Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About waJesu
waJesu
Explorer
Member since:
10-02-2020
a week ago
Community Statistics
| Posts | 28 |
| Solutions | 0 |
| Karma Given | 3 |
| Karma Received | 2 |
| Member Since | 10-02-2020 |
Activity Feed
- Posted Re: How to search for events with domains on DNS Blocklist? on Getting Data In. 2 weeks ago
- Posted How to search for events with domains on DNS Blocklist? on Getting Data In. 2 weeks ago
- Tagged How to search for events with domains on DNS Blocklist? on Getting Data In. 2 weeks ago
- Karma Re: List of URLs/domains in my logs in a particular period for gcusello. 11-08-2022 10:59 AM
- Posted How to write a search to remove duplicates on software inventory? on Splunk Enterprise. 11-08-2022 10:58 AM
- Tagged How to write a search to remove duplicates on software inventory? on Splunk Enterprise. 11-08-2022 10:58 AM
- Posted Management App for outdated apps on Security. 10-25-2022 05:25 AM
- Tagged Management App for outdated apps on Security. 10-25-2022 05:25 AM
- Posted How to search to get list of URLs/domains in my logs in a particular period? on Getting Data In. 07-28-2022 07:19 AM
- Tagged How to search to get list of URLs/domains in my logs in a particular period? on Getting Data In. 07-28-2022 07:19 AM
- Karma Re: Query to monitor web traffic for gcusello. 07-15-2022 03:08 AM
- Posted Setting up directory for estreamer logs on Security. 07-14-2022 06:41 AM
- Tagged Setting up directory for estreamer logs on Security. 07-14-2022 06:41 AM
- Posted Re: Query to monitor web traffic on Getting Data In. 07-08-2022 04:28 AM
- Posted Re: Query to monitor web traffic on Getting Data In. 07-06-2022 08:26 AM
- Posted Help with Query to monitor web traffic on Getting Data In. 07-06-2022 04:17 AM
- Tagged Help with Query to monitor web traffic on Getting Data In. 07-06-2022 04:17 AM
- Posted Re: Internet Content filtering dashboard on Security. 06-29-2022 08:47 AM
- Tagged Re: Internet Content filtering dashboard on Security. 06-29-2022 08:47 AM
- Posted How to create a WIDS/IDPS/Internet Content Filtering dashboard in Splunk? on Security. 06-28-2022 08:48 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
2 weeks ago
@tscroggins Thank you for the assistance. I tried index=main | lookup blocklist.csv Domain as url_domain output suspicious | search suspicious=1 It says "the destination suspicious was not found in the blocklist.csv. My table looks like this: I am not sure where I missed it.
... View more
2 weeks ago
I have lookup table with a DNS blocklist. What query can I use to search for events with any of the blocklisted domains. I had received advice to create a csv file with two columns: "Domain" and "suspicious" which is set to 1 for all the domains. Then I would search for the dns sourcetype and suspicious=1. This did not work.
... View more
- Tags:
- dns
Labels
- Labels:
-
other
11-08-2022
10:58 AM
I have a list of software installed in our environment but some of the software have several entries duplicated with the different versions. How do I clean up the list by removing the other versions and remaining with the latest version for each software. I need help with a query for this. The query must create a corrected list of the software.
... View more
- Tags:
- duplicates
Labels
- Labels:
-
using Splunk Enterprise
10-25-2022
05:25 AM
I need a Splunk management app to monitor all splunk servers for out-of-date, out-of-sync (running different versions) apps. Does anyone know which I one I can use?
... View more
- Tags:
- apps
Labels
- Labels:
-
other
07-28-2022
07:19 AM
I am new to Splunk and I need help to get a query that lists all the domains that are in my logs (that were accessed from my network or that accessed my network) at any given period or range
... View more
- Tags:
- urls in network
Labels
- Labels:
-
other
07-14-2022
06:41 AM
I am new to Splunk and need help directing estreamer logs to a particular directory in Splunk
... View more
- Tags:
- estreamer logs
Labels
- Labels:
-
other
07-06-2022
04:17 AM
I need help coming up with a query that can help create an IDPS/Internet Content Filtering dashboard in Splunk to continuously monitor the web traffic or pull reports when asked.
... View more
- Tags:
- web traffic
Labels
- Labels:
-
other
06-29-2022
08:47 AM
I am not very experienced. I would like to monitor the IPS for traffic from the internet. I need to come up with a dashboard. It's the splunk query to use that I am looking for.
... View more
- Tags:
- I a
06-28-2022
08:48 AM
I need help on how to create a WIDS/IDPS/Internet Content Filtering dashboard in Splunk so that I can continuously monitor the web traffic or pull up reports when asked.
... View more
Labels
- Labels:
-
other
04-01-2022
08:19 AM
I have a list of switches on our network and once in a while some of them stop reporting to Splunk. I need a query that lists those switches not reporting to be able to create a dashboard
... View more
Labels
- Labels:
-
other
04-01-2022
08:16 AM
I see logs leaving the proxy to an external IP. How do I know the internal IP requesting that external site/IP
... View more
Labels
- Labels:
-
other
11-04-2020
11:22 AM
My DNS is now only showing IP addresses in the logs. How do I get to see DNS names in the logs?
... View more
Labels
- Labels:
-
metadata
11-04-2020
04:56 AM
How do I check if a device has universal forwarder installed and if so how do I troubleshoot while it's not sending data to the indexer.
... View more
Labels
- Labels:
-
universal forwarder
10-23-2020
06:14 AM
You know how a DHCP returns a DHCPACK after the other 3 steps (DHCPDISCOVER, DHCPOFFER, and DHCPREQUEST). From the logs, I want to identify events where a DHCP broadcast has no DHCPACK. I hope I have clarified my need. So far I have used: index=* host=<dhcp servername> "no free leases". I believe there is a better query and maybe narrow results by hostname.
... View more
I need help coming up with an alert for DHCP broadcasts with no acknowledgement. The DHCP is injesting logs into Splunk.
... View more
Labels
- Labels:
-
alert action
10-23-2020
03:24 AM
1 Karma
Yeah the DHCP is bring logs into Splunk but I am specifically looking to create an alert for DHCP broadcasts with no acknowledgement. Please help along those lines. Thank you for the link. Though it doesn't have my solution, it is still helpful information to keep.
... View more
10-22-2020
12:33 PM
I need to create an alert for when my DHCP server is not returning acknowledgement. Please help
... View more
Labels
- Labels:
-
alert action
10-14-2020
07:38 AM
Hey Brian. I am not sure why it's returning Error in "eval" command: The expression is malformed. Expected
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
a week ago
|
