Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About khanlarloo
khanlarloo
Explorer
Member since:
06-02-2017
05-18-2022
Community Statistics
| Posts | 119 |
| Solutions | 1 |
| Karma Given | 3 |
| Karma Received | 0 |
| Member Since | 06-02-2017 |
Activity Feed
- Posted Re: Route and filter data on Getting Data In. 05-17-2022 10:00 PM
- Posted Re: Route and filter data on Getting Data In. 04-11-2022 12:58 AM
- Posted Re: Route and filter data on Getting Data In. 04-11-2022 12:37 AM
- Posted Re: Route and filter data on Getting Data In. 04-10-2022 10:30 PM
- Posted Re: Route and filter data on Getting Data In. 04-03-2022 03:28 AM
- Posted Is it possible to filter specific field values in indexers without HeavyForwarder in indexer cluster ? on Getting Data In. 04-03-2022 01:17 AM
- Posted Re: two search result at the same time on Splunk Search. 01-31-2022 03:15 AM
- Posted Re: two search result at the same time on Splunk Search. 01-31-2022 03:09 AM
- Posted two search result at the same time on Splunk Search. 01-31-2022 02:48 AM
- Posted hidden user in users on Security. 09-26-2021 02:18 AM
- Posted Re: data model field extraction on Splunk Enterprise. 07-31-2021 05:33 AM
- Posted data model field extraction on Splunk Enterprise. 07-20-2021 01:49 AM
- Karma Re: How can I index Netflow logs? for nickhills. 06-05-2020 12:49 AM
- Karma Re: add icon to app for niketn. 06-05-2020 12:49 AM
- Karma Re: Can we use regex for counting fields? for 493669. 06-05-2020 12:49 AM
- Posted Re: extract json files fields on Splunk Search. 05-26-2020 11:54 PM
- Posted Re: extract json files fields on Splunk Search. 05-19-2020 08:10 PM
- Posted Re: extract json files fields on Splunk Search. 05-19-2020 08:06 PM
- Posted Re: extract json files fields on Splunk Search. 05-19-2020 03:38 AM
- Posted Re: Different sourcetype with one hostname on Getting Data In. 05-19-2020 01:04 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
05-17-2022
10:00 PM
i do it, but i still recieve this log. transforms.conf [setnull] DEST_KEY = queue FORMAT = nullQueue REGEX = (?i)C:\\Program Files\\Citrix\\ConfigSync\\ConfigSync\.ps1 props.conf [source::XmlWinEventLog:Microsoft-Windows-PowerShell/Operational] TRANSFORMS-null= setnull
... View more
- Tags:
- t
04-11-2022
12:58 AM
my raw log is : </Data><Data Name='ScriptBlockId'>dd493fb0-9281-4197-a347-a7afaeea3632</Data><Data Name='Path'>C:\Program Files\Citrix\ConfigSync\ConfigSync.ps1</Data></EventData></Event> and i want to filter this part "C:\Program Files\Citrix\ConfigSync\ConfigSync.ps1" can you tell me what is the regex for it?
... View more
04-11-2022
12:37 AM
"XmlWinEventLog:Microsoft-Windows-PowerShell/Operational" is source, ilocated transforms.conf and props.con in indexeres under /$SPLUNK_HOME$/etc/slave-apps/_cluster/local
... View more
04-10-2022
10:30 PM
It doesn't work. my props.conf [XmlWinEventLog:Microsoft-Windows-PowerShell/Operational] TRANSFORMS-null= ConfigSync-win transforms.conf [ConfigSync-win] REGEX = Path=\"C:\\Program Files\\Citrix\\ConfigSync\\ConfigSync\.ps1\" DEST_KEY = queue FORMAT = nullQueue
... View more
04-03-2022
03:28 AM
Thank You for answering my question, Then How should I configure the output.conf? we have 60 indexer, and 5 Sh, and 500 UF with CM
... View more
04-03-2022
01:17 AM
Hi
Is it possible to filter specific field values in indexers without HeavyForwarder in indexer cluster ?
