Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About BDein
BDein
Explorer
Member since:
08-27-2021
10-11-2023
Community Statistics
| Posts | 26 |
| Solutions | 0 |
| Karma Given | 0 |
| Karma Received | 2 |
| Member Since | 2021-27-08 |
Activity Feed
- Posted Re: How to determine how long splunk has been up? on Monitoring Splunk. 10-11-2023 03:54 AM
- Posted Re: How can I use CLONE_SOURCETYPE to send a cloned modified event to a 3rd party without indexing the cloned event? on Getting Data In. 09-01-2023 01:44 AM
- Posted How to route in two directions with restrictions on one? on Getting Data In. 08-15-2023 06:21 AM
- Tagged How to route in two directions with restrictions on one? on Getting Data In. 08-15-2023 06:21 AM
- Tagged How to route in two directions with restrictions on one? on Getting Data In. 08-15-2023 06:21 AM
- Tagged How to route in two directions with restrictions on one? on Getting Data In. 08-15-2023 06:21 AM
- Posted Re: sudo systemctl start Splunkd keeps failing with (code=exited, status=8) on Installation. 08-03-2023 05:31 AM
- Posted Re: sudo systemctl start Splunkd keeps failing with (code=exited, status=8) on Installation. 08-03-2023 12:55 AM
- Posted Re: sudo systemctl start Splunkd keeps failing with (code=exited, status=8) on Installation. 08-02-2023 02:29 PM
- Posted Re: sudo systemctl start Splunkd keeps failing with (code=exited, status=8) on Installation. 08-02-2023 02:04 PM
- Posted Re: sudo systemctl start Splunkd keeps failing with (code=exited, status=8) on Installation. 08-02-2023 01:53 PM
- Posted sudo systemctl start Splunkd keeps failing with (code=exited, status=8) on Installation. 08-02-2023 12:43 PM
- Tagged sudo systemctl start Splunkd keeps failing with (code=exited, status=8) on Installation. 08-02-2023 12:43 PM
- Tagged sudo systemctl start Splunkd keeps failing with (code=exited, status=8) on Installation. 08-02-2023 12:43 PM
- Got Karma for Re: XML - WinEvent Whitelist. 10-25-2022 05:22 AM
- Posted Re: XML - WinEvent Whitelist on Dashboards & Visualizations. 10-25-2022 04:00 AM
- Posted How to filter EventID’s using “Splunk Add-on for Microsoft Windows” (Splunk_TA_windows) challenge. on All Apps and Add-ons. 10-22-2022 02:53 PM
- Tagged How to filter EventID’s using “Splunk Add-on for Microsoft Windows” (Splunk_TA_windows) challenge. on All Apps and Add-ons. 10-22-2022 02:53 PM
- Tagged How to filter EventID’s using “Splunk Add-on for Microsoft Windows” (Splunk_TA_windows) challenge. on All Apps and Add-ons. 10-22-2022 02:53 PM
- Tagged How to filter EventID’s using “Splunk Add-on for Microsoft Windows” (Splunk_TA_windows) challenge. on All Apps and Add-ons. 10-22-2022 02:53 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
10-11-2023
03:54 AM
Try this one: index=_internal "Splunkd starting" sourcetype=splunkd component=loader AND host=*
| append
[| search index=_internal "splunkd started" sourcetype=splunkd_stderr AND host=*
]
| eval st_{sourcetype}=1
| stats count sum(st_*) AS * earliest(_time) AS firstTime latest(_time) AS lastTime BY host
| eval uptime = tostring(now() - lastTime,"duration")
| foreach *Time
[| eval <<FIELD>>=strftime(<<FIELD>>,"%Y-%m-%d %H:%M:%S")
]
| table host count firstTime lastTime uptime *
... View more
09-01-2023
01:44 AM
Hi @rphillips_splk, While I know this is some time ago, I still find this very interesting! You used 2 different routing types here - so I need to ask if this also could be applied on 2 TCP (different) connections, so the cloned version could also be send as TCP and not syslog? Moreover - I'm in the situation, there will be an additional HF where you show the "syslog receiver" above, and the actual indexer - so basically route like this: UF -> HF (clone) -> IDX |-> HF -> IDX Can this be done as smooth as above? If so, how?
