Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Are you a member of the Splunk Community?
Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- About horst_poehlmann
horst_poehlmann
Explorer
Member since:
09-27-2013
03-22-2021
Community Statistics
| Posts | 10 |
| Solutions | 0 |
| Karma Given | 1 |
| Karma Received | 1 |
| Member Since | 09-27-2013 |
Activity Feed
- Posted Re: Can MaaS360 work with Splunk? on All Apps and Add-ons. 03-18-2021 07:51 PM
- Karma Re: How can I replace only the field value if found using Automatic lookups? for musskopf. 06-05-2020 12:47 AM
- Got Karma for Re: How can I replace only the field value if found using Automatic lookups?. 06-05-2020 12:47 AM
- Posted Re: once more about "File is binary or file encoding is not supported, only utf-8 encoded files are supported" on Getting Data In. 06-26-2019 09:14 PM
- Posted Re: Modify search string from input field to search IP addr db on Splunk Search. 02-07-2019 03:08 PM
- Posted Re: Modify search string from input field to search IP addr db on Splunk Search. 02-06-2019 06:22 PM
- Posted Re: Modify search string from input field to search IP addr db on Splunk Search. 02-05-2019 05:09 PM
- Posted Re: Modify search string from input field to search IP addr db on Splunk Search. 02-05-2019 04:59 PM
- Posted Modify search string from input field to search IP addr db on Splunk Search. 02-05-2019 04:25 PM
- Tagged Modify search string from input field to search IP addr db on Splunk Search. 02-05-2019 04:25 PM
- Posted Searching for related syslog messages for sendmail on Splunk Search. 01-06-2015 09:09 PM
- Tagged Searching for related syslog messages for sendmail on Splunk Search. 01-06-2015 09:09 PM
- Posted Re: How can I replace only the field value if found using Automatic lookups? on Splunk Search. 11-09-2014 07:52 PM
- Posted How can I replace only the field value if found using Automatic lookups? on Splunk Search. 11-05-2014 05:38 PM
- Tagged How can I replace only the field value if found using Automatic lookups? on Splunk Search. 11-05-2014 05:38 PM
- Tagged How can I replace only the field value if found using Automatic lookups? on Splunk Search. 11-05-2014 05:38 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 |
03-18-2021
07:51 PM
Has there been an updated link. There is still very little information about this and the link above no longer works.
... View more
06-26-2019
09:14 PM
I had a similar problem. In my case it turned out to be the fact that we changed the user that the splunk process was running under, so it could no longer access the lookup file in the lookup_tmp directory. The error message was totally misleading, but after changing the ownership of the lookup file to match the Splunk username, it worked again.
So in your case, make sure that the splunk process has access to "C:/Splunk/var/run/splunk/lookup_tmp/maintenance_windows_empty.csv"
... View more
02-07-2019
03:08 PM
The lines of the lookup table look something like this:
network,10.10.10.0,255.255.255.0,10.10.10.0/255.255.255.0,,,,,,Core/Server Room,,,,,FALSE,,,,,,,,,FALSE,FALSE,,,,,,,FALSE,LAN Addressing,,,,95,85,0,10,,,,,,,,,,,,,Site ABC,,OVERRIDE,432,,Voice Vlan222,*,OVERRIDE
I'm searching on field 2 (which is the "address" field).
I sort of got it working by adding a "0" to the extracted field, e.g.
|makeresults
| eval ip = "10.10.10.123"
| rex field=ip "(?\d+.\d+.\d+.)\d+"
| eval address=address1."0"
| lookup IPAM-Allnetworks address OUTPUT
| table
but is there a way to do a wildcard search instead? (i.e. 10.10.10.*)
Thx
PS: Not sure what happened to the previous comments.
... View more
02-06-2019
06:22 PM
Sorry. The lines look something like this:
network,10.10.10.0,255.255.255.0,10.10.10.0/255.255.255.0,,,,,,Core/Server Room,,,,,FALSE,,,,,,,,,FALSE,FALSE,,,,,,,FALSE,LAN Addressing,,,,95,85,0,10,,,,,,,,,,,,,Site ABC,,OVERRIDE,432,,Voice Vlan222,*,OVERRIDE
I'm searching on field 2 (address).
