Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About leonheart78
leonheart78
Explorer
Member since:
10-06-2011
06-05-2020
Community Statistics
| Posts | 30 |
| Solutions | 0 |
| Karma Given | 2 |
| Karma Received | 0 |
| Member Since | 10-06-2011 |
Activity Feed
- Karma Re: Regex for Windows Event from Syslog agent for aholzel. 06-05-2020 12:49 AM
- Karma Re: Join outer fails to return valid result even when the value exists in both searches for acharlieh. 06-05-2020 12:47 AM
- Posted Re: Using stats to organise repetitive data on Splunk Search. 02-08-2018 05:55 PM
- Posted Using stats to organise repetitive data on Splunk Search. 02-07-2018 05:39 PM
- Tagged Using stats to organise repetitive data on Splunk Search. 02-07-2018 05:39 PM
- Posted Using Data as Fields on Splunk Search. 01-15-2018 05:25 PM
- Posted Re: Regex for Windows Event from Syslog agent on Splunk Search. 09-11-2017 01:34 AM
- Posted Regex for Windows Event from Syslog agent on Splunk Search. 09-11-2017 12:20 AM
- Tagged Regex for Windows Event from Syslog agent on Splunk Search. 09-11-2017 12:20 AM
- Posted Regex on a Syslog parsed Windows Event on Splunk Search. 09-10-2017 11:59 PM
- Tagged Regex on a Syslog parsed Windows Event on Splunk Search. 09-10-2017 11:59 PM
- Posted No data indexed into Splunk when using nessus2splunk.py scripted input on All Apps and Add-ons. 06-21-2017 08:44 AM
- Tagged No data indexed into Splunk when using nessus2splunk.py scripted input on All Apps and Add-ons. 06-21-2017 08:44 AM
- Posted Adding additional value in Single Value Panel on Dashboards & Visualizations. 12-28-2016 07:48 PM
- Tagged Adding additional value in Single Value Panel on Dashboards & Visualizations. 12-28-2016 07:48 PM
- Posted How to split Start Time and End Time after using the Splunk transaction command? on Splunk Search. 08-22-2016 09:33 PM
- Tagged How to split Start Time and End Time after using the Splunk transaction command? on Splunk Search. 08-22-2016 09:33 PM
- Posted Re: Regex Extraction on Splunk Search. 08-15-2016 03:33 AM
- Posted Regex Extraction on Splunk Search. 08-15-2016 03:14 AM
- Tagged Regex Extraction on Splunk Search. 08-15-2016 03:14 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
02-08-2018
05:55 PM
Unfortunately, the output is not what I required. Basically, we need to sort the values in LimitString, into the respective TagName. I was reading up on the "bin" command, not sure it would help in getting what I wanted.
... View more
02-07-2018
05:39 PM
I have a set of data as below:
If you can see, the TagNames are repetitive. I would want to re-arrange it to below format
TagName LimitString1 LimitString2 LimitString3 .. . . . . . . . . .
CHEM_R13719 null 18
CHEM_R13720 null 01
.
.
CHEM_R13723 0 4940
May I know how can I use stats command to achieve this? Thank you
... View more
01-15-2018
05:25 PM
I’m currently working with some production line data, where each tag value represent a field. Example like below:
Tag | Value
R0001 | 1 -> Batch No
R0002 | 2018 -> Year
R0003 | 1 -> Month
R0004 | 22 -> Day
R0005 | 5040 -> Volume A
R0006 | 446 -> Volume B
R0007 | 189 -> Volume C
R0008 | 1099 -> Total Mixed
R0009 | 0 -> Result (0 = OK, 1 = Not OK)
I need to arrange the data to look as below
Batch No |Year |Month |Day |Volume A |Volume B |Volume C |Total Mixed |Result
1 |2018 |1 |22 |5040 |446 |189 |1099 |OK
2 |2018 |1 |23 |5030 |435 |198 |1078 |OK
I was looking at using the Lookup table to achieve it, but not sure how to go about doing it. Any advise is appreciated. Thank you.
... View more
- Tags:
- splunk-enterprise
09-11-2017
01:34 AM
Thanks for the regex. May I know were you able to extract the Change Attributes as well?
Thank you.
... View more
09-11-2017
12:20 AM
Hi, I'm trying to get the Target Account ID from the Windows Event parsed from a syslog agent. I'm trying to capture the Target Account Name, and Domain. The Account Name appeared in the below samples:
91275674
DEVOP0030
TEST. STUADMGR
dev.devmgr
When using Splunk regex, I could not capture all the above variations. Will love to know how can I do this extraction properly.
