Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Are you a member of the Splunk Community?
Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- About kagamalai
kagamalai
Explorer
Member since:
05-31-2021
12-10-2021
Community Statistics
| Posts | 46 |
| Solutions | 0 |
| Karma Given | 1 |
| Karma Received | 0 |
| Member Since | 05-31-2021 |
Activity Feed
- Posted Re: For all reported universal forwarders ( Linux and Windows) how do I verify the sources and sourcetype? on Monitoring Splunk. 11-25-2021 05:44 AM
- Posted Re: For all reported universal forwarders ( Linux and Windows) how do I verify the sources and sourcetype? on Monitoring Splunk. 11-25-2021 04:16 AM
- Posted For all reported universal forwarders ( Linux and Windows) how do I verify the sources and sourcetype? on Monitoring Splunk. 11-25-2021 03:29 AM
- Posted Re: Use Lookup Table To Identify Hosts That Have/Have Not Logged on Splunk Search. 11-10-2021 12:04 AM
- Posted Re: Splunk Enterprise Security: How to retrieve ldap assets information? on Splunk Enterprise Security. 09-19-2021 09:11 AM
- Posted Re: How to search for failed login attempts? on Splunk Search. 08-22-2021 08:37 PM
- Posted Fortigate TA & Apps Deployment on Splunk Enterprise Security. 07-13-2021 11:30 PM
- Posted Re: Fortinet FortiGate APP: Data from different indexers and sources on Splunk Enterprise Security. 07-06-2021 11:38 PM
- Posted Fortigate App for Splunk: How to setup and populate the logs? on Installation. 07-06-2021 07:00 AM
- Posted Fortigate App not working on Splunk Enterprise Security. 07-06-2021 12:01 AM
- Posted Re: Splunk Add-on for AWS is not working, s3 generic input not indexing while other s3 generic inputs are working? on All Apps and Add-ons. 07-04-2021 10:57 PM
- Posted Re: Before Indexing Filter Based ON JSON format data match on Getting Data In. 06-29-2021 10:17 AM
- Posted Re: Before Indexing Filter Based ON JSON format data match on Getting Data In. 06-29-2021 04:57 AM
- Posted Re: Before Indexing Filter Based ON JSON format data match on Getting Data In. 06-28-2021 10:25 PM
- Posted Re: Before Indexing Filter Based ON JSON format data match on Getting Data In. 06-28-2021 06:38 AM
- Posted Re: Before Indexing Filter Based ON JSON format data match on Getting Data In. 06-28-2021 01:31 AM
- Posted Re: Before Indexing Filter Based ON JSON format data match on Getting Data In. 06-25-2021 07:09 AM
- Posted Re: Before Indexing Filter Based ON JSON format data match on Getting Data In. 06-25-2021 05:16 AM
- Karma Re: Before Indexing Filter Based ON JSON format data match for mdorobek. 06-25-2021 04:40 AM
- Posted Re: Before Indexing Filter Based ON JSON format data match on Getting Data In. 06-24-2021 09:18 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
11-25-2021
05:44 AM
Thank you, but we do not manage the UF using the deployment server, TA Add-on. We have manually installed the UF and configured the log files, so the reason we want to verify each has all logs reporting to the indexer is that all the logs need to be configured correctly.
