About osasfrancis

osasfrancis · ‎05-27-2022

I am using Version 5.2.4. Yes, the field does not exist on this version, but it once did on older versions. Just cannot filter data based on scan name.

osasfrancis · ‎05-24-2022

I know this is an unsupported app, https://splunkbase.splunk.com/app/3501/ But does anyone have any suggestion? After the app install, when the app is launched. the inputs and configuration page is stuck on a loading screen with an unending spinning circle. have installed on 2 heavy forwarders and same thing. Any insight is highly appreciated.

osasfrancis · ‎05-23-2022

I am using Version 5.2.4. Yes, the field does not exist on this version, but it once did on older versions. Just cannot filter data based on scan name.

osasfrancis · ‎05-23-2022

For the latest version, Version 5.2.4, I have vulnerability data coming in from Tenable.SC. How can I filter the results based on the scan name? Cannot seem to figure it out. I remember in previous versions, we could leverage scan_result_info.name, but not in this latest version. Any thoughts is appreciated. Thanks

osasfrancis · ‎03-25-2022

HI, We are using the v5.2.3. Is there a way to get the scan name information? Thanks

osasfrancis · ‎09-13-2021

Hi, This solved my problem. Thanks

osasfrancis · ‎09-10-2021

I have the below test raw logs CEF:0|Forcepoint|Forcepoint DLP|8.8.0|55564097|DLP Syslog|2| act=Permitted duser=destuser@gmail.com fname=testfile.PDF.TXT - 11.01 KB msg=EndPoint Operation suser=User, Test cat=Test Category sourceServiceName=Endpoint Printing analyzedBy=Policy Engine testengine loginName=testuser1 sourceIp=N/A severityType=LOW sourceHost=testhost productVersion=8.0 maxMatches=0 timeStamp=2021-09-01 15:58:50.624 destinationHosts=N/A eventId=4762037341417287789 CEF:0|Forcepoint|Forcepoint DLP|8.8.0|55564097|DLP Syslog|2| act=Permitted duser=destuser@gmail.com fname=testfile.PDF.TXT - 11.01 KB msg=EndPoint Operation suser=User, Test cat=Test Category sourceServiceName=Endpoint Printing analyzedBy=Policy Engine testengine loginName=domain\\testuser sourceIp=N/A severityType=LOW sourceHost=testhost productVersion=8.0 maxMatches=0 timeStamp=2021-09-02 15:58:50.624 destinationHosts=N/A eventId=4762037341417287788 CEF:0|Forcepoint|Forcepoint DLP|8.8.0|55564097|DLP Syslog|2| act=Permitted duser=destuser@gmail.com fname=testfile.PDF.TXT - 11.01 KB msg=EndPoint Operation suser=User, Test cat=Test Category sourceServiceName=Endpoint Printing analyzedBy=Policy Engine testengine loginName=tuser sourceIp=N/A severityType=LOW sourceHost=testhost productVersion=8.0 maxMatches=0 timeStamp=2021-09-04 15:58:50.624 destinationHosts=N/A eventId=4762037341417287787 CEF:0|Forcepoint|Forcepoint DLP|8.8.0|55564097|DLP Syslog|2| act=Permitted duser=destuser@gmail.com fname=testfile.PDF.TXT - 11.01 KB msg=EndPoint Operation suser=User, Test cat=Test Category sourceServiceName=Endpoint Printing analyzedBy=Policy Engine testengine loginName=N/A sourceIp=N/A severityType=LOW sourceHost=testhost productVersion=8.0 maxMatches=0 timeStamp=2021-09-03 15:58:50.624 destinationHosts=N/A eventId=4762037341417287786 I am trying to use rex to extract a field called loginName, in which the regex will capture all entries after the "loginName=" text. I have tried ...| rex field=_raw "(loginName=)(?<loginName>[^\=]+)(?=\s)", but it does not capture all events. Please assist.

osasfrancis · ‎08-02-2021

It was a custom script.

osasfrancis · ‎07-09-2021

Yes. It does match.

