Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About Nsdjanin
Nsdjanin
New Member
Member since:
02-18-2017
06-05-2020
Community Statistics
| Posts | 7 |
| Solutions | 0 |
| Karma Given | 0 |
| Karma Received | 0 |
| Member Since | 02-18-2017 |
Activity Feed
- Posted Replication issue on Deployment Architecture. 01-24-2019 03:18 AM
- Tagged Replication issue on Deployment Architecture. 01-24-2019 03:18 AM
- Tagged Replication issue on Deployment Architecture. 01-24-2019 03:18 AM
- Tagged Replication issue on Deployment Architecture. 01-24-2019 03:18 AM
- Tagged Replication issue on Deployment Architecture. 01-24-2019 03:18 AM
- Tagged Replication issue on Deployment Architecture. 01-24-2019 03:18 AM
- Posted Re: I need to filter out logs that have "Account Name: SERVER01$" on Splunk Dev. 02-19-2017 08:31 AM
- Posted Re: I need to filter out logs that have "Account Name: SERVER01$" on Splunk Dev. 02-19-2017 12:48 AM
- Posted Re: I need to filter out logs that have "Account Name: SERVER01$" on Splunk Dev. 02-18-2017 03:45 PM
- Posted Re: Filtering windows security event logs with Regex on Splunk Search. 02-18-2017 02:37 PM
- Posted Re: I need to filter out logs that have "Account Name: SERVER01$" on Splunk Dev. 02-18-2017 10:22 AM
- Posted I need to filter out logs that have "Account Name: SERVER01$" on Splunk Dev. 02-18-2017 07:20 AM
- Tagged I need to filter out logs that have "Account Name: SERVER01$" on Splunk Dev. 02-18-2017 07:20 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 |
01-24-2019
03:18 AM
Hello!
Our Splunk system consists of 1xMaster,1xSearchHead and 2xIndexers.
Some time ago we had lots of traffic between two indexers. When we had a look we saw that 1.4 TB of data was copied over network between our two indexers in one direction in one day.
What can provoke that kind of network traffic? It seems that all buckets are copied over.
How can I find the cause of that behaviour?
Can somebody help me where to look?
... View more
02-19-2017
08:31 AM
Props.conf
[source::WinEventLog:Security]
TRANSFORMS-filterWinSecNull = filterWinSecNull
Transforms.conf
[filterWinSecNull]
REGEX = (?ms)[\s\r\n]+EventCode\s*=\s*4658[\s\r\n]+.*[\s\r\n]+Account\s+Name:\s*SERVER01\$[\s\r\n]+
DEST_KEY = queue
FORMAT = nullQueue
These are my props.conf and transforms.conf files.
I don't have any blacklists.
This configuration filters out all windows security logs from that particular machine that has lots of logs with Account name SERVER01$.
Do you have any ideas?
.
Thanks in advance
... View more
02-19-2017
12:48 AM
Woodcock thanks, but after your proposed changes I now have a situation that all of mine security logs from this particular machine is filtered out. Not only 4658 with account name SERVER01$ but all.
Do you have any idea?
... View more
02-18-2017
03:45 PM
I need to prevent them from being indexed.
... View more
02-18-2017
02:37 PM
How would this regex look like if I'm interested in filtering out only one machine account - SERVER01$ and not all of them?
Please help!
... View more
02-18-2017
10:22 AM
niketnilay thanks on answer but i need eventcode 4658.
I want to filter out only machine account Account Name: SERVER01$ that generates these logs. Other accounts I need.
... View more
02-18-2017
07:20 AM
Hello everybody,
I'm new in this field and I have one question.
We have too many windows security logs indexed that are generated by machine accounts.
I want to filter out logs that looks like this:
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4658
EventType=0
Type=Information
ComputerName=comp1.domain.com
TaskCategory=Removable Storage
OpCode=Info
RecordNumber=4463688
Keywords=Audit Success
Message=The handle to an object was closed.
Subject :
Security ID: DOMAIN1\SERVER01$
Account Name: SERVER01$
Account Domain: DOMAIN1
Logon ID: 0x347732
I need to filter out logs that have "Account Name: SERVER01$".
What is the best way to do this?
I know about props.conf and transforms.conf, but I don't know how to generate right regex for that.
Please help!
... View more
- Tags:
- splunk-enterprise
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:04 AM
|