... View more
08-15-2023
06:21 AM
Hi, Here is a challenge that works partly as expected. On a HF I need to split syslog data to two different instances, one internal in the company, and secondly to an external company (that does investigations on these). The external company has provided a sysmon config file, which collect all they need, but which on the other hand provides too much internally. The split of data sending two ways works great using props, transforms and outputs. Now the challenge is to remove some of the events send to the internal tcp group. props.conf
[source::XmlWinEventLog:Microsoft-Windows-Sysmon/Operational]
TRANSFORMS-routing = sysmon-routeToExt, sysmon-routeToInt
transforms.conf
[sysmon-routeToInt]
SOURCE_KEY = MetaData:Host
REGEX = (?i)(.*)
DEST_KEY=_TCP_ROUTING
FORMAT=TcpOut_Int
[sysmon-routeToExt]
SOURCE_KEY = MetaData:Host
REGEX = (?i)(.*)
DEST_KEY=_TCP_ROUTING
FORMAT=TcpOut_Ext
One of the basic questions is: Is there a way to use props (order vise) so it will be possible to send everything to one tcp group (external), and with the same events then filter (drop some events using REGEX), and send the remaining events to the second tcp group (internal) ?
... View more
Labels
08-03-2023
05:31 AM
Hi @PickleRick, Thanks - you're the man of the day😉👍 Even more time saved, thanks a lot for your time and sharing. Cheers, Bjarne
... View more
08-03-2023
12:55 AM
It's a bit embracing, as I've worked with linux for years, but I never touched SELinux before now, and I most admit, this is a complete new world, and a bit complex I must say. I figured out how to pipe audit.log in to audit2allow and get what need to be adjusted, but I didn't managed to figure out exactly how and where to store these SELinux policies. (if you know more, I'd be happy to learn some more 🙂 Anyway - THANKS - you saved my long long day with this!!! Most appreciated. Cheers, Bjarne
... View more
08-02-2023
02:29 PM
Ok, by disabling selinux it will actually start, so far so good. Now, what's needed to fix this, so it will start when enabled also? In other words, do you know how to analyze what's needed?
... View more
08-02-2023
02:04 PM
Let me try to have a look at that. But how come with ExecStart cmd and not systemctl?
... View more
08-02-2023
01:53 PM
I always download the tgz files, and unzip them directly in the the /opt/splunk folder, if it's splunk we're talking about?
... View more
08-02-2023
12:43 PM
I've been fighting all day trying to figure out what keeps causing above error when starting Splunk, and here is some background: OS: CentOS Stream 9
Kernel: Linux 5.14.0-295.el9.x86_64
Splunk: splunk-9.0.4.1-419ad9369127-Linux-x86_64.tgz Earlier (today) a ran version: 8.2.9, but as it kept failing I thought it could be the Splunk version and some systemctl stuff issues (as I've read quite a bit about), but after upgrading it's still the same. The service has been initiated as: sudo /opt/splunk/bin/splunk enable boot-start -systemd-managed 1 -user splunk The sudo systemctl status Splunkd shows: × Splunkd.service - Systemd service file for Splunk, generated by 'splunk enable boot-start'
Loaded: loaded (/etc/systemd/system/Splunkd.service; enabled; preset: disabled)
Active: failed (Result: exit-code) since Wed 2023-08-02 19:53:42 CEST; 1h 37min ago
Duration: 983us
Process: 402262 ExecStart=/opt/splunk/bin/splunk _internal_launch_under_systemd (code=exited, status=8)
Process: 402263 ExecStartPost=/bin/bash -c chown -R splunk:splunk /sys/fs/cgroup/system.slice/Splunkd.service (code=exited, status=0/SUCCESS)
Main PID: 402262 (code=exited, status=8)
CPU: 7ms
aug 02 19:53:42 localhost.localdomain systemd[1]: Stopped Systemd service file for Splunk, generated by 'splunk enable boot-start'.
aug 02 19:53:42 localhost.localdomain systemd[1]: Splunkd.service: Converting job Splunkd.service/restart -> Splunkd.service/start
aug 02 19:53:42 localhost.localdomain systemd[1]: Splunkd.service: Consumed 7ms CPU time.
aug 02 19:53:42 localhost.localdomain systemd[1]: Splunkd.service: Start request repeated too quickly.
aug 02 19:53:42 localhost.localdomain systemd[1]: Splunkd.service: Failed with result 'exit-code'.
aug 02 19:53:42 localhost.localdomain systemd[1]: Splunkd.service: Service restart not allowed.
