Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About anandhalagaras1
anandhalagaras1
Path Finder
Member since:
10-15-2019
2 weeks ago
Community Statistics
| Posts | 210 |
| Solutions | 0 |
| Karma Given | 10 |
| Karma Received | 1 |
| Member Since | 10-15-2019 |
Activity Feed
- Posted Re: Splunk Enterprise Advisories on Splunk Enterprise. 2 weeks ago
- Posted Splunk Enterprise Advisories- Is it mandatory to upgrade? on Splunk Enterprise. 2 weeks ago
- Posted Re: Time Conversion During Search Runtime on Splunk Search. 04-06-2022 03:16 AM
- Posted Re: Time Conversion During Search Runtime on Splunk Search. 04-06-2022 02:44 AM
- Posted Re: Time Conversion During Search Runtime on Splunk Search. 04-06-2022 12:42 AM
- Posted Why is "Application Name" field is available in Azure AD but not in the logs ingested into Splunk? on Getting Data In. 04-05-2022 11:41 PM
- Posted Re: Time Conversion During Search Runtime on Splunk Search. 03-10-2022 07:34 AM
- Posted How to do time conversion during search runtime? on Splunk Search. 03-10-2022 05:42 AM
- Posted Universal Forwarder & Associated Certificate Package Upgrade on Installation. 12-31-2021 05:29 AM
- Posted Re: User Account First Name Changed on Getting Data In. 08-25-2021 07:12 AM
- Posted User Account First Name Changed on Getting Data In. 08-25-2021 03:05 AM
- Posted Re: Ping Access Application into Splunk on Getting Data In. 07-20-2021 06:36 AM
- Posted Re: Ping Federate Application into Splunk on Getting Data In. 07-20-2021 06:36 AM
- Posted PingAccess & PingFederate App Not Populating the Stats in Dashboard on Getting Data In. 07-16-2021 09:01 AM
- Posted Re: Ping Federate Application into Splunk on Getting Data In. 07-14-2021 09:38 AM
- Posted Re: Ping Access Application into Splunk on Getting Data In. 07-14-2021 09:38 AM
- Posted Ping Federate Application into Splunk on Getting Data In. 07-13-2021 11:10 PM
- Posted Ping Access Application into Splunk on Getting Data In. 07-13-2021 11:02 PM
- Posted Re: Splunk Metrics on Getting Data In. 06-14-2021 11:00 PM
- Posted Re: Filtering out the message and body fields from wineventlog on Getting Data In. 06-14-2021 10:59 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
2 weeks ago
@richgalloway , Thank you for your detailed information. So from our current version 8.1 or 8.2 can we upgrade our systems directly to the latest version 8.2.6 or should we need to upgrade 8.2.0 and then to 8.2.6 something like that? FYI. Our Splunk search heads are hosted in Cloud and it is running with 8.2.2202.1
... View more
2 weeks ago
Hi Team,
Recently we got an email from Splunk Support stating with the Subject as "Splunk Enterprise Advisories - May 2022" so when checked the email I can able to see around 8 Advisories mentioned for Splunk Enterprise and they have also mentioned that Splunk Cloud wont be impacted and our environment we have 4 Splunk HF servers and 1 Deployment master server which are running with Splunk enterprise instance.
Reference Link:
https://www.splunk.com/en_us/product-security.html?lst=Email1&utm_medium=email&utm_source=splunk&utm_campaign=FY23Q2_CSM_GLBL_OTH_PTF_EN_Security_CVE
And our servers are running with Splunk Enterprise with versions Splunk 8.1.2 (build 545206cc9f70) & Splunk 8.1.3 (build 63079c59e632) respectively.
So is it mandate to upgrade our HF and DM servers to the latest version i.e. from 8.1.2 or 8.1.3 to 8.2.6?
Or do we have any workaround to address the gaps?
Also currently we are running with 8.1.2 or 8.1.3 so can i directly upgrade them to 8.2.6 version will there be any changes? Best recommendations?
So if we upgrade them to latest version will it fix all security vulnerability issue?
Also whether it should be upgraded immediately (Our HF and DM servers) or can we perform the upgrade might be in a month or so?
Kindly help on the same.
... View more
- Tags:
- splunk-enterprise
Labels
- Labels:
-
troubleshooting
-
upgrade
04-06-2022
03:16 AM
@ITWhisperer When I choose the Scatter chart there is a field as Mark so I have chosen the _time and Periods has been set to Auto and then for X axis what should I need to choose and for Y Axis should i need to choose the seconds? Since the data seems to be sluggish when i check now.
