About gharpe2

gharpe2 · ‎05-19-2016

I am using Splunk to send log source data to QRadar and need to find a way to filter out certain unwanted log events. Do you know of a way to filter out unwanted log events? FYI - I am sending the log data to QRadar via our 5 indexers.

gharpe2 · ‎04-05-2012

How can I find out what is taking up the CPU on a search head? Yesterday the utilization was 20% on avg., and today it is 80%.

gharpe2 · ‎01-27-2012

I have the Splunk for Windows app installed but it is collecting syslog UDP:514 data as well. How do I exclude the syslog data from the Windows app? I don't want to exclude it from Splunk entirely, just want to keep it out of the Windows app. gharpe2

gharpe2 · ‎12-23-2011

Need a search to report the last time a user has logged into Windows Active Directory. Assumption is this would be done by searching the WMI:WinEventLog:Security events. Would like it to report the date/time they last logged on, account name, workstation/host name, etc...

gharpe2 · ‎11-28-2011

Sample Events: 9:36:33.000 AM Nov 28 09:36:33 10.10.0.253 Nov 28 2011 10:36:33: %ASA-2-106001: Inbound TCP connection denied from 10.223.7.21/2999 to 109.13.183.81/445 flags SYN on interface inside host=10.10.0.253 Options| sourcetype=syslog Options| source=udp:514 Options 2 11/28/11 9:36:33.000 AM Nov 28 09:36:33 10.10.0.253 Nov 28 2011 10:36:33: %ASA-2-106006: Deny inbound UDP from 62.192.232.25/54657 to 63.78.74.228/35731 on interface outside host=10.10.0.253 Options| sourcetype=syslog Options| source=udp:514 Options 3 11/28/11 9:36:33.000 AM Nov 28 09:36:33 10.10.0.253 Nov 28 2011 10:36:33: %ASA-2-106001: Inbound TCP connection denied from 10.222.7.13/3954 to 109.21.83.57/445 flags SYN on interface inside host=10.10.0.253 Options| sourcetype=syslog Options| source=udp:514 Options

gharpe2 · ‎11-27-2011

Need a search to list the top 25 non-http and non-https services people are connecting to through my ASA. Does anyone have a search for that? I would like to list the port, protocol and number of times connections were made. Thanks, glh

gharpe2 · ‎11-27-2011

I need a search to show the top 25 non-http and non-https services going out of my firewall. Does anyone have a search to pull this data. I need to list the protocol, port number and number of times it was accessed. In table format would be nice as well.

gharpe2 · ‎08-24-2011

Is there a way to search the WMI:Security event log within Windows to find out who has local admin rights on a server?

gharpe2 · ‎04-28-2011

How do I conduct a search for unique usernames and get a count of how many people are logged on at any given time?

gharpe2 · ‎03-01-2011

How can I proactively monitor my Splunk indexes to make sure they are still indexing? I have an SNMP monitoring application, is there a way to setup an SNMP alert/monitor so if Splunk stops indexing it sends me an alert? Or, is there a way to do this directly within Splunk? thanks, glh

gharpe2 · ‎05-27-2010

What is the procedure for generating a CSR on a Windows 2003 server for Splunkweb?

Posts	11
Solutions	0
Karma Given	0
Karma Received	2
Member Since	‎05-27-2010

Online Status	Offline
Date Last Visited	‎06-05-2020 02:02 AM

How to filter out certain log events before sendin...

Search head CPU Utilization

Splunk Windows App

Active Directory User Audit

Firewall Services Search

Firewall Traffic

WMI Event Log Security Search

Username Search

Index Health Monitor

CSR on Windows 2003 Server