aug 02 19:53:42 localhost.localdomain systemd[1]: Splunkd.service: Changed dead -> failed
aug 02 19:53:42 localhost.localdomain systemd[1]: Splunkd.service: Job 99417 Splunkd.service/start finished, result=failed
aug 02 19:53:42 localhost.localdomain systemd[1]: Failed to start Systemd service file for Splunk, generated by 'splunk enable boot-start'.
aug 02 19:53:42 localhost.localdomain systemd[1]: Splunkd.service: Unit entered failed state. If I run the ExecStart=/opt/splunk/bin/splunk _internal_launch_under_systemd directly from the command line splunk starts without any problems - I don't get it. I've edited: /etc/systemd/system.conf and added: LogLevel=debug And running: journalctl -xeu Splunkd.service writes: ░░
░░ The unit Splunkd.service completed and consumed the indicated resources.
aug 02 19:53:42 localhost.localdomain systemd[1]: Splunkd.service: Will spawn child (service_enter_start): /opt/splunk/bin/splunk
aug 02 19:53:42 localhost.localdomain systemd[1]: Splunkd.service: cgroup-compat: Applying [Startup]CPUShares=1024 as [Startup]CPUWeight=100 on /system.slice/Splunkd.service
aug 02 19:53:42 localhost.localdomain systemd[1]: Splunkd.service: Failed to set 'io.weight' attribute on '/system.slice/Splunkd.service' to 'default 100': No such file or directory
aug 02 19:53:42 localhost.localdomain systemd[1]: Splunkd.service: cgroup-compat: Applying MemoryLimit=7922106368 as MemoryMax=
aug 02 19:53:42 localhost.localdomain systemd[1]: Splunkd.service: Passing 0 fds to service
aug 02 19:53:42 localhost.localdomain systemd[1]: Splunkd.service: About to execute /opt/splunk/bin/splunk _internal_launch_under_systemd
aug 02 19:53:42 localhost.localdomain systemd[1]: Splunkd.service: Forked /opt/splunk/bin/splunk as 402262
aug 02 19:53:42 localhost.localdomain systemd[1]: Splunkd.service: Will spawn child (service_enter_start_post): /bin/bash
aug 02 19:53:42 localhost.localdomain systemd[1]: Splunkd.service: About to execute /bin/bash -c "chown -R splunk:splunk /sys/fs/cgroup/system.slice/Splunkd.service"
aug 02 19:53:42 localhost.localdomain systemd[1]: Splunkd.service: Forked /bin/bash as 402263
aug 02 19:53:42 localhost.localdomain systemd[1]: Splunkd.service: Changed dead -> start-post
aug 02 19:53:42 localhost.localdomain systemd[1]: Starting Systemd service file for Splunk, generated by 'splunk enable boot-start'...
░░ Subject: A start job for unit Splunkd.service has begun execution
░░ Defined-By: systemd
░░ Support: https://access.redhat.com/support
░░
░░ A start job for unit Splunkd.service has begun execution.
░░
░░ The job identifier is 99280.
aug 02 19:53:42 localhost.localdomain systemd[1]: Splunkd.service: User lookup succeeded: uid=1002 gid=1002
aug 02 19:53:42 localhost.localdomain systemd[1]: Splunkd.service: User lookup succeeded: uid=1002 gid=1002
aug 02 19:53:42 localhost.localdomain systemd[402263]: Splunkd.service: Executing: /bin/bash -c "chown -R splunk:splunk /sys/fs/cgroup/system.slice/Splunkd.service"
aug 02 19:53:42 localhost.localdomain systemd[402262]: Splunkd.service: Executing: /opt/splunk/bin/splunk _internal_launch_under_systemd
aug 02 19:53:42 localhost.localdomain systemd[1]: Splunkd.service: Child 402263 belongs to Splunkd.service.
aug 02 19:53:42 localhost.localdomain systemd[1]: Splunkd.service: Control process exited, code=exited, status=0/SUCCESS (success)
░░ Subject: Unit process exited
░░ Defined-By: systemd
░░ Support: https://access.redhat.com/support
░░
░░ An ExecStartPost= process belonging to unit Splunkd.service has exited.
░░
░░ The process' exit code is 'exited' and its exit status is 0.
aug 02 19:53:42 localhost.localdomain systemd[1]: Splunkd.service: Got final SIGCHLD for state start-post.
aug 02 19:53:42 localhost.localdomain systemd[1]: Splunkd.service: Changed start-post -> running
aug 02 19:53:42 localhost.localdomain systemd[1]: Splunkd.service: Job 99280 Splunkd.service/start finished, result=done
aug 02 19:53:42 localhost.localdomain systemd[1]: Started Systemd service file for Splunk, generated by 'splunk enable boot-start'.
