Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About wvalente
wvalente
Explorer
Member since:
06-28-2017
08-12-2020
Community Statistics
| Posts | 39 |
| Solutions | 0 |
| Karma Given | 1 |
| Karma Received | 2 |
| Member Since | 06-28-2017 |
Activity Feed
- Posted Re: Parse Windows Logs from log source AWS Cloudwatch on Getting Data In. 08-12-2020 07:13 AM
- Karma Re: Parse Windows Logs from log source AWS Cloudwatch for to4kawa. 08-12-2020 07:11 AM
- Posted Re: Parse Windows Logs from log source AWS Cloudwatch on Getting Data In. 08-10-2020 08:06 AM
- Posted Re: Parse Windows Logs from log source AWS Cloudwatch on Getting Data In. 08-10-2020 05:37 AM
- Tagged Re: Parse Windows Logs from log source AWS Cloudwatch on Getting Data In. 08-10-2020 05:37 AM
- Posted How to parse Windows logs from log source in AWS CloudWatch via Lambda? on Getting Data In. 08-07-2020 06:49 AM
- Posted Re: Change host props and transforms not working on Getting Data In. 08-06-2020 11:17 AM
- Posted Re: Change host props and transforms not working on Getting Data In. 08-06-2020 08:48 AM
- Posted Change host props and transforms not working on Getting Data In. 08-03-2020 07:35 AM
- Got Karma for Monitor Console does not show any data. 06-05-2020 12:49 AM
- Posted Configure AWS Guardduty Logs on All Apps and Add-ons. 02-03-2020 03:24 AM
- Posted Re: How do you make a query to see logs not sent by a forwarder? on Splunk Search. 02-28-2019 10:09 AM
- Posted How do you make a query to see logs not sent by a forwarder? on Splunk Search. 02-28-2019 07:10 AM
- Posted How do you filter data for just one index when index=*? on Splunk Search. 02-14-2019 04:16 AM
- Tagged How do you filter data for just one index when index=*? on Splunk Search. 02-14-2019 04:16 AM
- Posted Customize inputs.conf Palo Alto - Multiple sources udp:514 on All Apps and Add-ons. 12-05-2018 02:47 AM
- Posted Why is the Universal Forwarder indexing its own logs? on Getting Data In. 11-01-2018 07:40 AM
- Posted Re: How do I use a look up to check to see if I'm getting logs from hosts that are in a CSV? on Splunk Search. 09-13-2018 07:56 AM
- Posted How do I use a look up to check to see if I'm getting logs from hosts that are in a CSV? on Splunk Search. 09-13-2018 05:36 AM
- Tagged How do I use a look up to check to see if I'm getting logs from hosts that are in a CSV? on Splunk Search. 09-13-2018 05:36 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
07-15-2021
06:45 AM
Polishing the config files above. Below conf files worked perfectly for me #props.conf [aws:cloudwatch:s3] TRANSFORMS-field_extraction_aws_windows_logs = parse_windows_logs_prefix,parse_windows_logs_suffix #Transforms.conf [parse_windows_logs_prefix] REGEX = \[(?<LogName>.*?)\]\s+\[(?<Type>.*?)\]\s+\[(?P<EventCode>\d+)]\s+\[(?P<SourceName>.*?)\]\s+\[(?P<ComputerName>.*?)]\s+\[(?P<message>[^.]+.)\s(?P<body>[^]]+.) FORMAT = LogName::"$1" Type::"$2" EventCode::"$3" Sourcename::"$4" ComputerName::"$5" message::"$6" body::"$7" WRITE_META = true [parse_windows_logs_suffix] SOURCE_KEY = field:body REGEX = (?m)^\s*(?<name>[^:]+):[\t ]+(?<value>.*)$ FORMAT = "$1"::"$2" REPEAT_MATCH = true WRITE_META = true
... View more
08-06-2020
11:17 AM
Hi Willem. I've done here and it's work very well. Thank you so much.
... View more
- Tags:
- hi
07-20-2020
07:13 AM
Hi there, I've spent 2 days trying to configure the Splunk emails. Not sure what the settings in alert_actions.conf file are but by default the sender is set to"splunk_sender" or something like that....so in order to send an email you have to specify the "from" property. Also you can change it in Settings > Searches, reports and alerts. Find your search or alert (if you want to use the alert email action) click Edit > Advanced edit and then change the value of "action.email.from". Also trying to send an email using gmail's smtp is a bit tricky as probably you have 2-layer authentication. I would recommend you to change the server.
... View more
02-03-2020
03:24 AM
Guys,
I'm trying to set up Guardduty log collection, but so far I'm not successful.
