Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Are you a member of the Splunk Community?
Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- About syazwani
syazwani
Path Finder
Member since:
09-06-2021
a week ago
Community Statistics
| Posts | 48 |
| Solutions | 2 |
| Karma Given | 5 |
| Karma Received | 3 |
| Member Since | 09-06-2021 |
Activity Feed
- Got Karma for How to migrate data in an indexer cluster to a new indexer cluster environment?. 10-23-2024 01:08 PM
- Got Karma for Re: KV Store status failed. 07-23-2024 06:19 AM
- Posted cidr match is not properly working on Splunk Search. 02-29-2024 10:25 PM
- Tagged cidr match is not properly working on Splunk Search. 02-29-2024 10:25 PM
- Posted Reset password in splunk for admin on Security. 11-30-2023 05:58 PM
- Karma Re: Syntax Error while using "distance" command for PickleRick. 10-16-2023 08:48 PM
- Posted Re: Syntax Error while using "distance" command on Splunk Search. 10-16-2023 08:47 PM
- Posted Re: Syntax Error while using "distance" command on Splunk Search. 10-16-2023 08:44 PM
- Karma Re: Syntax Error while using "distance" command for inventsekar. 10-16-2023 08:44 PM
- Tagged Re: Syntax Error while using "distance" command on Splunk Search. 10-16-2023 08:44 PM
- Posted Syntax Error while using "distance" command on Splunk Search. 10-15-2023 10:03 PM
- Tagged Syntax Error while using "distance" command on Splunk Search. 10-15-2023 10:03 PM
- Posted Search Head Clustering not working properly on Deployment Architecture. 09-08-2023 01:24 AM
- Posted How to Remove option label in Dashboard Studio? on Dashboards & Visualizations. 08-23-2023 01:39 AM
- Got Karma for How to create an alert with two condition to meet by sequence before the alert can trigger?. 02-28-2023 05:51 PM
- Posted How to create an alert with two condition to meet by sequence before the alert can trigger? on Splunk Search. 02-27-2023 09:58 PM
- Posted Re: How to write regex to extract value in between two phrases? on Splunk Search. 02-19-2023 06:21 PM
- Karma Re: Regex to extract value in between two phrase for batabay. 02-19-2023 06:20 PM
- Posted How to write regex to extract value in between two phrases? on Splunk Search. 02-15-2023 11:44 PM
- Posted Re: How to customize Threat Activity dashboard by adding new fields? on Splunk Enterprise Security. 01-11-2023 07:09 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
02-29-2024
10:25 PM
Hi, Why my CIDR matching in not following the lookup content? Query i used is as below: | makeresults | eval ip="10.10.10.10" | lookup testip ip OUTPUTNEW description Result should look like this: ip Description 10.10.10.10 New But the real output look like this: ip Description 10.10.10.10 New In Progress Closed I have check my lookup and its clearly state the Description for IP Range 10.10.10.10/27 is "New". Please help and thanks!
... View more
- Tags:
- cidr
11-30-2023
05:58 PM
Hi, how can we reset password for admin user from CLI. Currently i have indexer using Splunk 9.1.1 in testing environment and i forgot the username and password. There were some bin command that will prompt for Splunk username and password, so i need to reset the username and password. Please help. Thank you.
... View more
Labels
- Labels:
-
login
10-16-2023
08:47 PM
Hi @PickleRick, Noted on this. Yes I am using the Splunk App for Salesforce and it is using the "distance" command. Seems like they dont have a documentation for this app. Btw thankyou for your feedback.
... View more
10-16-2023
08:44 PM
Hi @inventsekar , Thank you for your feedback. Yes, I'm currently using the Splunk App for Salesforce and this is our first time installing it. On the Splunk warning message, it didnt mentioned any details, only as the above screenshot. I did check on the search.log, they error show "syntax error - script (path)". I guess i need to fine tuned the query or is there any other way I can work on?