2017-08-30 13:37:40 Kernel.Notice 172.21.197.99 Aug 30 13:37:56 DVDMZDCPRD01.dmz.devops.edu.my MSWinEventLog 5 Security 2548728 Wed Aug 30 13:37:50 2017 4738 Microsoft-Windows-Security-Auditing N/A Audit Success DVDMZDCPRD01.dmz.devops.edu.my 13824 A user account was changed.
Subject:
Security ID: S-1-5-21-3530313057-30343534556-3718217427-2613
Account Name: svc.vendor_guest
Account Domain: DMZ
Logon ID: 0x2524625D
Target Account:
Security ID: S-1-5-21-3530313057-3021056205-3718217427-25067
||Account Name: 91275674||
||Account Domain: DMZ||
Changed Attributes:
SAM Account Name: -
Display Name: -
User Principal Name: -
Home Directory: -
Home Drive: -
Script Path: -
Profile Path: -
User Workstations: -
Password Last Set: 8/30/2017 1:37:50 PM
Account Expires: -
Primary Group ID: -
AllowedToDelegateTo: -
Old UAC Value: -
New UAC Value: -
User Account Control: -
User Parameters: -
SID History: -
Logon Hours: -
Additional Information:
Privileges: -
... View more
09-10-2017
11:59 PM
I'm trying to extract the Account Name for this particular Windows Event, which is passed by a Syslog forwarder, instead of a Splunk forwarder.
Event Type 1
2017-09-02 23:26:45 Kernel.Notice 172.34.21.72 Sep 02 23:26:45 SAP019PRD01.devops.edu.my MSWinEventLog 5 Security 1307508 Sat Sep 02 23:26:37 2017 4738 Microsoft-Windows-Security-Auditing N/A Audit Success SAP019PRD01.devops.edu.my 13824 A user account was changed.
Subject:
Security ID: S-1-5-7
Account Name: ANONYMOUS LOGON
Account Domain: NT AUTHORITY
Logon ID: 0x3E6
Target Account:
Security ID: S-1-5-21-2116884625-2469882367-779485706-5698
Account Name: DEVOPS00030
Account Domain: DEVOPS
Changed Attributes:
SAM Account Name: -
Display Name: -
User Principal Name: -
Home Directory: -
Home Drive: -
Script Path: -
Profile Path: -
User Workstations: -
Password Last Set: 9/2/2017 11:26:37 PM
Event Type 2
2017-08-30 13:37:40 Kernel.Notice 172.34.196.99 Aug 30 13:37:56 DADMZDCPRD15.dmz.devops.edu.my MSWinEventLog 5 Security 2548728 Wed Aug 30 13:37:50 2017 4738 Microsoft-Windows-Security-Auditing N/A Audit Success DADMZDCPRD15.dmz.devops.edu.my 13824 A user account was changed.
Subject:
Security ID: S-1-5-21-3530313057-3021056205-3718217427-2613
Account Name: svc.devteam_guest
Account Domain: DMZ
Logon ID: 0x2524625D
Target Account:
Security ID: S-1-5-21-3530313057-3021056205-3718217427-25067
Account Name: 91276444
Account Domain: DMZ
Changed Attributes:
SAM Account Name: -
Display Name: -
User Principal Name: -
Home Directory: -
Home Drive: -
Script Path: -
Profile Path: -
User Workstations: -
Password Last Set: 8/30/2017 1:37:50 PM
Trying using the Splunk regex, but it just cannot capture both Event Types.
... View more
06-21-2017
08:44 AM
I have installed Splunk Add-on for Tenable, and currently using the scripted input to ingest .nessus file.
I have used the default settings which the default input folder is $SPLUNK_HOME\etc\apps\Splunk_TA_nessus\spool.
When I copied in the .nessus files. I saw the files disappeared, and files are created at $SPLUNK_HOME\var\spool\splunk.
But when I check my index, there is no data there. I search the _internal for the files status, below is what I got:
06-21-2017 23:19:43.053 +0800 INFO Metrics - group=per_source_thruput, series="d:\program files\splunk\var\spool\splunk\Homereview_va_credential_oh461v.nessus", kbps=6.337355, eps=16.935651, kb=196.456055, ev=525, avg_age=0.000000, max_age=0
May I know why I do not get any data in the splunk index?
