Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About Jamaal
Jamaal
Engager
Member since:
04-14-2017
06-05-2020
Community Statistics
| Posts | 6 |
| Solutions | 0 |
| Karma Given | 1 |
| Karma Received | 0 |
| Member Since | 04-14-2017 |
Activity Feed
- Karma Re: PDF chart does not display statistics correctly for aaraneta_splunk. 06-05-2020 12:46 AM
- Posted Re: Can I use Eval to correlate two serial logs that have specific fields? on Splunk Search. 08-23-2017 01:53 PM
- Posted Re: Can I use Eval to correlate two serial logs that have specific fields? on Splunk Search. 08-23-2017 12:00 PM
- Posted Re: Can I use Eval to correlate two serial logs that have specific fields? on Splunk Search. 08-22-2017 08:35 AM
- Posted Can I use Eval to correlate two serial logs that have specific fields? on Splunk Search. 08-22-2017 08:31 AM
- Tagged Can I use Eval to correlate two serial logs that have specific fields? on Splunk Search. 08-22-2017 08:31 AM
- Tagged Can I use Eval to correlate two serial logs that have specific fields? on Splunk Search. 08-22-2017 08:31 AM
- Tagged Can I use Eval to correlate two serial logs that have specific fields? on Splunk Search. 08-22-2017 08:31 AM
- Tagged Can I use Eval to correlate two serial logs that have specific fields? on Splunk Search. 08-22-2017 08:31 AM
- Tagged Can I use Eval to correlate two serial logs that have specific fields? on Splunk Search. 08-22-2017 08:31 AM
- Posted Re: PDF chart does not display statistics correctly on Reporting. 05-08-2017 10:14 AM
- Posted Why do I receive error "Search process did not exit cleanly, exit_code=255, description="exited with code 255"" and how to resolve it? on Deployment Architecture. 04-14-2017 09:51 AM
- Tagged Why do I receive error "Search process did not exit cleanly, exit_code=255, description="exited with code 255"" and how to resolve it? on Deployment Architecture. 04-14-2017 09:51 AM
- Tagged Why do I receive error "Search process did not exit cleanly, exit_code=255, description="exited with code 255"" and how to resolve it? on Deployment Architecture. 04-14-2017 09:51 AM
- Tagged Why do I receive error "Search process did not exit cleanly, exit_code=255, description="exited with code 255"" and how to resolve it? on Deployment Architecture. 04-14-2017 09:51 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 |
08-23-2017
01:53 PM
DalJeanis,
So re-reading your response, sounds like the logs would need to have a common field of some sort. Here is the raw log:
2017-08-22 00:01:03.624; [00000C3C] {125} username has successfully authenticated via Password
2017-08-22 00:01:03.610; [00000C3C] {121} username tries Password authentication
2017-08-22 00:01:03.376; [00000C3C] {110} enforcing anti-hammering delay [0.20 secs]
2017-08-22 00:01:03.288; [00000C3C] {120} username requests Password authentication
2017-08-22 00:01:02.207; [000009A8] {000} * x.x.x.x -> 1 active connections
2017-08-22 00:01:02.207; [000009A8] {109} List of currently connected IP and count of per-IP connections:
2017-08-22 00:01:02.113; [000009A8] {112} Optimizing socket configuration for better performance
2017-08-22 00:01:02.113; [000009A8] {111} Incoming connection request from [x.x.x.x]
so using the above logs, I was trying to see if I could possible correlate category={000} with category={125} maybe by time. So if the search see's category={000} and within say 5secs later if category={125} is listed, table source_ip(from category={000}) username(from category={125}).
... View more
08-23-2017
12:00 PM
Hi DalJeanis,
Thank you for assisting me with this issue. I tried running the search string you provided but I get the following error message: "Error in 'streamstats' command: The argument 'prior(mysource)' is invalid.
Here is what I copied and pasted into splunk:
index=name sourcetype=name_sftp earliest=-1d@d latest=@d| sort 0 _time
| eval mysource = if(category="000",source_ip,null())
| streamstats current=f prior(mysource) as lastsource window=1
| where category="125" AND isnotnull(lastsource)
| table username lastsource
Should I be swapping out "mysource" for maybe the name of the 'interesting field'?
... View more
08-22-2017
08:35 AM
TLDR;
How to pull results only if one matching interesting field data is followed by a different matching interesting field.
index=x sourcetype=x | if category=a is followed by category=b, table source_ip(from catgeory=a) username(from category=b)
... View more
08-22-2017
08:31 AM
Not sure if that titled made sense but hopefully I can explain it better here:
I am receiving sFTP logs from a host and I was able to manually extract new fields successfully and create several different reports, i.e. user login, failed logins, files downloaded etc., etc. ... Now I am attempting to correlate the external/source IP with the username that is associated with the external/source IP. The issue is that the external/source IP and the associating username are being indexed into separate lines. When someone is logging into the sFTP server the external/source IP is logged and the very next log that gets indexed is the username that just authenticated.
So I was thinking if I could create a search that uses the if-this-then-that logic. For example, if Splunk sees a log with category=a and the very next log shows category=b then table the external/source ip (from category=a) and username (from category=b). I manually extracted the field titled 'category'.
... View more
05-08-2017
10:14 AM
I know this is a very old topic but I have the same issue. I added display.visualizations.show = 0 under the saved search I want to disable the chart for but its still showing when a pdf is generated. Will I also need to restart splunk services for the changes to take affect?
... View more
04-14-2017
09:51 AM
When I attempt to run a basic search, index=foo sourcetype=* , and any other search, I get the following error message:
[splunk-idx-e1] Search process did not exit cleanly, exit_code=255, description="exited with code 255". Please look in search.log for this peer in the Job Inspector for more info.
[splunk-idx-e2] Search process did not exit cleanly, exit_code=255, description="exited with code 255". Please look in search.log for this peer in the Job Inspector for more info.
[splunk-idx-w1] Search process did not exit cleanly, exit_code=255, description="exited with code 255". Please look in search.log for this peer in the Job Inspector for more info.
[splunk-idx-w2] Search process did not exit cleanly, exit_code=255, description="exited with code 255". Please look in search.log for this peer in the Job Inspector for more info.
My Splunk setup consist of a Master Node(Cluster Master), Search Head, and 4 Indexers.
When I click the inspect job and then click search.log I don't see any error messages. I was able to perform this search with no problems prior to today. Can anyone help with this issue? I can provide more information if needed.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:03 AM
|