... View more
- Tags:
- hi
10-15-2023
10:03 PM
Hi peeps, I receive below error while running a query. below is my query; eventtype=sfdc-login-history | iplocation allfields=true SourceIp | eval cur_t=_time | streamstats current=t window=2 first(lat) as prev_lat first(lon) as prev_lon first(cur_t) as prev_t by Username | eval time_diff=cur_t - prev_t | distance outputField=distance inputFieldlat1=lat inputFieldLat2=prev_lat inputfieldLon1=lon inputFieldLon2=prev_lon | eval time_diff=-1*time_diff | eval ratio = distances3600/time_diff | where ratio> 500 | geostats latfield=lat longfield=lon count by Application
... View more
- Tags:
- query
Labels
- Labels:
-
using Splunk Enterprise
09-08-2023
01:24 AM
Hi, HTTP 503 Service Unavailable -- {"messages":[{"type":"ERROR","text":"This node is not the captain of the search head cluster, and we could not determine the current captain. The cluster is either in the process of electing a new captain, or this member hasn't joined the pool"}]} We received this error on one of the Search head cluster member. Is there any way to troubleshoot this? Please assist. Thankyou.
... View more
Labels
- Labels:
-
search head clustering
08-23-2023
01:39 AM
Hi, anyone know how to hide/remove the option label on Single Visualisation mode in Dashboard Studio? I want to hide the search, expand, reload and download option.
Thanks.
... View more
Labels
- Labels:
-
dashboard
-
Dashboard Studio
-
single value
02-27-2023
09:58 PM
1 Karma
Hi,
I want to create an alert with two condition to meet by sequence before the alert can trigger. We are using eventID for each condition.
First condition: eventID 4625 count more than 10 by source ip
Second condition: eventID 4624 count more than 1 by source ip
I want the query to meet the first condition, followed by second condition and populate a result. Please assist. Thank you.
... View more
02-19-2023
06:21 PM
Hi @batabay, thank you for the response. It works!
... View more
02-15-2023
11:44 PM
Hi, I need help to extract a value from field named "message".
Field "message" value is as below:
The process C:\Windows\system32\winlogon.exe (PRD01) has initiated the power off of computer PC01 on behalf of user ADMIN JABATAN for the following reason: No title for this reason could be found
The process C:\Windows\system32\shutdown.exe (PRD01) has initiated the restart of computer PC01 on behalf of user ADMIN\SUPPORT for the following reason: No title for this reason could be found
The process C:\Windows\system32\shutdown.exe (PRD01) has initiated the restart of computer PC01 on behalf of user admin for the following reason: No title for this reason could be found The value i want to extract is:
newField
ADMIN JABATAN
ADMIN\SUPPORT
admin
Please assist. Thanks.
... View more
Labels
- Labels:
-
field extraction
-
regex
-
rex
01-11-2023
07:09 PM
Hi, have you found solution for this? Im currently facing the same issue. Need to add more information.
... View more
12-12-2022
05:58 PM
1 Karma
Hi, Somehow, resync the KV store doesnt work for me. Ive reached to Splunk support and we had resolved the issue. What we did was: 1. regenerating server.pem file -stop splunk service - go to cd /opt/splunk/etc/auth and rename the server.pem file to server.pemck -start splunk 2. clean the kv store locally (on the problematic instance) - ./splunk stop - ./splunk clean kvstore --local -./splunk start Hope this helps. Thanks.
... View more
12-12-2022
05:51 PM
Hi @richgalloway , yea i did configure from the UI for HEC. And we face an error from Splunk "server are busy". We tried to look at the input.conf and some stanza are missing. We figure out that we need http stanza set the token name. But we dont know the correct format for the stanza. We have look into splunk documentation, somehow it didnt help us. Anyway, did you know the format stanza for it?
... View more
12-08-2022
10:58 PM
Hi, i need help on writing the [http] stanza in inputs.conf for HEC token configuration. Please assist. Thank you.
... View more
Labels
12-08-2022
10:14 PM
Is there any workaround for this issue? Currently im also facing the same issue. Please help.
