About Spelunke

Spelunke · ‎02-27-2012

Do you have setup an data input for syslog (udp(514)?

Spelunke · ‎02-25-2012

To answer my own question: According to a Splunk guy it’s not possible to lookup the GUID internally. I build a external lookup table to do that.

Spelunke · ‎02-25-2012

You can also check the current network connections with "netstat" and "netstat -a". Maybe you can detect something unusal.

Spelunke · ‎02-23-2012

no, it cant't the grabber runs under X only

Spelunke · ‎01-04-2012

I'm unable to find the right paramter till now. geoip still stops working after around 20k events and 12 seconds.

Spelunke · ‎01-04-2012

Spamming for your own software?

Spelunke · ‎01-04-2012

good point, but which limit to change?

Spelunke · ‎01-03-2012

I play around with some larger firewall logs and observe the same behavior. geoip stops always after approximately 20000 events. I will do some further testing later.

Spelunke · ‎01-03-2012

Any firewall between forwarder and splunk server?

Spelunke · ‎01-03-2012

using version 4.2.5, build 113966

Spelunke · ‎01-03-2012

I also observe this behavior with some apps from splunkbase: First setup fails, later it works… So it looks like a more general issue?

Spelunke · ‎01-02-2012

The argument to geoip must be the IP you want to lookup. For example: * | geoip src where src is the field containing the IP.

Spelunke · ‎01-02-2012

nfdump supports NetFlow v5, v7, and v9.

Spelunke · ‎01-02-2012

Please check with wireshark or tcpdump if you can see any flows on the server.

Spelunke · ‎01-02-2012

Can you test the flow collection with nfdump from the command line?

Spelunke · ‎01-02-2012

In license_usage.log the indexers appears as a kind of hash value (i=...): 01-02-2012 16:56:16.516 +0100 INFO LicenseUsage - type=Usage s="udp:514" st="cisco_asa" h="172.16.22.7" o="" i="821C72AB-3C16-4124-B278-6C02F448DC22" pool="mypool" b=17906 poolsz=100000 For reporting I want to look up the real names of the indexers. Is there an internal lookup table for doing this? Update: This field is the GUID of the system. But how to lookup the system name?

Spelunke · ‎01-01-2012

You don't have to add the firewalls to the app. Just send the logs from the firewalls to your Splunk server.

Posts	17
Solutions	0
Karma Given	6
Karma Received	4
Member Since	‎11-24-2011

Online Status	Offline
Date Last Visited	‎06-05-2020 02:03 AM

Decode indexer name hashes (GUID) from license_us...

Re: How to get Cisco App working

Re: Decode indexer name hashes (GUID) from licens...

Re: winsock error 10055

Re: does the OPSEC LEA App work on Windows?

Re: geoip search results not correct

Re: What can we do when forgot/lost WIndows admin ...

Re: GEOIP Only displaying 10000 results on a map

Re: geoip search results not correct

Re: New Splunk Installation Not Recieving Logs

Re: App Development - Setup.xml not found

Re: App Development - Setup.xml not found

Re: geoip search results not correct

Re: NetFlow version, performance

Re: Netflow app not retrieving any data

Re: splunk netflow problem

Decode indexer name hashes (GUID) from license_us...

Re: Multiple Cisco ASA's on the Cisco Security Sui...