About kochera

kochera · ‎08-28-2019

problem solved. I put part of the the props.conf [modsec:audit] SHOULD_LINEMERGE = false TRUNCATE = 99999 LINE_BREAKER = -{2,3}[a-zA-Z0-9]{8}-{1,3}Z-{2}([\r\n]+)-{2,3}[a-zA-Z0-9]{8}-{1,3}A-{2} TIME_PREFIX = -{2,3}[a-zA-Z0-9]{8}-{1,3}A-{2}\n[ MAX_TIMESTAMP_LOOKAHEAD = 26 TIME_FORMAT = %d/%b/%Y:%H:%M:%S %z KV_MODE = none directly on the heavyforwarders and keep the other part of the configuration in the TA on the indexers.

kochera · ‎08-27-2019

Hi, find below the sample. cheers, Andy ---6uIk3EEg---A-- [27/Aug/2019:15:35:57 +0200] 7fc42219c6c4d351842309e9d537dc9c 13.93.46.20 34698 13.93.46.20 443 ---6uIk3EEg---B-- POST /services/collector/event HTTP/1.1 Host: Authorization: Splunk 75B1123F-D42B-47A8-8146-F24704BE9C70 Accept-Encoding: gzip, deflate Connection: keep-alive Accept: / Content-Length: 382 User-Agent: python-requests/2.9.1 ---6uIk3EEg---F-- HTTP/1.1 200 Server: nginx Date: Tue, 27 Aug 2019 13:35:57 GMT Content-Length: 27 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Connection: keep-alive Vary: Authorization X-Frame-Options: SAMEORIGIN Strict-Transport-Security: max-age=63072000 ---6uIk3EEg---H-- ModSecurity: Warning. Matched "Operator Eq' with parameter 0' against variable REQUEST_HEADERS:Content-Type' (Value: 0' ) [file "/etc/modsecurity/owasp-modsecurity-crs/v3.1.1/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "732"] [id "920340"] [rev ""] [msg "Request Containing Content, but Missing Content-Type header"] [data ""] [severity "5"] [ver "OWASP_CRS/3.1.1"] [maturity "0"] [accuracy "0"] [hostname "13.93.46.20"] [uri "/services/collector/event"] [unique_id "7fc42219c6c4d351842309e9d537dc9c"] [ref "v217,3"] ModSecurity: Warning. Matched "Operator Eq' with parameter 0' against variable REQUEST_HEADERS:Content-Type' (Value: 0' ) [file "/etc/modsecurity/owasp-modsecurity-crs/v3.1.1/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "732"] [id "920340"] [rev ""] [msg "Request Containing Content, but Missing Content-Type header"] [data ""] [severity "5"] [ver "OWASP_CRS/3.1.1"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [hostname "13.93.46.20"] [uri "/services/collector/event"] [unique_id "7fc42219c6c4d351842309e9d537dc9c"] [ref "v217,3"] ---6uIk3EEg---J-- ---6uIk3EEg---K-- ---6uIk3EEg---Z--

kochera · ‎08-26-2019

Hi, Our raw events from mod_security logfile are split into three different events. I've tried multiple settings in props.conf without success. Current config is: [modsec:audit] SHOULD_LINEMERGE = false TRUNCATE = 0 NO_BINARY_CHECK = true #LINE_BREAKER = (\-{2,3}[a-zA-Z0-9]{8}\-{1,3}Z\-{2}([\r\n]+)\-{2,3}[a-zA-Z0-9]{8}\-{1,3}A\-{2}) LINE_BREAKER = ([\r\n]+)(\-{2,3}[a-zA-Z0-9]{8}\-{1,3}A\-{2}) MAX_TIMESTAMP_LOOKAHEAD = 32 MAX_EVENTS = 1024 TIME_PREFIX = \[ TIME_FORMAT = %d/%b/%Y:%H:%M:%S %z KV_MODE = none Cheers, Andy

kochera · ‎11-10-2017

I checked on that already. the permissions are ok. we get the error on all SH-cluster members although not equally spreaded.

kochera · ‎11-10-2017

we don't know. it just generates a lot of error messages in the splunkd.log

kochera · ‎11-10-2017

Hi, has anyone seen the error message below? ERROR AdminManager - Argument "actual_only" is not supported by this handler. Any ideas what may cause this? Cheers, Andy

kochera · ‎06-13-2017

Hi, we already have a HEC up and running and this is the only service we want to expose. cheers, Andy

kochera · ‎06-12-2017

Hi, the reason why we want to use HEC is that we don't want to open additonal tcp ports towards our on-premise Splunk instance. cheers, Andy

kochera · ‎06-11-2017

Hi, we would like to forward all data from a splunk instance in the "cloud" to an on-premise http event collector. Is there a way of doing this? cheers, Andy

kochera · ‎11-30-2015

Hi, thanks for your answer. But why is it writting the data properly when running it manually? cheers, Andy

kochera · ‎11-30-2015

Hi, I've a scheduled saved search running every day to collect events and writting the events to a new index. Running the search interactively is working fine but running the job started by the scheduler is not working at all. No data is written to the new index. Find below the search: index=access sourcetype="legacy" [search (index=access sourcetype="tap") OR (index=access sourcetype=vdi) |fields + user ] |collect index=access sourcetype=legacy_spec Any ideas what might cause this behaviour? cheers, Andy

kochera · ‎01-09-2015

Basically we should have a list of hosts and ports DB connect tries to connect to.