... View more
11-14-2022
11:51 PM
Hi @yuanliu , thanks for reply. This solution worked. I try to do
... View more
11-14-2022
01:22 AM
Hi peeps,
Need help to do some query. Basically I'm trying to group some of field value in the 'Category' field into new fields call 'newCategory'. Below are the sample of data:
The newCategory field will have the new count for each of the new field value (such as Anonymizers, Gambling, Malicious Site).
Please help.
Thank you.
... View more
10-20-2022
12:38 AM
found the silly mistake... need to rename the _time column | table _time, user, values(accessIP), reason, count | rename user as Username, values(accessIP) as "Access IP", reason as "Reason", _time as Time and it worked.....
... View more
10-20-2022
12:10 AM
Hi,
I need help to fine tuned my SPL Query. _time field is not properly formatted when we configure it in dashboard.
index=sslvpn sourcetype="sslvpnsourcetype" action=failure
| iplocation accessIP
| search Country ="Canada"
| stats values(accessIP), count by user, _time, reason
| eval _time=strftime(_time, "%d/%m/%Y %I:%M:%S %p")
| table _time, user, values(accessIP), reason, count
| rename user as Username, values(accessIP) as "Access IP", reason as "Reason", count as Count
This is the result table(_time column) when running on search and reporting app:
This is the result (_time column) when we configure in dashboard (Dashboard Studio):
Please assist us. Thank you.
... View more
Labels
- Labels:
-
Dashboard Studio
-
panel
10-11-2022
02:30 AM
Hi peeps, I want to join below information result in one table:
1st query index=sslvpn | iplocation src_ip | search Country != Malaysia | eval Country = if(isnull(Country),"unknown",Country) | table _time, user,src_ip,Country,action | rename user as "User ID", src_ip as "Source IP", action as "Status"
2nd query index=sslvpn group_path="ADL" | iplocation accessIP | where Country !="Malaysia" | table _time, user,accessIP,Country,action i try to join this table as below query: index=sslvpn | iplocation src_ip | search Country != Malaysia | eval Country = if(isnull(Country),"unknown",Country) | table _time, user,src_ip,Country,action | append [search index=sslvpn group_path="ADL" | iplocation accessIP | where Country !="Malaysia" | rename accessIP as src_ip] | rename user as "User ID", src_ip as "Source IP" action as "Status"
but the result is not consist of 2nd query information. please help. thankyou.
... View more
Labels
- Labels:
-
using Enterprise Security
10-11-2022
01:31 AM
Hi,
I need help to extract some field from below logs format. (Im so bad at this).
Oct 11 16:06:24 123.12.123.12 SVPN-USR[29489]: {"id":"6767676767","msgid":"6767676767","userInfo":{"userName":"wani","groupId":1519,"groupPath":"/Group ADL/SSAeF","authMethods":""},"clientInfo":{"ip":"123.12.123.12","vip":"123.12.123.12","osType":"WINDOWS","macAddr":"","deviceID":""},"msg":"[accessIP: 123.12.123.129 virtualIP: 123.12.123.12] User wani for session XXXXXXXXXXXX visit ip source ->ip 123.12.123.12 port 10123!","timeStamp":1665475584,"time":"2022-10-11 16:06:24","type":"userlog","logSubType":"access_resource","rcip":"123.12.123.12","actionResult":"success"}
Oct 11 16:06:24 123.12.123.12 SVPN-USR[29489]: {"id":"6767676767","msgid":"6767676767","userInfo":{"userName":"wani","groupId":1477,"groupPath":"/Group ADL/SSADS","authMethods":""},"clientInfo":{"ip":"123.12.123.12","vip":"123.12.123.12","osType":"WINDOWS","macAddr":"","deviceID":""},"msg":"[accessIP: 123.12.123.12 virtualIP: 123.12.123.12] User wani for session XXXXXXXXXXXX visit ip source ->ip 123.12.123.12 port 443!","timeStamp":1665475584,"time":"2022-10-11 16:06:24","type":"userlog","logSubType":"access_resource","rcip":"123.12.123.12","actionResult":"success"}
I want to extract the action result value, for example:
action_result = success
Please help!
