Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About anandhalagarasa
anandhalagarasa
Path Finder
Member since:
06-05-2017
06-05-2020
Community Statistics
| Posts | 202 |
| Solutions | 0 |
| Karma Given | 4 |
| Karma Received | 7 |
| Member Since | 06-05-2017 |
Activity Feed
- Got Karma for Is there any way to pull the report on license usage for the last one year irrespective of all indexes?. 04-16-2024 03:14 AM
- Karma Re: Qualys TA for harsmarvania57. 06-05-2020 12:50 AM
- Got Karma for Can you help me find where I can see the license usage per day in Enterprise Security?. 06-05-2020 12:50 AM
- Got Karma for Specific Wineventlog (Security) ingestion into Splunk. 06-05-2020 12:50 AM
- Karma Re: Field Extractions in Search Head GUI for micahkemp. 06-05-2020 12:49 AM
- Karma Re: Enterprise Trial license: does it include clustering? for inventsekar. 06-05-2020 12:49 AM
- Got Karma for How can we view the data retention policy we have set?. 06-05-2020 12:49 AM
- Got Karma for Interesting Fields Missing in Search & Reporting of two different Search Heads. 06-05-2020 12:49 AM
- Got Karma for Enterprise Trial license: does it include clustering?. 06-05-2020 12:49 AM
- Karma Re: Search Factory: Unknown search command 'vt'. for hardikJsheth. 06-05-2020 12:48 AM
- Got Karma for Search Factory: Unknown search command 'vt'.. 06-05-2020 12:48 AM
- Posted Re: Splunk Alert and Dashboard Creation Permissions on Security. 11-05-2019 04:32 AM
- Posted Splunk Alert and Dashboard Creation Permissions on Security. 11-05-2019 03:32 AM
- Posted Re: Splunk Cloud License Usage on Monitoring Splunk. 11-04-2019 11:36 PM
- Posted Splunk Cloud License Usage on Monitoring Splunk. 11-04-2019 11:24 PM
- Posted Re: Fortinet -Fortigate Data not reflecting In ES Dashboard on Dashboards & Visualizations. 10-24-2019 01:06 AM
- Posted Re: Fortinet -Fortigate Data not reflecting In ES Dashboard on Dashboards & Visualizations. 10-23-2019 07:40 AM
- Posted Fortinet -Fortigate Data not reflecting In ES Dashboard on Dashboards & Visualizations. 10-23-2019 06:54 AM
- Posted Use cases in Enterprise Secuirty on Splunk Enterprise Security. 10-22-2019 11:11 PM
- Tagged Use cases in Enterprise Secuirty on Splunk Enterprise Security. 10-22-2019 11:11 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 0 | |||
| 0 |
11-05-2019
04:32 AM
Can anyone help on my query
... View more
11-05-2019
03:32 AM
Hi Team,
We have deployed Splunk Cloud in our organisation. And the access for the users have been provided via SAML authentication. We have different application team and hence we have created different application roles and provided user level acccess to search the data with the respective index in Splunk Cloud.
Now a particular user has been assigned to X user level role and he can able to access Splunk Cloud and able to search the data index=x and he can able to create the alerts and dashboards as well. But the alert or dashboard which is getting created saves as Private and the user alone can able to view and access the Alerts & Dashboards whereas others with the same role couldn't able to view the same and also they couldn't able to share the data Globally since they dont have access. So where and how should we need to change the access level so that the user in a particular roles assigned needs to modify and share the alerts and dashboards globally.
So kindly help to check and update on the same.
... View more
- Tags:
- splunk-cloud
11-04-2019
11:24 PM
Hi Team,
We are using Splunk Cloud in our organisation. We have purchased around 200 GB of License so I was eager to check the day to day license average. Hence I have navigated Cloud Monitoring Console App and clicked the Overview tab i can able to see License Usage (yesterday) and the data is in GB and its around 122 GB.
But if i navigate to License Usage tab in Cloud Monitoring Console App and then Split the data by index I am getting the top 10 index information and when i checked for yesterday value i.e. I have summed up the value of all index and the overall data comes around 143.27 GB.
I am quite not sure which is the exact License count since the data in the overview tab is not matching with the data when we split across index or sourcetype since we can see a difference of 21.27 GB
So kindly let me know where can i pull the exact information of Splunk Cloud daily usage. Also let us know the data in the Overview tab (License Usage (yesterday) ) is the correct information or not.
... View more
- Tags:
- splunk-cloud
10-24-2019
01:06 AM
Can anyone help on my request.
