About g_paternicola

g_paternicola · ‎06-13-2022

if I have a retention at an index of 90days, but events come in with a broken timestamp that says 2018 or something; what counts for retention now? Indexed time or _time from the event?

g_paternicola · ‎04-04-2022

It works on Splunk 8.2.5..

g_paternicola · ‎04-04-2022

Hi, I know that, but we have a few Users that have spaces in the password. But this was not my question. Could Splunk deal with spaces in the password? If it should, then we have a bug.. if not then it should be configured in some ways.

g_paternicola · ‎04-04-2022

Hi everyone, I can't login to my Splunk account because I have a space at the beginning of my password. We will login to Splunk via LDAP. Does Splunk have a problem with that or is that a Bug? Thank you very much for any advice.

g_paternicola · ‎02-10-2022

Hello everyone I'm trying to get a list of ip addresses from an internet page and put them after that into a lookup table. My issius is that I can't use mvexpand to put every ip addresses into a single row... here my search: | curl method=get uri=https://feodotracker.abuse.ch/downloads/ipblocklist_recommended.txt | fields curl_message | rex field=curl_message mode=sed "s/.*#//g" | rex field=curl_message mode=sed "s/DstIP//g" | rex field=curl_message mode=sed "s/^\s+//g" and as results I will get a big block of data in one single row. How can I split these in multiple rows? Thank you all for the support.

g_paternicola · ‎12-20-2021

this command was my solution: Get-WinEvent -FilterHashTable @{ LogName = "Microsoft-Windows-TerminalServices-RDPClient/Operational"; ID = 1024 } There is no "TerminalServices-ClientActiveXCore" in the PowerShell results. This also why Splunk told me all the time "failed to find ...." Thank you!

g_paternicola · ‎12-20-2021

I already have this in my stanza: [WinEventLog://Microsoft-Windows-TerminalServices-ClientActiveXCore/Microsoft-Windows-TerminalServices-RDPClient/Operational] disabled = 0 renderXml = 1 sourcetype = XmlWinEventLog index = ad whitelist3=1024 But I always going to get this error, even if I put the '\' escape before "Operational" or after 12-20-2021 09:08:21.416 +0100 ERROR ExecProcessor [21652 ExecProcessor] - message from ""C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exe"" splunk-winevtlog - WinEventMon::configure: Failed to find Event Log with channel name='Microsoft-Windows-TerminalServices-ClientActiveXCore/Microsoft-Windows-TerminalServices-RDPClient/Operational'

g_paternicola · ‎12-19-2021

Is there anyone else that can help me, please?

g_paternicola · ‎12-03-2021

Already tried, but it didn't work.. 😞

g_paternicola · ‎12-03-2021

Hello I'm trying to injest event from this Microsoft event viewer: [WinEventLog://Microsoft-Windows-TerminalServices-ClientActiveXCore/Microsoft-Windows-TerminalServices-RDPClient/Operational] disabled = 0 renderXml = 1 sourcetype = XmlWinEventLog index = ad My issue is, that the name of the event log the whole path is and not just "Operational" like the others. Because of that I will get an error in Splunk: ERROR ExecProcessor [5076 ExecProcessor] - message from ""C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exe"" splunk-winevtlog - WinEventMon::configure: Failed to find Event Log with channel name='Microsoft-Windows-TerminalServices-ClientActiveXCore/Microsoft-Windows-TerminalServices-RDPClient/Operational' Is there a way to escape the "/" before Operational? Thank you very much in advice.

g_paternicola · ‎10-25-2021

Hello everyone, I have the following inputs.conf file which is actually working for the first 2 stanza, but not for the third one. could someone please tell me why? I do not get any events from them. [WinEventLog://Security] disabled = 0 renderXml = 1 start_from = oldest current_only = 0 evt_resolve_ad_obj = 1 checkpointInterval = 5 sourcetype = XmlWinEventLog index = ad whitelist1=4624,4769,4728,4732,4756,4761,4751,4746 # This stanza will send all events for the event_code 21 [WinEventLog://Microsoft-Windows-TerminalServices-LocalSessionManager/Operational] disabled = 0 renderXml = 1 sourcetype = XmlWinEventLog index = ad source="XmlWinEventLog:Microsoft-Windows-TerminalServices-LocalSessionManager/Operational" whitelist2=21 # This stanza will send all events for the event_code 1024 [WinEventLog://Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational] disabled = 0 renderXml = 1 sourcetype = XmlWinEventLog index = ad source="XmlWinEventLog:Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational" whitelist3=1024 Thank you very much for helping me!

g_paternicola · ‎10-18-2021

Thank you very much! That's a good one. Would also be possible to get which service has a warning or error?

g_paternicola · ‎10-18-2021

Hi everyone, I'm looking for a search, that shows me when the health status of splunkd is changing from green to yellow or red... Would that be possible?

