Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- About robnewman666
robnewman666
Path Finder
Member since:
10-11-2016
03-07-2022
Community Statistics
| Posts | 35 |
| Solutions | 0 |
| Karma Given | 8 |
| Karma Received | 5 |
| Member Since | 10-11-2016 |
Activity Feed
- Posted Re: Can I forward logs from a Heavy Forwarder in JSON format to another data capture device? on Getting Data In. 03-07-2022 02:25 PM
- Karma Re: Can I forward logs from a Heavy Forwarder in JSON format to another data capture device? for richgalloway. 03-07-2022 02:25 PM
- Posted Can I forward logs from a Heavy Forwarder in JSON format to another data capture device? on Getting Data In. 03-07-2022 08:10 AM
- Karma Re: Monitor a set of csv files for errors for PickleRick. 02-03-2022 05:18 AM
- Posted Re: Monitor a set of csv files for errors on Splunk Search. 02-03-2022 02:53 AM
- Posted Monitor a set of csv files for errors on Splunk Search. 02-03-2022 02:21 AM
- Tagged Monitor a set of csv files for errors on Splunk Search. 02-03-2022 02:21 AM
- Posted Re: Has anyone installed the Corelight App (and TA) onto a clustered Splunk setup on Getting Data In. 01-24-2022 05:37 AM
- Posted Re: Check if csv files have been updated to latest versions on Splunk Search. 01-13-2022 03:15 AM
- Posted Re: Check if csv files have been updated to latest versions on Splunk Search. 01-12-2022 02:38 AM
- Posted Check if csv files have been updated to latest versions on Splunk Search. 01-11-2022 04:15 AM
- Tagged Check if csv files have been updated to latest versions on Splunk Search. 01-11-2022 04:15 AM
- Tagged Check if csv files have been updated to latest versions on Splunk Search. 01-11-2022 04:15 AM
- Karma Re: Test connectivity between Search Heads and Indexers for richgalloway. 10-20-2021 12:45 AM
- Posted Failed connections from indexer to search head for mrsparkle/root.py on Knowledge Management. 10-19-2021 05:30 AM
- Tagged Failed connections from indexer to search head for mrsparkle/root.py on Knowledge Management. 10-19-2021 05:30 AM
- Posted Test connectivity between Search Heads and Indexers on Monitoring Splunk. 09-15-2021 03:46 AM
- Tagged Test connectivity between Search Heads and Indexers on Monitoring Splunk. 09-15-2021 03:46 AM
- Posted Re: Props and transforms to strip syslog header from Zeek data on Getting Data In. 04-07-2021 05:57 AM
- Karma Re: Props and transforms to strip syslog header from Zeek data for richgalloway. 04-07-2021 05:57 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 0 |
03-07-2022
02:25 PM
Thanks very much. 🙂
... View more
03-07-2022
08:10 AM
I wanted to ask if it was easy or possible to forward logs if some may be in text format from a HF to another device and send in JSON format?
... View more
- Tags:
- json
Labels
- Labels:
-
heavy forwarder
-
JSON
02-03-2022
02:21 AM
So I have a particular number of important csv files that I need to ensure have no errors - which I can lookup using the cmd: find . -name "bad_ips.csv" -exec 2>/dev/null echo {} \; -exec grep -n ",," {} \; | grep -B 1 "^1:" (I run about 5 of these against the csv files I am most interested in - with 'bad_ips' as an example) I am after a way of automating this and being able to run each day and see it in a Splunk dashboard. - is this possible?
... View more
Labels
- Labels:
-
lookup
01-24-2022
05:37 AM
As I recall, I think I made up my own TA to deal with the logs and also used some of the props.conf configs from the app which worked ok in the end for what I wanted it to do.
... View more
01-13-2022
03:15 AM
I think what I am after is a way of confirming the upload mechanism and if the csv files were uploaded, as I update them regularly, and have quite a few.
... View more
01-12-2022
02:38 AM
Thanks, but not getting any data on my csv files from metadata. 😞
... View more
01-11-2022
04:15 AM
Is there a way of checking if the latest csv updates were successful and if they were the most up to date versions (as I have csv files updated daily) - also if they were successful when they were run via scheduled tasks?
... View more
- Tags:
- csv
- inputlookup
- stats
Labels
- Labels:
-
stats
10-19-2021
05:30 AM
I have read the explanation on the mrsparkle dir via Solved: So I get the obvious Simpsons reference but what a... - Splunk Community but I am seeing a lot of instances of failed connections from the indexer to the search head via port 8000 trying to initiate a connection with it. Firstly - should this be trying to connect from the indexer to the search head, and if so, is it still valid that this is required? Then - why would that be failing if there are already connections from the indexer to the search head via 8000?
... View more
09-15-2021
03:46 AM
Hello, I am after a way of testing connectivity and reliability between my Search Heads and Indexers in a cluster as I am seeing some errors in the remote searches log for scheduled searches that are showing as some nodes 'does not exist' errors.