░░ Subject: A start job for unit Splunkd.service has finished successfully
░░ Defined-By: systemd
░░ Support: https://access.redhat.com/support
░░
░░ A start job for unit Splunkd.service has finished successfully.
░░
░░ The job identifier is 99280.
aug 02 19:53:42 localhost.localdomain splunk[402262]: Couldn't open "/opt/splunk/bin/../etc/splunk-launch.conf": Permission denied
aug 02 19:53:42 localhost.localdomain splunk[402262]: Couldn't open "/opt/splunk/bin/../etc/splunk-launch.conf": Permission denied
aug 02 19:53:42 localhost.localdomain splunk[402262]: ERROR: Couldn't determine $SPLUNK_HOME or $SPLUNK_ETC; perhaps one should be set in environment
aug 02 19:53:42 localhost.localdomain systemd[1]: Splunkd.service: Child 402262 belongs to Splunkd.service.
aug 02 19:53:42 localhost.localdomain systemd[1]: Splunkd.service: Main process exited, code=exited, status=8/n/a
░░ Subject: Unit process exited
░░ Defined-By: systemd
░░ Support: https://access.redhat.com/support
░░
░░ An ExecStart= process belonging to unit Splunkd.service has exited.
░░
░░ The process' exit code is 'exited' and its exit status is 8.
aug 02 19:53:42 localhost.localdomain systemd[1]: Splunkd.service: Failed with result 'exit-code'.
░░ Subject: Unit failed
░░ Defined-By: systemd
░░ Support: https://access.redhat.com/support
░░
░░ The unit Splunkd.service has entered the 'failed' state with result 'exit-code'.
aug 02 19:53:42 localhost.localdomain systemd[1]: Splunkd.service: Service will restart (restart setting)
aug 02 19:53:42 localhost.localdomain systemd[1]: Splunkd.service: Changed running -> failed
aug 02 19:53:42 localhost.localdomain systemd[1]: Splunkd.service: Unit entered failed state.
aug 02 19:53:42 localhost.localdomain systemd[1]: Splunkd.service: Consumed 7ms CPU time.
░░ Subject: Resources consumed by unit runtime
░░ Defined-By: systemd
░░ Support: https://access.redhat.com/support
░░
░░ The unit Splunkd.service completed and consumed the indicated resources.
aug 02 19:53:42 localhost.localdomain systemd[1]: Splunkd.service: Changed failed -> auto-restart
aug 02 19:53:42 localhost.localdomain systemd[1]: Splunkd.service: Service RestartSec=100ms expired, scheduling restart.
aug 02 19:53:42 localhost.localdomain systemd[1]: Splunkd.service: Trying to enqueue job Splunkd.service/restart/replace
aug 02 19:53:42 localhost.localdomain systemd[1]: Splunkd.service: Installed new job Splunkd.service/restart as 99417
aug 02 19:53:42 localhost.localdomain systemd[1]: Splunkd.service: Enqueued job Splunkd.service/restart as 99417
aug 02 19:53:42 localhost.localdomain systemd[1]: Splunkd.service: Scheduled restart job, restart counter is at 5.
░░ Subject: Automatic restarting of a unit has been scheduled
░░ Defined-By: systemd
░░ Support: https://access.redhat.com/support
░░
░░ Automatic restarting of the unit Splunkd.service has been scheduled, as the result for
░░ the configured Restart= setting for the unit.
aug 02 19:53:42 localhost.localdomain systemd[1]: Splunkd.service: Changed auto-restart -> dead
aug 02 19:53:42 localhost.localdomain systemd[1]: Splunkd.service: Job 99417 Splunkd.service/restart finished, result=done
aug 02 19:53:42 localhost.localdomain systemd[1]: Stopped Systemd service file for Splunk, generated by 'splunk enable boot-start'.
░░ Subject: A stop job for unit Splunkd.service has finished
░░ Defined-By: systemd
░░ Support: https://access.redhat.com/support
░░
░░ A stop job for unit Splunkd.service has finished.