... View more
04-06-2022
02:44 AM
@ITWhisperer , Thanks for your response. But is there any possibility to bring the data for each event in Line graph or Bar chart or Column Chart? And also for scatter chart how to mention the x axis and y axis information. Kindly help.
... View more
04-06-2022
12:42 AM
@ITWhisperer ,Thank you. The below mentioned solution worked as expected. But we want to get the data display in a graph format. So I have amended the query as below: index=abc host=xyz | rex "(?<seconds>\d+)s" | rex "(?<milli>\d+)ms" | rex "(?<micro>\d+)µs" | rex "(?<nano>\d+)ns" | fillnull value=0 seconds milli micro nano | eval seconds=round(seconds+(((((nano/1000)+micro)/1000)+milli)/1000),9) and then I have chosen Visualization-->Pivot-->Selected Fields. Then i have chosen the Line Chart. And now I can see X Axis with Date and Y Axis with Seconds information. So there are events with the same timing but with different seconds. 2022-03-23 00:51:53,113 Seconds 14.827107589 2022-03-23 00:51:53,113 Seconds 0.000293807 2022-03-23 00:51:53,113 Seconds 0.000333807 2022-03-23 00:51:53,113 Seconds 0.000436807 2022-03-23 00:51:53,113 Seconds 0.000781807 But in this graph, I can see the timing in X Axis whereas in Y axis for this timing 2022-03-23 00:51:53,113 i can see the count of Seconds ( i.e. Addition of all seconds and producing a count) for that time but we need the data in the graph for each and every events. So how to update the query so that for each and every event i need the graph output. So kindly help
... View more
04-05-2022
11:41 PM
Hi Team,
We have recently configured and ingested the Azure Active Directory Logs into Splunk. Hence we have installed the "Splunk Add-on for Microsoft Office 365" in our Heavy Forwarder server and followed the below documentation process as provided. https://blog.avotrix.com/to-collect-ad-azure-logs-to-splunk/
In our Add-On we have provided the Tenant details i.e. Tenant ID and Client ID and post which I have created the inputs --> Add Inputs "Management Activity" and provided the requested details and saved it.
Then the logs were getting ingested into Splunk as desired and we are getting the relevant fields as well with required data.
But one important field is missing that is the "Application Name" . So we want the Application Name field in which the user had logged on so that it will be really helpful for analysis. But the field is available in Azure AD whereas not in the Logs ingested into Splunk.
We can see the below fields are getting extracted but not the "Application Name" field and moreover in the raw logs also the field is not present. So how to get those field also ingested into Splunk as well.
Sample List of fields which are getting extracted automatically. ActorContextId ActorIpAddress Actor{}.ID Actor{}.Type ApplicationId AzureActiveDirectoryEventType ClientIP CreationTime DeviceProperties{}.Name DeviceProperties{}.Value ErrorNumber ExtendedProperties{}.Name ExtendedProperties{}.Value Id InterSystemsId IntraSystemId LogonError ModifiedProperties{}.Name ModifiedProperties{}.NewValue ModifiedProperties{}.OldValue ObjectId Operation
So kindly help to check on how to extract the Application Field.
... View more
Labels
- Labels:
-
field extraction
03-10-2022
07:34 AM
@ITWhisperer , Thank you. Now I can see the fields are getting extracted as desired. Our requirement is to create a report for the same i.e. If the total time taken is taking longer than expected then we need to get an alert and also if it comes under a visualization has a graph then it will be good as well. So is there any possibility to convert the value of seconds, nanoseconds, milliseconds & microseconds in a event to a single value. If yes then we can try to get a visualization as expected. Kindly help on the same.
... View more
03-10-2022
05:42 AM
Hi Team,
We got an requirement to create a report based on the accessed time present in the logs here in the logs the time is present with seconds, milliseconds, microseconds, nanoseconds value.
Example: 1s79ms874µs907ns So here in this case how to convert them into a unique value. So post which we need to check and create a report for the same. In most of the cases the time is getting started with milliseconds and in few cases the time information is getting started with seconds.
So how to convert the time (1s79ms874µs907ns) to an unique value either in seconds, milliseconds , microseconds or nanoseconds so then only we can able to create a report for the same.
Or do we have any other option to fix this issue while searching the logs during runtime.
So kindly help on my request.
