Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- Find Answers
- :
- About mrgibbon
mrgibbon
Contributor
Member since:
08-30-2012
06-05-2020
Community Statistics
| Posts | 114 |
| Solutions | 8 |
| Karma Given | 22 |
| Karma Received | 27 |
| Member Since | 08-30-2012 |
Activity Feed
- Got Karma for Re: Does Splunk support fields with whitespace from custom drill-down. 05-10-2022 06:34 AM
- Got Karma for Re: How to get Office 365 integrated as my SMTP server for Splunk alerting?. 06-24-2020 01:41 PM
- Karma Re: How to pass token during check and uncheck of the checkbox? for kyaparla. 06-05-2020 12:49 AM
- Karma Subsearch produced 50000 results, truncating to maxout 50000 for sureshwalmart. 06-05-2020 12:49 AM
- Karma Re: Indexing results from JKats Toolkit cURL for jkat54. 06-05-2020 12:48 AM
- Karma Re: What is the best practice for setting time zone? for jkat54. 06-05-2020 12:48 AM
- Karma Re: How to set a token in XML which is not displayed on table ?? for bruceclarke. 06-05-2020 12:48 AM
- Karma Adding Melbourne and Sydney Australia as available time zones in GUI. for Lucas_K. 06-05-2020 12:48 AM
- Karma Re: How to display 2 fields as a single field in Splunk with the greater value first? for MuS. 06-05-2020 12:48 AM
- Karma Is it possible to generate a PDF of a full dashboard and all its panels in a single page with Splunk 6.4? for o_calmels. 06-05-2020 12:48 AM
- Karma a couple of MS Windows AD Objects add-on macro fixes for mpf. 06-05-2020 12:48 AM
- Karma Re: Splunk Enterprise Security: How to troubleshoot why a Threat Intelligence download is failing for a single download source? for gjanders. 06-05-2020 12:48 AM
- Got Karma for Re: How to automatically log in to Splunk to display a dashboard on a TV screen with no interaction?. 06-05-2020 12:48 AM
- Got Karma for Re: how to show current ERROR trend as a single value. 06-05-2020 12:48 AM
- Got Karma for Re: Adding Melbourne and Sydney Australia as available time zones in GUI.. 06-05-2020 12:48 AM
- Got Karma for Re: Is it possible limit user access to an index on a Search Head level?. 06-05-2020 12:48 AM
- Got Karma for Cell value colours in 6.5, wildcards?. 06-05-2020 12:48 AM
- Got Karma for Re: If the Universal Forwarder doesn't do parsing, why do I see an abundance of "Failed to parse timestamp" errors in splunkd.log?. 06-05-2020 12:48 AM
- Got Karma for Re: How to search and table the retention time of each hot, warm, cold, and frozen bucket by each index?. 06-05-2020 12:48 AM
- Got Karma for Re: How to search and table the retention time of each hot, warm, cold, and frozen bucket by each index?. 06-05-2020 12:48 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 2 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 2 | |||
| 0 |
11-09-2016
07:03 PM
Its not a bug, its just the script or both try to create a file in /etc/init.d/ with the same details.
I get around it like this when I have two splunk instances on the same box:
nano /etc/init.d/splunk
edit this line:
"# Provides: splunkd" - Change splunkd to anything else. Useful might be ‘splunkdeploy’
Rename the file
mv /etc/init.d/splunk /etc/init.d/splunkdeploy
set perms to 755 on the script file.
chmod 755 /etc/init.d/splunkdeploy
chkconfig --add splunkdeploy – to fix symbolic links and other magic.
THEN run the second ‘enable boot-start’ command. It should go without a hitch.
sudo /opt/splunksearch/splunk/bin/splunk enable boot-start -user splunksearch
... View more
11-09-2016
05:03 PM
Hi, did you find an answer for this problem? I want to do the same thing.
Thanks
... View more
11-01-2016
03:03 PM
Yes! Please do 🙂
... View more
10-19-2016
06:27 PM
2 Karma
Hi all, Just wondering if there is a way yet of adding cell value colour scheme's using wildcards in 6.5?
So if I want to colour every cell containing the string 'sausages' I could use something like sausages.
I've tried all the usual things sausages,%sausages%, $sausages$ etc) with this, so I'm guessing its not possible yet, unless someone else knows better.
Cheers!
... View more
10-12-2016
07:46 PM
Sorted it.
There was a second file added to the inputs.conf and it didn't have the transforms applied to it!
So I was filtering on just one file, everything from the 2nd file was getting through.
Thanks so much for the help!!
... View more
10-12-2016
07:26 PM
yeah, the problem is, that this is just one example in this file, there are many others to add too.
I just want to start solving a small issue and work on it from there, its driving me nuts.
My original transforms.conf looked like this:
TRANSFORMS.CONF
[setnull]
REGEX= .
