Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About arkonner
arkonner
Path Finder
Member since:
03-26-2015
06-05-2020
Community Statistics
| Posts | 53 |
| Solutions | 0 |
| Karma Given | 0 |
| Karma Received | 5 |
| Member Since | 03-26-2015 |
Activity Feed
- Got Karma for How to Sort the "count by..." results. 06-05-2020 12:48 AM
- Got Karma for How to monitor Splunk 6.4 performance?. 06-05-2020 12:48 AM
- Got Karma for Event type disabled. 06-05-2020 12:48 AM
- Got Karma for Re: How to embed an image in a simple XML dashboard with HTML?. 06-05-2020 12:47 AM
- Got Karma for Re: How to embed an image in a simple XML dashboard with HTML?. 06-05-2020 12:47 AM
- Posted Using Maps+ for Splunk, how do you define a drill down? on All Apps and Add-ons. 09-19-2018 12:56 AM
- Posted How do you dynamically pass parameters over two dashboards? on Dashboards & Visualizations. 09-12-2018 06:12 AM
- Tagged How do you dynamically pass parameters over two dashboards? on Dashboards & Visualizations. 09-12-2018 06:12 AM
- Posted Re: Multiple lines in a CSV being combined into a single event on Getting Data In. 05-28-2018 12:52 AM
- Posted FireEye Error on All Apps and Add-ons. 05-18-2018 02:02 AM
- Posted Syslog data with SSL enabled on Getting Data In. 04-18-2018 06:51 AM
- Tagged Syslog data with SSL enabled on Getting Data In. 04-18-2018 06:51 AM
- Posted How to update input on Universal Forwarder using deployment server on Getting Data In. 03-22-2017 01:21 PM
- Tagged How to update input on Universal Forwarder using deployment server on Getting Data In. 03-22-2017 01:21 PM
- Tagged How to update input on Universal Forwarder using deployment server on Getting Data In. 03-22-2017 01:21 PM
- Posted Re: Add Picture to Dashboard on Dashboards & Visualizations. 02-09-2017 07:34 AM
- Posted Re: How to embed an image in a simple XML dashboard with HTML? on Dashboards & Visualizations. 01-11-2017 11:25 AM
- Posted Is it possible to display a JPG or BMP in a dashboard panel? on Dashboards & Visualizations. 01-09-2017 11:06 AM
- Tagged Is it possible to display a JPG or BMP in a dashboard panel? on Dashboards & Visualizations. 01-09-2017 11:06 AM
- Posted Re: Dedup by time on Alerting. 12-13-2016 02:00 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
09-19-2018
12:56 AM
Using a latitude & longitude on the map, I can see the corresponding location. For each location, it should be possible to link that on different dashboards like:
Rome ---> Rome Dashboard
London -> London Dashboard
... View more
09-12-2018
06:12 AM
I defined a lookup file with
Country Router lat lon Name Town
EG AA368Z 30.0771 31.2859 Egypt Cairo
.
.
.
With a search using a geostat command, I show the various router on the map (dashboard1)
On the map selecting the "dot" corresponding to one specific location, I was looking to pass this parameter to another dashboard.
That way, I could run searches only for the selected router/country.
Any help will be useful
... View more
05-28-2018
12:52 AM
Presently I have the same problem but what I looking for is only to recognize the CR as new event in files with the structure below, because the data extraction allow only two conditions [space and comma]
05/25/2018 15:21:55,INFO,10.3.140.197,j.brown,User logged in
05/25/2018 15:29:36,INFO,10.3.7.254,j.smith,User logged in
05/25/2018 15:29:59,INFO,10.3.7.254,j.smith,Temp Token Request
05/25/2018 15:29:59,INFO,,j.smith,Message sent:Backup Token Assigned
05/25/2018 15:33:12,INFO,10.3.7.254,j.smith,User logged in
05/25/2018 17:25:58,INFO,10.3.7.254,j.smith,User logged in
05/25/2018 17:26:23,ERROR,10.3.7.254,j.smith,Smart Token Request
05/25/2018 17:26:23,INFO,,j.smith,Message sent:Smart Token Request Failed
05/25/2018 17:27:10,ERROR,10.3.7.254,j.smith,Smart Token Request
05/25/2018 17:27:10,INFO,,j.smith,Message sent:Smart Token Request Failed
... View more
05-18-2018
02:02 AM
During the splunk server restart and written into _internal index the error reported below is displayed - seems to be introduced by the default configuration on which the app is provided.
