About garima_chauhan

garima_chauhan · ‎04-30-2014

Hi, The alert configuration changes do not get reflected on the console but the changes are applied and refect in the savedsearches.conf of each category of correlation rules, viz Access Protection, Endpoint and so on. Also, if changes are required to be reflected on the console, uncheck the "summary indexing" option which is displayed when these rules are opened through Manager>>Searches and Reports. I am not sure as to what impact will the unchecking have, but since I have scheduled most of these searches to run over short time periods, I am hoping that unchecking summary indexing will not impact my environment.

garima_chauhan · ‎04-29-2014

Hi, I am using Splunk v 5.0.5 with ES App 2.4.1. There are some correlation rules whose results show only timestamp as an event. When I click on create a report, a count field comes up but as such there is no other information. Some such correlation rules are Watchlisted Events,Personally Identifiable Information Detected. Please suggest as to what exactly is happening when these searches run.

garima_chauhan · ‎04-22-2014

Hi, I want to change the Alert condition of the correlation rules in ES APP. I am using ES App v 2.4.1 and Splunk v 5.0.5. If I open the correlation rule through Enterprise Security>>Configure>>Correlation Searches, I do not get many options like Alert condition, Expiration Time. However, these fileds are accesible if I open the same correaltion rule from core splunk>>Manager>>Searches and Reports. But, when I make any changes to these paramters through core splunk manager, the changes do not reflect even though it shows me "the search has been updated" message. I want the alert condition to be in accordance with the "No of events" option. Also I want to remove throttling since I have scheduled all the correlation rules in the ES APP and hence throttling isn't required. I am not sure how this can be done. Please help and correct me if I am wrong in my understanding of this. Thanks in anticipation.

garima_chauhan · ‎02-27-2014

Hi, I am using cluster set up with all instances of Splunk v5.0.5. I wanted to know what happens if the master goes down. The following link explains that the peers and search head will continue to work without any problem. A problem would only occur if one of the peers also goes down, in which case a standby master node can be of help. http://docs.splunk.com/Documentation/Splunk/5.0.5/Indexer/Whathappenswhenamasternodegoesdown I have a few questions, in the event that master node goes down: Is there any explicit time for which the peers and search head continue to work properly if all these are up and working. What else, apart from one of the peers going down, would arouse the need of a stand by cluster master? Please confirm if my understanding is correct. Also, do answer my queries. Any help would be appreciated.

garima_chauhan · ‎02-14-2014

Hi, removing count from search is not the problem. I am able to do that by using | table User Host LastLoginTime. My problem is that I want the report(graph) based on time without count being displayed in that. Right now, when I generate a report on the search, it gives me user on one axis and count on another and the chart is blank since I have not used it with table.

garima_chauhan · ‎02-14-2014

Hi, I have a search which displays the last login made by a user on several hosts. I want to generate a report on this search but don't want to use count as the parameter. I am able to create the report by using count but it is meaningless to include count here. I have tried | xyseries User Host LastLoginTime but it also does not give me the desired output in the form of a graph. I want to display the User,Host and LastLogintime in the report. How can I make the report meaningful without using count? I want the report to be a graph. Please suggest.

garima_chauhan · ‎02-13-2014

I do not know what the issue was, but now I am able to see an entry like: Accepted password for username in the logs. Thanks.

garima_chauhan · ‎02-13-2014

Hi, I want to create a query displaying successful logins in Linux. I have /var/log/secure logs but I cannot find anything like login,authentication successful or any other related keyword in these logs. I tried with the wtmp logs as well but I will have to provide a script in that case. My linux box does not have auth.log. Please suggest as to which log file shall I monitoror if there is an easier way of monitoring the wtmp logs in readable format.

garima_chauhan · ‎02-06-2014

Hi, Still didnt work..:( I copied this exact regex.

garima_chauhan · ‎02-05-2014

Hi, I tried the following search: source=FirewallLogs | rex "^(? [^s]+)?(s)(? [^s]+)?(s)(? [^s]+)?(s)(? [^s]+)?(s)(? [^s]+)?(s)(? [^s]+)?(s)(? [^s]+)?(s)(? [^s]+)?(s)(? [^s]+)?(s)(? [^s]+)?(s)(? [^s]+)?(s)(? [^s]+)?(s)(? [^s]+)?(s)(? [^s]+)?(s)(? [^s]+)?(s)*" | table field1 field2 but, nothing gets displayed.