DEST_KEY = queue
FORMAT = nullQueue
[whitelist]
REGEX = /etc|/usr|/bin|/sbin|/opt|/uniworks|/u|/lib
DEST_KEY = queue
FORMAT = indexQueue
[blacklist]
REGEX = /var|/tmp|/vol|/system|/rpool|/proc|/net|/mnt|/backup|/archive|/devices|/export|/kernel|/platform|/uniworks/data
DEST_KEY = queue
FORMAT = nullQueue
... View more
10-12-2016
07:24 PM
Yes, everything, it actually looks like the filtering might not be being applied at all.
... View more
10-12-2016
07:23 PM
So keep the first log entry and nullQueue the 2nd one:
2016-09-26T10:17:38+10:00 fort audit: [ID 702911 audit.notice] open(2) - read,write ok session 2315219746 by user as user:user from 23.23.23.23 obj /sausages/KEEPME.DAT
2016-09-26T10:17:38+10:00 fort audit: [ID 702911 audit.notice] open(2) - read,write ok session 2315219746 by user as user:user from 23.23.23.23 obj /sausages/data/somecorp/test.DAT
... View more
10-12-2016
07:19 PM
Yes, all the data is in one audit.log file, I want to remove any entries with /sausages/data but keep everything else with /sausages.
I thought the . regex at the start would kill off any other entries in the file too.
... View more
10-12-2016
06:04 PM
Hi all, Im trying to do file nullQueue filtering on my HWF.
I want to keep the log entries for /sausages but drop the ones for /sausages/data
So far I have this: (test setup on desktop)
PROPS.CONF
[source::/home/splunk/Desktop/xxx/fs-audit.log*]
TRANSFORMS-set= setnull,whitelist,blacklist
TRANSFORMS.CONF
[setnull]
REGEX= .
DEST_KEY = queue
FORMAT = nullQueue
[whitelist]
REGEX = /sausages
DEST_KEY = queue
FORMAT = indexQueue
[blacklist]
REGEX = /sausages/data
DEST_KEY = queue
FORMAT = nullQueue
I did play with escaping the slashes like \/sausages\/ but that didnt work either.
Thanks in advance.
... View more
10-10-2016
05:38 PM
Hi, Maybe you can find something suitable here:
https://www.youtube.com/user/splunkvideos
Cheers
... View more
10-05-2016
05:04 PM
I managed to work around this by un-taring the current version of Splunk over the top of the installation.
Running a chown command to make sure the files were all owned by the right user, then starting up again.
Worked for me, hope this can help someone else.
... View more
10-05-2016
05:04 PM
I managed to work around this by un-taring the current version of Splunk over the top of the installation.
Running a chown command to make sure the files were all owned by the right user, then starting up again.
Worked for me, hope this can help someone else.
... View more
10-05-2016
05:03 PM
I managed to work around this by un-taring the current version of Splunk over the top of the installation.
Running a chown command to make sure the files were all owned by the right user, then starting up again.
Worked for me, hope this can help someone else.
... View more
09-29-2016
11:10 PM
Try using:
index=nessusdb OR source=suricata
then using the coalesce command:
|eval src_ip = coalesce(src_ip,host_ip)
Then put in your table command with src_ip and the other fields.
... View more
09-29-2016
11:02 PM
Im just working through the logic now, without having sample data to test on I might not get answer for you, but...
This:
table product Successful sign-UP, Failed sign-UP, Successful sign-IN, Failed sign-IN
Needs to be this for starters:
table product "Successful sign-UP", "Failed sign-UP", "Successful sign-IN", "Failed sign-IN"
I'll let you know if I crack the rest.
... View more
09-27-2016
10:34 PM
Thanks for the confirmation, I'd be eager to see any future updates!
... View more
09-27-2016
09:14 PM
Could I use the collect command for instance? Or is there a better way? I dont want to use a summary index unless I really need to.
... View more
09-27-2016
09:07 PM
Hi All, Im just about to get cracking on a new project and want to know something before I start.
I'll be taking a look at the curl command in JKats Toolkit to retrieve data from an external system.
BUT, I don't want to view the data on a dashboard, I'd like to have it indexed instead.
Is it possible? If it is, how?
Thanks in advance!
... View more
09-26-2016
05:50 PM
Will do, i'll be wanting to index the returned results for a start, not just have them displayed.
As all this will be possibly done via overnight summary indexing.
... View more
09-26-2016
04:52 PM
Thanks! I'll take a look 🙂
... View more
09-26-2016
03:44 PM
Hi guimilare, Please let me know too, I might even be able to help out, although I dont have any python knowledge either! 🙂
... View more
09-25-2016
05:15 PM
I'd love to have the skills and time to sit and write a script for this, and I need to. I just haven't dealt with SOAP or REST API via scripting before.
I'm looking for how to write a custom splunk command, so take an ARG from a search result and run it against the SOAP interface on an external system. Returning the information back into Splunk.
... View more
09-22-2016
09:48 PM
1 Karma
I created an eventtypes.conf in /splunk_app_windows_infrastructure/local/ on my search head and indexer containing this:
[wineventlog-dns]
disabled = 0
search = sourcetype=WinEventLog:DNS Server
Problem solved, for now. 🙂
... View more
09-21-2016
10:00 PM
I have been looking for a way of doing this with peoplesoft, please let me know if you work out how to do it!
Thanks
... View more
