About saotaigiri

saotaigiri · ‎01-18-2022

Please, how do I set up Azure nsg logs on Splunk clouds? Please, does anyone have any material on that?

saotaigiri · ‎12-11-2020

Does the forwarder have inputs defined and enabled? Has the forwarder written any error messages into its splunkd.log file? Please I'm not too sure what you are asking, I installed the forwarder the normal way via windows, put in the splunk id and PW, put in a deployment server IP with the normal port 8089, the indexer @ 9997 and finished the installation. Not sure what I did wrong. Please help I'm a novice.

saotaigiri · ‎12-10-2020

After installing the universal forwarder on the forwarding host using windows, the splunk enterprise has been able to detect it but it is not sending any logs. Has 0 deployed apps. Please I need help on how to get it to start forwarding logs. Thanks.

saotaigiri · ‎10-01-2020

The output of the query brings the source IP, number of dest port and IPs. So when I dug deeper by search source IP one by one I found each IP address traffic is UDP 514 which is syslog server, hence my intent to add dedup udp514 to the query. Please what do you think?

saotaigiri · ‎10-01-2020

The query below is what is used to detect scanning on a network: | tstats summariesonly=t allow_old_summaries=t dc(All_Traffic.dest_port) as num_dest_port dc(All_Traffic.dest_ip) as num_dest_ip from datamodel=Network_Traffic by All_Traffic.src_ip | rename "All_Traffic.*" as "*" | where num_dest_port > 100 OR num_dest_ip > 100 | sort - num_dest_ip Unfortunately it detects syslog scanning and causes false positives. Please I need help on how or where to add dedup udp514 to the syntax so it omits the syslog files it detects or an option on how to omit the syslog files. Thanks

saotaigiri · ‎09-10-2020

Please what is the query for this search?

saotaigiri · ‎09-10-2020

Please I am looking for a query to search for the top alerts that fired within 2 weeks (or within a time frame). I am also looking for a query to show anomalies within a time frame

saotaigiri · ‎09-10-2020

Please what is the query for this search?

saotaigiri · ‎08-14-2020

A forwarder which was working before has stopped for up to a month now. After checking, it is confirmed that the forwarder is correctly configured, the service is running and reporting to the indexer, however there is no data showing on the indexer side or when a search is run on splunk for that forwarder. Can someone please help me in the right direction?

saotaigiri · ‎06-30-2020

The query below is what I am using but it doesn't seem to work. Please can you look at it and if possible tweak to the correct one. | rest /services/server/info | eval LastStartupTime=strftime(startuptime, "%Y/%m/%d %H:%M:%S") | eval timenow=now() | eval daysup = round((timenow - startuptime) / 86400,0) | eval Uptime = tostring(daysup) + " Days" | table splunk_server LastStartupTime Uptime I am looking to get an alert when a server or host meant to be feeding Splunk goes down. Thanks

saotaigiri · ‎06-29-2020

Thanks for your reply, please could help to write the SPL query. I am not good at writing SPL queries.

saotaigiri · ‎06-26-2020

Hello, The server was turned off to test if the alert would work but t did not work. Please what can I do to get an alert where the forwarder is not getting any data

saotaigiri · ‎06-25-2020

Please who knows a website where I can get video tutorials on Splunk processing Language (SPL)

saotaigiri · ‎06-24-2020

It is greyed out, should i enable it?

saotaigiri · ‎06-24-2020

i need script in SPL to show when there is an idle forwarder or if a forwarder isn't forwarding

saotaigiri · ‎06-23-2020

Please i need a script that can give result when there is an idle logger, or when the fowarder isnt feed any information

saotaigiri · ‎04-14-2020

Please i want to learn search processing language, is there some of video tutorial in?

Posts	17
Solutions	1
Karma Given	0
Karma Received	0
Member Since	‎04-14-2020

Online Status	Offline
Date Last Visited	‎01-19-2022 11:22 AM

How do I set up Azure nsg logs on Splunk clouds?

Universal forwarder not for forwarding

Alert Omitting

Top alerts fires

Splunk Forwarder issue

Splunk processing Language (SPL)

Idle log

Script for idle logger

How to learn Search processing language?

How do I set up Azure nsg logs on Splunk clouds?

Re: Universal forwarder not for forwarding

Universal forwarder not for forwarding

Re: Alert Omitting

Alert Omitting

Re: Top splunk alerts that fired

Top alerts fires

Re: Top splunk alerts that fired

Splunk Forwarder issue

Re: Idle log

Re: Idle log

Re: Idle log

Splunk processing Language (SPL)

Re: Idle log

Idle log

Script for idle logger

How to learn Search processing language?