Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About erictodor
erictodor
New Member
Member since:
05-11-2017
06-05-2020
Community Statistics
| Posts | 15 |
| Solutions | 0 |
| Karma Given | 0 |
| Karma Received | 0 |
| Member Since | 05-11-2017 |
Activity Feed
- Posted How to extract Target Account Name or Subject Account Name Security ID field from Windows Security Log? on Splunk Search. 03-07-2018 08:52 AM
- Tagged How to extract Target Account Name or Subject Account Name Security ID field from Windows Security Log? on Splunk Search. 03-07-2018 08:52 AM
- Tagged How to extract Target Account Name or Subject Account Name Security ID field from Windows Security Log? on Splunk Search. 03-07-2018 08:52 AM
- Tagged How to extract Target Account Name or Subject Account Name Security ID field from Windows Security Log? on Splunk Search. 03-07-2018 08:52 AM
- Tagged How to extract Target Account Name or Subject Account Name Security ID field from Windows Security Log? on Splunk Search. 03-07-2018 08:52 AM
- Tagged How to extract Target Account Name or Subject Account Name Security ID field from Windows Security Log? on Splunk Search. 03-07-2018 08:52 AM
- Posted Re: REGEX filter in transforms.conf file setting question on Splunk Enterprise. 01-09-2018 08:27 AM
- Posted Re: REGEX filter in transforms.conf file setting question on Splunk Enterprise. 01-09-2018 08:13 AM
- Posted Re: REGEX filter in transforms.conf file setting question on Splunk Enterprise. 01-09-2018 08:03 AM
- Posted Re: REGEX filter in transforms.conf file setting question on Splunk Enterprise. 01-09-2018 07:44 AM
- Posted Re: REGEX filter in transforms.conf file setting question on Splunk Enterprise. 01-09-2018 07:11 AM
- Posted Re: REGEX filter in transforms.conf file setting question on Splunk Enterprise. 01-08-2018 02:54 PM
- Posted Re: REGEX filter in transforms.conf file setting question on Splunk Enterprise. 01-08-2018 02:47 PM
- Posted Re: REGEX filter in transforms.conf file setting question on Splunk Enterprise. 01-08-2018 02:30 PM
- Posted REGEX filter in transforms.conf file setting question on Splunk Enterprise. 01-08-2018 02:07 PM
- Tagged REGEX filter in transforms.conf file setting question on Splunk Enterprise. 01-08-2018 02:07 PM
- Posted Re: Several of my forwarders are having issues blacklisting the _internal index on Getting Data In. 10-25-2017 08:56 AM
- Posted Several of my forwarders are having issues blacklisting the _internal index on Getting Data In. 09-19-2017 11:53 AM
- Tagged Several of my forwarders are having issues blacklisting the _internal index on Getting Data In. 09-19-2017 11:53 AM
- Tagged Several of my forwarders are having issues blacklisting the _internal index on Getting Data In. 09-19-2017 11:53 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
03-07-2018
08:52 AM
I'm searching on Windows Security Auditing logs and the Security_ID field but when I do, I'm realizing that there is a section for Subject and Target Account. I want to be able to extract each into its own unique field so I can search on one or the other. Here's a sample event log. Right now, both account_1 and account_2 would be in a field called Security_ID and I need to split the two. Thanks!
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4738
EventType=0
Type=Information
ComputerName=server.domain.com
TaskCategory=User Account Management
OpCode=Info
RecordNumber=00000000
Keywords=Audit Success
Message=A user account was changed.
Subject:
Security ID: DOMAIN\account_1
Account Name: account_1
Account Domain: DOMAIN
Logon ID: 0000000
Target Account:
Security ID: DOMAIN\account_2
Account Name: account_2
Account Domain: DOMAIN
... View more
01-09-2018
08:27 AM
Thank you for the distinction in definitions. Helps with explaining the issue more. This configuration is what we want Splunk to do. To forward all logs to our 3rd party. In these logs are computer names (my definition of host I was using). While the REGEX = . means match everything, is there any way to double verify that everything, is indeed, being forwarded?
... View more
01-09-2018
08:13 AM
That's a possibility. When I'm looking at the 3rd party feed, I'm assuming I'm looking at the feed before it's parsed and when I look at the raw data, I don't see all computer names. Is there a way to mimic this props.conf filter in a Splunk query so I can see what is being captured?
I guess the question is, IS Splunk sending entries from all hosts or is it sending a sub-set of hosts? I can't verify this from the Splunk side (yet?). If I can verify that it is, I can then focus on the 3rd party for not parsing the entries correctly but right now I don't know if the data out is good.
I hope that makes sense.
