About Ismail_BSA

Ismail_BSA · ‎10-03-2024

Hi @gcusello Thank you for replying on this post. I am also interested on detecting SQL injections. However, the first two links seems to be outdated and no longer referring to SQL injections subject. https://answers.splunk.com/app/questions/1528.html http://blogs.splunk.com/2013/05/15/sql-injection/ Could you please update them ?

Ismail_BSA · ‎05-16-2024

Hi @gcusello Thank you for your reply. That's exactly what we are doing now for searches. However, we were wondering if these fields could be directly calculated in the sourcetype. The final goal is to have those new fields in a data model and later call them in the correlation seraches and notable events. Regards,

Ismail_BSA · ‎05-15-2024

Hi, We are using Splunk Cloud, so we can't access the conf files. In one of our custom source types, we need to create multiple new fields. Those fields are calculated recursevaly meaning Eval2 calls result of Eval1, then Eval3 calls results of Eval 2.... Here are some examples of our Eval fields EVAL-url_primaire_apache=if(match(url, "/"), mvindex(split(url, "/"), 0), url) ```if there is a (/) caracter, we only keep the first part before the first (/), if not, we use the full url field``` EVAL-url_primaire_apache_sans_ports=if(match(url_primaire_apache, ":"), mvindex(split(url_primaire_apache, ":"), 0), url_primaire_apache) ```We use the result from the previous Eval to extract only the first part before ":" or the full previous result``` Now the issue is that only the first field is generated. I think that might be fine since Evals are done in parallel. I tried to create an alias on the result of the first Eval and then call it in the second Eval like this: FIELDALIAS-url_primaire_apache_alias1=url_primaire_apache AS url_p_a EVAL-url_primaire_apache_sans_ports=if(match(url_p_a, ":"), mvindex(split(url_p_a, ":"), 0), url_p_a) However, this still doesn't work since only the first Eval field is created. Neither the alias nor the second Eval are created. What am I missing? How can we create Eval fields recursively?

Ismail_BSA · ‎04-29-2024

Hi @SanjayReddy Thank you for your reply. Unfortunatelly, this is not working since your proposed commend will display the same fields as in the menu Fields>calculated fields. I think the issue is more related to the authorisations. I am 100% sure that I allowed my role to read/write the newly created varaible. But I can't find it. Regards.

Ismail_BSA · ‎04-26-2024

Hello, I recently encountered an issue with Splunk Cloud. After creating a new eval in the "Fields" menu under "calculated fields," named 'src' for the source type "my_source_type," I adjusted the permissions to make it readable and writable for my role, with app permissions set to all apps. However, upon saving these permissions, the eval disappeared, and I couldn't locate it anywhere. Thinking it might not have saved properly, I attempted to recreate it with the same name and source type. However, when I tried to adjust the permissions, I received a red error banner stating: "Splunk could not update permissions for resource data/props/calcfields [HTTP 409] [{'type': 'ERROR', 'code': None, 'text': 'Cannot overwrite existing app object'}]" Any recommendations on where I should search to locate the initially created eval that seems to have gone missing? Thank you.

Ismail_BSA · ‎04-26-2024

I am also interested by this question

Ismail_BSA · ‎03-05-2024

Thank you @tscroggins

Ismail_BSA · ‎03-05-2024

Server C is SUSE 15

Ismail_BSA · ‎03-04-2024

Hello @tscroggins Thank you for your follow up. However, I am not sure that we can apply this solution to our environment since our Server C (the one with the universal forwarder) is not a Windows server . The other servers (type A and B) are not connected to any external networks. After some internal discussions, a new idea was proposed and I am not sure if it could work, @tscroggins , @isoutamo , @scelikok I appreciate if you share your feed backs about it. The idea is to deploy a heavy forwarder on server B and a Universal forwarder on server C (the one connected to Splunk cloud) Servers A (DB server): Our databases generate SQLAudit files (and probably some Oracle DB audit files from similar servers). No external connections are allowed to these category of servers. Server B (Relay): This is the only server that can establish communications with the DB servers (category A). On this server, we can install a havy forwarder + DB connect to collect MSsql audit logs ( and Oracle audit logs from oracle servers). Please note that there are no external connections to this server and it cannot directly forwarder to Splunk Cloud. Server C (Universal Forwarder): The only one with allowed external connections. Havy forwarder on server B sends the collected logs to the universal forwarder on server C. The Universal forwarder then uploads the SQLAudit files and oracle audit files to the Splunk Cloud instance. Do you think that this is a feasable set up ? Best regards,

Ismail_BSA · ‎03-01-2024

Hi @scelikok Thank you for your reply. We will test this option and see if works. Best regards.

