About kjstogn

kjstogn · ‎11-02-2021

I think this may help: https://docs.splunk.com/Documentation/Splunk/8.2.2/Indexer/Managesinglepeerconfigurations I get what your saying as if you theoretically have 3 Indexer Peers therefore 3 different inputs.conf allowing Splunk SSL receiving. If it is a small deployment I would manage it on a peer by peer basis and locally configure it in its own app context/repository. Or use the same cert and password throughout (probably not what you want) and use the deployment server to deploy it as an app

kjstogn · ‎02-16-2021

Currently using it with Zeek version 3.0.8 on Security Onion 16.04.7.1 No issues with with JSON format. The add-on itself is rather lacking in the sourcetypes and covers just the main ones like conn, dns, ssl... definitely add the ones you would like to parse a little more. I personally like the JSON format more than TSV but it does support that fine as well with its sourcetype autotyping/dynamic extraction. I would beware of the TIME_FORMAT in props.conf as Zeek by default uses epoch but Security Onion has been configured to use ISO8601 If using ISO8601 substitute TIME_FORMAT = %s.%6N for TIME_FORMAT = %Y-%m-%dT%H:%M:%S.%6%z

kjstogn · ‎06-20-2020

I am trying to create a passive dns collection based on splunk stream data. My current SPL is this: index=botsv2 sourcetype=stream:dns query=*frothly.local | stats earliest(_time) as firstSeen, latest(_time) as lastSeen by query | eval firstSeen=strftime(firstSeen, "%m/%d/%Y %H:%M:%S") | eval lastSeen=strftime(lastSeen, "%m/%d/%Y %H:%M:%S") What I am trying to accomplish is show how many days as "activeDays" a query was made. Just because its first and last may be seen 30 days apart it may have only been queried a couple times. Also the stream queries and answers are separate events and how would i join them to create a by query and answers

kjstogn · ‎02-08-2020

I have a single indexer and single search head with the indexer attached as a search peer and I created one index called "winevent" on the indexer. I don't understand why the search head cannot see this index or auto complete it when I type it in search. Is there another file I need to modify to make my search head aware of the indexes in an indexer? I haven't seen a real clear answer on this and I am trying to expand my Splunk instance from all in one to distributed architecture

Posts	4
Solutions	1
Karma Given	0
Karma Received	0
Member Since	‎02-08-2020

Online Status	Offline
Date Last Visited	‎11-03-2021 11:20 AM

Passive DNS

Can't see newly created indexes on search head in ...

Re: How to configure the cluster peers inputs.conf...

Re: Does Splunk Add-on for Zeek aka Bro work with ...

Passive DNS

Can't see newly created indexes on search head in ...