Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About anuremanan88
anuremanan88
Explorer
Member since:
07-30-2017
06-23-2020
Community Statistics
| Posts | 32 |
| Solutions | 0 |
| Karma Given | 1 |
| Karma Received | 3 |
| Member Since | 07-30-2017 |
Activity Feed
- Karma Re: Help with writing a join command that joins a security breach to the previous login for somesoni2. 06-05-2020 12:49 AM
- Got Karma for Re: Splunk Enterprise Security: Issue found in "SA-IdentityManagement" : Identity - Asset CIDR Matches - Lookup Gen. 06-05-2020 12:49 AM
- Got Karma for How to show values only for data overlay in a chart?. 06-05-2020 12:49 AM
- Got Karma for How to show values only for data overlay in a chart?. 06-05-2020 12:49 AM
- Posted How to use tcaddindicator command in threat connect app on Splunk Enterprise Security. 05-08-2020 09:22 PM
- Tagged How to use tcaddindicator command in threat connect app on Splunk Enterprise Security. 05-08-2020 09:22 PM
- Tagged How to use tcaddindicator command in threat connect app on Splunk Enterprise Security. 05-08-2020 09:22 PM
- Posted Re: How do I update GeoLite2-City-Latest.mmdb on a deployment server? on Deployment Architecture. 02-03-2020 07:49 AM
- Posted Unable to View Notable when searching with event_id field on Splunk Enterprise Security. 12-12-2019 07:06 AM
- Tagged Unable to View Notable when searching with event_id field on Splunk Enterprise Security. 12-12-2019 07:06 AM
- Tagged Unable to View Notable when searching with event_id field on Splunk Enterprise Security. 12-12-2019 07:06 AM
- Posted Re: RSA Archer Data into Splunk on Dashboards & Visualizations. 03-06-2019 07:01 AM
- Posted Re: RSA Archer Data into Splunk on Dashboards & Visualizations. 03-06-2019 07:00 AM
- Posted Re: RSA Archer Data into Splunk on Dashboards & Visualizations. 03-05-2019 07:00 AM
- Posted RSA Archer Data into Splunk on Dashboards & Visualizations. 03-05-2019 06:55 AM
- Tagged RSA Archer Data into Splunk on Dashboards & Visualizations. 03-05-2019 06:55 AM
- Tagged RSA Archer Data into Splunk on Dashboards & Visualizations. 03-05-2019 06:55 AM
- Tagged RSA Archer Data into Splunk on Dashboards & Visualizations. 03-05-2019 06:55 AM
- Posted Re: Splunk Enterprise Security: Issue found in "SA-IdentityManagement" : Identity - Asset CIDR Matches - Lookup Gen on Splunk Enterprise Security. 02-28-2019 07:04 AM
- Posted Re: Logic Behind Geographically Improbable Access Detected ? on Splunk Dev. 02-28-2019 05:05 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 2 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
05-08-2020
09:22 PM
Hi, Anyone using threat connect app for Splunk. There are a bunch of commands built-in with this app. Do you know how to use them? We tried to run the tcaddindicator command. But it doesn't seem to work.
... View more
Labels
- Labels:
-
Other
02-03-2020
07:49 AM
Is your issue resolved? What did you do?
... View more
12-12-2019
07:06 AM
We have a panel in ES App Security Posture dashboard which shows all the overdue notables. While clicking on each notable, it will redirect to the incident review panel and search for the notable using the event_id field. For some notables we are not able to get the results, while some are showing results. I am attaching the screenshot. Anyone can help on this?
... View more
03-06-2019
07:01 AM
Actual log sample is
"
Mar 4 12:57:01 hostname vendor: RSA, product:Archer, version:1.0, ArcherVersion:6.4.10300.1028,ArcherInstance:prod,LogSourceIdentifier:10.240.88.47:0,eventtime:4/03/2019 4:57:01 AM,eventid:14, ArcherLog:" UserId:123 UserName:"123, 456" LogDate:4/03/2019 4:57:01 AM MethodName:FieldDefinitionManager.Get InputParameter:fieldIds<System.Collections.Generic.IList`1[System.Int32]>:<ROOT><V a="16106" /><V a="16133" /><V a="15730" /><V a="15735" /><V a="15733" /><V a="15736" /><V a="15743" /><V a="15748" /><V a="15751" /><V a="15754" /><V a="15749" /><V a="15747" /><V a="15746" /></ROOT> OutputValues:<ROOT><V a="15730" /><V a="15733" /><V a="15735" /><V a="15736" /><V a="15743" /><V a="15746" /><V a="13447" /><V a="15748" /><V a="15749" /><V a="15751" /><V a="15754" /><V a="16106" /><V a="16133" /></ROOT> Success:True
Mar 6 22:48:33 hostname vendor: RSA, product:Archer, version:1.0, ArcherVersion:6.4.10300.1028,ArcherInstance:TEST,LogSourceIdentifier:10.240.88.48:0,eventtime:2019-03-06 14:48:34,eventid:14, ArcherLog:" UserId:123 UserName:"assd, dcdfd" LogDate:2019-03-06 14:48:34 MethodName:ArcherTech.DataFeed.Workflows.ScheduledDataFeedWorkflow, ArcherTech.DataFeed, Version=6.4.10300.1028, Culture=neutral, PublicKeyToken=null InputParameter:3DataFeedId381 OutputValues:708ace45-2db1-4418-8612-30f25ad897ee Success:True "
... View more
03-06-2019
07:00 AM
Sorry that is not my actual log sample. The xml tags got removed while uploading to splunk portal.