Sample Logs for Reference:
DEBUG 2022-03-10 07:17:26,239 [Timer-x] com.abc.valid.AppData - EntryData >>>>>>>>ConnectionID:xxxxx ClientConnectionId: abcdefgh-xxxx-xxxx-xxxx-xxxxxxxxxxxx, accessed 145ms227µs975ns ago, IN_USE
DEBUG 2022-03-10 07:07:26,239 [Timer-x] com.abc.valid.AppData - EntryData >>>>>>>>ConnectionID:xxxxx ClientConnectionId: ijklmnop-xxxx-xxxx-xxxx-xxxxxxxxxxxx, accessed 1s79ms874µs907ns ago, IN_USE
DEBUG 2022-03-10 07:02:26,238 [Timer-x] com.abc.valid.AppData - EntryData >>>>>>>>ConnectionID:xxxxx ClientConnectionId: qrstuvwx-xxxx-xxxx-xxxx-xxxxxxxxxxxx, accessed 7ms215µs946ns ago, IN_USE
DEBUG 2022-03-10 06:57:26,237 [Timer-x] com.abc.valid.AppData - EntryData >>>>>>>>ConnectionID:xxxxx ClientConnectionId: qrstuvwx-xxxx-xxxx-xxxx-xxxxxxxxxxxx, accessed 168ms259µs830ns ago, IN_USE
DEBUG 2022-03-10 06:57:26,237 [Timer-x] com.abc.valid.AppData - EntryData >>>>>>>>ConnectionID:xxxxx ClientConnectionId: abcdefgh-xxxx-xxxx-xxxx-xxxxxxxxxxxx, accessed 6s993ms781µs523ns ago, IN_USE
DEBUG 2022-03-10 06:47:26,238 [Timer-x] com.abc.valid.AppData - EntryData >>>>>>>>ConnectionID:xxxxx ClientConnectionId: ijklmnop-xxxx-xxxx-xxxx-xxxxxxxxxxxx, accessed 2ms593µs888ns ago, IN_USE
DEBUG 2022-03-10 06:47:26,238 [Timer-x] com.abc.valid.AppData - EntryData >>>>>>>>ConnectionID:xxxxx ClientConnectionId: qrstuvwx-xxxx-xxxx-xxxx-xxxxxxxxxxxx, accessed 55ms239µs616ns ago, IN_USE
DEBUG 2022-03-10 06:47:26,238 [Timer-x] com.abc.valid.AppData - EntryData >>>>>>>>ConnectionID:xxxxx ClientConnectionId: abcdefgh-xxxx-xxxx-xxxx-xxxxxxxxxxxx, accessed 957ms778µs205ns ago, IN_USE
DEBUG 2022-03-10 06:47:26,238 [Timer-x] com.abc.valid.AppData - EntryData >>>>>>>>ConnectionID:xxxxx ClientConnectionId: ijklmnop-xxxx-xxxx-xxxx-xxxxxxxxxxxx, accessed 45ms536µs884ns ago, IN_USE
DEBUG 2022-03-10 06:47:26,238 [Timer-x] com.abc.valid.AppData - EntryData >>>>>>>>ConnectionID:xxxxx ClientConnectionId: qrstuvwx-xxxx-xxxx-xxxx-xxxxxxxxxxxx, accessed 22ms906µs437ns ago, IN_USE
DEBUG 2022-03-10 06:47:26,238 [Timer-x] com.abc.valid.AppData - EntryData >>>>>>>>ConnectionID:xxxxx ClientConnectionId: abcdefgh-xxxx-xxxx-xxxx-xxxxxxxxxxxx, accessed 46ms556µs466ns ago, IN_USE
DEBUG 2022-03-10 06:42:26,236 [Timer-x] com.abc.valid.AppData - EntryData >>>>>>>>ConnectionID:xxxxx ClientConnectionId: ijklmnop-xxxx-xxxx-xxxx-xxxxxxxxxxxx, accessed 3s286ms410µs997ns ago, IN_USE
DEBUG 2022-03-10 06:37:26,239 [Timer-x] com.abc.valid.AppData - EntryData >>>>>>>>ConnectionID:xxxxx ClientConnectionId: qrstuvwx-xxxx-xxxx-xxxx-xxxxxxxxxxxx, accessed 842ms323µs432ns ago, IN_USE
DEBUG 2022-03-10 06:27:26,236 [Timer-x] com.abc.valid.AppData - EntryData >>>>>>>>ConnectionID:xxxxx ClientConnectionId: abcdefgh-xxxx-xxxx-xxxx-xxxxxxxxxxxx, accessed 7ms698µs576ns ago, IN_USE
DEBUG 2022-03-10 06:27:26,236 [Timer-x] com.abc.valid.AppData - EntryData >>>>>>>>ConnectionID:xxxxx ClientConnectionId: ijklmnop-xxxx-xxxx-xxxx-xxxxxxxxxxxx, accessed 18ms948µs359ns ago, IN_USE
DEBUG 2022-03-10 06:17:26,236 [Timer-x] com.abc.valid.AppData - EntryData >>>>>>>>ConnectionID:xxxxx ClientConnectionId: qrstuvwx-xxxx-xxxx-xxxx-xxxxxxxxxxxx, accessed 257ms32µs814ns ago, IN_USE
... View more
- Tags:
- runtime
- splunk-search
Labels
- Labels:
-
field extraction
-
timechart
12-31-2021
05:29 AM
Hi Team, Our Splunk instance is hosted in Cloud and maintained by Splunk Support. So recently we got an email from Splunk Support stating that our Universal Forwarder & Associated Certificate Package has been upgraded to latest version since it is going to expire in couple of days and they have requested us to download and install the UF package from Search Head and rollout to all our Client machines since they are planning to upgrade the package in the indexer level in a couple of days. So our architecture is that we have 1 Deployment master server and 4 HF servers. Search heads , Cluster master , Indexers etc. are managed by Splunk Support. So usually we used to push the customized apps and as well as forwarder apps from our Deployment master server to all our client machines. and moreover all our Splunk servers