... View more
Labels
- Labels:
-
indexer
-
search head
04-07-2021
05:57 AM
This did work a treat. Thanks very much!
... View more
04-07-2021
05:17 AM
Thanks, will give this a try
... View more
04-07-2021
02:26 AM
I am trying to strip the Syslog header from the Zeek data that I have coming in as the Corelight TA only likes the raw zeek files. At the moment I have (on a clustered network) -on the indexers in /opt/splunk/etc/system/local the following transforms.conf and below that the props.conf: transforms.conf: [syslog-header-stripper-ts-host] REGEX = ^<\d+>[A-Z][a-z]+\s+\d+\s+\d+:\d+:\d+\s[^\s]*\s\S+:\s(.*)$ FORMAT = $1 DEST_KEY = _raw props.conf: [syslog] # For zeek data - stripping the syslog header TRANSFORMS-strip-syslog = syslog-header-stripper-ts-host This doesn't seem to work for the data - as it is still arriving at the Search Heads with the Syslog header on it. Do I need to put these onto the Search Heads instead? Or does the props and transforms need editing?
... View more
Labels
- Labels:
-
props.conf
-
syslog
-
transforms.conf
03-30-2021
07:28 AM
I am trying to setup the Corelight App for Zeek data on a clustered Splunk setup, but it seems the TA doesn't want to work along with the App. The App is required to be installed onto the Search Head cluster and the TA is to be on the Indexers, as per the guidelines from Corelight. I am wondering if the install isn't suited to a clustered Splunk setup. I am also having error codes for a Windows TA - but im not sure if this relates to this issue here.
... View more
Labels
- Labels:
-
indexer
03-08-2021
11:09 AM
1 Karma
Thanks, this does look better, so will try tomorrow. Thanks @scelikok! 🙂
... View more
03-08-2021
07:08 AM
1 Karma
Hello, I have the following search but I want it to show me the delay less and more out by more than 1 hour in a better way: index=av | eval index_time=_indextime, event_time=_time | eval delay=round((_indextime - _time)/60, 0) | convert ctime(index_time) ctime(event_time) | where delay<3600 OR delay>3600 | sort - index_time | table event_time index_time delay
... View more
03-05-2021
05:27 AM
Yep, ignore that, I could only copy from a different machine in this case, so was typing all this out. (Fixed)
... View more
03-05-2021
03:44 AM
Hello, I am trying to bring up a search that will tell me how much each index is being used, but the search_index field doesn't work. Here is the search: index=_audit action=search (id=* OR search_id=*) | rex "user=(?<user>.*?)," | search user!=splunk-system-user | search user!=admin | search search!=*_internal* search!=*_audit* | rex max_match=0 field=search_index "((?:index(\")?=(?:\\|\\\"|\")?)|(?:s\w+\s\S))(?<my_indexes>[^\\\s\"]+)" | eval search_index=mvdedup(search_index) | convert num(total_run_time) | eval time_of_search=strftime(_time, "%F %T") | table user time_of_search total_run_time savedsearch_name search_index search
... View more
11-17-2020
09:07 AM
Thanks, thought so, but was just curious. It goes to a 3rd party app then onwards to Splunk, but as there's no delimiter, it doesn't play well. Will try something else in the mean time perhaps.
... View more
11-17-2020
06:30 AM
Is it possible to add a stanza field to outputs.conf on a light forwarder to add a delimiter to data that currently has none? I realise that if sending data (in this case, zeek logs), directly to Splunk this would work, but my data is going somewhere else first then to Splunk, which is why I need the data to be delimited before it's sent. Can it all be done in outputs.conf, or even can I add props.conf and transforms.conf on the light forwarder?
... View more
Labels
11-09-2020
01:54 AM
There were a few orphaned searches that were linked to a user that had left. I had reassigned these (knowledge objects) to a current user, but the alerts still appear on the message board. Is there somewhere else where I need to amend something so that these alerts disappear?
... View more
Labels
- Labels:
-
saved search
-
scheduled search
11-05-2020
02:29 AM
I have a feed that has the host field defaulting to what is essentially the sourcetype, but in the shost field I have all the host data that I want/need in the host field. I want to know what is easier and won't break any of the splunk system configs for the built in host name extraction. Is it better to create a FIELDALIAS to have shost AS host in the props.conf for that dataset or to do something different like a transforms.conf?
... View more
Labels
- Labels:
-
index
-
props.conf
-
transforms.conf
02-13-2018
06:51 AM
I have added a csv file of the top 1 million domains in /opt/splunk/etc/system/lookups and then added a transforms.conf pointed to that file but I don't see any proof that this is working - ive restarted Splunk as well as amending the props.conf (in local) to reflect the stanza I used in transforms. Any help in this area is appreciated. I am also trying to get the domains from Stream data.
... View more
06-06-2017
01:46 PM
1 Karma
I didn't get to the bottom of this, so if anyone does, please comment. 🙂
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
03-07-2022
06:27 PM
|
Karma given to
