Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About gitingua
gitingua
Communicator
Member since:
03-25-2021
4 weeks ago
Community Statistics
| Posts | 97 |
| Solutions | 4 |
| Karma Given | 14 |
| Karma Received | 0 |
| Member Since | 03-25-2021 |
Activity Feed
- Posted Re: edit props file _time on Getting Data In. 4 weeks ago
- Posted How to write in props.conf so that the _time field takes time from the unixTime field? on Getting Data In. 4 weeks ago
- Posted Re: Why after switching from HF to UF, MSWindows:2012:IIS event no longer parses correctly? on Splunk Enterprise. 04-08-2022 01:10 AM
- Tagged Re: Why after switching from HF to UF, MSWindows:2012:IIS event no longer parses correctly? on Splunk Enterprise. 04-08-2022 01:10 AM
- Posted Why after switching from HF to UF, MSWindows:2012:IIS event no longer parses correctly? on Splunk Enterprise. 04-07-2022 03:35 AM
- Posted Re: Failed to apply deletes to some metadata. Check search.log for inconsistent metadata on Splunk Search. 03-01-2022 12:27 AM
- Posted Why did request in search head fail to apply delete to some metadata? on Splunk Search. 02-28-2022 06:57 AM
- Posted How to add and parse XML data in Splunk? on Getting Data In. 02-01-2022 02:29 AM
- Posted TailReader - File will not be read, is too small to match seekptr checksum on Splunk Enterprise. 12-23-2021 03:12 AM
- Posted why time range in alerts not working on Alerting. 12-07-2021 05:58 AM
- Posted regex help on Splunk Search. 11-26-2021 05:50 AM
- Posted Re: Not working SEDCMD. Props.conf. help on Splunk Enterprise. 11-23-2021 01:36 PM
- Posted Re: Not working SEDCMD. Props.conf. help on Splunk Enterprise. 11-23-2021 12:21 PM
- Posted Re: Not working SEDCMD. Props.conf. help on Splunk Enterprise. 11-22-2021 06:11 AM
- Posted Re: Not working SEDCMD. Props.conf. help on Splunk Enterprise. 11-22-2021 04:13 AM
- Posted Re: ms-Mcs-AdmPwd Plaintext in Splunk on Getting Data In. 11-22-2021 04:11 AM
- Posted Re: Not working SEDCMD. Props.conf. help on Splunk Enterprise. 11-22-2021 04:10 AM
- Posted Re: Not working SEDCMD. Props.conf. help on Splunk Enterprise. 11-18-2021 08:03 AM
- Posted Re: Not working SEDCMD. Props.conf. help on Splunk Enterprise. 11-18-2021 06:32 AM
- Posted Not working SEDCMD. Props.conf. help on Splunk Enterprise. 11-18-2021 03:07 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
4 weeks ago
@gcuselloHi! as you can see, my _time field is ahead of the unixTime field. And I would need the _time field to be the same as unixTime i want to change my sourcetype in props.conf so that _time takes time from unixTime field
... View more
4 weeks ago
Hello colleagues, I would like to know
I have events where there is a unixTime field. B ut the _time field does not show correctly how can I write in props.conf so that the _time field takes time from the unixTime field
... View more
04-08-2022
01:10 AM
@VatsalJagani Hi. We use the app https://splunkbase.splunk.com/app/3225/ The problem is that there is a sourcetype= MSWindows:2012:IIS But it is not described in the props file, it does not parse events, do you think need to change the application?
... View more
- Tags:
- props
04-07-2022
03:35 AM
Hello colleagues. we recently switched from Splunk HF to UF. before this event with sourcetype = MSWindows:2012:IIS. parsed normal but after installation, something went wrong. and events in the spanner do not take all the fields from the logs
... View more
Labels
03-01-2022
12:27 AM
what is related to the error is this WARN DownloadRemoteDataTransaction - Got status code: 204 ( No Content) from https://ip:8089/services/search/jobs/remote_splunk-sh_md_admin__admin__sysadmin__search1_md_DEE0755CDB96/search_telemetry.json 03-01-2022 11:02:36.723 WARN DownloadRemoteDataTransaction - Failed to download search.log from remote peer 'splunk-idx', uri='https://ip:8089', sid='remote_splunk-sh_md_admin__admin__sysadmin__search1_md_DEE0755CDB96' @richgalloway
... View more
02-28-2022
06:57 AM
Hello dear colleagues, has anyone encountered this error, I checked search.log for inconsistent metadata.
Help me decide.