kochera · ‎01-09-2015

Hi, We have an Oracle RAC environment with dataguard. We don't know which instance is the active one and which is the passive one. The JDBC connection string looks like: jdbc:oracle:thin:@(DESCRIPTION = (ADDRESS = (PROTOCOL = TCP) (HOST = <hostA-scan>) (PORT = 1532)) (ADDRESS = (PROTOCOL = TCP) (HOST = <hostB-scan>) (PORT = 1532)) (CONNECT_DATA = (SERVICE_NAME = kudaps_rw.T.pnet.ch) (CONNECT_TIMEOUT=5)(RETRY_COUNT=2) ) ) Any idea how to make DB Connect 'dataguard aware'? Cheers, Andy

kochera · ‎03-24-2014

Hi, I would like to compare the same hour for the last seven days. Is there a chance of using timewrap for this? cheers, Andy

kochera · ‎12-31-2013

Hi, on our newly installed Windows servers (windows server 2012 r2) we get the following error message while starting the Splunk Universal forwarder 12-31-2013 09:58:31.630 +0100 ERROR ExecProcessor - message from ""C:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"" splunk-netmon - NetmonConfig::InitNetmonConfig: No valid stanzas found. What I saw in the docs (http://docs.splunk.com/Documentation/Splunk/6.0.1/Data/MonitorWindowsnetworkinformation) is that this OS version is not supported. Could this be the cause for the above error? cheers, Andy

kochera · ‎10-29-2013

Hi, we will for sure give it a try. Thanks very much, Andy

kochera · ‎10-28-2013

Hi, Do you have any intentions to provide a database write option within the DB Connect app? Cheers, Andy

kochera · ‎06-25-2013

Hi, thanks for the hint. Finally I got a it working. 1) SELECT TO_TIMESTAMP(TO_CHAR(LOG_ENTRYDATE),'YYYY-MM-DD HH24:MI:SS.FF') LOG_ENTRYDATE, 2) SELECT TO_CHAR (TO_TIMESTAMP (LOG_ENTRYDATE, 'YYYY-MM-DD HH24:MI:SS,FF6'), 'YYYY-MM-DD HH24:MI:SS.FF3') LOG_ENTRYDATE, Both should work, for me solution 1) was just fine. Cheers, Andy

kochera · ‎06-19-2013

Hi Sigi, find below the definition of the log_entrydate field. LOG_ENTRYDATE VARCHAR2 YES 29 0 10 cheers, Andy

kochera · ‎06-19-2013

Hi, we use DB connect to monitor database jobs. Each job generates an entry. the field log_number is an increasing counter, the fiels log_entrydate is the actual timestamp. log_entrydate format: 2013-06-19 14:03:12.183506 I tried to extract the timestamp and to get an event for each log_number but was not successful. Configuration: output.timestamp = true output.timestamp.column = LOG_ENTRYDATE output.timestamp.parse.format = yyyy-MM-dd HH:mm:ss.SSS --> I don't know how to specify Any help is appreciated. Cheers, Andy

kochera · ‎03-20-2013

Problem solved. Used servicename instead of SID

kochera · ‎02-04-2013

Hi Sigi, I added the entry to dbx/local/database.conf and restart splunk. I still get the same error message when I try to add a new database connection. $ cat etc/apps/dbx/local/database.conf [default] database.sid = true cheers, Andy

kochera · ‎01-31-2013

Hi, we're running the DBX App 1.0.4 in production. After upgrading to 1.0.8 we get the following error: Encountered the following error while trying to save: In handler 'dbx-databases': Error connecting to database: java.sql.SQLException: Listener refused the connection with the following error: ORA-12514, TNS:listener does not currently know of service requested in connect descriptor Any idea what might cause this? Cheers, Andy

kochera · ‎01-23-2013

Hi, We're running Splunk 4.3.3. One of our customers would like to export the search results (approx. 300 events) over AllTime in raw-format. The UI export fails with an error message: File not found Firefox can't find the file at https://pspka028:7020/splunk/en-US/api/search/jobs/1358949211.44213/event?isDownload=true&timeFormat=%FT%T.%Q%:z&maxLines=0&count=500&filename=test&outputMode=raw&spl_ctrl-limit=limit&spl_ctrl-count=500. This seems to be a known problem, I found some similar questions on splunkbase but did not find an answer. Are there any updates regarding this? Cheers, Andy

kochera · ‎10-05-2012

Hi, thanks for the answer. what we get is a report portrait format. But for better readability(scalability) the customer would like to have in portrait format. Cheers, Andy

Posts	49
Solutions	1
Karma Given	3
Karma Received	18
Member Since	‎02-15-2011

Online Status	Offline
Date Last Visited	‎04-26-2023 10:32 AM

Why is this event splitting into three single even...

Unknown error message from Admin Manager

Forwarder send data to http event collector

saved search with collect command not running/not ...

In our Oracle RAC environment with dataguard, how ...

Same hour for the last 7 days

Windows splunk-netmon on Windows server 2012

write data to database

DB connect - timestamp issue

DBX: Problems after upgrading to 1.0.8

Re: Why is this event splitting into three single ...

Re: Why is this event splitting into three single ...

Why is this event splitting into three single even...

Re: Unknown error message from Admin Manager

Re: Unknown error message from Admin Manager

Unknown error message from Admin Manager

Re: Forwarder send data to http event collector

Re: Forwarder send data to http event collector

Forwarder send data to http event collector

Re: saved search with collect command not running/...

saved search with collect command not running/not ...

Re: In our Oracle RAC environment with dataguard, ...

In our Oracle RAC environment with dataguard, how ...

Same hour for the last 7 days

Windows splunk-netmon on Windows server 2012

Re: write data to database

write data to database

Re: DB connect - timestamp issue

Re: DB connect - timestamp issue

DB connect - timestamp issue

Re: DBX: Problems after upgrading to 1.0.8

Re: DBX: Problems after upgrading to 1.0.8

DBX: Problems after upgrading to 1.0.8

export raw AllTime: file not found

Re: Print report in landscape format