... View more
10-23-2019
07:40 AM
Kindly help on the query
... View more
10-23-2019
06:54 AM
Hi Team,
We are using Splunk Cloud in our environment. And we have a dedicated ES- Search head for Splunk Cloud as well. Currently we have installed the Fortinet Fortigate Add-on for Splunk (1.6.1) (https://splunkbase.splunk.com/app/2846) in our Heavy Forwarder and also in ES-Splunk Cloud Search head too. Based on the Add-On now we are getting the logs with the following sourcetypes fgt_traffic,fgt_event,fgt_utm.
As mentioned in the app when I checked in the ES-Splunk Cloud search head in Enterprise Security App I couldn’t able to find the Fortinet Fortigate data in dashboard as mentioned below.
Details provided in the Add-On:
"Verify the Add-on in Enterprise Security App
Available dashboards in Enterprise Security App supported by Fortinet Fortigate Add-on for Splunk.
Security Domain->Access->Access Center
Security Domain->Endpoint->Malware Center
Security Domain->Network->Traffic Center
Security Domain->Network->Intrusion Center
Security Domain->Network->Web Center
Security Domain->Network->Network Changes
Security Domain->Network->Port & Protocol Tracker
Security Domain->Identity->Session Center"
As recommended, I have disabled the Splunk Add-on for Fortinet as well but still the Fortinet Fortigate data is still not reflecting in ES Dashboards. Also I want to know how the data would in the Dashboard and how to know whether it is getting displayed in Dashboard or not as well.
Kindly help on this query.
... View more
- Tags:
- splunk-cloud
10-22-2019
11:11 PM
How to fetch and where to find what and all are the use cases which we have created till date in Enterprise Security Splunk Cloud search head. So that we can take a dump of it and also we can have make a note of it as well.
So where can i find those details.
... View more
10-22-2019
06:12 AM
Hi Team,
I have a requirement that to ingest a particular logs from a client machine so I have created a custom app with inputs in place. i.e. with source & sourcetype. Here sourcetype i have created newly as abcd. And I have pushed the custom app from Deployment server which in turn its getting applied to indexers and the log has been ingested into Splunk Cloud.
My query is that for each and every sourcetype which we create newly should be reported to Security Operations team so that they will keep track of it.
For example if a new sourcetype has been created and deployed from our end then the same day or the consecutive day an email has to be triggered to Security Operations team.
So what would be the search query to fetch the data.
... View more
- Tags:
- splunk-cloud
10-21-2019
01:31 AM
Hi Team,
We want to filter out the data during indexing time itself if the particular pattern (com.splunk.application) is captured in log. Hence kindly let us know what would be the props and transforms for the same. And the remaining data should ingest into splunk without any issues.
Pattern: If the keyword is present "com.splunk.application" in the event then it should not be indexed.
Sample Event:
DEBUG 2019-10-18 18:43:32,487 [I/O marker 01] com.splunk.applicationinsights.web.url.https.implementation.xxx.client.Maininstallerprog - [ad: 1] Response
processed
DEBUG 2019-10-18 18:43:32,487 [I/O marker 01] com.splunk.applicationinsights.web.url.https.implementation.xx.client.Internalmessage - [ex: 1] releasing connection
... View more
- Tags:
- splunk-cloud
10-21-2019
01:07 AM
1 Karma
Hi Team,
Currently we are ingesting all data from wineventlog Security, Application & System from all Windows Client machines. And due to this ingestion we are overloaded with the license usage and now we are planning only to ingest only the critical EventCode (4688,4624) and so on and the remaining Security wineventlog are not required so kindly let me know how to pull the data for a particular EventCode from all windows machine so that we will implement the same and check it.
Current Inputs:
[WinEventLog://Application]
disabled = 0
index = xxx
renderXml=0
[WinEventLog://Security]
disabled = 0
index = xxx
renderXml=0
[WinEventLog://System]
disabled = 0
index = xxx
renderXml=0
So it would be really helpful if i can ingest only the particular eventcode from wineventlog:security so that we will be saving some licenses.
... View more
- Tags:
- splunk-cloud
10-18-2019
07:33 AM
Hi Team,
We have Splunk Cloud deployed in our environment and we have built an heavy forwarder server. And here we have placed some props and transforms for filtration but actually when i check the data in Splunk Cloud the Regex is not getting applied and hence forth the data seems to be still the improper format so i want to know how to check whether my server is acting as an heavy forwarder or not.
And also how to check whether it is doing a filtering option before indexing in Splunk Cloud.
Kindly let me know on this.