Well, any help you that you could give us to solve the error would be appreaciated.
index=_internal eventtype="splunkd-log" log_level=ERROR
05-17-2018 19:07:52.840 +0200 ERROR SearchOperator:kv - Cannot compile RE \"[\w-.]{1,30})\"\s*(sid=\"(?\d*)")?\s*(stype=\"(?[\w-]{1,30})\")?\" for transform 'EXTRACT-malware-info_for_fireeye': Regex: invalid range in character class
... View more
04-18-2018
06:51 AM
To enforce security should be possible to configure a syslog listener with SSL enabled
... View more
03-22-2017
01:21 PM
Presently, I configured a deployment server - the deploymentclient.conf is present on each server - Should be possible to update the input.conf file content - like a new index name or a new eventid in the white list using the deployment server?
... View more
01-11-2017
11:25 AM
2 Karma
In order to display a static image on a dashboard I created the images directory on the path below -
C:\Program Files\Splunk\etc\apps\search\appserver\static\images\
The dashboard with the embedded images have the following source:
Roberto Test
See if html panels work
<html>
<h1>HTML Panel Example</h1>
<p>The HTML panel displays inline HTML.</p>
<pre><img src="/static/app/search/images/pretty1.jpg"/></pre>
</html>
</row>
<row>
<html>
<h1>HTML Panel Example</h1>
<p>The HTML panel displays inline HTML.</p>
<pre><img src="/static/app/search/images/pretty2.jpg"/></pre>
</html>
</row>
Was very useful to install the Dashboard 6.x examples app -
... View more
01-09-2017
11:06 AM
As a search output, I have the eventid and the relative users including a unique numeric id - in addition I have the unique numeric id as jpg name in a shared folder
eventid 1234 user s.brown \shared folder\s.bown.jpg or \shared folder\s.brown.bmp
Should be possible to display the events the users and the images in a dashboard panel?
... View more
12-13-2016
02:00 AM
The same event has been recorded by more than one domain controller - " count by Account_Name" is showing two events coming from server1 and server2 - in closing time - I am looking to eliminate the duplication if this append in a 5/10 sec time windows - If the same user i still strying to perform a login the new account_locked out will appear.
... View more
12-12-2016
08:12 AM
I am using the search below to determine the account locked out - It works fine but as result I received more than a single account locked-out events from at list two domain controllers between 2 seconds - Should be possible to use a dedup by time to avoid the same status over 5/10 seconds.
index=wineventlog source="WinEventLog:Security" sourcetype="WinEventLog:Security" Account_Name="*" EventCode=4740 OR EventCode=644 AND Account_Name!=Guest AND Account_Name!=Anonymous | eval Account_Name = mvindex(Account_Name,1) | eval Security_ID = mvindex(Security_ID,1) | timechart span=1h limit=20 useother=f count by Account_Name
... View more
12-12-2016
12:31 AM
I uninstalled the universal forwarder due to a security policy that blocks files modification by a user or program running without admin rights - However, I was not aware about it - thank you for your reply.
... View more
12-09-2016
05:25 AM
I am monitoring the directory where IIS logs are stored. The universal forwarder is sending the information on a dedicated index.
To upgrade the universal forwarder, I saved the customization files then I uninstalled the previous version. Then I installed the latest version copying the customization.
As result the universal forwarder re-indexed all files in the logs directory introducing a license violation.
