Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About johnvr
johnvr
Path Finder
Member since:
07-30-2017
06-05-2020
Community Statistics
| Posts | 17 |
| Solutions | 2 |
| Karma Given | 4 |
| Karma Received | 3 |
| Member Since | 07-30-2017 |
Activity Feed
- Got Karma for Re: How to detect Splunk searches ran by users without justification?. 02-18-2021 05:07 PM
- Karma Re: Issue with syslog data getting behind when read from our syslog server with a universal forwarder for woodcock. 06-05-2020 12:50 AM
- Karma Re: "invalid key in stanza" error after restarting the forwarder using Splunk_TA_nix (Splunk Add-on for Unix and Linux) in eventgen.conf on forwarders running on AIX operating system for woodcock. 06-05-2020 12:50 AM
- Karma Re: Search head - Search peer communication direction in distributed enviroment for nickhills. 06-05-2020 12:50 AM
- Got Karma for Re: What is the difference between Splunk Enterprise and Splunk Enterprise Security ?. 06-05-2020 12:49 AM
- Got Karma for Re: What is the difference between Splunk Enterprise and Splunk Enterprise Security ?. 06-05-2020 12:49 AM
- Karma Re: targetRepositoryLocation only working in global? for woodcock. 06-05-2020 12:46 AM
- Posted Re: How to detect Splunk searches ran by users without justification? on Splunk Enterprise Security. 06-15-2019 12:30 PM
- Posted Re: C.I.M Authentication Data Model acceleration not accelerating action=success events on Reporting. 04-17-2019 02:13 PM
- Posted Re: In Splunk Enterprise Security, what are the pros and cons of querying across multiple Splunk systems? on Splunk Enterprise Security. 03-06-2019 12:11 PM
- Posted Re: In Splunk Enterprise Security, what are the pros and cons of querying across multiple Splunk systems? on Splunk Enterprise Security. 03-06-2019 10:09 AM
- Posted Re: Possible losing field values when using "stats...by field_name" on Splunk Search. 03-02-2019 09:30 PM
- Posted Re: Can you help me with some weird search behavior with SEDCMD? on Getting Data In. 03-02-2019 08:56 PM
- Posted Re: Splunk ES Installation and Configuration dashboard error. on Splunk Enterprise Security. 03-02-2019 08:29 PM
- Posted Re: Can I concatenate the arguments contained in Linux auditd "EXECVE" events? on Splunk Search. 10-18-2018 12:20 PM
- Posted Re: Can I concatenate the arguments contained in Linux auditd "EXECVE" events? on Splunk Search. 10-18-2018 12:07 PM
- Posted Re: Can I concatenate the arguments contained in Linux auditd "EXECVE" events? on Splunk Search. 10-18-2018 12:06 PM
- Posted Re: Can I concatenate the arguments contained in Linux auditd "EXECVE" events? on Splunk Search. 10-15-2018 10:56 AM
- Posted Re: Can I concatenate the arguments contained in Linux auditd "EXECVE" events? on Splunk Search. 10-12-2018 03:42 PM
- Posted Can I concatenate the arguments contained in Linux auditd "EXECVE" events? on Splunk Search. 10-11-2018 04:03 PM
Topics I've Started
06-15-2019
12:30 PM
1 Karma
There's plenty you can do in Splunk to monitor user activity - I would recommend the top answer to this previous question in how to do that:
https://answers.splunk.com/answers/12477/get-users-search-history.html
It shouldn't be difficult to build a dashboard looking at those, search performance, and other statistics like total # of searches, searches with poor SPL like "index=*", etc.
However, as @richgalloway mentioned, Splunk doesn't really have a concept of business justification.
You're better off looking at user and role permissions and limits to determine who has access to what datasets based on who would have a business justification for doing so.
It's my experience that "micro-managing" user searches in Splunk can lead to a negative work environment, especially if Splunk is being used in a security capacity. Especially for threat-hunting or IR, where searches can be run in parallel or quick succession, and a long process to justify each one can become prohibitive to the end goal.
... View more
04-17-2019
02:13 PM
If summariesonly=false doesn't produce results, then the problem isn't the acceleration, it's that the data's probably not normalized properly. There's no data to accelerate.
Try running " cim_Authentication_indexes tag=authentication | stats values(action)" - is "success" one of the listed values?
