Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About lqiao
lqiao
Explorer
Member since:
04-15-2013
06-05-2020
Community Statistics
| Posts | 15 |
| Solutions | 0 |
| Karma Given | 0 |
| Karma Received | 1 |
| Member Since | 04-15-2013 |
Activity Feed
- Got Karma for splunk list monitor directories or files. 06-05-2020 12:46 AM
- Posted Find threat details for Dell SonicWALL Analytics App for Splunk on All Apps and Add-ons. 06-11-2018 08:16 AM
- Tagged Find threat details for Dell SonicWALL Analytics App for Splunk on All Apps and Add-ons. 06-11-2018 08:16 AM
- Tagged Find threat details for Dell SonicWALL Analytics App for Splunk on All Apps and Add-ons. 06-11-2018 08:16 AM
- Tagged Find threat details for Dell SonicWALL Analytics App for Splunk on All Apps and Add-ons. 06-11-2018 08:16 AM
- Tagged Find threat details for Dell SonicWALL Analytics App for Splunk on All Apps and Add-ons. 06-11-2018 08:16 AM
- Tagged Find threat details for Dell SonicWALL Analytics App for Splunk on All Apps and Add-ons. 06-11-2018 08:16 AM
- Posted Re: How to search how much bandwidth a forwarder is using? on Splunk Search. 06-07-2018 12:37 PM
- Posted Re: crawl search command doesn't exist on Splunk 7.0.2 on Splunk Search. 02-12-2018 09:24 AM
- Posted crawl search command doesn't exist on Splunk 7.0.2 on Splunk Search. 02-08-2018 01:49 PM
- Tagged crawl search command doesn't exist on Splunk 7.0.2 on Splunk Search. 02-08-2018 01:49 PM
- Posted Re: Why am I getting the following error after updating from 6.6.0 to 6.6.3: Invalid key in stanza [auditTrail] in /opt/splunk/etc/system/local/audit.conf on Splunk Search. 01-17-2018 12:42 PM
- Posted KV store issue for collection SavedSearchHistory on Knowledge Management. 01-09-2018 02:07 PM
- Tagged KV store issue for collection SavedSearchHistory on Knowledge Management. 01-09-2018 02:07 PM
- Posted Re: Different authentications for HEC Token on Security. 01-04-2018 03:09 PM
- Posted Re: Different authentications for HEC Token on Security. 01-04-2018 03:07 PM
- Posted Re: Different authentications for HEC Token on Security. 01-03-2018 08:38 AM
- Posted Re: Different authentications for HEC Token on Security. 01-03-2018 08:28 AM
- Posted Different authentications for HEC Token on Security. 01-02-2018 02:23 PM
- Tagged Different authentications for HEC Token on Security. 01-02-2018 02:23 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 1 |
06-11-2018
08:16 AM
Hi,
I am using Splunk App SonicWall Analytics. Sonicwall data is coming to Splunk via IPFIX with extensions.
I am struggling with the Threats v2 dashboard. The main query to find threats is: index=sonicwall tid=257 OR tid=357 OR tid=459 flow_to_virus_id!=0. This query returns events. But the panels of “Threats over time”, “Top Viruses Blocked” and “Where did the Virus come from?” don’t display proper information.
While digging into the Splunk Queries on the dashboard, I noticed that a field virus_name is used in above mentioned panels but there is no existence of such field. I went through the lookups and couldn’t find any mapping between flow_to_virus_id and virus_name.
In addition, I also would like to the mapping between the dest_ip (where did the virus come from) and the real name of the ”from place”.
In summary, what I like to see is the same as Sonicwall threat report:
- How many threats overtime are coming from viruses? And what are they?
- How many threats overtime are coming from Intrusions? And what are they?
- How many threats overtime are coming from spyware? And what are they?
Please help. Thank you very much!
... View more
06-07-2018
12:37 PM
Hi sbattista09,
I think jkellerman was referring the answer from jbsplunk that the function in the timechart should be avg instead of sum which I agree.
... View more
02-12-2018
09:24 AM
Thanks Chris. I received the same feedback from Laura Stewart - Sr Staff Technical Writer for the search command online doc.
... View more
02-08-2018
01:49 PM
when executing "| crawl root=/home/bob", I got below error:
Error in 'crawl' command: Cannot find program 'crawl' or script 'crawl'.
The latest Splunk version in the doc for this command is 6.6.5. Does this mean that this command has been removed? If so, why? If not, how to use it on 7.0.2? Thanks.
... View more
- Tags:
- splunk-enterprise
01-17-2018
12:42 PM
After our upgrade to 6.6.5 from 6.4.3, I am seeing the same error. Do you know more how to fix this? Thanks.
