About eidil

eidil · ‎10-22-2020

Sorry for the confusion, but my intention is to know how the huawei device data can be indexed in splunk and populated with important fields/formats that can be used for such as ESS app. seems that for cisco appliances, you can use TA-cisco-app for the logs to be populated with important fields. Any alternatives for huawei devices?

eidil · ‎10-21-2020

Hi, I am trying to ingest huawei USG6650 device logs but it seems that no app is available in splunk base for this purpose. Is there any other way/guide for this?

eidil · ‎09-09-2020

eidil · ‎09-09-2020

Somethg like this

eidil · ‎09-09-2020

Hi @thambisetty , it seems d-able but the real logs are having much more details. How do we know which fields needs to be written in the streamstats command?

eidil · ‎09-07-2020

I am trying to join two searches based on closest time to match ticketnum with its real event e.g. index=monitoring, 12:01:00 host=abc status=down 3:05:00 host=abc status=down index=ticket 12.03:00 host=abc ticketnum=inc123 3:07:00 host=abc ticketnum=inc456 Any idea on how to join these two based on closest time?

eidil · ‎08-18-2020

This query is just a part of some more complex query. the subsearch will return specific host name while the main search will search the disk space volume at a specified time.

eidil · ‎08-18-2020

My previous team has set a static host name in the input.conf. I am currently trying to make the IP as the host name. I had tried using host_segment=3 and it did not work. Any suggestions? [default] host = IDSPGASPVLOGP01 [monitor:///opt/syslog/172.16.43.126/*/*/*] disabled = 0 sourcetype = cisco:ios interval = 30 [monitor:///opt/syslog/172.16.63.77/*/*/*] disabled = 0 sourcetype = cisco:ios interval = 30 [monitor:///opt/syslog/172.16.43.30/*/*/*] disabled = 0 sourcetype = cisco:ios interval = 30

eidil · ‎08-17-2020

because i'm trying to get results based on host_name in host_tier.csv with gold tier SLA

eidil · ‎08-16-2020

I am trying to use data models in my subsearch but it seems it returns 0 results. | datamodel disk_forecast C_drive search | join type=inner host_name [ | datamodel disk_forecast C_drive search | search value > 80 | stats count by host_name | lookup host_tier.csv host_name output host_name, tier | search tier = G | fields host_name ] |timechart span=1d first(value) by host_name limit=0 I tried using normal searches to replace the data model and it worked fine. Is there any restriction of using datamodel in subsearch?

eidil · ‎04-16-2020

You can edit the app.conf file. Search for the install stanza and change: is_configured = true

Posts	11
Solutions	0
Karma Given	1
Karma Received	2
Member Since	‎04-16-2020

Online Status	Offline
Date Last Visited	‎03-23-2021 03:36 AM

Indexing Huawei Firewall device logs into Splunk

Joining two search based on closest time

dynamic host name

How to use data models in subsearch

Re: Indexing Huawei Firewall device logs into Splu...

Indexing Huawei Firewall device logs into Splunk

Re: Joining two search based on closest time

Re: Joining two search based on closest time

Re: Joining two search based on closest time

Joining two search based on closest time

Re: How to use data models in subsearch

dynamic host name

Re: How to use data models in subsearch

How to use data models in subsearch

Re: Cisco Security Suite Setup Failure