About florianhh

richgalloway · ‎11-10-2022

The Splunk-to-Splunk protocol is proprietary. There are no public documents about it.

florianhh · ‎11-08-2022

Dangerously simple! It worked for me.

PickleRick · ‎07-14-2022

If you can devise your application field from other field(s) - for example some set of host values corresponds with application A and other set is app B, you could try using lookups or eventtypes to calculate it in search-time.

florianhh · ‎07-01-2022

This Worked for me as well. No need to give admin_all_objects permission! Splunk V. 8.2.5

florianhh · ‎02-01-2022

Gooood Morning 🙂 I need some advice, we have several sources of Information about our Company assets, i know not ideal but better then dont know any. So i wrote a script thats collects everything from these Asset sources and writes the Info to a big KV Store. (1.5GB) on the Splunk-ES SH. The script does that every 6h. No i want to add these Info to the Splunk ES Asset- und Identitäts-Management. How do i aliase a kvstore field name so its CIM compliance with the required fieldnames as stated here. https://docs.splunk.com/ ? I thought about fieldaliases in a props.conf as per normal datasources. But im not sure to use the collection name as a source in the stanza? [source::ipam_assets_collection] FIELDALIAS-asset_ip = Address AS ip Is there a better way?

PickleRick · ‎11-05-2021

And here's where you're absolutely wrong 🙂 Firstly, the console is used very often not just by admins and security (Splunk can and often does ingest and analyze many types of data - for example, I'm using it to track my car using GPS data :D). Secondly - there is a legitimate way to send the emails - the proper alert action. And it's more or less the only way you really should need (and I'm not saying it as a splunk user or admin but as a 20+ years experienced email servers administrator). And if you really, really need the functionality of sending any email to any recipient through any server, you can always write your own alertaction script. But I would strongly advise against it.

venkatasri · ‎06-15-2021

@florianhh :: is used for indexed fields preferred by Splunk. Otherwise EventCode=1234 OR EventCode::1234 both are same. If EventCode is not an indexed field with :: you won't get any results. It's always better to search in UI first and add it to search filter. -- An upvote would be appreciated if it helps!

florianhh · ‎06-09-2021

Hey There, i want to push this threat and ask if somethings changed since 2016? I have the same question, need to delete and post data to a KV store and do not want to grand Admin level permissions to a user just for that.

Posts	11
Solutions	0
Karma Given	2
Karma Received	1
Member Since	‎03-23-2021

Online Status	Offline
Date Last Visited	‎11-10-2022 05:17 AM

What is S2S Protocol Specification?

How to add new fields to certain events via _meta?

KVstore field Aliase

Allow Usergroups to send Email

View only User

Re: S2S Protocol Specification

Re: Can I delete all data from a KV store at once?

Re: _meta and internal fields

Re: Splunk Support for Active Directory: Why are n...

KVstore field Aliase

Re: Allow Usergroups to send Email

Re: View only User

Re: What is the minimum permissions I can give a u...