... View more
01-09-2018
08:03 AM
I'm sorry, the limits of my Splunk knowledge is being hit by your question. I don't know how to query Splunk to see the output of the data stream to the 3rd party. I'm looking at 3rd party tool itself and looking at the data coming in. By looking at that data, I can see the computer names that are being matched. The pattern I've discerned is what I've posted before about the computer names. Those with letters and numbers are fine. Anything with something else in it doesn't reach the 3rd party.
Is there a way I can write a query to see the output to compare and provide the data you're looking for ?
(and thank you for your patience with me on this question)
... View more
01-09-2018
07:44 AM
This is what I have. I'm assuming the text below represents the computer name filter.
--Eric
[WinEventLog:Security]
TRANSFORMS-t1 = eliminate-eventcodes
[CSC_FileMon]
DATETIME_CONFIG = CURRENT
NO_BINARY_CHECK = 1
SHOULD_LINEMERGE = false
pulldown_type = 1
[host::*]
TRANSFORMS-main = wstn_eventlogs
... View more
01-09-2018
07:11 AM
Basically, we have computer names that are whole words without any non-characters in the name (i.e. Computer01) and we have names with non-characters in them (i.e. Computer-01). It looks like the filter only matches the 1st, names with only characters and numbers. I need to capture all names, including the ones with '-' in them.
Any help would be appreciated.
... View more
01-08-2018
02:54 PM
This is the complete props.conf
[set_sourcetype_to_stash]
REGEX = .
DEST_KEY = MetaData:Sourcetype
FORMAT = sourcetype::stash
[extract_spent]
REGEX = (?P\d+)ms$
[eliminate-eventcodes]
REGEX = EventCode=(0000)
DEST_KEY = queue
FORMAT = nullQueue
[wstn_eventlogs]
REGEX = .
DEST_KEY = _SYSLOG_ROUTING
FORMAT = windowsworkstationsmain
... View more
01-08-2018
02:47 PM
This is from the search head.
... View more
01-08-2018
02:30 PM
Here's some additional info. Let me know if this is helpful.
Thank you
Props.conf
[host::*]
TRANSFORMS-main = test_eventlogs
Transforms.conf
[test_eventlogs]
REGEX = .
DEST_KEY = _SYSLOG_ROUTING
FORMAT = windowsworkstationsmain
Outputs.conf
[syslog:windowsworkstationsmain]
server = my.destination.com
sendCookedData = true
... View more
01-08-2018
02:07 PM
We're forwarding events to a 3rd party. In our transforms.conf file, the filter looks like the following
REGEX = .
For some reason, this filter capture names without any hyphens. Here's what I'm talking about
Success - Computer
Failure - Co-m-puter
We have computer names with the '-' in them but they don't get captured. Is there a better wild card string that can be used to capture all computer names, regardless of what characters are in them.
Thanks!
... View more
- Tags:
- splunk-enterprise
10-25-2017
08:56 AM
I found that the problem end points with this issue had to do with the fact that the Forwarder version was a bit out of date. When I upgraded from 6.0 to 6.6.3, the forwarder started to play nice and follow my config file.
... View more
09-19-2017
11:53 AM
Several of my forwarders are having issues blacklisting the _internal index. On my forwarder's \etc\system\local folder, I have a outputs.conf file with the following logic
[tcpout]
defaultGroup = default-autolb-group
forwardedindex.3.blacklist = (_internal|_audit)
I use this same logic on my workstations with successful results but however, on this representative machine, even confirming that the blacklist item is being processed by the fowarder (looking at splunkd.log), it still doesn't blacklist the __internal index. I have tried a more aggressive filter (forwardedindex.3.blacklist = _.*) but that doesn't work as well. I'm a bit stumped as to where to check next as to why this is happening and how to correct.
Any help would be appreciated.
Thank you!
... View more
05-15-2017
10:20 AM
That didn't work. I managed to make this regex work in a simulator but I'm not sure why I can't get the syntax to work in Splunk
\.+\w+\' (works in simulator)
"(?<'path'>)\.+\w+\" (attempt at Splunk regex logic)
... View more
05-15-2017
09:18 AM
I have a search which produces c:\folder\folder\folder\folder\file.exe as results. I want to remove file.exe so that I'm left with c:\folder\folder\folder\folder. It's unknown how many subfolders may exist in my search results. Any help with the regex syntax would be great.
Thank you
... View more
05-11-2017
12:20 PM
I have a search which produces c:\folder\folder\folder\folder\file.exe as results. I want to remove all of the c:\folders so I'm only left with file.exe. Its unknown how many subfolders may exist in my search. I'm still new to regex searching so I managed to get the query I want in a simulator but I can't get splunk to produce the results.
Expression [^\\\]*$
| rex field=Filepath "(?<'Path'>[^\\\]*$)"
Any help would be appreciated
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:03 AM
|