I have a heavy forwarder that forwards logs to the indexer and the search head queries the data in the indexer.
I configured the add-ons on the necessary platforms (heavy forwarder and search head), I configured the accounts needed to forward the logs.
The logs are being sent via the SQS queue. The logs arrive at the indexer, but I can't get the dashboard populated (Splunk App for AWS and aws_guardduty).
On the dashboards, in the 'AccountID' menu, a message appears
"Search produced no results."
I also tried to configure via HEC, but there is an error message that it cannot connect to the platform.
Can someone help me?
... View more
02-28-2019
10:09 AM
Yeah, the problem with this search is that return an hosts that are offline for months. Strange.
... View more
02-14-2019
04:28 AM
Your question is not very clear. Perhaps you can share some sample output of the search you have right now and then give an example of what it should be.
It is not clear to me whether you want to filter out a certain index, or whether you want to look for user=Administrator that occurs only in one (not a specific one, but once) index?
... View more
12-12-2018
11:42 AM
https://answers.splunk.com/answers/205815/how-to-configure-different-sourcetypes-for-udp-por.html
You can use the following in your inputs.conf
[udp://SOURCE_IP:PORT]
... View more
11-01-2018
08:35 AM
It is best practice to index _internal logs. Your Distributed Monitoring Console won't fully work without it and you won't really be able to remotely troubleshoot any problems on your UFs.
If you are worried about the amount of data in the index, just adjust frozenTimePeriodinSecs on those indexes so you don't hang on to them for too long
... View more
09-13-2018
08:25 AM
286 results have the lookup columns added. Do you want to see the count of hosts in the lookup not reporting in from your search time window? If so, instead of lookup, use | append [| inputlookup client_sys] and then uses a stats to bring the two together to show which are not shown, a filter on those not present in the data, and then a stats to count the ones not filtered.
| tstats count AS tstats_cnt where index = main OR index = client* by host | append [| inputlookup client_sys | rename hostname AS host ] | stats first(tstats_cnt) AS tstats_cnt by host | search NOT tstats_cnt=* | stats count AS host_dc
... View more
06-22-2018
01:26 PM
Hi @wvalente,
Installing "CEF Extraction Add-on for Splunk" app won't help if you are not using the field extractions it provides. Please see usage examples in the app's README.
--Igor
... View more
05-10-2018
05:55 AM
1 Karma
Just be careful with maxHotSpanSecs with its default of 7776000 - 90 days! one major objective is to have fewer buckets as possible and this value helps in this regard. If you reduce it and the flow of data into this index is relatively low, you can create lots of small buckets, that the OS might not like.
... View more
04-23-2018
10:41 AM
hello there,
i dont think this is the reason your MC doesnt show correct results
can you elaborate on your challenge?
on a side note, i think Splunk modified the Updated field in REST to beginning in epoch time couple of versions ago.
worthwhile to check with your Splunk SE if they plan to change it back
... View more
04-20-2018
07:34 AM
Hi @nplamondon,
Tks for answer.
I'll check this configuration again.
The problem is that this information has always been shown.
... View more
08-22-2017
10:24 AM
1 Karma
Hi Wvalente,
Usually splunk restart for savedsearch.conf changes is not required, you have to refresh by using ,
http://<yoursplunkserver>:<your web port, default 8000>/debug/refresh
Below link will help you to understand when to restart splunk,
https://docs.splunk.com/Documentation/Splunk/6.6.2/Admin/Configurationfilechangesthatrequirerestart
Check your Splunk version and the documents for more information,
Hope this will helps you!!!
... View more
08-08-2017
02:41 AM
I believe that lastlog is a sparse file see http://www.noah.org/wiki/Lastlog_is_gigantic
... View more
08-02-2017
12:59 AM
it's the same thing, only different field names:
index=your_index sourcetype=your_sourcetype (EventCode=4722 OR EventCode=4725)
| transaction user
| search EventCode=4722 EventCode=4725
Bye.
Giuseppe
... View more
07-26-2017
01:41 PM
try this
index=xxx process=useradd earliest=-1m@m | stats count by user | where count>=40
... View more
07-25-2017
05:15 AM
Hi DlJeanis,
I'm talking about linux user.
I can use the 'windows user' query.
Tks for your support.
... View more
07-19-2017
07:06 AM
You are doing it wrong; use syslog-ng on a UF (not HF), write to disk and use monitor :
http://www.georgestarcher.com/splunk-success-with-syslog/
... View more
07-13-2017
10:20 AM
Thanks for your support cpetterborg.
I'll try this and I return if it works.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
08-12-2020
12:37 PM
|
