Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Are you a member of the Splunk Community?
Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- Find Answers
- :
- About osasfrancis
osasfrancis
Path Finder
Member since:
08-16-2017
04-17-2025
Community Statistics
| Posts | 18 |
| Solutions | 1 |
| Karma Given | 0 |
| Karma Received | 1 |
| Member Since | 08-16-2017 |
Activity Feed
- Posted Re: Tenable Add-On for Splunk on Splunk Search. 05-27-2022 07:24 AM
- Posted OctopusDeploy- Stuck on loading screen on All Apps and Add-ons. 05-24-2022 04:14 PM
- Posted Re: Tenable Add-On for Splunk on Splunk Search. 05-23-2022 12:10 PM
- Posted Tenable Add-On for Splunk- How can I filter the results based on the scan name? on Splunk Search. 05-23-2022 10:09 AM
- Posted Re: In the present version of Tenable Add-On for Splunk, why is scan result information missing in logs? on All Apps and Add-ons. 03-25-2022 11:32 AM
- Posted Re: Extract field using rex on Splunk Search. 09-13-2021 07:43 AM
- Posted Extract field using rex on Splunk Search. 09-10-2021 04:46 PM
- Posted Re: deploymentclient.conf getting overwritten on Deployment Architecture. 08-02-2021 10:19 AM
- Posted Re: Regex help on Deployment Architecture. 07-09-2021 09:28 AM
- Got Karma for Re: deploymentclient.conf getting overwritten. 07-09-2021 06:06 AM
- Posted Regex help on Deployment Architecture. 07-08-2021 02:12 PM
- Posted Re: deploymentclient.conf getting overwritten on Deployment Architecture. 07-08-2021 02:02 PM
- Posted Re: deploymentclient.conf getting overwritten on Deployment Architecture. 06-30-2021 12:19 PM
- Posted deploymentclient.conf getting overwritten on Deployment Architecture. 06-30-2021 10:22 AM
- Posted Re: Splunk not indexing text file on Getting Data In. 04-06-2021 10:30 AM
- Posted Splunk not indexing text file on Getting Data In. 04-05-2021 12:53 PM
- Posted Re: Splunkbase Add on ServiceNow on Splunk Enterprise Security. 09-19-2019 07:55 AM
- Posted Re: Splunkbase Add on ServiceNow on Splunk Enterprise Security. 09-18-2019 07:06 AM
- Posted Re: Splunkbase Add on ServiceNow on Splunk Enterprise Security. 09-16-2019 11:05 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
05-27-2022
07:24 AM
I am using Version 5.2.4. Yes, the field does not exist on this version, but it once did on older versions. Just cannot filter data based on scan name.
... View more
05-24-2022
04:14 PM
I know this is an unsupported app,
https://splunkbase.splunk.com/app/3501/
But does anyone have any suggestion? After the app install, when the app is launched. the inputs and configuration page is stuck on a loading screen with an unending spinning circle. have installed on 2 heavy forwarders and same thing.
Any insight is highly appreciated.
... View more
- Tags:
- OctopusDeploy
Labels
- Labels:
-
installation
05-23-2022
12:10 PM
I am using Version 5.2.4. Yes, the field does not exist on this version, but it once did on older versions. Just cannot filter data based on scan name.
... View more
05-23-2022
10:09 AM
For the latest version, Version 5.2.4, I have vulnerability data coming in from Tenable.SC. How can I filter the results based on the scan name? Cannot seem to figure it out. I remember in previous versions, we could leverage scan_result_info.name, but not in this latest version.
Any thoughts is appreciated.
Thanks
... View more
03-25-2022
11:32 AM
HI, We are using the v5.2.3. Is there a way to get the scan name information? Thanks
... View more
09-10-2021
04:46 PM
I have the below test raw logs CEF:0|Forcepoint|Forcepoint DLP|8.8.0|55564097|DLP Syslog|2| act=Permitted duser=destuser@gmail.com fname=testfile.PDF.TXT - 11.01 KB msg=EndPoint Operation suser=User, Test cat=Test Category sourceServiceName=Endpoint Printing analyzedBy=Policy Engine testengine loginName=testuser1 sourceIp=N/A severityType=LOW sourceHost=testhost productVersion=8.0 maxMatches=0 timeStamp=2021-09-01 15:58:50.624 destinationHosts=N/A eventId=4762037341417287789 CEF:0|Forcepoint|Forcepoint DLP|8.8.0|55564097|DLP Syslog|2| act=Permitted duser=destuser@gmail.com fname=testfile.PDF.TXT - 11.01 KB msg=EndPoint Operation suser=User, Test cat=Test Category sourceServiceName=Endpoint Printing analyzedBy=Policy Engine testengine loginName=domain\\testuser sourceIp=N/A severityType=LOW sourceHost=testhost productVersion=8.0 maxMatches=0 timeStamp=2021-09-02 15:58:50.624 destinationHosts=N/A eventId=4762037341417287788 CEF:0|Forcepoint|Forcepoint DLP|8.8.0|55564097|DLP Syslog|2| act=Permitted duser=destuser@gmail.com fname=testfile.PDF.TXT - 11.01 KB msg=EndPoint Operation suser=User, Test cat=Test Category sourceServiceName=Endpoint Printing analyzedBy=Policy Engine testengine loginName=tuser sourceIp=N/A severityType=LOW sourceHost=testhost productVersion=8.0 maxMatches=0 timeStamp=2021-09-04 15:58:50.624 destinationHosts=N/A eventId=4762037341417287787 CEF:0|Forcepoint|Forcepoint DLP|8.8.0|55564097|DLP Syslog|2| act=Permitted duser=destuser@gmail.com fname=testfile.PDF.TXT - 11.01 KB msg=EndPoint Operation suser=User, Test cat=Test Category sourceServiceName=Endpoint Printing analyzedBy=Policy Engine testengine loginName=N/A sourceIp=N/A severityType=LOW sourceHost=testhost productVersion=8.0 maxMatches=0 timeStamp=2021-09-03 15:58:50.624 destinationHosts=N/A eventId=4762037341417287786 I am trying to use rex to extract a field called loginName, in which the regex will capture all entries after the "loginName=" text. I have tried ...| rex field=_raw "(loginName=)(?<loginName>[^\=]+)(?=\s)", but it does not capture all events. Please assist.
