Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About krisrmal
krisrmal
Engager
Member since:
07-08-2020
10-26-2021
Community Statistics
| Posts | 7 |
| Solutions | 0 |
| Karma Given | 1 |
| Karma Received | 0 |
| Member Since | 07-08-2020 |
Activity Feed
- Posted Re: Forwarder on AMI in AWS for Auto Scaling groups on All Apps and Add-ons. 10-26-2021 03:20 AM
- Posted Re: invalid Stanza error in SplunkEnterpriseSecuritySuite on Splunk Enterprise Security. 11-25-2020 11:25 PM
- Karma Re: Splunking OpenVPN Server Logs for to4kawa. 09-28-2020 09:49 PM
- Posted Re: Splunk App for AWS: How to adjust the regular expression in props.conf to extract fields in ELB Access Logs? on All Apps and Add-ons. 08-20-2020 01:15 AM
- Tagged AWS ELB logs not correctly parsing on All Apps and Add-ons. 08-19-2020 09:10 PM
- Posted AWS ELB logs not correctly parsing on All Apps and Add-ons. 08-19-2020 09:06 PM
- Tagged AWS ELB logs not correctly parsing on All Apps and Add-ons. 08-19-2020 09:06 PM
- Tagged AWS ELB logs not correctly parsing on All Apps and Add-ons. 08-19-2020 09:06 PM
- Tagged AWS ELB logs not correctly parsing on All Apps and Add-ons. 08-19-2020 09:06 PM
- Tagged AWS ELB logs not correctly parsing on All Apps and Add-ons. 08-19-2020 09:06 PM
- Posted Re: Splunk Add-on for Amazon Web Services: Why are ALB Access logs not getting indexed or parsed correctly? on All Apps and Add-ons. 08-19-2020 08:59 PM
- Posted Re: Splunking OpenVPN Server Logs on Security. 07-11-2020 04:08 AM
- Tagged Re: Splunking OpenVPN Server Logs on Security. 07-11-2020 04:08 AM
- Tagged Splunk query output formating to Jason format on Getting Data In. 07-08-2020 05:43 AM
- Posted Splunk query output formating to Jason format on Getting Data In. 07-08-2020 05:37 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 |
10-26-2021
03:20 AM
Hi @jphilipsen Would like to check with you, how did you managed to get this done?
... View more
11-25-2020
11:25 PM
Did you find any solution for this? I also facing the similar issue.
... View more
08-20-2020
01:15 AM
Hi @klaxdal Would you be able to share the props.conf config block you have added to ingest ELB logs. Currently I'm experiencing similar issue, where I cannot parse the logs properly. Thanks!
... View more
08-19-2020
09:06 PM
Hi, I'm using Add-on for Amazon Web Services version 5.0.0. I have ingested ALB logs as described in https://docs.splunk.com/Documentation/AddOns/released/AWS/IncrementalS3. Now I could see the logs are being indexed. However, those events still not parsing correctly. still I could see only the raw logs. Is there anyone who could successfully parse the AWS ALB logs? I'm using Index cluster. I have followed the below thread, though it is bit old. Still no luck. https://community.splunk.com/t5/All-Apps-and-Add-ons/Splunk-Add-on-for-Amazon-Web-Services-Why-are-ALB-Access-logs/m-p/231895#M25928
... View more
Labels
08-19-2020
08:59 PM
Hi I know this is quite old thread. However, Now I'm suing Add-on for Amazon Web Services version 5.0.0. I have ingested ELB logs as described in https://docs.splunk.com/Documentation/AddOns/released/AWS/IncrementalS3. Now I could see the logs are being ingested. However, those events still no parsing. still I could see only the raw logs. I have added the props.conf as you shows above, still the issue is same. Am I missing something else?
... View more
07-11-2020
04:08 AM
@bradp1234 , @meoo @sajbutler Did anyone managed to get OpenVPN logs to Splunk? If so, can anyone help on this?
... View more
- Tags:
- sajbutler sajbutler
07-08-2020
05:37 AM
I have ingested some logs to Splunk which now looks like below when searching from search header. {\"EventID\":563662,\"EventType\":\"LogInspectionEvent\",\"HostAgentGUID\":\"11111111CE-7802-1111111-9E74-BD25B707865E\",\"HostAgentVersion\":\"12.0.0.967\",\"HostAssetValue\":1,\"HostCloudType\":\"amazon\",\"HostGUID\":\"1111111-08CF-4541-01333-11901F731111109\",\"HostGroupID\":71,\"HostGroupName\":\"private_subnet_ap-southeast-1a (subnet-03160)\",\"HostID\":85,\"HostInstanceID\":\"i-0665c\",\"HostLastIPUsed\":\"192.168.43.1\",\"HostOS\":\"Ubuntu Linux 18 (64 bit) (4.15.0-1051-aws)\",\"HostOwnerID\":\"1111112411\",\"HostSecurityPolicyID\":1,\"HostSecurityPolicyName\":\"Base Policy\",\"Hostname\":\"ec2-11-11-51-45.ap-southeast-3.compute.amazonaws.com (ls-ec2-as1-1b-datalos) [i-f661111148a3f6]\",\"LogDate\":\"2020-07-08T11:52:38.000Z\",\"OSSEC_Action\":\"\",\"OSSEC_Command\":\"\",\"OSSEC_Data\":\"\",\"OSSEC_Description\":\"Non standard syslog message (size too large)\",\"OSSEC_DestinationIP\":\"\",\"OSSEC_DestinationPort\":\"\",\"OSSEC_DestinationUser\":\"\",\"OSSEC_FullLog\":\"Jul 8 11:52:37 ip-172-96-50-2 amazon-ssm-agent.amazon-ssm-agent[24969]: \\\"Document\\\": \\\"{\\\\n \\\\\\\"schemaVersion\\\\\\\": \\\\\\\"2.0\\\\\\\",\\\\n \\\\\\\"description\\\\\\\": \\\\\\\"Software Inventory Policy Document.\\\\\\\",\\\\n \\\\\\\"parameters\\\\\\\": {\\\\n \\\\\\\"applications\\\\\\\": {\\\\n \\\\\\\"type\\\\\\\": \\\\\\\"String\\\\\\\",\\\\n \\\\\\\"default\\\\\\\": \\\\\\\"Enabled\\\\\\\",\\\\n \\\\\\\"description\\\\\\\": \\\\\\\"(Optional) Collect data for installed applications.\\\\\\\",\\\\n \\\\\\\"allowedValues\\\\\\\": [\\\\n \\\\\\\"Enabled\\\\\\\",\\\\n How can I format this correctly to show in JSON format when searing in searcher header. I'm pretty new to Splunk, hence have less idea on this. My file_monitor > props.conf looks like below [myapp:data:events]
pulldown_type=true
INDEXED_EXTRACTIONS= json
category=Custom
description=data
disabled=false
TRUNCATE=99999
... View more
- Tags:
- splunk
Labels