I have a request in SH, when I drive it I get this error
... View more
Labels
- Labels:
-
join
-
metadata
-
search job inspector
02-01-2022
02:29 AM
how parsing xml data ? <v8e:Event> <v8e:Level>Information</v8e:Level> <v8e:Date>2022-01-26T16:20:24</v8e:Date> <v8e:ApplicationName>Job</v8e:ApplicationName> <v8e:ApplicationPresentation>Фоновое</v8e:ApplicationPresentation> <v8e:Event>Finish</v8e:Event> <v8e:EventPresentation>Сеанс</v8e:EventPresentation> <v8e:User>Jong Wik</v8e:User> <v8e:UserName>Корот</v8e:UserName> <v8e:Computer>srv-2-srv</v8e:Computer> <v8e:Metadata/> <v8e:MetadataPresentation/> <v8e:Comment/> <v8e:Data xsi:nil="true"/> <v8e:DataPresentation/> <v8e:TransactionStatus>NotApplicable</v8e:TransactionStatus> <v8e:TransactionID/> <v8e:Connection>0</v8e:Connection> <v8e:Session>5146</v8e:Session> <v8e:ServerName/> <v8e:Port>0</v8e:Port> <v8e:SyncPort>0</v8e:SyncPort> </v8e:Event>
... View more
12-23-2021
03:12 AM
ERROR TailReader - File will not be read , is too small to match seekptr checksum ( file=c:\logs\ MailBoxAudit \ mailboxaudit _23_12_2021_13_48.csv ) . Last time we saw this initcrc , filename was different. You may wish to use larger initCrcLen for this sourcetype , or a CRC salt on this source. inputs.conf /opt/splunk/etc/deployment-apps/TA-Exchange-Mailbox/local/ inputs.conf [monitor://c:\logs\MailBoxAudit] whitelist=\.csv$|\.CSV$ sourcetype=csv index= indexname disabled=false crcSalt = <SOURCE> initCrcLength=8192 after making a change to the file inputs.conf. i ran the command /opt/splunk/bin/splunk reload deploy-server -class heavy_forwarders for the changes to be accepted the file comes to the index, but it does not start up some what could be the problem ?
... View more
12-07-2021
05:58 AM
I have an alert. which runs every minute "cron" and the setting is set to "time range last 4 minutes" but for some reason my alert works 30 minutes ago and in this interval look for 4 minutes create at 4:46:04 PM search 4:16:00 pm to 4:20:00 pm Time is correct on SH servers.
... View more
Labels
- Labels:
-
alert action
-
cron
-
other
-
throttling
11-26-2021
05:50 AM
hello my friends. how using regex can delete everything in bold {"test": " { \n \"data\": \"check\",\n \"git_branch\": \"master\",\n \"git_repo_name\": \"reponame\",\n \"id\": 234,\n \"timestamp\": 16378522342,\n } "} output { \"data\": \"check\", \"git_branch\": \"master\", \"git_repo_name\": \"reponame\", \"id\": 3413, \"timestamp\": 16378522342 }
... View more
Labels
11-23-2021
01:36 PM
You can deploy a props.conf configuration utilising “SEDCMD” and have it apply to the sourcetype “ActiveDirectory”. This means, as the data is streaming into Splunk and before it ends up on disk “indexed”, it will be anonymised. To do this we utilise the Splunk “SEDCMD”. This is much like the sed command you would find on a *nix based system. Ideally the props.conf file should be placed on a Splunk Heavy Forwarder on it’s path towards the Indexer, you could place this configuration on an indexer, but to avoid potential performance issues try use a Splunk Heavy Forwarder. deploy-server vim /opt/splunk/etc/ deployment-apps/Splunk_TA_windows # props.conf on a HF.
[ActiveDirectory]
SEDCMD-anonymiseLaps = s/ms-Mcs-AdmPwd\=.*/ms-Mcs-AdmPwd=####!!!!!#####/g save deploy-server$ /opt/splunk/bin/splunk reload deploy-server
... View more
11-22-2021
06:11 AM
indexer /opt/splunk/etc/system/local/props.conf Yes. I restarted every time I changed there @richgalloway
... View more
11-22-2021
04:13 AM
@richgalloway https://techcommunity.microsoft.com/t5/microsoft-defender-for-identity/laps-splunk-account-reading-ms-mcs-admpwd/m-p/2242426 https://www.databl.io/anonymise-your-clear-text-laps-passwords-in-splunk/
... View more
11-22-2021
04:10 AM
@richgalloway no access to raw data. but I found a question similar to mine. and there are sources where they show an example. I drove them but also unsuccessfully https://community.splunk.com/t5/Getting-Data-In/ms-Mcs-AdmPwd-Plaintext-in-Splunk/td-p/562704
... View more
11-18-2021
08:03 AM
not working i changed and rebooted at 18:52. at 18:55 the event came as before props.conf [ActiveDirectory] SHOULD_LINEMERGE = false LINE_BREAKER = ([\r\n]+---splunk-admon-end-of-event---\r\n[\r\n]*) EXTRACT-GUID = (?i)(?!=\w)(?:objectguid|guid)\s*=\s*(?<guid_lookup>[\w\-]+) EXTRACT-SID = objectSid\s*=\s*(?<sid_lookup>\S+) SEDCMD-mask_ms_pwd = s/(ms-Mcs-AdmPwd)=(.*)/\1=******/g Maybe something from the other lines bothers him?
... View more
11-18-2021
06:32 AM
@richgalloway I know what's new. new events do not change ms-Mcs -AdmPwd =a 01LePq5 exactly what is needed. or the desired complete
... View more
11-18-2021
03:07 AM
Not working SEDCMD in my props.conf /opt/splunk/etc/system/local/props.conf [ActiveDirectory] SEDCMD-mask_ms_pwd = s/(ms-Mcs-AdmPwd\s*=)\s*.*/ms-Mcs-AdmPwd=*******/ I checked it on regex101.com everything works. wrote a line in props.conf and reloaded splunk. but still hides nothing
... View more
11-17-2021
04:58 AM
Hello my friends. I have a report that uses the "ldapsearch" command. He works every day The problem is that the report can be executed. and the next day the report is in the "running" status. And it works through. somewhere right away somewhere it keeps
... View more
Labels
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
4 weeks ago
|
Karma given to