... View more
11-25-2021
04:16 AM
Thank you for your reply, reporting of connected/Not connected systems; --- I have spl to check and installed and not installed UF status. configuration checks. What is the best way to check all three or 5 logs reporting to indexer hostwise? We need to identify the host if one of the logs is missing on any host. Thanks Manickam
... View more
11-25-2021
03:29 AM
Hi, There are more than 1000 UF Windows and Linux systems installed. It is a distributed environment with around 100 systems at each location, one indexer deployed, and each indexer connected to a search head. Our next step is to verify that all the hosts have been configured properly and are reporting to the indexer. In cases where a host does not have the source or sourcetype, we need to update the list to match host and not match host against the below lookup table. Could someone please suggest the spl. source sourcetype WinEventLog:Security WinEventLog WinEventLog:Application WinEventLog WinEventLog:System WinEventLog /var/log/haproxy/haproxy.log haproxy /var/log/audit/audit.log audit /var/log/maillog postfix_syslog /var/log/messages linux_messages_syslog /var/log/cron cron Thanks Manickam
... View more
Labels
- Labels:
-
forwarder management
11-10-2021
12:04 AM
Hi , I used below query but not getting any output - I have lookup table dc.csv with host, IP field. Could you please look and advise | metadata index=_internal | eval host=lower(host) | stats count BY host | append [ | inputlookup dc.csv |eval host=lower(host), count=0 | fields host IP count ] | stats sum(count) AS total value(IP) AS IP BY host | eval IP=if(isnull(IP),"Not present in lookup",IP), status=if(total=0,"Missing","Present") | table host IP status
... View more
09-19-2021
09:11 AM
I used the below query but not searched the computer assets its through the below error message please advise ? "Error in 'rex' command: Encountered the following error while compiling the regex '(OU|CN)\=(?.+)': Regex: unrecognized character after (? or (?-. " |ldapsearch domain=XXX search="(&(objectClass=computer))"
|eval city=""
|eval country=""
|eval priority="medium"
|eval category="normal"
|eval dns=dNSHostName
|eval owner=managedBy
|rex field=sAMAccountName mode=sed "s/\$//g"
|eval nt_host=sAMAccountName |search nt_host=segurinfo
|makemv delim="," dn
|rex field=dn "(OU|CN)\=(?.+)"
|table Source_Address,mac,nt_host,dns,owner,priority,lat,long,city,country,bunit,category,pci_domain,is_expected,should_timesync,should_update,requires_av
... View more
07-13-2021
11:30 PM
Hi, We have around the world 10 data centers each dc have the firewall setup, servers, splunk indexer. Headquarters have the search heads and are connected via search peers. Now we want to deploy the fortigate Apps in our search heads and access all the firewall logs and view the dashboards. Please suggest how we should keep the index name in each data center ? Can we keep the index name Fortigate for all the DC ? or we should keep unique name ? Please suggest
... View more
Labels
07-06-2021
11:38 PM
Hi I am able to view the following dashboards but not all the dashboards Working Dashboards 1. Fortinet Security Overall 2. Traffic Dashboard 3.Event Dashboard 4. VPN Dashboard Not working Dashboard 1.Thread Dashboards 2. Authentication Dashboard if any one know the solution please let me know same to fix it.
... View more
07-06-2021
07:00 AM
Hi,
I am trying to configure the Fortigate App for splunk, the first dashboard is working fine but no traffic, event dashboard showing empty
if any one know how to setup and populate the logs pls help me.
Above is image current source type and index name is firewall
But Below Dashboard is empty
... View more
07-06-2021
12:01 AM
Hi The Fortinet Fortigate App for Splunk not working and Dashboards are empty. I have installed both the app including TA. And also below is the my data inputs type UDP:514 Sourcetype:fgt_log if any one know the setup or configuration changes please suggest what are the changes need to be do ? Thanks
... View more
Labels
- Labels:
-
administration
-
configuration
-
installation
07-04-2021
10:57 PM
There is no improvement, but every time changing the configuration and restarted the Splunk service it will take an hour to resume the logs flow
... View more
06-29-2021
10:17 AM
Thank you its working fine.
... View more
06-29-2021
04:57 AM
Thank you for reply, Yes tested with regex101 site before using the pattern the pattern is below Please have look is there any mistake ? REGEX = (\"WAFFlags\":\"1\"|\"FirewallMatchesActions\":\[\"log\"\]|\"FirewallMatchesActions\":\[\"log\",\"log\"\]|\"FirewallMatchesSources\":\[\"firewallRules\",\"waf\"\]|\"FirewallMatchesActions\":\[\"block\"\]) If above method is work its very useful.
... View more
06-28-2021
10:25 PM
@mdorobek , Please advise its not working while adding the OR operator" | " is there any other methods to filter the same ?
... View more
06-28-2021
06:38 AM
Thanks, How many OR operator I can add ? could you please verify the below is correct format REGEX = (\"WAFFlags\":\"1\"|\"FirewallMatchesActions\":\[\"log\"\]|\"FirewallMatchesActions\":\[\"log\",\"log\"\]|\"FirewallMatchesSources\":\[\"firewallRules\",\"waf\"\]|\"FirewallMatchesActions\":\[\"block\"\]|\"FirewallMatchesActions\":\[\"challengeSolved\"\]|\"FirewallMatchesActions\":\[\"challenge\"\]) I have doubt on this its not filtering
... View more
06-28-2021
01:31 AM
Hi I have to write with below format ? in transforms.conf ? regex = (\"WAFFlags\":\"1\"|\"FirewallMatchesActions\":\[\"log\"\]|\"FirewallMatchesActions\":\[\"log\",\"log\"\]|\"FirewallMatchesSources\":\[\"firewallRules\",\"waf\"\]) Thanks.