DM & HF are running with Linux OS. https://docs.splunk.com/Documentation/Forwarder/8.2.4/Forwarder/ConfigSCUFCredentials#Install_the_forwarder_credentials_on_a_deployment_server So as per the documentation I have downloaded the "splunkclouduf.spl" credentials package from our Search head and placed it in /opt/splunk/etc/deployment-apps folder in our DM server then as mentioned I have untar the file so after untar the file I can see a new folder as "100_xxxx_splunkcloud" Later it is mentioned to install the credentials package so in here in this case it is mentioned to choose the path of splunkclouduf.spl so should i need to choose which path and install it? /opt/splunk/etc/deployment-apps/splunkclouduf.spl (OR) /opt/splunk/etc/deployment-apps/100_xxxx_splunkcloud I am quite not sure hence I am struck over here and didn't installed the credentials yet so kindly help to check and update please. And post installation of credentials package it is mentioned to restart the Splunk instance in the DM server. So post installation in my DM server how do I push them to all client machines? Do i need to edit the existing forwarder outputs app (which is pushed to all client machines and HF) Since we already have an app "forwarder_outputs" which we have pushed to all client machines. So in this app we have local and metadata folder in it. And in local folder we have limits.conf, outputs.conf, xxx_cacert.pem & xxx_server.pem file and in metadata folder we have local.meta so now what are the files do i need to modify post installing the credential package in DM server and push them to all client machines so that the UF package would be running with latest version. So kindly help on my request .
... View more
Labels
- Labels:
-
heavy forwarder
-
universal forwarder
08-25-2021
03:05 AM
Hi All, One of the user account has been changed by someone and it got reflected in our Active Directory as well so we want to know who has changed it. Consider an example i.e. I am Anandh Alagarasan and my Firstname would be Anandh and Lastname would be Alagarasan. So recently someone has updated my Firstname to Venkat. So in Active Directory when we checked the account i could see that my account is reflecting as Venkat Alagarasan. So we want to know who had changed the FirstName of the user. Hence we want to know will it be captured in Wineventlogs ? If yes, We want to find out who is the user who had changed the First name of the user account Anandh Alagarasan? So kindly help to know how to pull the information using Search query.
... View more
Labels
- Labels:
-
other
07-20-2021
06:36 AM
Can anyone kindly to check and update me on the same.
... View more
07-16-2021
09:01 AM
Hi Team, I have installed PingAccess (https://splunkbase.splunk.com/app/5368/) and PingFederate (https://splunkbase.splunk.com/app/976/) app in our Splunk Search head and based on this below mentioned documentation we have edited the log4j2.xml file in the client machines where pingaccess and pingfederate app has been installed. post which I can see a huge amount of files log files got generated in /log directory and I have ingested all the log files into Splunk. Documentation Link: https://docs.pingidentity.com/bundle/pingfederate-102/page/qst1564002981075.html https://docs.pingidentity.com/bundle/pingaccess-62/page/gyx1564006725145.html But when I navigated to the app and I couldn't able to see any data in the dashboard ? And it is showing as no results and search is waiting for inputs. So do i need to configure additional things to reflect in the dashboard? Since in both the apps I couldnt able to see any data getting populated so kindly help on the same. FYI. I have ingested all the log files using an index as main and for all the logs from pingaccess i used the sourcetype as pingaccess and for all the log files from pingfederate i used the index as main and sourcetype as pingfederate. And the logs from pingconsole i used the index as main and sourcetype as pingconsole. So am i missing anything in the configuration kindly let me know since I want the dashboard to work as expected.