... View more
- Tags:
- splunk-cloud
10-17-2019
01:24 AM
As requested a single event looks like as below.
x,xx.xxx.xx.x,xx.xxx.x.x,xxxxx,xxx,T,O,A,B,,,,","xxxxxxxxxx,xx.xxx.xx.x,xx.xxx.x.x,xxxxx,xxx,T,O,A,E,,,,","xxxxxxxxxx,xx.xxx.xx.x,xx.xxx.x.x,xxxxx,xxx,T,O,A,B,,,,","xxxxxxxxxx,xx.xxx.xx.x,xx.xxx.x.x,xxxxx,xxx,T,O,A,E,,,,","xxxxxxxxxx,xx.xxx.xx.x,xx.xxx.x.x,xxxxx,xxx,T,O,A,B,,,,","xxxxxxxxxx,xx.xxx.xx.x,xx.xxx.x.xx,xxxxx,xxxx,T,O,A,B,,,,","xxxxxxxxxx,xx.xxx.xx.x,xx.xxx.xxx.xxx,xxxxx,xxxx,T,O,A,E,,,,","xxxxxxxxxx,xx.xxx.xx.x,xx.xxx.x.x,xxxxx,xxx,T,O,A,E,,,,","xxxxxxxxxx,xx.xxx.xx.x,xx.xxx.x.x,xxxxx,xxx,T,O,A,B,,,,","xxxxxxxxxx,xx.xxx.xx.x,xx.xxx.x.x,xxxxx,xxx,T,O,A,E,,,,","xxxxxxxxxx,xx.xxx.xx.x,xx.xxx.x.x,xxxxx,xxx,T,O,A,B,,,,","xxxxxxxxxx,xx.xxx.xx.x,x.xx.xx.xxx,xxxxx,xxxx,T,O,A,B,,,,","xxxxxxxxxx,xx.xxx.xx.x,xx.xxx.x.x,xxxxx,xxx,T,O,A,E,,,,","xxxxxxxxxx,xx.xxx.xx.x,xx.xxx.x.x,xxxxx,xxx,T,O,A,B,,,,","xxxxxxxxxx,xx.xxx.xx.x,xx.xxx.x.x,xxxxx,xxx,T,O,A,E,,,,","xxxxxxxxxx,xx.xxx.xx.x,x.xx.xx.xxx,xxxxx,xxxx,T,O,A,E,,,,","xxxxxxxxxx,xx.xxx.xx.x,xx.xxx.x.xx,xxxxx,xxxx,T,O,A,E,,,,"]}]}]}},{"time":"xxxx-xx-xxTxx:xx:xx.xxxxxxxZ","systemId":"bxxxexxx-xfxx-xbxe-becx-xxdfxxxxxxxx","macAddress":"xxxDxAxEExCx","category":"NetworkSecurityGroupFlowEvent","resourceId":"/SUBSCRIPTIONS/XXxXXXx-XXXx-xxxx-Xxxx-xXxxxxXXxXxX/RESOURCEGROUPS/MCSPUSxNETWORK/PROVIDERS/MICROSOFT.NETWORK/NETWORKSECURITYGROUPS/USxPORINDI","operationName":"NetworkSecurityGroupFlowEvents","properties":{"Version":x,"flows":[{"rule":"UserRule_servicechecks","flows":[{"mac":"xxxDxAxEExCx","flowTuples":["xxxxxxxxxx,xx.xxx.x.xxx,xx.xxx.xx.x,xxxxx,xxx,T,I,A,E,x,xxx,x,xxx","xxxxxxxxxx,xx.xxx.x.xxx,xx.xxx.xx.x,xxxxx,xxx,T,I,A,B,,,,","xxxxxxxxxx,xx.xxx.x.xxx,xx.xxx.xx.x,xxxxx,xxx,T,I,A,E,x,xxx,x,xxx","xxxxxxxxxx,xx.xxx.x.xxx,xx.xxx.xx.x,xxxxx,xxx,T,I,A,B,,,,","xxxxxxxxxx,xx.xxx.x.xxx,xx.xxx.xx.x,xxxxx,xxx,T,I,A,E,x,xxx,x,xxx","xxxxxxxxxx,xx.xxx.x.xxx,xx.xxx.xx.x,xxxxx,xxx,T,I,A,B,,,,","xxxxxxxxxx,xx.xxx.x.xxx,xx.xxx.xx.x,xxxxx,xxx,T,I,A,E,x,