... View more
Labels
- Labels:
-
using Splunk Enterprise
09-07-2022
12:04 AM
Hi peeps,
We were fine tuning the Notable Event, and there were fields that were not showing any values. Those fields are the Risk Score, Risk Event and Risk Object. We have configure the value under the Risk Analysis Tab.
Please assist us on this. Thank you.
... View more
Labels
08-23-2022
08:26 PM
Hi peeps,
Need help in extracting some fields;
Sample logs:
Aug 24 09:30:43 101.11.10.01 CEF:0|KasperskyLab|SecurityCenter|13.2.0.1511|GNRL_EV_ATTACK_DETECTED|Network attack detected|4|msg=User: NT AUTHORITY\\SYSTEM (System user)\r\nComponent: Network Threat Protection\r\nResult description: Blocked\r\nName: Scan.Generic.PortScan.TCP\r\nObject: TCP from 101.11.10.01 at 101.11.10.01:25\r\nObject type: Network packet\r\nObject name: TCP from 101.11.10.01 at 101.11.10.01\r\nAdditional: 101.11.10.01\r\nDatabase release date: 23/8/2022 12:26:00 PM rt=1661304218000 cs9=Workstation cs9Label=GroupName dhost=082HALIM141 dst=101.11.10.01 cs2=KES cs2Label=ProductName cs3=11.0.0.0 cs3Label=ProductVersion cs10=Network Threat Protection cs10Label=TaskName cs1=Scan.Generic.PortScan.TCP cs1Label=AttackName cs6=TCP cs6Label=AttackedProtocol cs4=2887053442 cs4Label=AttackerIPv4 cs7=25 cs7Label=AttackedPort cs8=2887125841 cs8Label=AttackedIP
Aug 24 09:30:43 101.11.10.01 CEF:0|KasperskyLab|SecurityCenter|13.2.0.1511|GNRL_EV_ATTACK_DETECTED|Network attack detected|4|msg=User: NT AUTHORITY\\SYSTEM (System user)\r\nComponent: Network Threat Protection\r\nResult description: Blocked\r\nName: Scan.Generic.PortScan.TCP\r\nObject: TCP from 101.11.10.01 at 101.11.10.01:42666\r\nObject type: Network packet\r\nObject name: TCP from 101.11.10.01 at 101.11.10.01:42666\r\nAdditional: 101.11.10.01\r\nDatabase release date: 23/8/2022 12:26:00 PM rt=1661304218000 cs9=Workstation cs9Label=GroupName dhost=082HALIM141 dst=101.11.10.01 cs2=KES cs2Label=ProductName cs3=11.0.0.0 cs3Label=ProductVersion cs10=Network Threat Protection cs10Label=TaskName cs1=Scan.Generic.PortScan.TCP cs1Label=AttackName cs6=TCP cs6Label=AttackedProtocol cs4=2887053442 cs4Label=AttackerIPv4 cs7=42666 cs7Label=AttackedPort cs8=2887125841 cs8Label=AttackedIP
I need help to extract the underline value for fields name TCP.
Sample:
TCP=101.11.10.01
Please help. Thanks.
... View more
Labels
- Labels:
-
using Splunk Enterprise
06-21-2022
12:49 AM
Hi @isoutamo, Thanks for replying. Our current environment is multisite indexer cluster environment and we will plan to decommission the system with hardware. Our target environment is also multisite indexer cluster with new hardware. We are not replacing the new environment, we are migration to new environment. We are planning to cutover to the new cluster approcahes. We are using the same OS and the splunk version will be from 8.2 to 8.3 We are going for online migration and we dont have a specific time period. Thank you.
... View more
06-21-2022
12:27 AM
1 Karma
Hi peeps, I need some information about migrating data from an instance in a cluster environment to a new cluster environment. I was unable to find documentation about this process, so I would like to get some advice or pros/cons details from the experts. Please help. Thank you.
... View more
Labels
- Labels:
-
configuration
-
installation
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
a week ago
|
Karma given to