░░
░░ The job identifier is 99417 and the job result is done.
aug 02 19:53:42 localhost.localdomain systemd[1]: Splunkd.service: Converting job Splunkd.service/restart -> Splunkd.service/start
aug 02 19:53:42 localhost.localdomain systemd[1]: Splunkd.service: Consumed 7ms CPU time.
░░ Subject: Resources consumed by unit runtime
░░ Defined-By: systemd
░░ Support: https://access.redhat.com/support
░░
░░ The unit Splunkd.service completed and consumed the indicated resources.
aug 02 19:53:42 localhost.localdomain systemd[1]: Splunkd.service: Start request repeated too quickly.
aug 02 19:53:42 localhost.localdomain systemd[1]: Splunkd.service: Failed with result 'exit-code'.
░░ Subject: Unit failed
░░ Defined-By: systemd
░░ Support: https://access.redhat.com/support
░░
░░ The unit Splunkd.service has entered the 'failed' state with result 'exit-code'.
aug 02 19:53:42 localhost.localdomain systemd[1]: Splunkd.service: Service restart not allowed.
aug 02 19:53:42 localhost.localdomain systemd[1]: Splunkd.service: Changed dead -> failed
aug 02 19:53:42 localhost.localdomain systemd[1]: Splunkd.service: Job 99417 Splunkd.service/start finished, result=failed
aug 02 19:53:42 localhost.localdomain systemd[1]: Failed to start Systemd service file for Splunk, generated by 'splunk enable boot-start'.
░░ Subject: A start job for unit Splunkd.service has failed
░░ Defined-By: systemd
░░ Support: https://access.redhat.com/support
░░
░░ A start job for unit Splunkd.service has finished with a failure.
░░
░░ The job identifier is 99417 and the job result is failed.
aug 02 19:53:42 localhost.localdomain systemd[1]: Splunkd.service: Unit entered failed state.
lines 2855-2974/2974 (END) In relation to above error: aug 02 22:14:58 localhost.localdomain systemd[404267]: Splunkd.service: Executing: /opt/splunk/bin/splunk _internal_launch_under_systemd
aug 02 22:14:58 localhost.localdomain splunk[404267]: Couldn't open "/opt/splunk/bin/../etc/splunk-launch.conf": Permission denied
aug 02 22:14:58 localhost.localdomain splunk[404267]: Couldn't open "/opt/splunk/bin/../etc/splunk-launch.conf": Permission denied
aug 02 22:14:58 localhost.localdomain splunk[404267]: ERROR: Couldn't determine $SPLUNK_HOME or $SPLUNK_ETC; perhaps one should be set in environment
aug 02 22:14:58 localhost.localdomain systemd[1]: Splunkd.service: Child 404267 belongs to Splunkd.service.
aug 02 22:14:58 localhost.localdomain systemd[1]: Splunkd.service: Main process exited, code=exited, status=8/n/a The text: "/opt/splunk/bin/../etc/splunk-launch.conf": Permission denied does not make any sense it's set as: -rwxrwxrwx. 1 splunk splunk 765 2 aug 19:31 splunk-launch.conf Any help would be highly appreciated.
... View more
Labels
- Labels:
-
heavy forwarder
-
Linux
-
splunkd
10-25-2022
04:00 AM
1 Karma
@richgalloway your whitelist = 106,4624,4625 will not work as long renderXml = true according to the documentation. With renderXml = true you need to use: $XmlRegex
... View more
10-22-2022
02:53 PM
Does anyone have core knowledge on how the remove all events the fulfill these two searches, then I’d be very pleased to hear how, as I’ve already spend quite a bit of time investigating, editing and deploying unfortunately still without lock: index=wineventlog EventCode=4672 host IN (SKEXCH0*) src_user IN (SKEXCH0*$) index=wineventlog EventID=4624 TargetUserName=cscad WorkstationName IN (VHPDOC540*) IpAddress=“122.85.52.*” Where the source for each of the two is as follows: 1. <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4672</EventID><Version>0</Version><Level>0</Level><Task>12548</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2022-10-22T20:49:51.515030900Z'/><EventRecordID>7104199399</EventRecordID><Correlation ActivityID='{08b0282e-d41c-0001-cb3d-b0081cd4d801}'/><Execution ProcessID='924' ThreadID='54024'/><Channel>Security</Channel><Computer>SKEXCH03.son.sok.net</Computer><Security/></System><EventData><Data Name='SubjectUserSid'>S-1-5-18</Data><Data Name='SubjectUserName'>SKEXCH03$</Data><Data Name='SubjectDomainName'>SON</Data><Data Name='SubjectLogonId'>0x183d0ad065</Data><Data Name='PrivilegeList'>SeSecurityPrivilege