... View more
Labels
- Labels:
-
rex
08-02-2021
10:19 AM
It was a custom script.
... View more
07-08-2021
02:12 PM
HI, In the below event example 7/8/2021 12:21:17 PM 111C PACKET 0000020BF8B054E0 UDP Snd xx.xx.xx.xx d6b8 R Q [8085 A DR NOERROR] AAAA (13)PC-3QZT282-D(7)system(2)us(0) 7/8/2021 12:21:17 PM 111C PACKET 0000020BF8B054E0 UDP Snd xx.xx.xx.xx d6b8 R Q [8085 A DR NOERROR] AAAA (13)PC-3QBVQ11-D(7)maintenance(2)us(0) I am trying to have a regex that would exclude the first entry from being indexed. Below is the config i have props.conf [Test:system] TRANSFORMS-null = setnull transforms.conf [setnull] REGEX = .+system.+ DEST_KEY = queue FORMAT = nullQueue After restarting splunk on the heavy forwarder, it still indexes the first event with system in the event. Please assist. Thanks
... View more
Labels
- Labels:
-
indexer
07-08-2021
02:02 PM
1 Karma
We figured out the issue. Seems there was a script that was replacing the file. Thanks for all your responses.
... View more
06-30-2021
12:19 PM
We do not use a third party app. Also, there is only 1 deploymentclient.conf file that is getting deployed. It is the same file that was de[p
... View more
06-30-2021
10:22 AM
We are in the process of migrating a lot of hosts to report to a new deployment server. The deploymentclient.conf file was changed to reflect the IP address of the new deployment server and the hosts phones home to the new new deployment server and we verify logs coming in. Then after some time, something modifies the deploymentclient.conf file to have the hosts report back to the old deployment server. We cannot seem to figure out what is making this change. We have uninstalled and reinstalled the universal forwarder on a test client this past week and everything was fine. Then the same thing happened yesterday and the host is reporting back to the old deployment server. This is happening on some hosts, not all. The ones that do not have this problem are reporting to the same new deployment server with no problems. Any suggestions would be helpful
... View more
Labels
- Labels:
-
deployment client
04-06-2021
10:30 AM
Hi, Thanks for your response. It stopped indexing 4/3/2021. And since then, the text file has been overwritten every hour with new contents, but for some reason, it is just not picking up the updated file. Also, the program creating the text file does not have the ability to give the file a new name everytime it generates it.
... View more
04-05-2021
12:53 PM
Hi all, i have a simple splunk app that monitors a folder and indexes a text file that is overwritten every hour. It works fine. Then all of a sudden, it just stops indexing, even as new files are created. Below are my configs. Any suggestion is appreciated inputs.conf [monitor://E:\Splunk\ccure\AllSites\*.txt] sourcetype = ccure:allsite:csv index = security disabled = false [monitor://E:\Splunk\ccure\Forced_Held\*.txt] sourcetype = ccure:door_csv index = security disabled = false props.conf [ccure:allsite:csv] SHOULD_LINEMERGE=false NO_BINARY_CHECK=true CHARSET=UTF-8 INDEXED_EXTRACTIONS=csv KV_MODE=none category=Structured disabled=false pulldown_type=true CHECK_METHOD=modtime [ccure:door_csv] SHOULD_LINEMERGE=true NO_BINARY_CHECK=true CHARSET=UTF-8 LINE_BREAKER=([\r\n]+) MAX_TIMESTAMP_LOOKAHEAD=180 disabled=false CHECK_METHOD=modtime SEDCMD-crop_extra_line=s/(?!match)Door Forced Report - InfoSec(?!match)($|([\r\n]+))//g TRANSFORMS-set=setnull
... View more
Labels
- Labels:
-
indexer
09-19-2019
07:55 AM
@kpanchal, thanks for your response with this. From the link, in my previous comment, i was able to ping my servicenow instance from my splunk server successfully using command prompt.
... View more
09-18-2019
07:06 AM
@kpanchal Apologies, how exactly do you ping from the splunk instance? The server in which i have the addon installed on can ping servicenow via cmd prompt.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
04-17-2025
08:59 AM
|
