About dimitris_vergos

dimitris_vergos · ‎04-20-2016

Hello, I have a location map/image of a large factory, and would like to show on the factory the areas where specific sensors are generating data, and overlay that error message or metric on that specific part of the image/map. Any ideas on how I can define specific areas on the location map/image? I was thinking chloroform maps, but for that you need long/lat which I do not have. What I was thinking is, if there was a way to define the location and when one of the sensors which has a unique ID, I can lookup a file that gives me the quadrant that the sensor is in and show the error within that location. Does anyone have any ideas?

dimitris_vergos · ‎03-14-2016

Events within RSA enVision can output directly to a flat file by way of the “lsdata” command. Based on specific criteria passed with the lsdata command, events collected are presented in a syslog formatted log file. Example: lsdata –events syslog –time start now >> log.unx After that you can have these files be picked up by Splunk UF/HF and forward them to your Splunk index. /D

dimitris_vergos · ‎03-12-2016

If anyone else has the same question, this is the query that I used. Note: Some additional field extractions may be necessary. "SELECT TOP 100000 i.date_time as [date], i.record_number as session_id, i.source_server_ip_int as dvc, i.source_ip_int as src, i.destination_ip_int as dest, i.full_url, i.url, i.port, p.name as app, pc.name as app_category, i.bytes_sent as bytes_out, i.bytes_received as bytes_in, i.duration, i.category as category_id, CASE when c.parent_category=0 then c.name ELSE c.child_name END as category, u.user_login_info as [user], i.hits, d.description as action_description, dp.name as ws_action FROM (((((incoming i left join users u on i.user_id=u.user_id) left join protocols p on i.protocol_id=p.id) left join protocol_category pc on p.parent_id=pc.id) left join category c on i.category=c.category) left join disposition d on i.disposition_code=d.disposition_code) left join disposition_parent dp on d.blocking=dp.disposition_parent_id"

dimitris_vergos · ‎11-18-2015

Any luck with this? I am also trying to set it up, but the script fails at running gets stuck here - 2015-11-19 11:22:30,811 INFO nexpose_setup:34 - Executing nexpose_setup.py

dimitris_vergos · ‎10-29-2015

I will proceed with DB connect, and pull in the data from there and monitor also to see the load that it will apply by pulling the data.

dimitris_vergos · ‎10-29-2015

Has anyone imported data into Splunk from Websense Proxy in version 7.5? Unfortunately, you cannot send to SIEM via Syslog and need to grab the data from the SQL Database. If anyone has done this, do you mind sharing the process.

dimitris_vergos · ‎05-14-2015

Hello Guys/Girls, just as an update so far I have filtered out the events in a manual way using the following query: //Original | tstats summariesonly min(_time) as firstTime,max(_time) as lastTime from datamodel=Authentication where Authentication.app!=unknown by Authentication.app | drop_dm_object_name("Authentication") | inputlookup append=T access_app_tracker | stats min(firstTime) as firstTime,max(lastTime) as lastTime by app | outputlookup access_app_tracker | stats count //Modified | tstats summariesonly min(_time) as firstTime,max(_time) as lastTime from datamodel=Authentication where Authentication.app!=unknown Authentication.app!=*_small by Authentication.app | drop_dm_object_name("Authentication") | inputlookup append=T access_app_tracker | stats min(firstTime) as firstTime,max(lastTime) as lastTime by app | outputlookup access_app_tracker | stats count

dimitris_vergos · ‎05-14-2015

Hello, I am seeing that ES app. also brings in data from the _internal index and add it to the ES application dashboards. For example, I am seeing in the Access dashboard that it brings in a lot of data from *-too_small data files which are related to splunk running remote searches. what is the best way to actually filter out these events from not being searched by the Splunk dashboards? I don't want to actually go and edit every single dashboard and modify the searches, but on the other hand I still want this data to be stored in the _internal index as well. Thank you.

dimitris_vergos · ‎03-04-2015

Here you go, ID V_ID C_ID C_IP L_ID V_DATE V_F V_M 90050 1 6 31.5.253.88 8 2015-03-04 14:26:56 58 1