... View more
12-28-2016
07:48 PM
I have my XML code as below trying to show the COMM_AMT as a secondary value in the Single value panel. I have added the additional fields such as "field" and "changeField", but it does not reflect in my dashboard. May I know why?
<panel>
<title>Top SELLER (PTE)</title>
<single>
<search>
<query>index=transaction | table TSAC_NO, AGENT_NRIC, BIZ_NAME, MOBILE_NO, RANK_CODE, TEAM_NAME, PROPERTY, PROP_TYPE, TSAC_TYPE, COBROKE_AGENT, DATE_OPTION, DATE_SUBMIT, DATE_ENTER, DATE_INV, COMM_AMT | stats sum(COMM_AMT) as COMM_AMT by BIZ_NAME | sort -COMM_AMT</query>
<earliest>$field1.earliest$</earliest>
<latest>$field1.latest$</latest>
</search>
<option name="field">BIZ_NAME</option>
<option name="changeField">COMM_AMT</option>
<option name="drilldown">none</option>
<option name="colorBy">value</option>
<option name="colorMode">none</option>
<option name="numberPrecision">0</option>
<option name="showSparkline">1</option>
<option name="showTrendIndicator">1</option>
<option name="trendColorInterpretation">standard</option>
<option name="trendDisplayMode">absolute</option>
<option name="unitPosition">after</option>
<option name="useColors">0</option>
<option name="useThousandSeparators">1</option>
<option name="linkView">search</option>
</single>
</panel>
... View more
08-22-2016
09:33 PM
Currently, I'm using Splunk transaction command to derive the duration using an attribute named TimeStamp from a database.
After processing the command, I noticed that the TimeStamp attribute will now contain both the StartTime and EndTime in a single field. May I know how can I split the TimeStamp field to get the StartTime and EndTime?
Thank you
Below is the sample data
TagName,ValveName,VMB,TeamName,TimeStamp,StampId,Comment,duration,Flow,TAB,ToolName
"CHEM_R02671_02","H2O2-1","102V1135-3","CHEM_U_H2O2-1","2016-08-01 23:59:48.63 2016-08-02 00:00:15.883","4007998 4008037","H2O2-1 AV- 102V1135-3 Open","27.253",0,H2O2,"CAROZ-18"
"CHEM_R02671_04","H2O2-1","102V1636-1","CHEM_U_H2O2-1","2016-08-01 23:59:48.63 2016-08-02 00:00:15.883","4008000 4008038","H2O2-1 AV- 102V1636-1 Open","27.253",,,
"CHEM_R02668_07","H2O2-1","102V1723-4","CHEM_U_H2O2-1","2016-08-01 23:59:48.63 2016-08-02 00:00:15.883","4008001 4008039","H2O2-1 AV- 102V1723-4 Open","27.253",0,H2O2,"CAROZ-13"
"CHEM_R02631_14","H2SO4-1","101V2117-3","CHEM_U_H2SO4-1","2016-08-01 23:59:48.63 2016-08-02 00:00:15.883","4008002 4008043","H2SO4-1 AV- 101V2117-3 Open","27.253",0,H2SO4,"CUSOVT-23"
"CHEM_R02443_04",ESC794,"32V1414-1","CHEM_U_ESC784","2016-08-01 23:59:48.63 2016-08-02 00:00:15.883","4008006 4008046","ESC794 AV- 32V1414-1 Open","27.253",0,ESC794,"CULKCMP-02"
"CHEM_R02443_07",ESC794,"32V1414-4","CHEM_U_ESC784","2016-08-01 23:59:48.63 2016-08-02 00:00:15.883","4008007 4008047","ESC794 AV- 32V1414-4 Open","27.253",0,ESC794,"CULKCMP-07"
"CHEM_R02441_15",ESC794,"32V1402-4","CHEM_U_ESC784","2016-08-01 23:59:48.63 2016-08-02 00:00:15.883","4008011 4008049","ESC794 AV- 32V1402-4 Open","27.253",0,ESC794,"CULKCMP-13"
... View more
08-15-2016
03:33 AM
Unfortunately, the data have others values, thus I will not be able to use the eval command to list them all out. Anyway to be able to extract the value during index time?
Thank you.
... View more
08-15-2016
03:14 AM
Hi,
I have encountered error while trying to using the Splunk Web to extract the below bolded field
Remark="B78OH30% OV- 22V1797-2 Open"
Remark="F2O2-1 OV- 102V1723-4 Open"
Remark="BSC794 OV- 32V1415-4 Open"
Remark="F2SO4-1 OV- 101V2023-1 Open"
However, I keep getting Extraction failed in the the process.
