Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Are you a member of the Splunk Community?
Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- About ivarny
ivarny
Path Finder
Member since:
06-18-2014
08-29-2024
Community Statistics
| Posts | 20 |
| Solutions | 2 |
| Karma Given | 11 |
| Karma Received | 2 |
| Member Since | 06-18-2014 |
Activity Feed
- Posted Re: Splunk Add-on for Microsoft Cloud Services event_format_flags on All Apps and Add-ons. 08-29-2024 06:21 AM
- Posted Re: Splunk Add-on for Microsoft Cloud Services event_format_flags on All Apps and Add-ons. 08-29-2024 01:06 AM
- Posted Splunk Add-on for Google Cloud Platform documentation redirects to unavailable github pages. Intentional or error? on All Apps and Add-ons. 06-28-2024 06:17 AM
- Tagged Splunk Add-on for Google Cloud Platform documentation redirects to unavailable github pages. Intentional or error? on All Apps and Add-ons. 06-28-2024 06:17 AM
- Got Karma for TA Linux Auditd for OCSF transforms has bugs. 06-20-2024 11:32 AM
- Posted TA Linux Auditd for OCSF transforms has bugs on Knowledge Management. 06-14-2024 03:20 AM
- Tagged TA Linux Auditd for OCSF transforms has bugs on Knowledge Management. 06-14-2024 03:20 AM
- Posted Re: Splunk Add-on for Microsoft Cloud Services event_format_flags on All Apps and Add-ons. 10-19-2022 02:58 AM
- Karma Splunk Add-on for Microsoft Cloud Services - What can event_format_flags be used for? for Tasos. 10-19-2022 02:56 AM
- Posted Re: MSA - Insufficient privileges to collect resource usage metrics on Security. 08-23-2022 03:38 AM
- Karma Re: Cannot expand lookup field due to a reference cycle in the lookup configuration. for sean_wong. 02-17-2022 02:28 AM
- Posted Re: Support encoded TTY from audit.log in Linux Auditd app on All Apps and Add-ons. 07-17-2021 11:50 AM
- Posted Dashboards App (Beta) Tables and control over column width on All Apps and Add-ons. 04-23-2021 01:04 AM
- Tagged Dashboards App (Beta) Tables and control over column width on All Apps and Add-ons. 04-23-2021 01:04 AM
- Tagged Re: (Splunk Dashboards App Beta) How to Customize Table on All Apps and Add-ons. 04-23-2021 01:01 AM
- Posted Re: (Splunk Dashboards App Beta) How to Customize Table on All Apps and Add-ons. 04-23-2021 01:00 AM
- Posted Re: missing fields in sign-ins events after upgrading Microsoft Azure add-on for Splunk to 3.1.1 on All Apps and Add-ons. 04-09-2021 02:03 AM
- Karma Re: missing fields in sign-ins events after upgrading Microsoft Azure add-on for Splunk to 3.1.1 for fed_kerr. 04-09-2021 02:01 AM
- Tagged Re: missing fields in sign-ins events after upgrading Microsoft Azure add-on for Splunk to 3.1.1 on All Apps and Add-ons. 04-09-2021 01:46 AM
- Tagged Re: missing fields in sign-ins events after upgrading Microsoft Azure add-on for Splunk to 3.1.1 on All Apps and Add-ons. 04-09-2021 01:45 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 1 | |||
| 0 | |||
| 0 | |||
| 0 |
08-29-2024
06:21 AM
Sure, it seems it was only needed for a particular eventhub, and there I am running: SEDCMD-remove_quot_infront= s/^\"{/{/g SEDCMD-remove_quot_behind = s/}\"$/}/g SEDCMD-remove_slash = s/\\"/"/g
... View more
08-29-2024
01:06 AM
Nope, I think I ended up with using sed in props to remove the offending " ".
... View more
06-28-2024
06:17 AM
When trying to access documentation for add on 3088 which should be on https://docs.splunk.com/Documentation/AddOns/released/GoogleWorkspace/About I am redirected to https://github.com/pages/auth?nonce=cdd5c03e-1d79-4996-9ec8-36e50189986b&page_id=47767351&path=Lw Which is unavailable without login and also with one of my github logins. What's going on here?
... View more
- Tags:
- documentation
Labels
- Labels:
-
configuration
06-14-2024
03:20 AM
1 Karma
The transforms to set sourcetypes has a bug. The regex uses a capture group that is not used in the format statment. When this is the case splunk does not return a match on the regex. To get this to work it is neccessary to change the regex to a non-capturing group e.g. for:
[auditdclasses2]
REGEX = type\=(ANOM_|USER_AVC|AVC|CRYPTO_REPLAY_USER|RESP)
DEST_KEY = MetaData:Sourcetype
FORMAT = sourcetype::linux:audit:ocsf:finding
must be change to
REGEX = type\=(?:ANOM_|USER_AVC|AVC|CRYPTO_REPLAY_USER|RESP)
Then it works. The same for the other auditdclasses1 - 6.
... View more
Labels
10-19-2022
02:58 AM
Anyone? We are getting json formatted data that is garbeld now via the Microsoft-Cloud-Services app. It was formatted correctly via the AAD app. Now there is extra " " around the json and additional \" around each key.
