About shashilendra

shashilendra · ‎12-27-2022

Hi , Can i push prop.conf and transfrom.conf via deployment server to Universal Forwarder (installed on 600 Linux server) i am thinking to create these prop and transfroms file on deployment server under /opt/splunk/etc/deployment-apps/<App Name>/local. will it work thanks shashi

shashilendra · ‎12-07-2022

Hi Team, getting huges audit logs and wanted to blacklist in input.conf . index=*linux* source="/var/log/audit/audit.log" type=proctitle

shashilendra · ‎01-17-2021

Hi , i can see the matching IP address from both index , but i want to know which source IP address Triger this traffic and at what time . in ASA log "src_ip" field contain the source IP address. i will create a alert which contain time src ip , dest_ip/indicator

shashilendra · ‎01-16-2021

Hi , i tried your query but no result , however both index having matching IP address. dest_ip=13.66.139.23 indicator=13.66.139.23

shashilendra · ‎01-16-2021

Even i tried below query as well index=asa dest_ip=* [search sourcetype="otx:indicator" type=IPV4 | fields indicator | rename indicator as dest_ip] | table dest_ip Thanks shashi

shashilendra · ‎01-16-2021

Hi , i have a index "otx" and having field "indicator" so i want to trigger alert if any IP address from "indicator" match to my ASA firewall logs where "dest_ip" is field in ASA logs. i am trying belong query. index=asa | join dest_ip [search sourcetype="otx:indicator" type=IPV4 | fields indicator | rename indicator as dest_ip] Thanks shashi

shashilendra · ‎12-17-2020

Above url is not working , could someone tell the step to integrate

Posts	7
Solutions	0
Karma Given	1
Karma Received	0
Member Since	‎12-06-2020

Online Status	Offline
Date Last Visited	‎12-27-2022 06:13 AM

How to get linux logs to blacklist in input.conf?

search field from 1 index to other index field

Re: How to get linux logs to blacklist in input.co...

How to get linux logs to blacklist in input.conf?

Re: search field from 1 index to other index fie...

Re: search field from 1 index to other index fie...

Re: search field from 1 index to other index fie...

search field from 1 index to other index field

Re: Ingesting AlienVault OTX feed service with Spl...