Thx
... View more
02-05-2019
05:09 PM
Quotes around it worked. I just need to work out how to add a "*" wildcard to the end of the search so that it searches:
address=10.10.10.*
... View more
02-05-2019
04:59 PM
Thanks. I tried something similar, but the eval command gives me:
Error in 'eval' command: The number 10.10.10.123 is invalid.
... View more
02-05-2019
04:25 PM
I'm trying to create a dashboard that lets a user input an IP address and then search through the IP address database to search for the subnet and location.
e.g. if someone enters 10.10.10.123, it would basically do a search through a csv of "10.10.10."
So I've tried this for example (among a 1000 other things)
| inputlookup IPAM-Allnetworks.csv
| search address=10.10.10.123 (This would obviously be the $address$ from the form)
| rex field=address "(?\d+.\d+.\d+.)\d+"
| where address = src_subnet
| table address cidr location VLAN (i.e. interesting fields from CSV)
Yes, this will only work for /24 subnets, but will cover most use cases.
The problem I see is that I need to extract the fields before actually searching. I can see why my search doesn't work but not sure how to fix it.
... View more
- Tags:
- splunk-enterprise
01-06-2015
09:09 PM
I would like to write a search to give me all log lines relating to a particular bounced email message:
Basically I can monitor for a log line that has "postmaster-mail.sh" in it. That log line also contains the initial Message ID (which doesn't get extracted by default by I created a field called msgID).
I then have to run a series of manual searches to find out all log line.
Basically I search for w010cweA015328 , the find the next message ID, which is x000mbnW025320 , that will give me the next message ID which is a070yZwR021222 .
So my search would end up looking like this:
sourcetype=syslog host="relay" process=sm-mta w010cweA015328 OR x000mbnW025320 OR a070yZwR021222
I then get the following lines, which tell me why the message failed and from which IP it came from.
Jan 7 11:14:57 mailserver sm-mta[00228]: w010cweA015328: to=| postmaster-mail.sh, ctladdr=postmaster (1/0), delay=00:00:01, xdelay=00:00:01, mailer=esta, pri=20001, dsn=2.0.0, stat=Sent
Jan 7 11:14:56 mailserver sm-mta[00228]: x000mbnW025320: w010cweA015328: return to sender: User unknown
Jan 7 11:14:46 mailserver sm-mta[00228]: x000mbnW025320: to=, delay=00:00:05, xdelay=00:00:05, mailer=smtp, pri=10332, relay=[10.140.12.43] [10.140.12.43], dsn=5.1.1, stat=User unknown
Jan 7 11:14:41 mailserver sm-mta[00228]: a070yZwR021222: x000mbnW025320: DSN: User unknown
Jan 7 11:14:41 mailserver sm-mta[00228]: a070yZwR021222: to=,,,,,,,,,,,,,, delay=00:00:30, xdelay=00:00:30, mailer=smtp, pri=0250112, relay=[10.140.12.43] [10.140.12.43], dsn=2.0.0, stat=Sent (<201300020033.a070yZwR021222@mailserver.ken.qt.rae.zg> Queued mail for delivery)
Jan 7 11:14:41 mailserver sm-mta[00228]: a070yZwR021222: to=,,,,,,,,,,,,,,,,,,,,,,,, [more], delay=00:00:30, xdelay=00:00:30, mailer=smtp, pri=0250112, relay=[10.140.12.43] [10.140.12.43], dsn=2.0.0, stat=Sent (<201300020033.a070yZwR021222@mailserver.ken.qt.rae.zg> Queued mail for delivery)
Jan 7 11:14:36 mailserver sm-mta[00228]: a070yZwR021222: to=, delay=00:00:25, xdelay=00:00:25, mailer=smtp, pri=0250112, relay=[10.140.12.43] [10.140.12.43], dsn=5.1.1, stat=User unknown
Jan 7 11:14:31 mailserver sm-mta[00228]: a070yZwR021222: to=, delay=00:00:20, xdelay=00:00:20, mailer=smtp, pri=0250112, relay=[10.140.12.43] [10.140.12.43], dsn=5.1.1, stat=User unknown