... View more
03-06-2019
12:11 PM
One additional comment: @mcronkrite gave a great presentation at .conf 2016 about ES multi-tenancy. Depending on the details of how the networks are laid out, you may be looking at what's essentially a multi-tenant deployment.
https://conf.splunk.com/files/2016/recordings/enterprise-security-multi-tenant-fundamentals.mp4
... View more
03-06-2019
10:09 AM
One other possible consideration is the Asset framework in ES. Namely, are these business units sharing the same internal IP space, or is it a separate 10. or 192.168.? I also would recommend using tags for each unit, thus - as DMA summaries include tags - this would give you and others the ability to narrow down those summaries by environment.
Also, as @pkeenan87 mentioned, indexer sizing will change when you move to ES - both for the sake of adding the DMA summaries themselves onto storage, but also for throughput. A general rule of thumb is that each indexer in an ES environment should only be indexing 1/3-1/2 of what a non-ES indexer is doing, as a result of the search load.
To that end, you may find it necessary to expand the IX tier in that environment.
... View more
03-02-2019
09:30 PM
Rather than running dedup + table, have you tried running stats values(src_ip)? Do you get different results?
... View more
03-02-2019
08:56 PM
In addition to @DavidHourani, I'd add - are you using any Heavy Forwarders? If so, does the SEDCMD configuration reside on them? You've stated that you know it won't work if the data's already indexed, but HF's don't need to index that data themselves, and they've already gone through the typing queue - where SECMD resides - before it reaches the indexers.
So if you DO have heavy forwarders, and this data crosses one of them, check to make sure that the SEDCMD configuration is being placed on those.
... View more
03-02-2019
08:29 PM
Hey @rafeeqsid25,
I'm assuming by your saying there's no data on the dashboard, there's no data on any of them? Your "all ES datamodels are accelerated" comment kind of tips me off, as it's not too common to see an environment where they all are.
There's kind of a lot to go through here, and I don't know how familiar you are with Splunk or its mechanisms, so I'll start at the baseline.
Do you know if your data is CIM-compliant? You can get an overview of CIM, the Common Information Model, here: https://docs.splunk.com/Documentation/CIM/4.12.0/User/Overview
ES dashboards are populated by searches based - mostly - on the summaries created by accelerated data models. But the acceleration of that data is dependent on the data being normalized to that Common Information Model.
Try this. Datamodel summaries - what model accelerations create - are generated by underlying searches. Those searches look something like this:
`relevant_indexes` tag=relevant
Take any of those models, and run their searches ad-hoc. Do you get results? If not, they're probably not CIM compliant, or you just don't have the data applicable to that model. Or both.
... View more
10-18-2018
12:20 PM
Then again... if I push everything to regular regex extractions, I'm going to have to account for any # of arguments... hm...
... View more
10-18-2018
12:07 PM
I'll add that these fields are just being parsed via KV_Mode, which might be part of the problem. It's breaking arguments that have spaces. Therefore, I may need to turn KV_Mode to none, and try regular regex extractions.
... View more
10-18-2018
12:06 PM
Getting much better results with the RegEx.
About 70% get parsed.
A couple examples that don't... (the second example makes sense b/c spaces are included in the argument)... I'll mess with this, but let me know if you've got any updates. One thing I've noticed... these EXECVE events end with the final argument. So "$" may be relevant somewhere.
argc=2 a0=df a1=-iP
argc=3 a0=sh a1=-c a2=rpm -qp --queryformat '%{NAME} %{VERSION}-%{RELEASE}\012' /tmp/prod-lti-number.x86_64.rpm
... View more
10-15-2018
10:56 AM
That works! Well, in some cases. In others, not. Investigating. Would this work in props.conf as an eval, or would it have to be an extraction, or...?
index=auditd type=EXECVE, the argc (the count) field is represented in about 96% of events, but that's only working in about 30%.
... View more
10-12-2018
03:42 PM
If I understand what you're asking, the answer is yes. It's always a+digit. a0, a1, a2, etc.
In some cases, I've seen this get into the 100s.
... View more
10-11-2018
04:03 PM
For example, a standard EXECVE event in my environment will appear as:
type=EXECVE msg=audit($something$) : arg=3 a0=systemctl a1=status a2=auditd.service
I'm attempting to concatenate those so that, in every event, I'll end up with a field, call it "total_argument" where the value in the above circumstance will be "systemctl status auditd.service"
The catch is, the argument number will obviously vary from event to event, and vary wildly - this means a simple eval to add a0, a1, and a2 would work only for the messages that only have 3 arguments.