g_paternicola · ‎09-13-2021

Hi everyone, I'm trying to get a simple text from a raw event, but I can't make it works. The event looks like this: and my regex looks like this: | rex field=_raw "Allow\s(?<GroupName>\w.+)\s+Enroll" my issue is, that I only going to get a few of those groups, but not all... for example I will get the Domain Users but not the Enterprise Users which is in the same raw file... Could please someone help me with this regex?

g_paternicola · ‎09-08-2021

Hi everyone, I'm getting probably an issue with the extraction of my Fortinet data. I have installed the following apps: Fortinet FortiGate App for Splunk SplunkAppForFortinet 1.5.1 Fortinet Fortigate Add-on for Splunk Splunk_TA_fortinet_fortigate 1.6.2 Does anyone know the different of the field action and ftnt_action? because I'm getting different results there. In field action do I have for example "blocked" but in ftnt_action do I have "detected" and also "dropped". This is a bit confusing while I'm trying to get only blocked attacks. Could someone please help me?

g_paternicola · ‎09-06-2021

Hi everyone, is there a possibility to get data in with renderXML=true via wmi.conf stanza? Thanks for helping me.

g_paternicola · ‎08-23-2021

Hi everyone, I'm a bit confused about the retention time of an index. I have created an index (via indexes.conf) with 90 days retention time and max volume of 50GB... so, I always knew, that the logs are gonna delete if the index has reached the max volume or the time has reached 90 days... But in my case my index has 4.8 GB reached and the oldest event is from the 1st of May, which is more than 90 days... Do I understand this wrong?

g_paternicola · ‎08-13-2021

Yeah, this makes absolute sense to me, but It also depends on how the "auto" calculation works. if that could generate a delay of 15 mins then it makes no sense for the */5 and */1 searches. Do you know how the calculation works?

g_paternicola · ‎08-13-2021

Hi everyone, I have some questions about skipped searches. With the following search, I have found, that on my SH I have a few (2800 last 7 days) skipped searches. index = _internal skipped sourcetype=scheduler status=skipped | stats count by app search_type reason savedsearch_name | sort -count I have made other searches with show me all saved searches and their scheduled cronjob. I have found, that I have more than 70 searches that are running every 5 minutes and a few are running every minute. Would that be my issue with the skipped searches, even they are running for just a few seconds (max 5 seconds). On all 70 scheduled searches is the parameter schedule_window set to 0.

g_paternicola · ‎06-09-2021

Hi everyone, I have installed Splunk on Windows and unfortunately, instead of the user admin I have created the user splunk. After that I created in the Splunk Web Gui the user admin and set it as an admin. But now I will get some errors like this: Invalid user admin, provided in passAuth argument, attempted to execute command "R:\Program Files\Splunk\bin\Python3.exe" "R:\Program Files\Splunk\etc\apps\python_upgrade_readiness_app\bin\pura_send_email.py" Is there any solution for that? Thank you very much!

g_paternicola · ‎06-04-2021

I know about this page, but I can't understand it very well. with OpenSSL, I have created a CSR file, which I paste it into a web service (zerossl) in order to create a SSL web certificate. Now I have got 2 files a ca_bundle.crt and a certificate.crt. But I noticed that in Splunk .../auth/splunkweb there are 2 files but not crt, but .pem. How could I make it works?

g_paternicola · ‎06-02-2021

Hi everyone, I have created an ssl web certificate from an online service and got 3 files: ca_bundle.crt certificate.crt private.key What I have to do in order to install my SSL certificate in my Search Head? Thank you very much for helping me!

g_paternicola · ‎06-01-2021

yeah, I also believe that, because I didn't get any results on the Duration

g_paternicola · ‎06-01-2021

Hi everyone, I have a table which gives me 2 fields Username and Duration. How can I dedup the Username and add the total of the Duration in one row? Thank you very much!

g_paternicola · ‎05-17-2021

It works now... Grazie!

Posts	48
Solutions	2
Karma Given	10
Karma Received	0
Member Since	‎10-06-2020

Online Status	Offline
Date Last Visited	‎06-14-2022 03:16 AM

What counts for Splunk retention time if events co...

How do I change Space in Password with login via L...

Split block of data into multiple rows

Failed to find Windows Event Log

No Event Code 1024 appear

Search for status of health status of splunkd

Getting text from raw event with regex

Fortinet filed extractions

RenderXML via wmi stanza

Indexes configuration

What counts for Splunk retention time if events co...

Re: Space in Password with login via LDAP

Re: Space in Password with login via LDAP

How do I change Space in Password with login via L...

Split block of data into multiple rows

Re: Failed to find Windows Event Log

Re: Failed to find Windows Event Log

Re: Failed to find Windows Event Log

Re: Failed to find Windows Event Log

Failed to find Windows Event Log

No Event Code 1024 appear

Re: Search for status of health status of splunkd

Search for status of health status of splunkd

Getting text from raw event with regex

Fortinet filed extractions

RenderXML via wmi stanza

Indexes configuration

Re: Skipped Searches

Skipped Searches

Splunk internal user Error

Re: SSL Web Certificate

SSL Web Certificate

Re: Total of 2 rows

Total of 2 rows

Re: Compare _time of 2 events