xxx,x,xxx","xxxxxxxxxx,xx.xxx.x.xxx,xx.xxx.xx.x,xxxxx,xxx,T,I,A,B,,,,","xxxxxxxxxx,xx.xxx.x.xxx,xx.xxx.xx.x,xxxxx,xxx,T,I,A,E,x,xxx,x,xxx","xxxxxxxxxx,xx.xxx.x.xxx,xx.xxx.xx.x,xxxxx,xxx,T,I,A,B,,,,","xxxxxxxxxx,xx.xxx.x.xxx,xx.xxx.xx.x,xxxxx,xxx,T,I,A,E,x,xxx,x,xxx","xxxxxxxxxx,xx.xxx.x.xxx,xx.xxx.xx.x,xxxxx,xxx,T,I,A,B,,,,","xxxxxxxxxx,xx.xxx.x.xxx,xx.xxx.xx.x,xxxxx,xxx,T,I,A,E,x,xxx,x,xxx","xxxxxxxxxx,xx.xxx.x.xxx,xx.xxx.xx.x,xxxxx,xxx,T,I,A,B,,,,","xxxxxxxxxx,xx.xxx.x.xxx,xx.xxx.xx.x,xxxxx,xxx,T,I,A,E,x,xxx,x,xxx","xxxxxxxxxx,xx.xxx.x.xxx,xx.xxx.xx.x,xxxxx,xxx,T,I,A,B,,,,"]}]},{"rule":"DefaultRule_AllowVnetOutBound","flows":[{"mac":"xxxDxAxEExCx","flowTuples":["xxxxxxxxxx,xx.xxx.xx.x,xx.xxx.xx.xx,xxxxx,xxxx,T,O,A,B,,,,","xxxxxxxxxx,xx.xxx.xx.x,xx.xxx.x.x,xxxxx,xxx,T,O,A,B,,,,","xxxxxxxxxx,xx.xxx.xx.x,xx.xxx.x.x,xxxxx,xxx,T,O,A,E,,,,","xxxxxxxxxx,xx.xxx.xx.x,xx.xxx.x.x,xxxxx,xxx,T,O,A,B,,,,","xxxxxxxxxx,xx.xxx.xx.x,xx.xxx.x.x,xxxxx,xxx,T,O,A,E,,,,","xxxxxxxxxx,xx.xxx.xx.x,xx.xxx.x.x,xxxxx,xxxxx,T,O,A,E,,,,","xxxxxxxxxx,xx.xxx.xx.x,xx.xxx.x.x,xxxxx,xxx,T,O,A,E,,,,","xxxxxxxxxx,xx.xxx.xx.x,xx.xxx.xx.xx,xxxxx,xxx,T,O,A,E,,,,","xxxxxxxxxx,xx.xxx.xx.x,xx.xxx.x.x,xxxxx,xxx,T,O,A,E,,,,","xxxxxxxxxx,xx.xxx.xx.x,xx.xxx.x.x,xxxxx,xxx,T,O,A,E,,,,","xxxxxxxxxx,xx.xxx.xx.x,xx.xxx.x.x,xxxxx,xxx,T,O,A,B,,,,","xxxxxxxxxx,xx.xxx.xx.x,xx.xxx.x.xx,xxxxx,xxxx,T,O,A,B,,,,","xxxxxxxxxx,xx.xxx.xx.x,xx.xxx.x.x,xxxxx,xxx,T,O,A,B,,,,","xxxxxxxxxx,xx.xxx.xx.x,xx.xxx.x.x,xxxxx,xxx,T,O,A,E,,,,","xxxxxxxxxx,xx.xxx.xx.x,xx.xxx.xxx.xx,xxxxx,xxxx,T,O,A,E,,,,","xxxxxxxxxx,xx.xxx.xx.x,xx.xxx.x.x,xxxxx,xxx,T,O,A,E,,,,","xxxxxxxxxx,xx.xxx.xx.x,xx.xxx.x.x,xxxxx,xxx,T,O,A,E,,,,","xxxxxxxxxx,xx.xxx.xx.x,xx.xxx.x.x,xxxxx,xxx,T,O,A,B,,,,","xxxxxxxxxx,xx.xxx.xx.x,xx.xxx.x.x,xxxxx,xxx,T,O,A,E,,,,","xxxxxxxxxx,xx.xxx.xx.x,xx.xxx.x.x,xxxxx,xxx,T,O,A,E,,,,","xxxxxxxxxx,xx.xxx.xx.x,xx.xxx.x.x,xxxxx,xxx,T,O,A,B,,,,","xxxxxxxxxx,xx.xxx.xx.x,xx.xxx.xxx.xxx,xxxxx,xxxx,T,O,A,B,,,,","xxxxxxxxxx,xx.xxx.xx.x,xx.xxx.x.x,xxxxx,xxx,T,O,A,B,,,