Ismail_BSA · ‎02-27-2024

Hello, In our unique environment, we face some limitations. We cannot directly install Splunk forwarders on the database servers, nor can we create a Splunk user account within the databases. Here’s the situation: Server A (DB server): Our databases generate SQLAudit files. Server B (Relay): These SQLAudit files are transmitted from server A to a different 'relay' server (let’s call it Server B). Unfortunately, Server B also cannot accommodate Splunk forwarders. Server C (Universal Forwarder): From Server B, the audit files are further transmitted to another server (Server C). On Server C, we have a Splunk Universal forwarder that should upload the SQLAudit files to our Splunk Cloud instance. The challenge lies in the fact that SQLAudit files are in a native format that Splunk cannot directly interpret. While the ideal solution would be to install forwarders directly on the original DB servers (which is not feasible for us), we also recognize that using DB connect and creating a Splunk account on the DB is not an option. Given these constraints, are there any other viable options we can explore? Best regards,

Ismail_BSA · ‎08-10-2023

By checking the index="_internal" I found some errors related to my files that are not being uploded, here is an example -0400 ERROR TailReader [3438 tailreader0] - File will not be read, is too small to match seekptr checksum (file=/file path/). Last time we saw this initcrc, filename was different. You may wish to use larger initCrcLen for this sourcetype, or a CRC salt on this source. Consult the documentation or file a support case online at http://www.splunk.com/page/submit_issue for more info. I found this other question that seems simlar to my issue Solved: How do you fix this? ERROR TailingProcessor - File... - Splunk Community and the resolution was to increase the initCrcLength value More details could be found on the official doc: inputs.conf - Splunk Documentation Thank you

Ismail_BSA · ‎08-10-2023

Hi @gcusello I already deleted the .swp files. The new files (.xml) are still not being uploaded

Ismail_BSA · ‎08-10-2023

Hi @gcusello The issue is that splunk is not Uploading my files but only uploading the .swp files (that are autocreated temporelly when I open the files with Vim command). Are you seure that there isn't any other copy of the file, eventually with a different name?: The files are recent, I created them my self and I am sure they are not duplicated. I also tried to copy the entire folder /DATA/remotelogs-ORACLE-MESS/test/ to a new one /DATA/remotelogs-ORACLE-MESS/NEWtest/ and I created a new monitor Stanza but did not resolve my issue (no files are being uploded from the new folder) [monitor:///DATA/remotelogs-ORACLE-MESS/NEWtest/*] index=test_bd_oracle sourcetype=test_oracle:audit:xml host_segment = 3 I also made sure to restart the Splunk Forwarder on my server.

Ismail_BSA · ‎08-10-2023

Hi @scelikok Thank you for your reply. However, I checked all monitor stanzas and they are not hitting the same path, I also renamed the original folder to "test" just to be sure it's unique and not interfearing with other paths.

Ismail_BSA · ‎08-10-2023

Hi, I have an issue where my UF installed on a linux server is not uploading data to Splunk from a specific folder. My inputs.conf file contains multiple simliar set ups for several folders to be uploaded. Everything is working perfectly except for one folder. In the inputs.conf file, I have the following set up for this folder: [monitor:///DATA/remotelogs-ORACLE-MESS/test/*] index=test_bd_oracle sourcetype=test_oracle:audit:xml host_segment = 3 This set up is to upload all files under path /DATA/remotelogs-ORACLE-MESS/test/ However, no files are being uploaded. What is also wierd is that when I open one of those files using the Linux Vim command, a temporary copy of that file is autocreated with extension .swp and the UF UPLOADS the .swp file. Any help is appreciated. Thank you.

Posts	16
Solutions	1
Karma Given	3
Karma Received	0
Member Since	‎10-18-2022

Online Status	Offline
Date Last Visited	‎10-03-2024 03:44 PM

How to use Eval recursively?

Difficulty Locating Newly Added Calculated Field (...

uploading sqlaudit files into Splunk

Issue with UF not uploading files from a specific ...

Re: How to find SQL Injection activity or OWASP at...

Re: How to use Eval recursively?

How to use Eval recursively?

Re: Difficulty Locating Newly Added Calculated Fie...

Difficulty Locating Newly Added Calculated Field (...

Re: how to customize the mltk model predefined in ...

Re: uploading sqlaudit files into Splunk

Re: uploading sqlaudit files into Splunk

Re: uploading sqlaudit files into Splunk

Re: uploading sqlaudit files into Splunk

uploading sqlaudit files into Splunk

Re: Issue with UF not uploading files from a speci...

Re: Issue with UF not uploading files from a speci...

Re: Issue with UF not uploading files from a speci...

Re: Issue with UF not uploading files from a speci...

Issue with UF not uploading files from a specific ...

Are you a member of the Splunk Community?