SeBackupPrivilege
SeRestorePrivilege
SeTakeOwnershipPrivilege
SeDebugPrivilege
SeSystemEnvironmentPrivilege
SeLoadDriverPrivilege
SeImpersonatePrivilege
SeDelegateSessionUserImpersonatePrivilege</Data></EventData></Event> 2. <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4624</EventID><Version>2</Version><Level>0</Level><Task>12544</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2022-10-22T20:55:10.9831608Z'/><EventRecordID>790343401</EventRecordID><Correlation/><Execution ProcessID='860' ThreadID='11144'/><Channel>Security</Channel><Computer>SKDC02.son.sok.net</Computer><Security/></System><EventData><Data Name='SubjectUserSid'>S-1-0-0</Data><Data Name='SubjectUserName'>-</Data><Data Name='SubjectDomainName'>-</Data><Data Name='SubjectLogonId'>0x0</Data><Data Name='TargetUserSid'>S-1-5-21-606747145-57989841-682003330-85457</Data><Data Name='TargetUserName'>cscad</Data><Data Name='TargetDomainName'>SON</Data><Data Name='TargetLogonId'>0x11a5ba720</Data><Data Name='LogonType'>3</Data><Data Name='LogonProcessName'>NtLmSsp </Data><Data Name='AuthenticationPackageName'>NTLM</Data><Data Name='WorkstationName'>VHPDOC540COP001</Data><Data Name='LogonGuid'>{00000000-0000-0000-0000-000000000000}</Data><Data Name='TransmittedServices'>-</Data><Data Name='LmPackageName'>NTLM V2</Data><Data Name='KeyLength'>128</Data><Data Name='ProcessId'>0x0</Data><Data Name='ProcessName'>-</Data><Data Name='IpAddress'>122.85.52.113</Data><Data Name='IpPort'>53191</Data><Data Name='ImpersonationLevel'>%%1833</Data><Data Name='RestrictedAdminMode'>-</Data><Data Name='TargetOutboundUserName'>-</Data><Data Name='TargetOutboundDomainName'>-</Data><Data Name='VirtualAccount'>%%1843</Data><Data Name='TargetLinkedLogonId'>0x0</Data><Data Name='ElevatedToken'>%%1842</Data></EventData></Event> In the inputs.conf I’ve tried the following without any success – yet: [WinEventLog://Security]
disabled = 0
whitelist = 512,513,517,528,529,530,531,532,533,534,535,536,537,539,540,552,592,601,602,612,624,632,636,660,852,1102,4608,4616,4624,4625,4648,4649,4656,4662,4670,4672,4688,4697,4698,4702
,4719,4720,4723,4728,4732,4742,4746,4751,4756,4761,4768,4769,4771,4776,4794,5025,5152,5805,5827,5828,5829,5830,5831,7045,7468
## Blacklisted EventCodes for Exchange and cscad
blacklist3 = EventCode="4672" host="SKEXCH0.*" src_user="SKEXCH\d{2}\$"
blacklist4 = EventCode="4624" TargetUserName="cscad" WorkstationName="VHPDOC540.*" IpAddress="122\.85\.52\.\d{1,3}"
blacklist5 = $XmlRegex="<EventID>4672</\EventID>.*?<Computer>SKEXCH\d{2}\.[a-zA-Z0-9\.]+<\/Computer>.*?SubjectUserName'>SKEXCH\d{2}\$<\/Data>"
blacklist6 = $XmlRegex="EventID>4624<\/EventID>.*?Computer>SKDC\d+\.[a-zA-Z0-9\.]+<.*+TargetUserName'>cscad<\/Data>.*?'WorkstationName'>VHPDOC540[^<]+</Data.*?'IpAddress'>122\.85\.52\.\d{1,3}<\/Data>"
blacklist7 = $XmlRegex="\<EventID\>4672\</\EventID\>.*?<Computer\>SKEXCH\d{2}\.[a-zA-Z0-9\.]+\<\/Computer\>.*?SubjectUserName\'\>SKEXCH\d{2}\$\<\/Data\>"
blacklist8 = $XmlRegex="EventID>4624<\/EventID>.*?Computer>SKDC\d+\.[a-zA-Z0-9\.]+<.*+TargetUserName'>cscad<\/Data>.*?'WorkstationName'>VHPDOC540[^<]+</Data.*?'IpAddress'>122\.85\.52\.\d{1,3}<\/Data>"
renderXml=true
index = wineventlog
... View more
Labels
- Labels:
-
configuration
09-03-2022
01:28 PM
Can also be accomplished over time by: index=summary sourcetype=stash source IN (Summary_Error_*)
| fields + *
| bin _time span=1d
| eval search_name=search_name+"#"+_time
| stats mode(*) AS * by search_name
| transpose 1000 header_field=search_name column_name=fieldName
| eval type=if(match(fieldName,"(_raw|_time|date_.*|eventtype|tag.*|index|sourcetype|host|info_.*|punct|time*.?pos|search_name|search|search_now|splunk_server.*|linecount)"),"internal","custom")