... View more
01-09-2018
02:07 PM
From time to time, I am getting below warning:
WARN SavedSearchHistory - Can't persist saved-search history due to the KV-Store either being disabled or failing
It doesn't appear all the time, just randomly. What does this message mean? How to fix this? We have KV-Store enabled. Thanks.
... View more
- Tags:
- splunk-enterprise
01-04-2018
03:09 PM
I never hear my feedback back. I did more testing and added comment to your answer. Thanks for your answer. I don't want to accept it directly as the version part might confuse other people. It is not your mistake. My comment is being reviewed by the moderator.
... View more
01-04-2018
03:07 PM
Hi outcoldman,
You are correct. I'd like to amend something to your answers after my testing. It is not your mistake. It is a Splunk doc issue.
Even in this doc http://dev.splunk.com/view/event-collector/SP-CAAAE8Y#basicauth, it says that "Basic authentication and query string authentications are new features in Splunk 6.4 and above.", basic and query string authentications are not working on Splunk 6.4.3, see the result in my question.
I tested on Splunk 6.5.6 (latest 6.5 version), basic authentication is working here. Query string authentication gave {"text":"Token is required","code":2} error, meaning that it is not supported on 6.5 version.
I tested also on Splunk 6.6.5 (latest 6.6 version), both basic authentication and query string authentication are supported. 6.6.0 is the first version supporting configuration allowQueryStringAuth. Splunk doc says by default, allowQueryStringAuth = false, so result: {"text":"Query string authorization is not enabled","code":16}. After setting it to true, result is {"text":"Success","code":0}. This setting is not visible in the default inputs.conf.
... View more
01-03-2018
08:38 AM
Looking at the example, it mentions:
Using Basic auth (6.5.0 and later only)
wrong in the doc?
... View more
01-03-2018
08:28 AM
Thank you. I am using Splunk 6.4.3. I can test with higher version today.
... View more
01-02-2018
02:23 PM
Hi,
I am following this online doc to test the three authentication for HEC tokens: http://dev.splunk.com/view/event-collector/SP-CAAAE7G. I don't understand why only HTTP authentication works while the other two gave different errors. Is it a permission issue? Please help. Thank you.
HTTP Authentication:
Command: curl -k http://hostname:8088/services/collector -H 'Authorization: Splunk tokenId' -d '{"sourcetype": "mysourcetype", "event":"Hello, World!"}'
Result: {"text":"Success","code":0}
Basic Authentication:
Command: curl -k -u "x:tokenID" http://hostname:8088/services/collector -d '{"sourcetype": "mysourcetype", "event":"Hello, World!"}'
Result: {"text":"Invalid authorization","code":3}
Query String:
Command: curl -k http://hostname:8088/services/collector/event?token=tokenId -d '{"sourcetype": "mysourcetype", "event":"Hello, World!"}'
Result: {"text":"Token is required","code":2}
... View more
- Tags:
- splunk-enterprise
12-18-2017
08:38 AM
Yes, you can use Windows TA or simply in the UF inputs.conf, configure the whitelist or blacklist. The whitelist or blacklist functionality exists only from UF v6 onwards.
The original post was in 2012, probably at that time, the solution was to do the regex on the indexer or heavy forwarder layer.
... View more
04-18-2013
12:50 AM
I found an answer to my own question. This problem is a known issue for release 4.3.6. See below:
http://docs.splunk.com/Documentation/Splunk/4.3.6/ReleaseNotes/KnownIssues
•Searches that contain subsearches do not return data in environments where search heads are running version 4.3.6 and indexers are running prior to 4.3.6. To work around this issue, upgrade indexers to the same version as the search heads. (SPL-65120)
... View more
04-18-2013
12:34 AM
Hi,
I have a search as follows:
query 1 [search query 2]
I find in the internet that Searches that contain subsearches do not return data in environments where search heads are running version 5.0.x and indexers are running version 4.3.x. To work around this issue, upgrade indexers to the same version as the search heads. (SPL-62457).
But our indexers are running version 4.3.5.2 and we upgraded search head to 4.3.6. Then the above search doesn't return any data any more. It works fine with search-head 4.3.5.2.
My problem is the same as known issue SPL-62457? If I upgrade indexer also to 4.3.6, this problem will disappear?
Thank you very much for your kink answer.
Lu
... View more
04-16-2013
05:10 AM
1 Karma
Hi,
When I execute command splunk list monitor: I see that there are two different types of monitoring: Monitored directories and Monitored Files.
For one specific monitored directory, does all the files of all the subfolders be monitored?
Thank you.
... View more