May I know how can I extract just the required field?
Thank you.
... View more
05-11-2016
06:32 PM
I have installed the IP Reputation App in my Splunk server which is behind a firewall. I have allowed port 54 for DNS resolution, but the Threatscore is still 0. May I know if there are other ports I need to open for the app to work?
Thank you.
... View more
12-08-2015
10:50 PM
Could it be something wrong with my props.conf? I see in the default template, the source contain double backslash instead of one.
... View more
12-08-2015
10:38 PM
I have updated the settings in the transforms.conf and restarted Splunk. But the settings did not take effect. The transforms.conf is located at /etc/system/local. Is there anything which I might have done wrongly?
... View more
12-08-2015
09:09 PM
Hi,
I'm using the Syslog server to gather all my Windows events. Right now, I'm trying to use a Splunk Heavy forwarder to filter off Event ID 5156 and 4768.
I have configured both my props.conf and transforms.conf.
Below are the settings:
props.conf
[source::D:\Program Files (x86)\Syslogd\Logs]
TRANSFORM-null= setnull
transforms.conf
[setnull]
REGEX= (\d+.){6}\d+\s(5156|4768)
DEST_KEY = queue
FORMAT = nullQueue
One of the sample messages from the Windows Events is below
2015-12-09 12:52:12 Kernel.Notice 192.168.1.12 Dec 09 12:52:12 DSFDCUAT01.buk.edu.my MSWinEventLog 5 Security 14032221 Wed Dec 09 12:48:50 2015 5156 Microsoft-Windows-Security-Auditing N/A Audit Success DSFDCUAT01.buk.edu.my 12810 The description for Event ID 5156 from source Microsoft-Windows-Security-Auditing cannot be found. Either the component that raises this event is not installed on your local computer or the installation is corrupted. You can install or repair the component on the local computer.If the event originated on another computer, the display information had to be saved with the event.The following information was included with the event: 4. FormatMessage failed with error 1815, The specified resource language ID cannot be found in the image file.
I'm trying to filter the Event ID which is located in Wed Dec 09 12:48:50 2015 5156 within the message.
Pls advise if my Regex is correct.
Thank you.
... View more
11-11-2015
09:54 PM
I have installed the Alert Manager app and triggered an Alert through my savedsearch. I have ensured that the permission of the Alert is set to Global, and Read permission to All Apps and Everyone.
However, I'm unable to see any trigger alerts in the Alert Manager App. Pls help.
... View more
- Tags:
- alert
- Alert Manager
10-29-2015
07:56 AM
Currently I have 2 indexes:
Index A contains ProgramID, User
Index B contains ID, Machine
I would like to use stats to join these 2 indexes based on ProgramID and ID, and get a table to reflect the User, Machine, and the Percent count of the Machine in the record.
How can I do it?
Thank you.
... View more
10-27-2015
11:42 PM
Hi there,
I'm handling a set of data which in one of the attributes, CustNo is inconsistent. I need to append "0" for those CustNo which are lesser than 10 digits.
Currently, I'm using "...... | eval CustNo= "0" + CustNo |" which is appending "0" to all the CustNo.
Thank you.
Leon
... View more
- Tags:
- eval
- manipulation
08-23-2015
05:56 PM
index=p_data | rex field=_raw "language=\"eng\">\s+(?.*?)" | search index=p_data (EventId OR ChannelId OR Name) | xmlkv | where (sourcetype="p_sourcetype" AND EventId!="") OR ChannelId!="" | stats values(EventId) as EventId values(Name) as Name values(ChannelId) as ChannelId by source
The result came out as below
SOURCE EventId Name ChannelId
source1 PG0019283 Winter 174
PG0018294 Summer
PG0037926 Spring
source2 PG0073947 Spiderman 186
PG0089362 Superman
source3 PG0045281 Apple 902
source4 PG0019283 Winter 174
PG0037926 Spring
I need to flatten them to look like below:
SOURCE EventId Name ChannelId
source1 PG0019283 Winter 174
source1 PG0018294 Summer 174
source1 PG0037926 Spring 174
source2 PG0073947 Spiderman 186
source2 PG0089362 Superman 186
source3 PG0045281 Apple 902
source4 PG0019283 Winter 174
source4 PG0037926 Spring 174
Thanks
... View more
08-23-2015
01:17 PM
Hi, your suggestion works! However, the each ChannelId now is tied with multiple EventId. How can I tag the ChannelId to each EventId?
