Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About newsplunker1
newsplunker1
Path Finder
Member since:
02-04-2020
06-30-2023
Community Statistics
| Posts | 33 |
| Solutions | 2 |
| Karma Given | 4 |
| Karma Received | 2 |
| Member Since | 02-04-2020 |
Activity Feed
- Posted Re: Why can't Splunk Add-on for JIRA Cloud go to internet via Proxy? on All Apps and Add-ons. 06-30-2023 08:53 AM
- Posted Re: How to remove everything BEFORE the second comma AND before indexing? on Splunk Enterprise. 05-05-2023 10:34 AM
- Posted How to remove everything BEFORE the second comma AND before indexing? on Splunk Enterprise. 05-05-2023 08:58 AM
- Tagged How to remove everything BEFORE the second comma AND before indexing? on Splunk Enterprise. 05-05-2023 08:58 AM
- Tagged How to remove everything BEFORE the second comma AND before indexing? on Splunk Enterprise. 05-05-2023 08:58 AM
- Tagged How to remove everything BEFORE the second comma AND before indexing? on Splunk Enterprise. 05-05-2023 08:58 AM
- Posted Re: Index non winevent log sources on All Apps and Add-ons. 03-09-2023 07:27 AM
- Posted Re: Is Splunk Supporting Add-on for Active Directory Compatible with python 3? on All Apps and Add-ons. 03-09-2023 07:04 AM
- Posted Index non winevent log sources on All Apps and Add-ons. 03-09-2023 07:01 AM
- Tagged Index non winevent log sources on All Apps and Add-ons. 03-09-2023 07:01 AM
- Tagged Index non winevent log sources on All Apps and Add-ons. 03-09-2023 07:01 AM
- Posted Re: SOAR - Only add to the list when the condition is met on Splunk SOAR (f.k.a. Phantom). 02-23-2023 12:01 PM
- Posted SOAR - Only add to the list when the condition is met? on Splunk SOAR (f.k.a. Phantom). 02-20-2023 02:15 PM
- Karma Re: How to remove logs from specific sourcetype being indexed? for scelikok. 02-14-2023 08:18 AM
- Karma Re: Remove logs from specific sourcetype being indexed for gcusello. 02-14-2023 08:18 AM
- Posted Re: Remove logs from specific sourcetype being indexed on Getting Data In. 02-14-2023 07:23 AM
- Posted Re: How to remove logs from specific sourcetype being indexed? on Getting Data In. 02-14-2023 07:14 AM
- Posted Re: Remove logs from specific sourcetype being indexed on Getting Data In. 02-14-2023 07:11 AM
- Posted Re: Remove logs from specific sourcetype being indexed on Getting Data In. 02-13-2023 02:33 PM
- Posted How to remove logs from specific sourcetype being indexed? on Getting Data In. 02-13-2023 02:32 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 2 | |||
| 0 | |||
| 0 | |||
| 0 |
06-30-2023
08:53 AM
@Tim-Lin Any luck with this ? Im in the same boat
... View more
05-05-2023
10:34 AM
@richgalloway That seems to do the trick ( I ll mark yours as the asnwer ) - Do you have any idea on how to use SED to replace the strings before the comma with a number lets say 0 for example this is the original event <190>May 4 20:20:36 data.test.com 1,2023/05/04 20:20:35,013001101002958 becomes like 0,0,013001101002958
... View more
05-05-2023
08:58 AM
I have the following events
<190>May 4 20:20:36 data.test.com 1,2023/05/04 20:20:35,013001101002958,test,end,2305,2023/05/04
I want to remove everything before the second comma (including the comma)
Since i dont want it to be indexed , im using the props and transforms on my HF to do that . My regex seems to work but when i try to implement it ,it does not filter anything
props.conf
[source::/var/log/splunk/IP/syslog.log] TRANSFORMS-null = remove_before_comma
transforms.conf
[remove_before_comma] REGEX = ^([^,]*,[^,]*), DEST_KEY = queue FORMAT = nullQueue
Here is the regex
https://regex101.com/r/Lxqgue/1
Any idea why this is not working properly
Thanks
... View more
- Tags:
- props
- regex
- transforms
Labels
- Labels:
-
administration
-
configuration
-
splunk-assist
03-09-2023
07:27 AM
@gcusello This was just for quick testing in the dev env but in the prod, i do have specific indexes for each category.