| stats count(*) AS * BY type
| transpose 1000 column_name=search_name header_field=type
| rename "row 1" AS fieldCount
| search search_name!=fieldName
| rex field=search_name "(?<search_name>[^#]+)#(?<_time>.*)"
| stats max(*) as * BY _time search_name
... View more
09-03-2022
12:25 PM
How about this one: index=summary sourcetype=stash source IN (Summary_Error_*)
| fields + *
| stats mode(*) AS #* by search_name
| transpose header_field=search_name column_name=fieldName
| eval type=if(match(fieldName,"#(_raw|date_.*|eventtype|tag.*|index|sourcetype|host|info_.*|punct|time*.?pos|search_name|search|search_now|splunk_server.*|linecount)"),"internal","custom")
| stats count(*) AS * BY type
| transpose column_name=search_name header_field=type
| rename "row 1" AS fieldCount
| search search_name!=fieldName It was used for summary index by might as well be used other ways.
... View more
07-22-2022
08:49 AM
For info, it actually worked as soon as I renamed my userid in etc/passwd👍
... View more
07-22-2022
08:34 AM
Thanks for the info, but it still doesn't make much sense, unless Splunk has made some weird hardcode on the admin account for test/dev licenses. Thanks again for your input:-)
... View more
07-22-2022
08:16 AM
So basically what you're telling is, that non-standard usernames can cause this issue, or what exactly are you describing here? I've struggled with this for more than a year now, and got no usable answer anywhere... my username in Splunk is nilsjul, but the history lookup file is named: "BDs-MacBook-Pro-2019-idx.csv"
... View more
07-22-2022
08:04 AM
Did you ever get a solution to this? I'm running a single instance on Mac, and have same issue, but the csv is there, but it doesn't show up in "Search History" nor using | history
... View more
01-20-2022
05:41 AM
I actually just got this one into place by simply adding a wildcard to props.conf, so it now looks like this: [default]
TRANSFORMS = ingest-eval-rule-timeskew, ingest-eval-rule-evtsize, ingest-eval-rule-tierhost
[(?::){0}*]
TRANSFORMS = ingest-eval-rule-timeskew, ingest-eval-rule-evtsize, ingest-eval-rule-tierhost And now all - except for a few internal sourcetypes, it's great.
... View more
01-20-2022
03:20 AM
Can it really be true, that no-one knows anything about this?
... View more
01-20-2022
03:17 AM
Hi Guys, This is a very interesting topic, for which I've made an app, not only for HF's but also for the IDX's, however I do see some challenges here... First of all I took a little different approach in props.conf, as I used the [default] stanza, with the aim to hit ALL events coming in. It works - to a curtain extend, but it's really wired (to me) how, as most UF's sends their data through the HF's, and some directly to the IDX's, and for some strange reason, that I've spend quite some time investigating - without a solution (nor explanation) yet. Some hosts "hits" the transforms (props) and gets the new values, and some don't, even though the all pass the same HF's. Of those host sending directly to the IDX's none of them "hits" the transforms. transforms.conf
---------------------------
[ingest-eval-rule-timeskew]
INGEST_EVAL = timeSkew=time() - _time
WRITE_META=true
[ingest-eval-rule-evtsize]
INGEST_EVAL = evtSizeB=len(_raw)
WRITE_META=true
[ingest-eval-rule-tierhost]
INGEST_EVAL = tierHost=replace(splunk_server,"\..*","")
WRITE_META = true
props.conf
---------------------------
[default]
TRANSFORMS = ingest-eval-rule-timeskew, ingest-eval-rule-evtsize, ingest-eval-rule-tierhost
fields.conf
---------------------------
[timeSkew]
INDEXED = True
[evtSizeB]
INDEXED = True
[tierHost]
INDEXED = True Does anyone of you have an idea about: Why none of the data parsing direct to the IDX's don't "hit" this transform? Why some hosts (UF's) sending data through the HF's "hits" and some don't?