garima_chauhan · ‎02-05-2014

Hi gfuente, My log file looks like: 7 123456 1.1.1.1 sfgdfghdghgdh 25 6 2.2.2.2 5255225 3.3.3.3 80 1 1 0 sdgzdfsg 7 456789 1.1.1.1 fsdfgsfgsfgfv 52 6 3.3.3.3 4654646 5.5.5.5 4564 2 2 2 pathoffile ssdfgsfg 7 123456 1.1.1.1 sfgdfghdghgdh 25 6 2.2.2.2 5255225 3.3.3.3 80 1 1 0 pathoffilevzfsgfgjsdlgjlsggflkgj sdgzdfsg I am guessing that the column number discrepancy is due to the fact that if one column value is blank, it is not left blank and is instead populated with the next column value. In any case, I do not how how to tackle this. Please help.

garima_chauhan · ‎02-05-2014

Hi, I have Host Firewall Logs coming in a text file. The data in the text file is separated by spaces and is inconsistent as for some rows there are say 8 columns, in some there are fewer and in some greater than 8 columns. I want to perform filed extraction on this data. How can this be achieved? I am familiar with csv field extraction but there the data is not inconsistent as is the case with this text file. I am using Splunk v5.0.5. Please help. Its quite urgent. Any help would be really appreciated.

garima_chauhan · ‎01-31-2014

Path is spunk\etc\master-apps_cluster\local and _cluster is missing in peers.

garima_chauhan · ‎01-31-2014

Hi, I am facing problems while editing and re-enforcing the indexes.conf from master. I edited the indexes.conf in Splunk\etc\master-apps\local and applied it to the peers by using the cluster-bundle command. However, on doing so the default and local folders under slave-apps on peers got deleted. I want to know the correct way of doing this, as in how and in which sequence to stop the master, peers, search head, in order to apply the edited indexes.conf successfully. I am using all Splunk instances of v5.0.5 Please respond.

garima_chauhan · ‎01-31-2014

Thanks Steve G. It turns out that the indexing errors that I was recieving were due to wrong configuration of archival policy.

garima_chauhan · ‎01-27-2014

Hi, I have set up a clustered environment for testing purpose. The cluster comprises of 2 peers, a search head, a master node and a universal forwarder. All components are Splunk v5.0.5. I have set both the search factor and replication factor 2. I want to archive the data on each of the peers. When I push the common indexes.conf from the master node, I get indexing errors and the configuration does not work. If, I need to archive the data from both the peers, do I need to have a separate indexes.conf for each peer? Thanks in anticipation. Please respond.

garima_chauhan · ‎01-02-2014

I added the line signtool --sign destdir as the last line of the script and even before the copy line, but it did not work. The script doesnt run. If I remove the signtool line, it works fine. Please help

garima_chauhan · ‎01-02-2014

Hi, I am using a script for archiving logs from colddb to a desired location. I have used the coldToFrozenExample.py script and basically just changed the archived location. The script works fine. However, since I intend to sign the bucket before archiving, I used the signtool -s ARCHIVE_DIR line in the script just before the bucket was to be copied to the location(as stated in the documentation). But, on doing so, the script doesnt work. Could it be the placement of signtool command? If so, please specify the exact location, as to where it should be placed. I am not familiar with python and hence, not able to spot the location. Any help would be appreciated. Thanks in advance.

garima_chauhan · ‎12-25-2013

Hi, I wanted to know that, if splunk Universal forwarder service is stopped for some time and then started again. When it starts forwarding the data again, does it forward the data from the time when it was stopped? More specifically, how many days' data would the universal forwarder forward,once its service is started again,if the service was stopped for a longer duration, say 10 days or so?

garima_chauhan · ‎11-21-2013

Thanks jtacy. I am able to see the metrics.log as you mentioned.

Posts	29
Solutions	0
Karma Given	7
Karma Received	2
Member Since	‎11-05-2013

Online Status	Offline
Date Last Visited	‎06-05-2020 02:03 AM

Correlation Rules in ES App

Changing configuration in ES App Correlation Rules

Cluster Master

Report generation without using count

Linux Successful Login

Filed Extraction on Text File

Editing the common Indexes.conf in a cluster

Data Archival-Clustered environment

Archive Signing

Splunk Universal Forwarder

Re: Changing configuration in ES App Correlation R...

Correlation Rules in ES App

Changing configuration in ES App Correlation Rules

Cluster Master

Re: Report generation without using count

Report generation without using count

Re: Linux Successful Login

Linux Successful Login

Re: Filed Extraction on Text File

Re: Filed Extraction on Text File

Re: Filed Extraction on Text File

Filed Extraction on Text File

Re: Editing the common Indexes.conf in a cluster

Editing the common Indexes.conf in a cluster

Re: Data Archival-Clustered environment

Data Archival-Clustered environment

Re: Archive Signing

Archive Signing

Splunk Universal Forwarder

Re: SSL connection between Indexer and Forwarder