About Vyber90

Vyber90 · ‎08-18-2021

Then, why wouldn't Splunk let me search without commiting any previous violations? This doesn't look automatic at all

Vyber90 · ‎08-18-2021

Okay, so after the 60 days of Enterprise trial my license has expired. Now, how can I download the perpetual free license? Once I get into the store the only things I find require a payment, and the you have pricing questions we have answers website doesn't solve anything.

Vyber90 · ‎08-09-2021

Here you go: In order to not change JSON's original stuff I created this new sourcetype. The lines I've manually added are TRUNCATE and followTail (the last one was added as a solution proposed in this very thread).

Vyber90 · ‎08-06-2021

I'm sorry to tell you that it doesn't work for me (I put that line in a new sourcetype in the props.conf file, where I think it should go). As I said, I put that line in and it was today that I added information after the latest event of the JSON. As I said in the question, now instead of 7 events (6 + the new event), I have 13 (6 events + their 6 duplicate events + the new event). By the way, I don't know if this is obvious or not, so I'll tell you this piece of information. Duplicate events would look like this: The duplicated events are carbon copies. They have the same information, the same timestamps, the same quantity of lines, and they do even filter out when using dedup.

Vyber90 · ‎07-31-2021

What I'm doing is: I am doing stuff by my own an then parsing all the information as a JSON in order to append it to the end of an Splunk indexed file. The problem is: Splunk, instead of just adding the information that wasn't there when the file was last updated, adds all the information again as if it was completely new, and thus giving me duplicate information. I tried to append the information without altering what was already there, but this doesn't seem to solve anything. What would you do to only add the new info?

Vyber90 · ‎06-26-2021

That's the problem. I have a Sysmon JSON to examine but, although in the "Add Data" section everything looks OK, once I get to the search time Events are joined and split without pattern. After I thought about it a second, I noticed that the document did not have timestamps and Splunk was complaining about it, so I solved it but the issue was still there. The problem looks like this: Sometimes the Event begins OK but melts with other events before its end, and others (like the upper example) don't have a heading. I'm not using any plug-ins or apps. Just clicked on Add Data, selected the document as a non-timestamped JSON, and started searching. How would you solve this? the JSON to be analyzed is downloadable from Blue Team Labs Online.

Posts	6
Solutions	0
Karma Given	1
Karma Received	0
Member Since	‎06-26-2021

Online Status	Offline
Date Last Visited	‎08-18-2021 09:29 AM

Splunk license has expired

Splunk duplicates events from a custom-made JSON e...

Splunk doesn't format Sysmon JSON correctly

Re: Splunk license has expired

Splunk license has expired

Re: Splunk duplicates events from a custom-made JS...

Re: Splunk duplicates events from a custom-made JS...

Splunk duplicates events from a custom-made JSON e...

Splunk doesn't format Sysmon JSON correctly