About marcmuher

marcmuher · ‎07-06-2017

In Splunk, go to settings->data inputs, then click udp. Add a UDP port there if there is not already one (I used 50000 to be sure that there were no conflicts), then click next. On the next page, for sourcetype select operating system->syslog. Everything else can be the defaults, but I had the Kaspersky stuff go into it's own index, but that's just me. In Kaspersky, go to the Administration Server page, and click "Configure Notifications and Event Export", then select "Configure export to SIEM system." Make sure that "automatically export..." is checked, select "Splunk (CEF Format)" for the SIEM system, enter the IP address of your Splunk server, enter the port that you selected in Splunk and UDP. Click apply. Data should start showing up in Splunk now.

marcmuher · ‎01-20-2017

It's a windows machine. Server 2012 R2. The switching of the folder separators are the replies that I'm getting, not the input.

marcmuher · ‎01-20-2017

To see how much each source is putting through, try this search- change the sourcetype as needed. sourcetype=WinEventLog:* | fields _raw, _time, host | eval evt_bytes = len(_raw) | timechart span=1d sum(eval(evt_bytes/1024/1024)) AS TotalMB by host To see how big your indexes are, try this search: | rest /services/data/indexes | eval perc=(currentDBSizeMB * 100 / maxTotalDataSizeMB ) | table title currentDBSizeMB maxTotalDataSizeMB perc

marcmuher · ‎01-19-2017

Using Splunk 6.5.1 on Windows Server 2012 R2. Pretty standard installation, one server with Splunk installed on the D drive and a bunch of forwarders. I'm trying to generate a self-signed certificate using these directions: http://docs.splunk.com/Documentation/Splunk/6.5.1/Security/Self-signcertificatesforSplunkWeb When I get to step 4, I put in this line from the d:\splunk\bin directory after (after changing the end from $splunk_home\openssl.cnf) openssl req -new -key myCAPrivateKey.key -out myCACertificate.csr -config d:\splunk\openssl.cnf I get the message "WARNING: can't open config file: C:\\wrangler-2.0\\build-home\\ivory/ssl/openssl.cnf but it still creates the private key. The next step, I enter (after again changing the end from $splunk_home\openssl.cnf) openssl x509 -req -in myCACertificate.csr -signkey myCAPrivateKey.key -out myCACertificate.pem -days 3650 -config d:\splunk\openssl.cnf I get the reply: WARNING: can't open config file: C:\\wrangler-2.0\build-home\\ivory/ssl/openssl.cnf And there I'm stuck. Anyone have any ideas?

marcmuher · ‎12-30-2016

Indeed, changing the inputs.conf on the systems with the universal forwarder was the solution when using 6.5.1. I changed the biggest offender this morning, and it looks like it will reduce our data consumption per domain controller by about 80%. For some reason, we were logging and then processing through Splunk every time a computer did a DNS lookup, which was the bulk of the 5156 codes. I also learned something important. I had cut and pasted the [WinEventLog://Security] disabled = 0 blacklist = EventCode = ”5156” from an email from our Splunk after-sales engineer into Notepad on the target computer. On the email the quotation marks are curved. Splunk does not appear to like curved quotation marks, so Splunk ignored the command and it did not work. Once I typed the quotation marks in manually ("5156"), it worked.

marcmuher · ‎12-27-2016

Thank you for the replies. According to our Splunk after-sales engineer, we need to change the input.conf on the systems that have a universal forwarder, not just the heavy forwarder. Once I get our network guys to make these changes, I'll post whether it worked or not.

marcmuher · ‎12-21-2016

Thanks for replying so quickly! It's the inputs.conf on the Splunk server itself - we don't have a heavy forwarder, just universal forwarders, so I didn't think I need to do anything to the servers with the forwarders on them. I'm restarting the Splunk service whenever I make a change, although I am getting an error message when I stop the splunkd service that says "Windows could not stop the Splunkd service on Local Computer. Error 1503: The service did not respond to the start or control request in a timely fashion." But then it restarts normally. I tried btool, but get the message "Splunk_home must be set. Stopping." and I only have the brain power to troubleshoot one problem at a time!

marcmuher · ‎12-21-2016

I apologize since this has been answered before. I've tried all the solutions offered in the previous threads and am still not able to get it working. I need to filter out event code 5156 coming into our Splunk instance. We're seeing about 25,000 of these events per minute (possibly a Kaspersky issue on the servers coming in over universal forwarders, but I can't do anything about that) and I'm trying to lessen our total usage. We're on Windows, using Splunk Enterprise 6.5.1. I've tried editing the inputs.conf file in splunk\etc\system\local and adding this entry: [WinEventLog://Security] disabled = 0 blacklist = "5156" I've done it with and without the // in WinEventLog and with and without the "" around 5156, but am still seeing the same amount of 5156 events coming through in Splunk as before. And I'm obviously pretty new with Splunk and my position in this company so I'm trying to get something working correctly

Posts	8
Solutions	1
Karma Given	2
Karma Received	1
Member Since	‎12-21-2016

Online Status	Offline
Date Last Visited	‎06-05-2020 02:04 AM

When trying to create a self-sign certificate, why...

Why am I unable to filter out an event code?

Re: Splunk and Kaspersky Security Center 10

Re: When trying to create a self-sign certificate,...

Re: How to generate a search to compare license us...

When trying to create a self-sign certificate, why...

Re: Why am I unable to filter out an event code?

Re: Why am I unable to filter out an event code?

Re: Why am I unable to filter out an event code?

Why am I unable to filter out an event code?