... View more
03-05-2019
07:00 AM
"
Mar 4 12:44:11 hostname vendor: RSA, product:Archer, version:1.x, ArcherVersion:6.4.x.x,ArcherInstance:xxxx,LogSourceIdentifier:xx.xx.xx.xx:x,eventtime:4/03/2019 14:44:11 AM,eventid:10, ArcherLog:" UserId:1234 UserName:"xxxx xxxxx" LogDate:4/03/2019 14:44:11 AM MethodName:FieldDefinitionManager.GetFieldDisplay InputParameter:fieldIds: OutputValues: Success:True
... View more
03-05-2019
06:55 AM
Anyone integrated RSA Archer with Splunk? I am currently ingesting data from Archer via syslog. However i am finding difficulty in extracting fields as the logs are having xml data embedded along with Key value pairs. I am giving a sample log below. Anyone can help me in extracting the fields?
"
Mar 4 00:00:11 hostname vendor: RSA, product:Archer, version:1.x, ArcherVersion:6.x.x.x,ArcherInstance:Prod,LogSourceIdentifier:xx.xxx.xx.xx:x,eventtime:xx/xx/xxxx xx:xx:xx AM,eventid:00, ArcherLog:" UserId:1234 UserName:"xxxxxx, xxxxxx" LogDate:xx/xx/xxxx xx:xx:xx AM MethodName:FieldDefinitionManager.GetFieldDisplay InputParameter:fieldIds: OutputValues: Success:True
... View more
- Tags:
- archer
- rsa
- splunk-data
02-28-2019
07:04 AM
1 Karma
Is the app updated? I am also facing this issue..
... View more
02-28-2019
05:05 AM
Is this command working anymore? I am not able to use this in the latest version of Splunk.
... View more
02-07-2018
05:50 AM
I have this option already enabled this option. It will enable datavalues for all fields. However I was looking to enable datavalue only for certain fields.
... View more
02-07-2018
02:26 AM
This option is hiding the fields Error and Warn. I want the chart for these fields, but it should hide the data values for these fields.
... View more
02-06-2018
09:25 AM
2 Karma
I have a bar chart with a data overlay in it. The chart shows the data values for the fields "Error" "Warn" and "Total". I require the chart to show values only for the field "Total". Other two fields "Error" and " Warn" should not show any values.
... View more
- Tags:
- splunk-enterprise
11-21-2017
03:57 AM
Using stats will remove other fields present in the event. Is there a way to keep the other fields also
... View more
11-21-2017
03:54 AM
I need to get the most recent event using the field LastUpdateTime field for each host. dedup wont work here.
... View more
11-21-2017
01:20 AM
We are collecting logs from McAfee and Splunk pulls information for each host every 1 Hr. The logs have two fields host and LastUpdateTime. I need to get the most recent event for each host using the LastUpdateTime without losing any other fields. Please help me in writing a query for this.
... View more
- Tags:
- splunk-enterprise
10-06-2017
07:04 AM
It gives the same result " Invalid value "1506657600-14400" for time term 'earliest' "
... View more
10-06-2017
06:40 AM
Hi ,
Thank You for your inputs. This worked when i use relative time as input. However when i give Date and time range as input. i am getting the below error
Invalid value "1506657600-4h" for time term 'earliest'
Hoe to fix this?
... View more
10-05-2017
01:41 PM
Hi I am trying to search for two event types each in different time range. Here i am using time token. The eventtypes are "Password Change" and "Login". When i apply search for last 4 hrs, my query should search "password change" event for last 4 hrs and "login" event for last 8hrs. Similarly when i change the time filter my query should change accordingly.
index=new (EventType="Password Change" earliest=$token.earliest$ latest=$token.earliest$) OR (EventType="Login" earliest=$token.earliest$-4h latest=$token.earliest$) | remaining query
Anyone can help me in this?
... View more
10-04-2017
12:36 PM
Thanks for the reply. Here i need to search time using input filter. I use input token for this. My search would look like this
(eventtype=breach earliest=$token.earliest$ latest=now) OR (eventtype=login earliest=$token.earliest$-4h latest=now).
But its not working
... View more
10-04-2017
11:41 AM
I have to search for two logs from same index using different time range. For example one eventtype is "login" and the other eventtype is "breach". In a single search i need to search for both eventtypes. But when i do a search for last 4 hrs, it should search eventtype "breach" for last 4 hrs and eventtype "login" for last 8 hrs. Anyone can help me in this?
... View more
10-04-2017
11:14 AM
Or in other ways. If I want to search login alone 1 Hrs earlier than the time i selected for security breach events, how can i do it.
... View more
10-04-2017
11:10 AM
Thank You so much. We were testing this for a week. Now we found another issue. If an user logins as 8:00 AM does some security breach events between 8:05 AM to 8:15 AM and when apply a time filter from 8:01 AM to 8:15 AM we will are not getting the correct data.
... View more
09-21-2017
08:15 AM
The coalesce is filling out my SecurityBreach events also with the Static Value.
... View more
09-21-2017
07:50 AM
Thank You. Very much appreciated. You made my work much easier. I have been testing it from yesterday. I have a small problem now. In the above scenario, some of my login events does not have Organization and OrgCode in it. I need to fill those fields with some static value and then map it to the SecBreach event. Can you help me?
... View more
09-20-2017
12:50 PM
I need to list them all and map the Organization and OrgCode to it from the corresponding Login Event
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-23-2020
01:26 PM
|
