About mirkokorn

mirkokorn · ‎11-04-2018

If anyone else runs into the same error contact support. They confirmed the behaviour as bug.

mirkokorn · ‎11-04-2018

Already found the answer, but just wanted to share in case anybody else runs into this problem. We had the structured-data format enabled. Therefore the format didn't match the expectations of the app. Turned the option off and the app worked fine.

mirkokorn · ‎10-26-2018

Hi there, I'm currently onboarding juniper srx firewall data with the Splunk_TA_juniper. Unfortunately the format in the app does not match the logs produced by our devices. For example the app does contain the following in transforms.conf: [force_sourcetype_for_junos_firewall] DEST_KEY = MetaData:Sourcetype REGEX = \s+RT_FLOW:|\s+RT_IDS: FORMAT = sourcetype::juniper:junos:firewall Our logs look like this: <Timestamp> <Hostname> RT_FLOW <Message> So in our logs there is no colon after RT_FLOW. Is this a known problem with SRX firewalls in combination with the TA? I just wanted to make sure that there is no simple way around this before I go and rewrite all the regex to match our logs. Thanks in advance.

mirkokorn · ‎09-17-2018

Hi Fred, as I have progressed with my splunk training I came to understand that this seems to be a use case that just doesn't go well with the concept of how splunk works. Splunk simply doesn't do lots of data enrichment during indexing time. With all th advantages and disadvantages this may bring. The only suitable solution I have come across by now is to have a seperate index that logs changes on dns entries and do a join of both indexes for dns lookup. I didn't implement it, but this should be a viable soution for the problem.

mirkokorn · ‎07-30-2018

Hi all, I'm currently doing some tests with UF on Windows 10 hosts. Unfortunately I'm getting an error I was not able to get rid off yet. When running UF as an user account that is part of the Administrators group, everything is running fine. As we do not want to run the process with full administrative rights, I created a local user "splunk" and gave it the following rights: - full control over UF directory - Permission to log on as a service. - Permission to log on as a batch job. - Permission to replace a process-level token. - Permission to act as part of the operating system. - Permission to bypass traverse checking. (source: http://docs.splunk.com/Documentation/Splunk/6.6.3/Installation/ChoosetheuserSplunkshouldrunas) With the non-privileged settings I do get the following messages in splunkd.log with WinRegMon inputs enabled: 07-30-2018 14:50:26.985 +0200 ERROR ExecProcessor - message from ""C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"" splunk-regmon - manageDriver Open SC Manager failed! Error = 5 07-30-2018 14:50:26.985 +0200 ERROR ExecProcessor - message from ""C:\Program Files\SplunkUniversalForwarder\bin\splunk-regmon.exe"" splunk-regmon - WinRegistryMonitor::StartDriver: Unable to install driver. Accordingly, I do net get any data from source WinRegMon. The same configuration seems to be working fine on Windows 7. Anyone had the same issues yet? Tested versions are UF 6.6.3 and UF 7.1.1

mirkokorn · ‎06-20-2017

Thanks for the answer, but I am actually not sure how you would actually configure these options without a lot of restrictions. A. Your idea is to watch the logs for entries that inform about new DHCP/DNS leases, right? That might work for devices using DHCP and newly assigned DNS entries, but I wouldn't be able to query for old IPs/hostnames like long running servers or workstations that are used daily and therefore don't have leases expiring. At the moment we don't send these logs into splunk. If there weren't such big advantages I could imagine doing so, but I am not sure yet whether this is the right solution for me. B. basically has the same problem as it relies on DHCP/DNS logs. Is there really no way to trigger a DNS lookup on indexing? We're just replacing an ELK installation with splunk and this is the single first thing that was way easier to do with ELK.

mirkokorn · ‎06-16-2017

I am facing a problem I struggle to find a solution for. I want to get the hostname that was associated to an IP address at the time the event occured. I first tried to us external_cmd in transforms.conf and LOOKUP in props.conf, but I found out that LOOKUP only works at search-time and therefore does not solve my problem. Now I am looking for a solution to either add the hostname to the event at index-time or to look up the hostname for specific times so that I can use serch-time lookups. I've been searching for a while now but were not able to find any suitable solution.

Posts	7
Solutions	0
Karma Given	0
Karma Received	4
Member Since	‎06-16-2017

Online Status	Offline
Date Last Visited	‎09-26-2022 01:10 PM

regex in Splunk_TA_juniper not matching logs

splunk-regmon causes errror when UF with non-privi...

How to do DNS lookup for event-time

Re: splunk-regmon causes errror when UF with non-p...

Re: regex in Splunk_TA_juniper not matching logs

regex in Splunk_TA_juniper not matching logs

Re: How to do DNS lookup for event-time

splunk-regmon causes errror when UF with non-privi...

Re: How to do DNS lookup for event-time

How to do DNS lookup for event-time