... View more
Labels
- Labels:
-
other
07-14-2021
09:38 AM
Can anyone kindly check and reply me on the same.
... View more
07-13-2021
11:10 PM
Hi Team, I have installed and utilizing the PingFederate application in our organization for few of our client servers. And now we want it to ingest the logs generated from these app into Splunk and utilize the Dashboards to view the statistics present in the Splunk Search head. So I have installed PingFederate App for Splunk (https://splunkbase.splunk.com/app/976/) in our Splunk Search heads. The PingFederate application are running in our client servers so I have logged into one of the client server where Ping Federate app has been installed and I can see that the Splunk Universal Forwarder (UF) has been already installed in the client server and it is reporting in Splunk. So now I have navigated to the directory in which PingFederate is installed and I can see the version we are using for PingFederate is 10.2.1 PingFederate: I have followed the documentation for PingFederate ( https://docs.pingidentity.com/bundle/pingfederate-93/page/qst1564002981075.html) and tried to setup in the client server. But I can see in the documentation we are having 5 Logger elements and I am quite not sure which one should I need to uncomment and which RollingFile should I need to uncomment in the log4j2.xml file? So kindly help on the same. And post uncommenting the required stanza should I need to restart the PingFederate service to consider into effect? Kindly help on the same. And if the log file is generated in the log directory then what index and sourcetype information should I need to use? So that the dashboards which is present in the app should work as expected for both the Apps? Or if I missing out anything then kindly help to correct me on the same as well.
... View more
Labels
- Labels:
-
other
07-13-2021
11:02 PM
Hi Team, I have installed and utilizing the PingAccess application in our organization for few of our client servers. And now we want it to ingest the logs generated from these app into Splunk and utilize the Dashboards to view the statistics present in the Splunk Search head. So I have installed PingAccess App for Splunk (https://splunkbase.splunk.com/app/5368/) in our Splunk Search heads. The PingAccess application are running in our client servers so I have logged into one of the client server where Ping Access app has been installed and I can see that the Splunk Universal Forwarder (UF) has been already installed in the client server and it is reporting in Splunk. So now I have navigated to the directory in which PingAccess is installed and I can see the version we are using for PingAccess is 6.2.0 Ping Access: So as per the documentation provided I have (https://docs.pingidentity.com/bundle/pingaccess-63/page/gyx1564006725145.html) followed the steps i.e. edited the log4j2.xml file and uncommented the below lines from the Stanza. <AppenderRef ref="ApiAudit2Splunk"/> <AppenderRef ref="EngineAudit2Splunk"/> <AppenderRef ref="AgentAudit2Splunk"/> But in the xml file I couldn’t able to find the below lines as mentioned in the document? <AppenderRef ref="SidebandClientAudit2Splunk"/> <AppenderRef ref="SidebandAudit2Splunk"/> So what should I need to do if these lines are missing in the xml file? Shall I skip it or should I need to include it? Kindly help on the same please. And post performing the steps do I need to restart the PingAccess service so that the respective log files would be generated in the log directory? Kindly confirm on this part as well. And if the log file is generated in their respective directory then I believe we need to ingest the below mentioned log files into Splunk and we already have the setup (Splunk universal forwarder) running in the server so we can just go ahead and use any of the index and sourcetype information or do we have anything specific index name along with sourcetype (For PingAccess App) which need to be created in Splunk and use them to ingest the logs ? Kindly confirm on the same as well. (Since we want the dashboards installed in the Splunk Search head should be showing up the statistics). • pingaccess_engine_audit_splunk.log • pingaccess_api_audit_splunk.log • pingaccess_agent_audit_splunk.log So kindly help me on my query..
... View more
Labels
- Labels:
-
other
06-14-2021
10:59 PM
@venkatasri , Actually i want to send the "body" field to nullQueue. So How can I send to nullQueue do we need to write props and transforms for the same. Or should I make them stop by updating in inputs.conf kindly help me with the stanza if possible.
... View more