,","xxxxxxxxxx,xx.xxx.xx.x,xx.xxx.x.x,xxxxx,xxx,T,O,A,E,,,,","xxxxxxxxxx,xx.xxx.xx.x,xx.xxx.x.x,xxxxx,xxx,T,O,A,B,,,,","xxxxxxxxxx,xx.xxx.xx.x,x.xx.xx.xxx,xxxxx,xxxx,T,O,A,B,,,,","xxxxxxxxxx,xx.xxx.xx.x,xx.xxx.x.xx,xxxxx,xxxx,T,O,A,E,,,,","xxxxxxxxxx,xx.xxx.xx.x,xx.xxx.x.x,xxxxx,xxx,T,O,A,E,,,,"]}]}]}},{"time":"xxxx-xx-xxTxx:xx:xx.xxxxxxxZ","systemId":"bxxxexxx-xfxx-xbxe-becx-xxdfxxxxxxxx","macAddress":"xxxDxAxEExCx","category":"NetworkSecurityGroupFlowEvent","resourceId":"/SUBSCRIPTIONS/XXxXXXx-XXXx-xxxx-Xxxx-xXxxxxXXxX/RESOURCEGROUPS/MCSPUSxNETWORK/PROVIDERS/MICROSOFT.NETWORK/NETWORKSECURITYGROUPS/USxPORINDI","operationName":"NetworkSecurityGroupFlowEvents","properties":{"Version":x,"flows":[{"rule":"UserRule_servicechecks","flows":[{"mac":"xxxDxAxEExCx","flowTuples":["xxxxxxxxxx,xx.xxx.x.xxx,xx.xxx.xx.x,xxxxx,xxx,T,I,A,E,x,xxx,x,xxx","xxxxxxxxxx,xx.xxx.x.xxx,xx.xxx.xx.x,xxxxx,xxx,T,I,A,B,,,,","xxxxxxxxxx,xx.xxx.x.xxx,xx.xxx.xx.x,xxxxx,xxx,T,I,A,E,x,xxx,x,xxx","xxxxxxxxxx,xx.xxx.x.xxx,xx.xxx.xx.x,xxxxx,xxx,T,I,A,B,,,,","xxxxxxxxxx,xx.xxx.x.xxx,xx.xxx.xx.x,xxxxx,xxx,T,I,A,E,x,xxx,x,xxx","xxxxxxxxxx,xx.xxx.x.xxx,xx.xxx.xx.x,xxxxx,xxx,T,I,A,B,,,,","xxxxxxxxxx,xx.xxx.x.xxx,xx.xxx.xx.x,xxxxx,xxx,T,I,A,E,x,xxx,x,xxx","xxxxxxxxxx,xx.xxx.x.xxx,xx.xxx.xx.x,xxxxx,xxx,T,I,A,B,,,,","xxxxxxxxxx,xx.xxx.x.xxx,xx.xxx.xx.x,xxxxx,xxx,T,I,A,E,x,xxx,x,xxx","xxxxxxxxxx,xx.xxx.x.xxx,xx.xxx.xx.x,xxxxx,xxx,T,I,A,B,,,,","xxxxxxxxxx,xx.xxx.x.xxx,xx.xxx.xx.x,xxxxx,xxx,T,I,A,E,x,xxx,x,xxx","xxxxxxxxxx,xx.xxx.x.xxx,xx.xxx.xx.x,xxxxx,xxx,T,I,A,B,,,,","xxxxxxxxxx,xx.xxx.x.xxx,xx.xxx.xx.x,xxxxx,xxx,T,I,A,E,x,xxx,x,xxx","xxxxxxxxxx,xx.xxx.x.xxx,xx.xxx.xx.x,xxxxx,xxx,T,I,A,B,,,,","xxxxxxxxxx,xx.xxx.x.xxx,xx.xxx.xx.x,xxxxx,xxx,T,I,A,E,x,xxx,x,xxx","xxxxxxxxxx,xx.xxx.x.xxx,xx.xxx.xx.x,xxxxx,xxx,T,I,A,B,,,,","xxxxxxxxxx,xx.xxx.x.xxx,xx.xxx.xx.x,xxxxx,xxx,T,I,A,E,x,xxx,x,xxx"]}]},{"rule":"DefaultRule_AllowVnetOutBound","flows":[{"mac":"xxxSxAxSSxVx","flowTuples":["xxxxxxxxxx,xx.xxx.xx.x,xx.xxx.x.x,xxxxx,xxx,T,O,A,B,,,,","xxxxxxxxxx,xx.xxx.xx.x,xx.xxx.x.x,xxxxx,xxx,T,O,A,E,,,,","xxxxxxxxxx,xx.xxx.xx.x,xx.xxx.x.x,xxxxx,xxx,T,O,A,B,,,,","xxxxxxxxxx,xx.xxx.xx.x,xx.xxx.xx.xx,xxxxx,xxx,U,O,A,B,,,,","xxxxxxxxxx,xx.xxx.xx.x,xx.xxx.xx.xx,xxxxx,xxx,T,O,A,B,,,,","xxxxxxxxxx,xx.xxx.xx.x,xx.xxx.x.x,xxxxx,xxx,T,O,A,E,,,,","xxxxxxxxxx,xx.xxx.xx.x,xx.xxx.x.x,xxxxx,xxx,T,O,A,B,,,,","xxxxxxxxxx,xx.xxx.xx.x,xx.xxx.x.x,xxxxx,xxx,T,O,A,B,,,,","xxxxxxxxxx,xx.xxx.xx.x,xx.xxx.x.x,xxxxx,xxxxx,T,O,A,B,,,,","xxxxxxxxxx,xx.xxx.xx.x,xx.xxx.x.x,xxxxx,xxx,T,O,A,B,,,,","xxxxxxxxxx,xx.xxx.xx.x,xx.xxx.x.x,xxxxx,xxx,T,O,A,B,,,,","xxxxxxxxxx,xx.xxx.xx.x,xx.xxx.x.x,xxxxx,xxx,T,O,A,B,,,,","xxxxxxxxxx,xx.xxx.xx.x,xx.xxx.x.x,xxxxx,xxx,T,O,A,B,,,,","xxxxxxxxxx,xx.xxx.xx.x,xx.xxx.x.x,xxxxx,xxx,T,O,A,B,,,,","xxxxxxxxxx,xx.xxx.xx.x,xx.xxx.x.x,xxxxx,xxx,T,O,A,B,,,,","xxxxxxxxxx,xx.xxx.xx.x,xx.xxx.x.x,xxxxx,xxx,T,O,A,B,,,,","xxxxxxxxxx,xx.xxx.xx.x,xx.xxx.x.x,xxxxx,xxx,T,O,A,B,,,,","xxxxxxxxxx,xx.xxx.xx.x,xx.xxx.x.x,xxxxx,xxxxx,T,O,A,B,,,,","xxxxxxxxxx,xx.xxx.xx.x,xx.xxx.x.xx,xxxxx,xxxx,T,O,A,B,,,,","xxxxxxxxxx,xx.xxx.xx.x,xx.xxx.x.x,xxxxx,xxx,T,O,A,B,,,,","xxxxxxxxxx,xx.xxx.xx.x,x.xx.xx.xxx,xxxxx,xxxx,T,O,A,E,,,,","xxxxxxxxxx,xx.xxx.xx.x,xx.xxx.x.x,xxxxx,xxx,T,O,A,E,,,,","xxxxxxxxxx,xx.xxx.xx.x,xx.xxx.x.x,xxxxx,xxx,T,O,A,B,,,,","xxxxxxxxxx,xx.xxx.xx.x,xx.xxx.x.x,xxxxx,xxx,T,O,A,E,xxx,xxxxx,xxx,xxxxxx","xxxxxxxxxx,xx.xxx.xx.x,xx.xxx.x.x,xxxxx,xxx,T,O,A,E,x,xxx,x,xxx","xxxxxxxxxx,xx.xxx.xx.x,xx.xxx.x.x,xxxxx,xxx,T,O,A,B,,,,","xxxxxxxxxx,xx.xxx.xx.x,xx.xxx.x.x,xxxxx,xxx,T,O,A,E,,,,","xxxxxxxxxx,xx.xxx.xx.x,xx.xxx.x.x,xxxxx,xxx,T,O,A,B,,,,","xxxxxxxxxx,xx.xxx.xx.x,xx.xxx.x.x,xxxxx,xxx,T,O,A,E,xx,xxxx,xx,xxxxx","xxxxxxxxxx,xx.xxx.xx.x,xx.xxx.x.x,xxxxx,xxxxx,T,O,A,E,xx,xxxx,xx,xxxxx","xxxxxxxxxx,xx.xxx.xx.x,xx.xxx.x.x,xxxxx,xxx,T,O,A,E,xx,xxxxx,xx,xxxxx","xxxxxxxxxx,xx.xxx.xx.x,xx.xxx.x.x,xxxxx,xxx,T,O,A,E,xx,xxxx,xx,xxxxx","xxxxxxxxxx,xx.xxx.xx.x,xx.xxx.x.x,xxxxx,xxx,T,O,A,E,,,,","xxxxxxxxxx,xx.xxx.xx.x,xx.xxx.x.x,xxxxx,xxx,T,O,A,B,,,,","xxxxxxxxxx,xx.xxx.xx.x,xx.xxx.xxx.xxx,xxxxx,xxxx,T,O,A,B,,,,","xxxxxxxxxx,xx.xxx.xx.x,xx.xxx.x.x,xxxxx,xxx,T,O,A,E,,,,","xxxxxxxxxx,xx.xxx.xx.x,xx.xxx.x.x,xxxxx,xxx,T,O,A,B,,,,","xxxxxxxxxx,xx.xxx.xx.x,xx.xxx.x.x,xxxxx,xxx,T,O,A,E,,,,","xxxxxxxxxx,xx.xxx.xx.x,xx.x.xx.xxx,xxxxx,xxx,T,O,A,B,,,,","xxxxxxxxxx,xx.xxx.xx.x,xx.xxx.x.x,xxxxx,xxx,T,O,A,E,,,,","xxxxxxxxxx,xx.xxx.xx.x,xx.xxx.xxx.xx,xxxxx,xxxx,T,O,A,B,,,,","xxxxxxxxxx,xx.xxx.xx.x,xx.xxx.x.xx,xxxxx,xxxx,T,O,A,E,,,,","xxxxxxxxxx,xx.xxx.xx.x,xx.xxx.x.x,xxxxx,xxx,T,O,A,E,,,,"]}]}]}},{"time":"xxxx-xx-xxTxx:xx:xx.xxxxxxxZ","systemId":"bxxxexxx-xfxx-xbxe-becx-xxdfxxxxxxxx","macAddress":"xxxSxSxXXxCx","category":"NetworkSecurityGroupFlowEvent","resourceId":"/SUBSCRIPTIONS/XXxXXXx-XXXx-xxxx-Xxxx-xXxxxxXXxXxX/RESOURCEGROUPS/MCSPUSxNETWORK/PROVIDERS/MICROSOFT.NETWORK/NETWORKSECURITYGROUPS/USxXXXXXXX","operationName":"NetworkSecurityGroupFlowEvents","properties":{"Version":x,"flows":[{"rule":"UserRule_servicechecks","flows":[{"mac":"xxxDxAxEExCx","flowTuples":["xxxxxxxxxx,xx.xxx.x.xxx,xx.xxx.xx.x,xxxxx,xxx,T,I,A,B,,,,","xxxxxxxxxx,xx.xxx.x.xxx,xx.xxx.xx.x,xxxxx,xxx,T,I,A,E,x,xxx,x,xxx","xxxxxxxxxx,xx.xxx.x.xxx,xx.xxx.xx.x,xxxxx,xxx,T,I,A,B,,,,","xxxxxxxxxx,xx.xxx.x.xxx,xx.xxx.xx.x,xxxxx,xxx,T,I,A,E,x,xxx,x,xxx","xxxxxxxxxx,xx.xxx.x.xxx,xx.xxx.xx.x,xxxxx,xxx,T,I,A,B,,,,","xxxxxxxxxx,xx.xxx.x.xxx,xx.xxx.xx.x,xxxxx,xxx,T,I,A,E,x,xxx,x,xxx","xxxxxxxxxx,xx.xxx.x.xxx,xx.xxx.xx.x,xxxxx,xxx,T,I,A,B,,,,","xxxxxxxxxx,xx.xxx.x.xxx,xx.xxx.xx.x,xxxxx,xxx,T,I,A,E,x,xxx,x,xxx","xxxxxxxxxx,xx.xxx.x.xxx,xx.xxx.xx.x,xxxxx,xxx,T,I,A,B,,,,","xxxxxxxxxx,xx.xxx.x.xxx,xx.xxx.xx.x,xxxxx,xxx,T,I,A,E,x,xxx,x,xxx","xxxxxxxxxx,xx.xxx.x.xxx,xx.xxx.xx.x,xxxxx,xxx,T,I,A,B,,,,","xxxxxxxxxx,xx.xxx.x.xxx,xx.xxx.xx.x,xxxxx,xxx,T,I,A,E,x,xxx,x,xxx","xxxxxxxxxx,xx.xxx.x.xxx,xx.xxx.xx.x,xxxxx,xxx,T,I,A,B,,,,","xxxxxxxxxx,xx.xxx.x.xxx,xx.xxx.xx.x,xxxxx,xxx,T,I,A,E,x,xxx,x,xxx","xxxxxxxxxx,xx.xxx.x.xxx,xx.xxx.xx.x,xxxxx,xxx,T,I,A,B,,,,"]}]},
... View more
10-16-2019
07:05 AM
Can anyone help please.
