About SoknySplunk

SoknySplunk · ‎07-07-2020

Hello, Now I face this issue too. did you resolve it. If can please guide me. thanks

SoknySplunk · ‎01-30-2020

all events

SoknySplunk · ‎01-29-2020

I'm trying to do whitelist on windows eventcode on my test environment before applying on production. after apply and reload, there no log activity come to splunk. [WinEventLog://Security] disabled = 0 whitelist1 = 4624,4625,4634,4688,4689,4720,4722-4726,4728,4729,4732,4756,4778,4779 whitelist2 = EventCode="5156" Message="(putty.exe)|(SecureCRT.exe)|(mstsc.exe)|(winscp.exe)" Thanks in advance your help

SoknySplunk · ‎12-23-2019

Hi , In splunk query i need to convert time format as below . Current format - 08:09.23 AM, Fri 06/10/2016 Required Format : 10/06/2016 08:09:23

SoknySplunk · ‎02-20-2019

I would like to ask you between Splunk Universal Forwarder version 7.2.4 and our Central System version is 7.1.3 -does it compatible?

SoknySplunk · ‎02-11-2019

Hello Splunk Community, Do all you guys know why my _audit and _internal index show status blank on Mater-note?

SoknySplunk · ‎02-08-2019

Could anyone tell me about query to show which app fail to reload after i run command #splunk reload deploy-server?

SoknySplunk · ‎09-11-2018

By the way, could we use metadata to pull both host and source and last date?

SoknySplunk · ‎09-11-2018

Thank you, it's a great example.

SoknySplunk · ‎09-10-2018

Does any body have search_query related sourcetype update that show: - how many host in one sourcetype (increase/decrease host)? - which host not update on time? Thanks

SoknySplunk · ‎09-04-2018

For example: Field_color Field_user red user_a yellow user_b orange user_c blue user_d If I choose blue in field_color, it should be show user_d only one in field_user if i choose orange it should be show user_c only one in field_user

SoknySplunk · ‎09-03-2018

user_a like all color user-b like red color user_c like yellow and orange user_d like blue. thanks

SoknySplunk · ‎09-03-2018

I have two dropdown list related to each other. - Dropdown_list 1= red, yellow, orange, blue… - Dropdown_list 1= user_a, user_b, user_c, user_d When I choose a colour in dropdown_list_1, I want dropdown_list_2 to show default all user who love that colour. ALL. Thanks your help.

SoknySplunk · ‎02-27-2018

After red splunk document, i still confuse thawed directory and frozen. i would like to ask you, what is thawed directory? when does data move to thawed directory?

SoknySplunk · ‎09-28-2017

It works well, thanks you

SoknySplunk · ‎09-27-2017

Hi, I have example of date/time as below Mon 28 Dec 2015 06:26:19 PM ICT Mon 26 May 2014 04:52:02 PM ICT Fri 17 Feb 2017 04:01:59 PM ICT Wed 28 Jun 2017 05:49:04 PM ICT Wed 05 Oct 2016 06:46:30 PM ICT I want to sort it by date, month year... in the correct order. could you please tell me how to do it.

SoknySplunk · ‎07-24-2017

I want to collect log from user AD. I have used eventcode 4720 and eventcode 4624. i wonder how to combine these two events together and get table like this: host, RecordNumber, user_id, signature, status, admin_id, src_ip, logonby, logon_time, Create_time, Logon_ID

Posts	17
Solutions	0
Karma Given	0
Karma Received	0
Member Since	‎07-04-2017

Online Status	Offline
Date Last Visited	‎02-08-2023 02:26 AM

WinEvent whitelist not working

Convert Time Format

Does splunk central-system v7.1.3 compatible with ...

Can you help me figure out why my _audit and _inte...

Does anyone know query to show App reload Failure ...

Does host in one sourcetype gets updated or not?

Can you help me with my dropdown list show?

what is thawed directory and when does data move t...

sorting date/time

AD monitoring

Re: splunk and task manager

Re: WinEvent whitelist not working