syscall events from the linux-auditd app? Syscall is generating thousands of events per minute and it is out of scope for me at the moment.
... View more
02-24-2017
04:43 AM
Thanks @somesoni2, but its generating 0 events, which i know is not true because there are number of users with delete_by_ capabilities.
... View more
02-23-2017
12:36 PM
The results doesn't tell me which users have the "delete_by_keyword" capability. It just shows me which role has the capability in it.
... View more
02-23-2017
12:11 PM
This returns the following error:
Error in 'where' command: The arguments to the 'mvfind' function are invalid.
... View more
Hi,
I am trying to find a way for Splunk to alert on any modifications made to user roles/capabilities that state whether a user has gained access to "delete". I have tried the following REST, but it does not alert when a user gains the delete capability. Any help would be appreciated.
| rest services/authorization/roles | search capabilities=delete_by_keyword
... View more
02-23-2017
05:25 AM
What is the best option to check whether a option in local.meta is being corrected defined or not, if not by btool?
... View more