... View more
10-16-2019
02:12 AM
Hi anyone can you kindly help on my request please.
... View more
10-15-2019
07:43 AM
Kindly help on the request.
... View more
10-15-2019
06:16 AM
can anyone help on the request.
... View more
10-15-2019
04:04 AM
Hi Team,
We got an requirement to ingest NSG logs from Azure into Splunk Cloud. So we have installed the "Splunk Add-on for Microsoft Cloud Services" in our Heavy Forwarder server and we have created the inputs in Azure Storage Blob and post which I can able to see the logs were getting ingested into Splunk Cloud but a single event seems to be a combination of multiple events.
So I have tried this solution by applying the props and transforms.conf as mentioned below:
https://www.splunk.com/blog/2017/02/20/splunking-microsoft-azure-network-watcher-data.html
props.conf:
[sourcetype]
LINE_BREAKER = }([\r\n]s*,[\r\n]s*){
SEDCMD-remove_header = s/{\s*\"records\"\:s*[\s*//g
SEDCMD-remove_footer = s/][\r\n]\s*}.*//g
SHOULD_LINEMERGE = false
KV_MODE = json
TIME_PREFIX = time\":\"
REPORT-tuples = extract_tuple
transforms.conf:
[extract_tuple]
SOURCE_KEY = properties.flows{}.flows{}.flowTuples{}
DELIMS = ","
FIELDS = time,src_ip,dst_ip,src_port,dst_port,protocol,traffic_flow,traffic_result
Then I have tried the Splunk answers Regex provided in the following weburl:
https://answers.splunk.com/answers/714696/process-json-azure-nsg-flow-log-tuples.html
props.conf:
[sourcetype]
LINE_BREAKER = (\")\d{10}
SHOULD_LINEMERGE = false
SEDCMD-remove_not_epoch = s/\"\D.*$//g
transforms.conf:
[extract_tuple]
DELIMS = ","
FIELDS = time,src_ip,dest_ip,src_port,dest_port,transport,traffic_flow,traffic_result
But still the logs are getting generated as a very big event and after 10000 characters its getting categorized as a single event so kindly help to provide relevant props and transforms.conf so that I can implement in my environment and check the feasibility of it.
... View more
09-19-2019
06:36 AM
Kindly help on the request.
... View more
09-19-2019
06:23 AM
Hi Team,
We have a separate ES- Splunk Cloud for our organisation.
So in which we have provided access via SAML authentication for all the members in Security Operations team. And we have created roles like for them as well.
Our issue is currently one of the user from Security Operations team can able to login via SAML authentication but he couldn't able to view the Incident Review dashboard data when he searched for anytime.
When we checked the Job Inspector we are getting the below mentioned errors.
So other users who are provided with the same role has access to Incident review dashboard and they can view the notable events whereas this particular user alone couldnt able to view the incident review dashboard events.
When i checked the Job Inspector i can see error events like below:
Search process did not exit cleanly, exit_code=255, description="exited with code 255". Please look in search.log for this peer in the Job inspector for more info.
Also some error in logs as:
WARN Download Remote DataTransaction - Got status code : 404 (Not Found) from indexer.
So kindly let me know why the particular user can able to login the Splunk Cloud but couldn't able to view the events in the Incident Dashboard.
... View more
09-13-2019
12:08 AM
@thesplunkmonkey,
my question is i use the below mentioned stanza but the old data is not getting ingested into Splunk Cloud.
[monitor:///ijk/lmn/otp.log]
sourcetype = xyz
index = abc
disabled = 0
Here i didn't use anything like ignoreOlderThan command itself but still the last updated log is not getting ingested into Splunk Cloud.
So should i need to add any command in the stanza so that it will pull the old data as well.
... View more
09-11-2019
11:10 PM
@thesplunkmonkey ,
Thanks for your response.
I just want to know whether can i able to index the old data logs into Splunk. For example the log file has been lastly updated two days before and I have done the configuration today so will it be getting ingested into Splunk?
My requirement is that I want to index those log data into Splunk as well so based on that kindly help on the input stanza.
... View more
09-11-2019
11:00 PM
Can anyone help on the request
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:03 AM
|