I'm looking for a way to accomplish this that would concatenate those values regardless of how many arguments the event would have.
Is there a way to accomplish this in Splunk?
... View more
- Tags:
- splunk-enterprise
08-30-2018
08:09 PM
2 Karma
Splunk Enterprise is just the full name of "Splunk" - Enterprise Security is a premium suite of apps (see: additional licensing cost) that enriches, normalizes, accelerates, and - with great sex appeal - displays data for infosec purposes.
Another way to say it - Splunk is a data analytics platform, Enterprise Security (ES) is a SIEM built onto it.
... View more
02-01-2018
12:15 PM
This'll vary greatly depending on your needs, your users, and your environment (especially in comparison to your volume).
First, you can't cluster two indexers without adding a third appliance, a Cluster Master, but you can still employ it as a search peer -
non-clustered indexer - to balance the load.
A couple other ideas...
Offload smaller roles, like License Manager or Deployment Server, onto it.
Create a dedicated DMC
... View more
01-29-2018
10:08 AM
Alternatively, you can just scp it over if, for whatever reason, the forwarder's not a deployment client.
... View more
07-30-2017
07:57 AM
Thanks for your help in advance.
I have a set of single value visualizations inside a single dashboard panel. Each of these has drilldown panels that appear when you select the value, and that removes the drilldown panels that would appear when you select the others (each has , , etc.
What I'm trying to do is add another layer of differentiation - aside from a heading - as to which value is selected. I want to do that by changing colorMode to "block" if the drilldown is active. So it's a color-against-white if unselected, then when selecting it, it drills down into those panels, and also changes to a block colorMode, white-against-color. Does that make sense?
I've tried this a few ways - it won't take inside a , and I can't figure out how to set an to a token.
Is this possible...
So what I have right now is.....
<panel>
<title>Name of My Panel</title>
<single>
<title>Single Value One</title>
<search base="base">
<query>| stats count</query>
</search>
<option name="colorBy">value</option>
<option name="colorMode">none</option>
<option name="drilldown">all</option>
<option name="numberPrecision">0</option>
<option name="rangeColors">["0x65a637","0x65a637"]</option>
<option name="rangeValues">[0]</option>
<option name="showSparkline">1</option>
<option name="showTrendIndicator">0</option>
<option name="trendColorInterpretation">standard</option>
<option name="trendDisplayMode">absolute</option>
<option name="unitPosition">after</option>
<option name="useColors">1</option>
<option name="useThousandSeparators">1</option>
<drilldown>
<set token="show_dash_one">y</set>
<unset token="show_dash_two"></unset>
<unset token="show_dash_three"></unset>
</drilldown>
</single>
<single>
<title>Single Value Two</title>
<search base="base_two">
<query>| stats count</query>
</search>
<option name="colorBy">value</option>
<option name="colorMode">none</option>
<option name="drilldown">all</option>
<option name="numberPrecision">0</option>
<option name="rangeColors">["0xd93f3c","0xd93f3c"]</option>
<option name="rangeValues">[0]</option>
<option name="showSparkline">1</option>
<option name="showTrendIndicator">0</option>
<option name="trendColorInterpretation">standard</option>
<option name="trendDisplayMode">absolute</option>
<option name="unitPosition">after</option>
<option name="useColors">1</option>
<option name="useThousandSeparators">1</option>
<drilldown>
<set token="show_dash_two">y</set>
<unset token="show_dash_one"></unset>
<unset token="show_dash_three"></unset>
</drilldown>
</single>
<single>
<title>Single Value Three</title>
<search base="base_three">
<query>| stats count</query>
</search>
<option name="colorBy">value</option>
<option name="colorMode">none</option>
<option name="drilldown">all</option>
<option name="numberPrecision">0</option>
<option name="rangeColors">["0xd93f3c","0xd93f3c"]</option>
<option name="rangeValues">[0,30,70,100]</option>
<option name="showSparkline">1</option>
<option name="showTrendIndicator">1</option>
<option name="trendColorInterpretation">standard</option>
<option name="trendDisplayMode">absolute</option>
<option name="unitPosition">after</option>
<option name="useColors">1</option>
<option name="useThousandSeparators">1</option>
<drilldown>
<set token="show_dash_three">y</set>
<unset token="show_dash_one"></unset>
<unset token="show_dash_two"></unset>
</drilldown>
</single>
... and I'd like to find a way to either call a token in the option or write something in or both to accomplish this.
is this possible?
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:03 AM
|