... View more
03-09-2023
07:04 AM
@Krithika No issues have been noticed when I upgraded to 9.01 four months ago. It passed the upgrade readiness app .
... View more
03-09-2023
07:01 AM
Hi, I'm trying to index the following sources with the below configs. Im using Splunk UF. Im receiving other logs such as internal , win event security/application so no firewall or communication issues between the client and server [WinEventlog://Microsoft-AzureADPasswordProtection-DCAgent/Admin] index=main disabled=0 [WinEventlog://Microsoft-AzureADPasswordProtection-DCAgent/Operational] index = main disabled = 0 Thanks
... View more
Labels
- Labels:
-
configuration
-
other
-
troubleshooting
02-23-2023
12:01 PM
@phanTom Thanks for taking the time to look into this one for me So im using %% to loop through the list of host i want to scan/ping but my struglle i guess is how to output the result into a format/block where i can call it later on for other actions host 1 with index 1 and host 3 with index 3 pass the decision block so my next step is to only apply other actions on those ( host1/index1 , host3/index3 ) I hope i made this clearer than before Thanks
... View more
02-20-2023
02:15 PM
Hi,
I have a list of hosts that i want to check their status , so I have created an if statement to filter out the ones that does not meet the if statement , then i have an action to ping on the ones that met the IF statement
ex:
host1, host2,host3,host4
if host==host1 OR host == host4
The next action would be scan ONLY ( host1 , host4)
I have the playbook working with all actions but i just could not figure out the way how to only process the hosts that meet the IF condition
Thanks
... View more
- Tags:
- If statement
Labels
02-14-2023
07:23 AM
This will disable all sourcetypes pan:threat pan:traffic pan:system I just want to disable or ignore the logs for pan:userid sourcetype
... View more
02-14-2023
07:14 AM
Thanks @scelikok - I ll test it and report back
... View more
02-14-2023
07:11 AM
Hi @gcusello Thanks for taking the time to look into this. I could not find that sourcetype in the inputs.conf . Splunk monitors the following file source="/var/log/splunk/network/paloalto/IP@/syslog.log" my inputs.conf [monitor:///var/log/splunk/network/paloalto/IP@/syslog.log] disabled = 0 host = host_segment = 6 sourcetype = pan:log index = test I can only see the pan:userid in the props conf
... View more
02-13-2023
02:33 PM
Sorry I meant sourcetype NOT index
... View more
02-13-2023
02:32 PM
Hi Everyone,
Im trying to stop the following index from being indexed into Splunk using the props/transforms confs on HF but with no luck - What am i doing wrong here ?
props.conf
[pan:userid] TRANSFORMS-set-nullqueue=set_nullqueue
transforms.conf
[set_nullqueue] REGEX=. DEST_KEY=queue FORMAT=nullQueue
Thank you!!
... View more
Labels
02-06-2023
01:07 PM
Thank you - That worked for me
... View more
02-06-2023
10:46 AM
Hi All,
Im struggeling to remove everything before the date using SED
Example
|makeresults|eval_raw="Feb 2 14:27:50 test.dh.test.com named[123456]: [ID xxxxx local6.info] 02-Feb-2021 14:27:50.448 queries: info: client @172ac618 x.x.x.x#61721 (cd1ae518178748adbca4cff52b24b791.fp.measure.office.com): query: cd1ae51817ffdfdfhhh8748adbca4cff52b24b791.fp.measure.office.com IN A + (x.x.x.x)"
1- I want to remove everything up to 02-Feb-2021 ( the date should be included )
I tried this rex mode=sed field=_raw "s/[^[0-9]{2}-[\w]{3}-[0-9]{4}]*//g" NO LUCK
Desired resullt would be something like this
02-Feb-2021 14:27:50.448 queries: info: client @172ac618 x.x.x.x#61721 (cd1ae518178748adbca4cff52b24b791.fp.measure.office.com): query: cd1ae51817ffdfdfhhh8748adbca4cff52b24b791.fp.measure.office.com IN A + (x.x.x.x)"
2- I want to keep only the last 3 parts of the domain
Example
cd1ae51817ffdfdfhhh8748adbca4cff52b24b791.fp.measure.office.com
Desire result: fp.measure.office.com
I have a working rex that does that but how can i use SED to avoid indexing anything before the last 3 parts of the domain
| rex field=_raw "query:\s(?:[^\s.]+\.)*(?P<query_dns1>[^\s.]+\.[^\s.]+\.[^\s.]+)"
THANK YOU!!