Jan 7 11:14:26 mailserver sm-mta[00228]: a070yZwR021222: to=, delay=00:00:15, xdelay=00:00:15, mailer=smtp, pri=0250112, relay=[10.140.12.43] [10.140.12.43], dsn=5.1.1, stat=User unknown
Jan 7 11:14:21 mailserver sm-mta[00228]: a070yZwR021222: to=, delay=00:00:10, xdelay=00:00:10, mailer=smtp, pri=0250112, relay=[10.140.12.43] [10.140.12.43], dsn=5.1.1, stat=User unknown
Jan 7 11:14:16 mailserver sm-mta[00228]: a070yZwR021222: to=, delay=00:00:05, xdelay=00:00:05, mailer=smtp, pri=0250112, relay=[10.140.12.43] [10.140.12.43], dsn=5.1.1, stat=User unknown
Jan 7 11:14:11 mailserver sm-mta[11642]: a070yZwR021222: from=, size=1210, class=0, nrcpts=41, msgid=<201300020033.a070yZwR021222@mailserver.ken.qt.rae.zg>, proto=DEANA, daemon=MTA, relay=guogcagiv01 [10.005.12.107]
The first message ID will give me the first two line, the second one will give me the next 2 and the third the rest.
I've tried a number of things, but am having problems working it out. My first thought was to use sub searches, so I tried to extract the msg ID, but that did not work (mostly because the msgID if the second line is different to the message ID of the first line).
I would need to run the second search without the msgID= part (ie only the actual value w010cweA015328)
I'm sure there is an easier way, but I can't think of it.
Thanks.
... View more
- Tags:
- sendmail
11-09-2014
07:52 PM
1 Karma
I could not find any of the variables I used in my lookup definitions using the GUI in the files under $SPLUNK_HOME. I grep'd for a particular string. Not that important at this stage though.
Thanks, the eval function did the trick. Not sure how efficient that is as I had to use 4 separate eval functions (src, dest port and protocol), but it does work.
Appreciate your answer.
... View more
11-05-2014
05:38 PM
I have a problem with my checkpoint logs and automatic lookup tables (although the problem is not specific to checkpoint logs but rather automatic lookups).
The original log lines look something like this:
loc=1959996|time= 6Nov2014 11:48:49|action=accept|orig=fw|i/f_dir=inbound|i/f_name=Lan1|has_accounting=1|product=VPN-1 & FireWall-1|__policy_id_tag=product=VPN-1 & FireWall-1[db_tag={999999999-63E0-11E4-8888-999999999999};mgmt=cpmgr;date=1415077659;policy_name=POL1]|service_id=domain-udp|src=SERVER1|s_port=64444|dst=DESTSERV1|service=domain-udp|proto=udp|rule=77
loc=1960000|time= 6Nov2014 11:48:49|action=accept|orig=fw|i/f_dir=inbound|i/f_name=Lan2|has_accounting=1|product=VPN-1 & FireWall-1|__policy_id_tag=product=VPN-1 & FireWall-1[db_tag={999999999-63E0-11E4-8888-999999999999};mgmt=cpmgr;date=1415077659;policy_name=POL1]|service_id=https|src=10.0.0.1|s_port=55555|dst=10.1.0.1|service=https|proto=tcp|rule=222
When splunk creates the fields, I end up with src=SERVER1 and src_ip=SERVER1 (same for dest and dest_ip)
What I want to do is replace src_ip with the actual IP of SERVER1, so I created a csv from the checkpoint config (using CPrules.pl) and that all works fine.
However, there are also lines that are not defined and therefore already contain an IP address (see logline 2 above), which means it can't find it in the lookup table and therefore returns a blank field. I use the "Overwrite field values" feature in automatic lookups.
My Question is, can I somehow keep the original value if it wasn't found in the lookup table?
Also, when defining lookups in the Web GUI, where is the information stored?
PS: I use splunk 6.1
Thanks
... View more