dimitris_vergos · ‎03-03-2015

Hello, I am trying to import data from a MySQL database. While the import works fine, the time field gets populated with the time that the event is being imported, but not the 'datetime' field that I have specified in the database (in my case V_Date). inputs.conf / [$SPLUNK_HOME/var/lib/splunk/persistentstorage/dbx] [dbmon-tail://CTM/CTM Violations] host = CTM index = development_index output.format = kv output.timestamp = 0 query = SELECT VIOLATION_ID,V_DATE,VIOLATION_TYPE_ID,V_CLIENT_ID,VIOLATION_SOURCE, VIOLATION_FREQUENCY,V_LICENCE_ID,V_MODULE_ID\r\nFROM VIOLATIONS {{WHERE $rising_column$ > ?}} sourcetype = CTM Violations tail.rising.column = VIOLATION_ID interval = auto table = CTM Violations disabled = 0 output.timestamp.column = V_DATE output.timestamp.format = yyyy-MM-dd HH:mm:ss I have also tried without the output.timestamp.column = V_DATE output.timestamp.format = yyyy-MM-dd HH:mm:ss Date Column is V_DATE // V_DATE datetime. I tried creating a props.conf file at a second stage. [host::CTM] DATETIME_CONFIG = NONE SHOULD_LINEMERGE = false Any suggestions?

dimitris_vergos · ‎09-29-2014

Hello, I have set up ES and I am trying to input information from IIS. While the information is being parsed correctly and the fields are being seperated as they should (via the pre-built sourcetype=iis), I see that in the ES is it not being normalized as it should. I also see that there is no TA for it as well. I have tried adding field-alias on the Search head as seen in http://answers.splunk.com/answers/128538/ta-for-iis-that-follows-the-common-information-model.html My architecture consists of UF -> HF -> Indexer -> SH (different boxes for all). So far the fields are not being normalized correctly.

dimitris_vergos · ‎09-28-2014

Hello, I see in the ES Guide @ http://docs.splunk.com/Documentation/ES/latest/Install/AdvancedThreatdashboards that you can integrate with domaintools.com in order to identity any new domains showing up. But when I go to domaintools.com to sign up for the free api, I think this has changed, and you can only buy now packages. Has anyone tried it? is that correct? If so, is there another service that can be used?

dimitris_vergos · ‎09-23-2014

Thanks MarioM

dimitris_vergos · ‎09-23-2014

Hello, Is there any issue or concern if I add specific tags to specific data coming in (i.e. DR Site) to Splunk, even though they are CIM compliant and are being used by the ES application? Will that break anything?

dimitris_vergos · ‎09-23-2014

Yes, you are right, played around with it a bit and now it is working byt adding in the inputs.conf the necessary index. Now my questions is the following Regarding Point one. I have a deployment server, and I have deployed the Splunk_TA_Windows application to my UFs (which contain my local folder with the inputs.conf, outputs.conf file, and other files/folders such as props.conf etc.). Now for my HF I should create a different application on my deployment server that will include all Splunk_TA_Windows files (excluding inputs.conf and outputs.conf, since they are being managed by a different application) is that correct? Also for the Search Head, since it will not be doing any receiving of data, do I have to modify anything and create a local directory for the TA_Windows or leave it as is @ $SPLUNK_HOME/etc/apps with its default directory?

dimitris_vergos · ‎09-23-2014

Hello, I am currently doing a Splunk implementation where I have multiple Universal Forwarders which will be sending information to my Heavy Forwarders, where we will be doing a lot of filtering (thus is why we choose to have HF in between). Thus the flow of events as of now is the following: UF -> HF -> Indexer I have two questions as of now: 1.When it comes to TAs for Windows (even for Linux), do I have to place them both on the UF and HF (ofcourse I have to put them on the SH as well) or does it suffice if I put them just on the UF? 2.When information is coming in my UF into my HF I want them to go to a particular index. From what I have tested by just adding in the inputs.conf file the following: HF - inputs.conf [splunktcp://9997] index = os_index it wont' put the information into the index i want Second attempt that i did was try to also modify the inputs.conf at the indexer for that particular HF: [splunktcp://HF1:9997] index = os_index but still no luck. What is the best method to do it? I have to add routing information on the HF to push it to the correct index? If so, do I need to also deploy the Windows/Linux TAs on the HF as well?

Posts	16
Solutions	0
Karma Given	0
Karma Received	5
Member Since	‎08-23-2014

Online Status	Offline
Date Last Visited	‎06-05-2020 02:03 AM

How to overlay images on certain locations of a ma...

How to import data into Splunk from Websense Proxy...

ES app. bringing in _internal data into dashboards

Splunk DB Connect: Why is the timestamp specified ...

IIS and ES application & CIM

domaintools & Splunk ES Integration

Tagging Data from data sources that are CIM compli...

Using Heavy Forwarders as an intermediary Layer

How to overlay images on certain locations of a ma...

Re: RSA envision SIEM integration

Re: How to import data into Splunk from Websense P...

Re: Rapid7 Enterprise application failing to confi...