... View more
06-25-2021
07:09 AM
Hi, How do I match OR condition here ? I want to do index if any one match below it should be index "WAFFlags":"1" or "FirewallMatchesActions":["log"] or "FirewallMatchesActions":["log","log"] or "FirewallMatchesSources":["firewallRules","waf"]
... View more
06-25-2021
05:16 AM
Thank you its working......
... View more
06-24-2021
09:18 AM
Thank you for detailed explanation and your time. I am using below apps for downloading the cloudflare logs. so where i have to use or edit the props.conf, transforms.conf files which path?. all the apps having the props/transforms files in default directory. 1. Splunk Add-On for AWS ----- downloading the logs from s3. 2. Cloudflare Technology Add-On for Splunk ------- 3. Cloudflare App for Splunk. I am running the splunk on Linux /opt/splunk/etc/apps Please advise path for this scenario Thanks in advance
... View more
06-24-2021
07:22 AM
Thank you for your reply, I have a doubt on this, if the condition is match the entire event will be indexed or only matched field and value only indexed ? please clarify
... View more
06-24-2021
12:03 AM
Hi, Thanks for your response, please look the below raw format. {"BotScore":99,"BotScoreSrc":"Machine Learning","CacheCacheStatus":"unknown","CacheResponseBytes":2254,"CacheResponseStatus":200,"CacheTieredFill":false,"ClientASN":6805,"ClientCountry":"de","ClientDeviceType":"mobile","ClientIP":"79.14.16.54","ClientIPClass":"noRecord","ClientMTLSAuthCertFingerprint":"","ClientMTLSAuthStatus":"unknown","ClientRequestBytes":4059,"ClientRequestHost":"ty.xyz.com","ClientRequestMethod":"POST","ClientRequestPath":"/common/endpoint/","ClientRequestProtocol":"HTTP/2","ClientRequestReferer":"https://ty.xyz.com/games/Popular/","ClientRequestScheme":"https","ClientRequestSource":"eyeball","ClientRequestURI":"/common/endpoint/","ClientRequestUserAgent":"Mozilla/5.0 (Linux; Android 10; MAR-LX1A) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.114 Mobile Safari/537.36","ClientSSLCipher":"ECDHE-ECDSA-AES128-GCM-SHA256","ClientSSLProtocol":"TLSv1.2","ClientSrcPort":46452,"ClientTCPRTTMs":33,"ClientXRequestedWith":"XMLHttpRequest","EdgeCFConnectingO2O":false,"EdgeColoCode":"DUS","EdgeColoID":48,"EdgeEndTimestamp":"2021-06-24T01:33:16Z","EdgePathingOp":"wl","EdgePathingSrc":"macro","EdgePathingStatus":"nr","EdgeRateLimitAction":"","EdgeRateLimitID":0,"EdgeRequestHost":"ty.xyz.com","EdgeResponseBodyBytes":300,"EdgeResponseBytes":1192,"EdgeResponseCompressionRatio":0,"EdgeResponseContentType":"application/json","EdgeResponseStatus":200,"EdgeServerIP":"18.41.42.13","EdgeStartTimestamp":"2021-06-24T01:33:16Z","EdgeTimeToFirstByteMs":224,"FirewallMatchesActions":[],"FirewallMatchesRuleIDs":[],"FirewallMatchesSources":[],"OriginDNSResponseTimeMs":0,"OriginIP":"14.11.28.17","OriginRequestHeaderSendDurationMs":0,"OriginResponseBytes":0,"OriginResponseDurationMs":215,"OriginResponseHTTPExpires":"","OriginResponseHTTPLastModified":"","OriginResponseHeaderReceiveDurationMs":215,"OriginResponseStatus":200,"OriginResponseTime":215000000,"OriginSSLProtocol":"TLSv1.2","OriginTCPHandshakeDurationMs":0,"OriginTLSHandshakeDurationMs":0,"ParentRayID":"00","RayID":"664235027de321b1","SecurityLevel":"med","SmartRouteColoID":0,"UpperTierColoID":0,"WAFAction":"unknown","WAFFlags":"0","WAFMatchedVar":"","WAFProfile":"unknown","WAFRuleID":"","WAFRuleMessage":"","WorkerCPUTime":0,"WorkerStatus":"unknown","WorkerSubrequest":false,"WorkerSubrequestCount":0,"ZoneID":134451718,"ZoneName":"ty.xyz.com"} Show syntax highlighted host = svr003.xyz.netsource = s3://prod-cloudflare/logs/ty.xyz.com/20210624/20210624T013257Z_20210624T013327Z_0c91c265.log.gzsourcetype = _json