... View more
12-28-2021
01:49 AM
Hi @isoutamo , Thanks for your fast reply, it looks weird to me as well - so thanks for confirming. /Bjarne
... View more
12-27-2021
01:12 PM
Hi Everyone, I'm running Splunk Enterprise 8.2.2.1 on my MacOS (Big Sur), and it runs quite well, except that there is no search history available using a user id with admin role. But from the CLI in: etc/users/bd/search/history There is actually a file called <hostname>.idx.csv which holds all my history. 1. Can anyone please explain what's going on here? PS. I have 5 instances running on my Mac (A combined SH/IDX, DPL, HFWD, and 2 UF's), and it all works nice together. The difference is that I have an internal created user on the SH (the one with no history above), but on IE the HFWD I use the user "splunk" (this user also runs all the instances on OS level) to log in with, and here history work just fine. 2. There is gotta be a missing link, but which? Cheers, Bjarne
... View more
Labels
- Labels:
-
lookup
12-27-2021
12:46 PM
Hi Everyone,
I have 5 instances of Splunk running my Mac (Big Sur v11.6):
SH+IDX
DPL
HFWD
UF (sending to HFWD)
UF (sending to IDX)
All working pretty well, but there are a few hick-ups running on MacOSX (Big Sur, 11.6), and the new major one I've run it to is there is NO introspection (Resource Usage) collected! The "resource_usage.log" is completely empty, and running :
/opt/splunk_dpl/bin/splunkd instrument-resource-usage -p 8087 --with-kvstore --debug
Writes:
I-data gathering (Resource Usage) not supported on this platform.
DEBUG RU_main - I-data gathering (IOWait Statistics) not supported on this OS
WARN WatchdogActions - Initialization failed for action=pstacks. Deleting.
DEBUG InstrumentThread - Entering 0th iter (thread KVStoreOperationStatsInstrumentThread)
DEBUG InstrumentThread - Entering 0th iter (thread KVStoreCollectionStatsInstrumentThread)
DEBUG InstrumentThread - Entering 0th iter (thread KVStoreServerStatusInstrumentThread)
DEBUG InstrumentThread - Entering 0th iter (thread KVStoreProfilingDataInstrumentThread)
DEBUG InstrumentThread - Entering 0th iter (thread KVStoreReplicaSetStatsInstrumentThread)
1. Does this really mean there is no support for resource usage on Mac, og am I getting something wrong here? To me there is not really that much difference between a Mac and a Linux box (while knowing there are some differences) , and most commands run on a linux are run the exact same way on a mac. 2. If this does not come out of the box, how can it be enabled? 3. Which processes are run on linux to exactly fulfill the "Resource Usage" and IOWait stats, that one could try move into the mac? 4. Does anyone know exactly how and where the scripts/processes are configured in Splunk to facilitate this?
Any core details would be most appreciated.
Cheers,
Bjarne
... View more
Labels
08-27-2021
01:34 AM
Hi R.Ismo, Thanks for your input, this is pretty much also my knowledge, but I'd like to hang around a bit, as there are some very creative guys out there, that might have some interesting ideas/workarounds etc😊
... View more
08-27-2021
01:00 AM
Hi, A lot of Splunkers knows how to measure common latency/timeskew in Splunk using _time and _indextime, but who knows to measure the latency in all steps from a UF on it way to the Indexer, where there could be more Forwarders underway to the indexers (Heavy, Intermediate etc), where latency could raise. The question was really asked here: Indexing latency arising at forwarders? , but never answered. Does anyone know how to nails this information? My idea was somehow to enrich the data in every level, by adding every tier of forwarder to each event with its hostname, and its timestamp, in which way you always would be in control and know the exact source of eventual latency - if you can follow my approach? Ie. Would it be possible to use INGEST_EVAL to add new fields on every new tier the event passes, like: t<no>_host=<host> t<no>_time=<timestamp> This approach will likely also touch on cooked data, and to what extend it's possible to enrich these underway. Let me hear your thoughts and ideas.
... View more
Labels
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
10-11-2023
11:14 AM
|