Is it possible to avoid this behaviour saving the previous status of the indexed logs?
... View more
10-11-2016
02:40 AM
In order to improve the Splunk performance in a single server installation I added a search head - The new server is now also a master licensing server and the previous one is configured as slave -
Should be possible to move from the old index server to the new search head the alerts generation or is a role/function that runs only on the index server.
... View more
10-08-2016
12:57 PM
Presently I have a master server with the indexes plus a search head just installed with demo version - I am planning to copy the lic file from the master to the new search head - then I will configure the master as slave server - On the search head using the GUI I will configure this server as part of "enterprice" copying the server.cfg and the lic file - Sounds good?
... View more
09-01-2016
05:01 AM
This is exactly what I am looking for -
In the example under session opsecparsing] the Regex command allows only drop, reject and block - The regex should accept a command to exclude all different by "accept" like REGEX =! (accept)
[opsecparsing]
REGEX = (drop|reject|block)
props.conf
[opsec]
TRANSFORMS-drops = opsecnull, opsecparsing
#transforms.conf
[opsecnull]
REGEX = .
DEST_KEY = queue
FORMAT = nullQueue
[opsecparsing]
REGEX = (drop|reject|block)
DEST_KEY = queue
FORMAT = indexQueue
... View more
09-01-2016
01:36 AM
I have a checkpoint cluster configuration with a single management workstation - Installing the Add-on to establish the connection I got a huge volume of data - Should be possible to "filter" the checkpoint events in order to reduce it.
... View more
08-18-2016
08:23 AM
1 Karma
On the various dashboards created after the upgrade of the last Splunk Enterprice version (6.4.2) a yellow triangle is now present.
Selecting it a pop-up appear saying "Evernttype 'wineventlog-dns" disabled or does not exist.
How can disabled it and find what introduced it
... View more
08-11-2016
03:03 AM
with the search below I identify the account locked-out - I am using "column chart" output and under visualization format there is no limit but as result only ten Account names are displayed. I have no idea where this limit has been introduced and I need to display all Account locked-out
Thank you in advance for the attention given
index=wineventlog source="WinEventLog:Security" sourcetype="WinEventLog:Security" Account_Name="*" EventCode=4740 OR EventCode=644 AND Account_Name!=Guest AND Account_Name!=Administrator AND Account_Name!=Anonymous | eval Account_Name = mvindex(Account_Name,1) | eval Security_ID = mvindex(Security_ID,1) | timechart span=1h useother=f count by Account_Name
... View more
08-01-2016
01:14 PM
Hi, I am trying to explain myself better - In the raw data I have for a single event as Account_Name the userid and the DCx$
Account_Name = DC1$ Account_Name J.smith EventCode 4740
Account_Name = DC1$ Account_Name p.brown EventCode 4740
Account_Name = DC2$ Account_Name p.brown EventCode 4740
as search result using stats by Account Name
DC1$ = 2
J.smith = 1
DC2$ = 1
p.brown = 2
What I'm looking for :
j.smith = 1
p.brown = 2
Thank you in advance for the attention given
... View more
08-01-2016
05:43 AM
All domain controllers are sending the event code 644 & 4740 to windowseventlog index.
Using the search below I am able to determine the accounts locked out - As result the search provide the account name locked-out
As account name I have the DomainController$ and users name - I can't use =!DomainControler$ to display only the user name because also the users name related will be omitted -
index=wineventlog source="WinEventLog:Security" sourcetype="WinEventLog:Security" Account_Name="*" EventCode=4740 OR EventCode=644 AND Account_Name!=Guest AND Account_Name!=Administrator AND Account_Name!=Anonymous | timechart span=1h count by Account_Name
... View more
06-08-2016
08:14 AM
Thank you for your quick reply -
... View more
06-08-2016
05:02 AM
Is it possible to find out which new features have been introduced by Splunk 6.4.1 from Splunk 6.4?
... View more
Labels
- Labels:
-
upgrade
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:03 AM
|