... View more
06-23-2021
10:44 PM
We want to filter the event before indexing based on filed value match. For example below is the single event, if the below condition is match we need to index the whole event otherwise drop the whole event. WAFAction = unknown WAFFlags = 0 Please advise how to achieve the same ? Sample event JSON format with time stamp { [-] BotScore: 98 BotScoreSrc: Machine Learning CacheCacheStatus: unknown CacheResponseBytes: 1877 CacheResponseStatus: 200 CacheTieredFill: false ClientASN: 701 ClientCountry: us ClientDeviceType: desktop ClientIP: 196.142.18.94 ClientIPClass: noRecord ClientMTLSAuthCertFingerprint: ClientMTLSAuthStatus: unknown ClientRequestBytes: 3912 ClientRequestMethod: POST ClientRequestPath: /common/endpoint/ ClientRequestProtocol: HTTP/2 ClientRequestScheme: https ClientRequestSource: eyeball ClientRequestURI: /common/endpoint/ ClientRequestUserAgent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.114 Safari/537.36 ClientSSLCipher: ECDHE-ECDSA-AES128-GCM-SHA256 ClientSSLProtocol: TLSv1.2 ClientSrcPort: 50738 ClientTCPRTTMs: 14 ClientXRequestedWith: XMLHttpRequest EdgeCFConnectingO2O: false EdgeColoCode: EWR EdgeColoID: 11 EdgeEndTimestamp: 2021-06-24T01:33:21Z EdgePathingOp: wl EdgePathingSrc: macro EdgePathingStatus: nr EdgeRateLimitAction: EdgeRateLimitID: 0 EdgeRequestHost: api.xyz.com EdgeResponseBodyBytes: 71 EdgeResponseBytes: 814 EdgeResponseCompressionRatio: 0 EdgeResponseContentType: application/json EdgeResponseStatus: 200 EdgeServerIP: 62.15.62.15 EdgeStartTimestamp: 2021-06-24T01:33:21Z EdgeTimeToFirstByteMs: 160 FirewallMatchesActions: [ [+] ] FirewallMatchesRuleIDs: [ [+] ] FirewallMatchesSources: [ [+] ] OriginDNSResponseTimeMs: 0 OriginIP: 44.12.238.17 OriginRequestHeaderSendDurationMs: 0 OriginResponseBytes: 0 OriginResponseDurationMs: 148 OriginResponseHTTPExpires: OriginResponseHTTPLastModified: OriginResponseHeaderReceiveDurationMs: 90 OriginResponseStatus: 200 OriginResponseTime: 148000000 OriginSSLProtocol: TLSv1.2 OriginTCPHandshakeDurationMs: 18 OriginTLSHandshakeDurationMs: 40 ParentRayID: 00 RayID: 6642351fccb80ca5 SecurityLevel: med SmartRouteColoID: 0 UpperTierColoID: 0 WAFAction: unknown WAFFlags: 0 WAFMatchedVar: WAFProfile: unknown WAFRuleID: WAFRuleMessage: WorkerCPUTime: 0 WorkerStatus: unknown WorkerSubrequest: false WorkerSubrequestCount: 0 ZoneID: 134451718 ZoneName: yy.xxxxx.com } Show as raw text host = idx1.server001.net.netsource = s3://cloudflare/logs/20210624/20210624T013257Z_20210624T013327Z_0c91c265.log.gzsourcetype = _json
... View more
Labels
- Labels:
-
indexer
-
JSON
-
props.conf
-
transforms.conf
06-21-2021
03:12 AM
I am also facing exact same issue | message="The last data ingestion iteration hasn't been completed yet."
... View more
Thank you let me try this.
... View more
Hi, Below is the source type index="cloudflare" sourcetype="cloudflare:json" thanks
... View more