... View more
08-23-2015
01:07 PM
Hi,
Thanks for your suggestion, it seems to have worked, but the issues is that within a ChannelId, it contains multiple EventId, how can I expand it so that each EventId is tagged with a ChannelId so to output to csv?
... View more
08-23-2015
11:53 AM
Below is the search which I'm trying:
index=p_data sourcetype="p_sourcetype" | xmlkv | where EventId!="" | table source,EventId | join type=outer max=0 source [search index=p_data | xmlkv | where ChannelId!="" | table source,ChannelId] | table source,EventId,ChannelId | where EventId = "PG0019283"
The result return with the source and the EventId, but ChannelId is empty, which it should contain some value.
When I conduct the searches separately, they both contain the identical source value for joining.
Pls assist.
Thank you.
... View more
- Tags:
- join
- outer_join
08-22-2015
09:46 PM
Trying to achieve the below:
eval x=mvzip(Title,Serial,beginTime,language,a1,a2,b1,b2)
How can I achieve this?
Thank you.
... View more
08-21-2015
06:07 PM
Hi,
I'm trying to ingest multiple files with the below format:
<?xml version="1.0" encoding="UTF-8"?>
<BroadcastData creationDate="20150820080127">
<CVendorInfo>
<CVendorId>Lysis</CVendorId>
<CVendorName>Lysis S.A.</CVendorName>
</CVendorInfo>
<ScheduleData>
<FreqPeriod endTime="20150820082900" beginTime="20150820070000">
<FreqId>174</FreqId>
<Event duration="1740" beginTime="20150820070000">
<EventId>CP0012650858</EventId>
<DvbEventId>15664</DvbEventId>
<EventType>S</EventType>
<PreviewTime>0</PreviewTime>
<VpgProduction>
<VpgText language="eng">
<Name>Headline News</Name>
<Description>Top Stories in Headlines.</Description>
<ExtendedInfo name="Contentid_ref">CP0012650858</ExtendedInfo>
<ExtendedInfo name="AudioTrack">eng</ExtendedInfo>
<ExtendedInfo name="Start_over_flag">0</ExtendedInfo>
</VpgText>
<ParentalRating>0</ParentalRating>
<DvbContent>
<Content nibble2="0" nibble1="0"/>
<User nibble2="A" nibble1="0"/>
</DvbContent>
</VpgProduction>
</Event>
<Event duration="1860" beginTime="20150820072900">
<EventId>CP0012650859</EventId>
<DvbEventId>15665</DvbEventId>
<EventType>S</EventType>
<PreviewTime>0</PreviewTime>
<VpgProduction>
<VpgText language="eng">
<Name>Boom Bust</Name>
<Description>Booms and BustDescription>
<ExtendedInfo name="Contentid_ref">CP0012650859</ExtendedInfo>
<ExtendedInfo name="AudioTrack">eng</ExtendedInfo>
<ExtendedInfo name="Start_over_flag">0</ExtendedInfo>
</VpgText>
<ParentalRating>0</ParentalRating>
<DvbContent>
<Content nibble2="0" nibble1="0"/>
<User nibble2="A" nibble1="0"/>
</DvbContent>
</VpgProduction>
</Event>
<Event duration="1740" beginTime="20150820080000">
<EventId> CP0012650860</EventId>
<DvbEventId>15666</DvbEventId>
<EventType>S</EventType>
<PreviewTime>0</PreviewTime>
<VpgProduction>
<VpgText language="eng">
<Name>Headline News</Name>
<Description> Top Stories in Headlines.</Description>
<ExtendedInfo name="Contentid_ref"> CP0012650860</ExtendedInfo>
<ExtendedInfo name="AudioTrack">eng</ExtendedInfo>
<ExtendedInfo name="Start_over_flag">0</ExtendedInfo>
</VpgText>
<ParentalRating>0</ParentalRating>
<DvbContent>
<Content nibble2="0" nibble1="0"/>
<User nibble2="A" nibble1="0"/>
</DvbContent>
</VpgProduction>
</Event>
</FreqPeriod>
</ScheduleData>
</BroadcastData>
I want to have the timestamp based on the BroadcastData creationDate, and to extract all the XML attributes. How can I go about doing this? Thanks in advance.
... View more
08-14-2015
11:19 PM
I'm currently trying to compare 3 fields (ID, Start_time, Log_time) from 2 different indexes, and to get the differences when any of the 3 attributes are unmatched.
How can I go about doing this?
Thank you.
... View more