... View more
07-17-2021
11:50 AM
I tested on Ubuntu today and also found that only type="TTY" was produced. (I added the "session required pam_tty_audit.so enable=*" to /etc/pam.d/common-session as /etc/pam.d/password-auth-ac did not seem to get picked up. ) I got the "User TTY" dashboard working fine by editing the dash and setting: type="USER_TTY" OR type="TTY" I also added the comm field to the table as that provides additional good insight into what's going on.
... View more
04-23-2021
01:04 AM
It seems my tables in the beta app gets more or less the same with, so fields containing short text or numerical elements take up too much space from those with longer text strings for example. Seem not to adjust well automatically and I am not finding a way to control it manually, any ideas?
... View more
Labels
- Labels:
-
configuration
-
dashboard
04-23-2021
01:00 AM
How about control of column width in tables? It seems my tables in the beta app gets more or less the same with, so fields containing short text or numerical elements take up too much space from those with longer text strings for example. Seem not to adjust well automatically and I am not finding a way to control it manually, any ideas?
... View more
04-09-2021
02:03 AM
Awsome, that was a quick fix, thanks for the quick response "Fed_Kerr"!
... View more
04-09-2021
01:32 AM
We also see this issue after upgrade to 3.1.1. Did you find any resolution to the problem? Cloud being so important and these log sources are really important, so it's strange that this is an unsupported app from Splunk.
... View more
02-17-2021
05:06 AM
Found the problem by digging a bit in the code. input_module_curl_inputs.py", line 43, is getting and testing the values from inputs configuration. Seems that len test is failing instead of setting 0 if nothing is entered in the (put) payload section. So I just entered {"dummy":"load"} in the Payload section and the input started working.
... View more
01-20-2021
03:25 AM
It works to run the | curl method=get to my URL, but when setting it up as a modular input I get errors in the ta_webtools_curl_inputs.log. I am running version 2.0.2 of the tool on Splunk Enterprise 8.0.4. The error: 2021-01-20 12:08:50,106 ERROR pid=125277 tid=MainThread file=base_modinput.py:log_error:309 | Get error when collecting events. Traceback (most recent call last): File "/opt/splunk/etc/apps/TA-webtools/bin/ta_webtools/aob_py3/modinput_wrapper/base_modinput.py", line 128, in stream_events self.collect_events(ew) File "/opt/splunk/etc/apps/TA-webtools/bin/curl_inputs.py", line 84, in collect_events input_module.collect_events(self, ew) File "/opt/splunk/etc/apps/TA-webtools/bin/input_module_curl_inputs.py", line 43, in collect_events if len(payload)>0: TypeError: object of type 'NoneType' has no len() Any pointers to what may cause this error? Perhaps @jkat54 ?
... View more
- Tags:
- 4146
Labels
- Labels:
-
troubleshooting
I tested this in a distributed environment and to get it to work i needed:
Forwarding in outputs.conf
[tcpout]
defaultGroup = send2indexers
indexAndForward = false
and
[indexAndForward]
index=false
Also the target index for the log event alert has to be defined on the searchheads.
... View more
09-20-2016
04:19 AM
The solution to this was to find in the local.meta permissions setup.
We wanted a general locked down approach and open up on the specific level.
This does not seem to be supported as the general settings overrides the more specific settings.
We had in ./apps/search/metadata/local.meta
[]
access= read [ admin ], write [ admin ]
then for commands we wanted to grant access
[commands]
access = read : [ * ], write : [ admin ]
export = system
But this did not work since the [] stanza overrules the [commands] stanza.
Therefore we had to put
[]
access = read : [ * ], write : [ admin ]
And then tighten in on each more specific stanza...
... View more
09-20-2016
04:11 AM
I had tested copying xmlkv.py to the home app of the user(s) but that did not solve it.
... View more
08-11-2016
07:57 AM
Yes, owned by splunk and r-x for all so that's not it. One interesting thing is that it exists only in ~/etc/apps/search/bin. So I tried copying it into the /bin folder of our custom app, but nothing changed, so I think that is also barking up the wrong tree. Therefore I think it must be some missing capability for these users.
... View more
08-11-2016
06:42 AM
We have users with somewhat limited capabilities using custom search home apps.
They are able to search the data they should, but gets an error when trying to use python based search commands, specifically
xmlkv.
The search looks like:
index=win* host=vm-ktapp-2 LogName=Application | xmlkv
As admin I am able to run the search, but the users get the error:
Unknown search command 'xmlkv'.
We are on 6.3.3 currently.
I am suspecting some capability is needed to allow using the Python base search commands, but I have trouble guessing which.
Anyone have an idea?
The users have these capabilites now:
accelerate_search
change_own_password
get_metadata
get_typeahead
input_file
list_inputs
output_file
pattern_detect
request_remote_tok
rest_apps_view
rest_properties_get
rest_properties_set
schedule_rtsearch
search
... View more
06-23-2016
06:56 AM
Works. Very useful.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
08-29-2024
12:22 PM
|