... View more
Labels
- Labels:
-
indexer
01-31-2022
03:15 AM
no, i want the dest field in search1 be the src field in search 2
... View more
01-31-2022
03:09 AM
No i don't want the drilldown search, i want to have one result from two search time is important what time that two result happend in two search. the dest field in search1 be the src in search 2 but in one query
... View more
01-31-2022
02:48 AM
I want to have a search, the output of which is the next search stream, provided that each occurred at a common time. For example: from a source with a specific port is connected to several destinations, and then the search destinations are the first source of the next search, provided that each occurred at the same time. search1: index=fgt src=172.26.122.1 dest_port=443 (dest=172.20.120.1 OR dest=172.20.120.2) | stats count by src,dest,_time search 2: search1 (src=172.20.120.1 OR src=172.20.120.2) | stats count by src,dest,_time
... View more
Labels
- Labels:
-
subsearch
09-26-2021
02:18 AM
hi we had the user with name user1, after some days the user was hidden in settings>users, but still user can login to splunk web. and we can't find user in users.
... View more
Labels
- Labels:
-
authentication
-
login
07-31-2021
05:33 AM
I did everything you said according to the link you sent, but there is still the same problem.
... View more
07-20-2021
01:49 AM
Hi,I have a dns log whose fields are not extracted properly and so I used Rex. I encountered a problem. When i search index = dns * source = "516" host = dns -sender All fields are extracted correctly. But when i search | "from datamodel:" Network_Resolution | search dns -sender My fields get value of unknown. Can anyone help me !!!!
... View more
Labels
- Labels:
-
troubleshooting
05-19-2020
08:10 PM
I want to make my search based on the fields extracted from my json log.But none of my fields were extracted and I have to extract my desired fields by writing Regex.
i separate my logs with defining different indexes in transforms.conf and props.conf
... View more
05-19-2020
03:38 AM
Hi,splunk Cannot extract fields.what should i do to extract this json fields?
... View more
05-19-2020
01:04 AM
no my reason is just for identifying the flow.
my setting in transforms.conf :
[fw-sourcetype]
REGEX = FG1092
DEST_KEY = MetaData:sourcetype
FORMAT = fortigate
in props.conf
[host::192.168.x.x]
TRANSFORMS-sourcetype-fg = fw-sourcetype
... View more
05-19-2020
01:00 AM
I have json logs that I want to extract.I did All items related to field extraction in props.conf file.
my log
{"export_time":"06:45:53","flows":[{"applicationNamePath":"XXX","applicationName":"tcp","flowStartSeconds":"1589957129","sourceTransportPort":"XXX","sourceIPv4Address":"190.x.x.x","destinationIPv4Address":"X.x.x.x","flowId":"64414","flowDirection":"0","tunnelTechnology":"no","destinationTransportPort":"443","flowExpired":"1","detectionCompleted":"0","tcpControlBits":"14","flowDurationMilliseconds":"9000","octetTotalCount":"152","packetTotalCount":"3","applicationCategoryName":"Network Service","p2pTechnology":"no","attributes":[]}],"last":1}
my props.conf:
indexed_extraction = json
... View more
05-12-2020
09:10 PM
No. i can't change the port number.I have no way to change the port. is there a way i can configure the transforms.conf or props.conf files to receive logs in different sourcetype?
... View more
05-11-2020
07:53 PM
no they don't come from different port.(hostname,Source and sourcetype) are the same.
... View more
05-11-2020
03:52 AM
We have a series of logs from different devices such as (Firewall .waf. antivirus,...) that come from syslog server to Splunk with the same host name. I want to separate the logs based on sourcetype. All logs have the same Hostname and source.
is it possible to define different sourcetype?
... View more
05-18-2019
08:50 PM
can you tell me, what did you enable in group policy ?
... View more
05-18-2019
07:42 AM
yes,i put wineventloglog:security input on my dc, but when i create user it doesn't show any log on my app.
... View more
05-17-2019
12:48 AM
i installed Splunk Universal Forwarder on my domain controller ,but when i create user on ad it doesn't show any log. even in my windows event viewer
... View more