... View more
Labels
- Labels:
-
field extraction
-
regex
-
rex
10-17-2022
08:18 AM
Im trying to blacklist the below eventcodes since we dont have any use for them but somehow it is not working . I made the below change and delpoyed it to all UF via DS . Any idea why it is not working ?
[WinEventLog://Security] disabled = 0 evt_resolve_ad_obj = 1 checkpointInterval = 5 blacklist = 1003,501,510,7036,1066,17137,8003,403,404,410,900-902,4690,4099 index = winlog renderXml=false
... View more
Labels
- Labels:
-
administration
-
configuration
05-15-2020
02:44 PM
2 Karma
Hello,
I'm able to receive almost all eventcodes for wineventlog:security but missing the logs for eventcode 4776 .
I have the Windows TA app installed on the universal forwarder and search head. I have tried the following:
I uncheck the box labeled "Overwrite field values" which should Splunk from overwriting the existing Error_Code field (it did not work).
Then, created props.conf in the search head with this:
source::WinEventLog:Security
FIELDALIAS-Status_as_Error_Code = Status ASNEW Error_Code
Then, restarted the search head.
None of those steps are working. I checked the blocklist in the input file but code 4776 is one of them.
Could you please help?
Thanks
... View more
04-28-2020
08:29 AM
The file format was the issue - I also uploaded the file into splunk instance and generates the props file then copied it to where the UF is installed
... View more
04-24-2020
08:09 AM
Im monitoring a JSON file and forwarding the data using UF to my indexers . Im having problems to extract the JSON fields . Here is my props file . Nothing is being extracted ( i was trying to upload a screenshot but i dont have enought points ) . i know its something with the props but im unable to figure it out . any help would be appreciated
[test]
DATETIME_CONFIG =
INDEXED_EXTRACTIONS = json
KV_MODE = none
LINE_BREAKER = ([\r\n]+)
NO_BINARY_CHECK = true
category = Structured
disabled = false
pulldown_type = true
Thanks
... View more
04-23-2020
12:28 PM
So i got the file now ingested into indexers (There was something wrong with the file format) but im having problems extracting the JSON fields properly . im not getting all of the lines .
Here is my props file now
[test]
DATETIME_CONFIG =
INDEXED_EXTRACTIONS = json
KV_MODE = none
LINE_BREAKER = ([\r\n]+)
NO_BINARY_CHECK = true
category = Structured
disabled = false
pulldown_type = true
... View more
04-23-2020
12:26 PM
So i got the file now ingested into indexers (There is something wrong with the file format) but im having problem extracting the JSON fields properly .
... View more
04-23-2020
05:40 AM
Yes i restarted after making the changes . I keep seeing this "TailingProcessor - Adding watch on path: C:\temp\ . so to me , its able to see the path but not able to read it ? if so , the splunk account has access to that path , so i dont know whats going on
... View more
04-23-2020
05:37 AM
Thanks Manjunath,
I actually have it that way with the temp*.json . And i tried the full syntax ( index,sourcetype) , nothing changed. I checked the user access and has a full access to that path.
... View more
04-23-2020
05:21 AM
Thanks Pave - Did that but no changes
... View more
04-23-2020
05:21 AM
Thanks rich,
I tried that but nothing returned - i tried the splunk list command and showed no directory is being monitored which is weird because i have other directories working properly .
... View more