osasfrancis · ‎07-08-2021

HI, In the below event example 7/8/2021 12:21:17 PM 111C PACKET 0000020BF8B054E0 UDP Snd xx.xx.xx.xx d6b8 R Q [8085 A DR NOERROR] AAAA (13)PC-3QZT282-D(7)system(2)us(0) 7/8/2021 12:21:17 PM 111C PACKET 0000020BF8B054E0 UDP Snd xx.xx.xx.xx d6b8 R Q [8085 A DR NOERROR] AAAA (13)PC-3QBVQ11-D(7)maintenance(2)us(0) I am trying to have a regex that would exclude the first entry from being indexed. Below is the config i have props.conf [Test:system] TRANSFORMS-null = setnull transforms.conf [setnull] REGEX = .+system.+ DEST_KEY = queue FORMAT = nullQueue After restarting splunk on the heavy forwarder, it still indexes the first event with system in the event. Please assist. Thanks

osasfrancis · ‎07-08-2021

We figured out the issue. Seems there was a script that was replacing the file. Thanks for all your responses.

osasfrancis · ‎06-30-2021

We do not use a third party app. Also, there is only 1 deploymentclient.conf file that is getting deployed. It is the same file that was de[p

osasfrancis · ‎06-30-2021

We are in the process of migrating a lot of hosts to report to a new deployment server. The deploymentclient.conf file was changed to reflect the IP address of the new deployment server and the hosts phones home to the new new deployment server and we verify logs coming in. Then after some time, something modifies the deploymentclient.conf file to have the hosts report back to the old deployment server. We cannot seem to figure out what is making this change. We have uninstalled and reinstalled the universal forwarder on a test client this past week and everything was fine. Then the same thing happened yesterday and the host is reporting back to the old deployment server. This is happening on some hosts, not all. The ones that do not have this problem are reporting to the same new deployment server with no problems. Any suggestions would be helpful

osasfrancis · ‎04-06-2021

Hi, Thanks for your response. It stopped indexing 4/3/2021. And since then, the text file has been overwritten every hour with new contents, but for some reason, it is just not picking up the updated file. Also, the program creating the text file does not have the ability to give the file a new name everytime it generates it.

osasfrancis · ‎04-05-2021

Hi all, i have a simple splunk app that monitors a folder and indexes a text file that is overwritten every hour. It works fine. Then all of a sudden, it just stops indexing, even as new files are created. Below are my configs. Any suggestion is appreciated inputs.conf [monitor://E:\Splunk\ccure\AllSites\*.txt] sourcetype = ccure:allsite:csv index = security disabled = false [monitor://E:\Splunk\ccure\Forced_Held\*.txt] sourcetype = ccure:door_csv index = security disabled = false props.conf [ccure:allsite:csv] SHOULD_LINEMERGE=false NO_BINARY_CHECK=true CHARSET=UTF-8 INDEXED_EXTRACTIONS=csv KV_MODE=none category=Structured disabled=false pulldown_type=true CHECK_METHOD=modtime [ccure:door_csv] SHOULD_LINEMERGE=true NO_BINARY_CHECK=true CHARSET=UTF-8 LINE_BREAKER=([\r\n]+) MAX_TIMESTAMP_LOOKAHEAD=180 disabled=false CHECK_METHOD=modtime SEDCMD-crop_extra_line=s/(?!match)Door Forced Report - InfoSec(?!match)($|([\r\n]+))//g TRANSFORMS-set=setnull

osasfrancis · ‎09-19-2019

@kpanchal, thanks for your response with this. From the link, in my previous comment, i was able to ping my servicenow instance from my splunk server successfully using command prompt.

osasfrancis · ‎09-18-2019

@kpanchal Apologies, how exactly do you ping from the splunk instance? The server in which i have the addon installed on can ping servicenow via cmd prompt.

osasfrancis · ‎09-16-2019

Were you able to resolve this?

Posts	18
Solutions	1
Karma Given	0
Karma Received	1
Member Since	‎08-16-2017

Online Status	Offline
Date Last Visited	‎11-18-2022 06:06 PM

OctopusDeploy- Stuck on loading screen

Tenable Add-On for Splunk- How can I filter the r...

Extract field using rex

Regex help

deploymentclient.conf getting overwritten

Splunk not indexing text file

Re: Tenable Add-On for Splunk

OctopusDeploy- Stuck on loading screen

Re: Tenable Add-On for Splunk

Tenable Add-On for Splunk- How can I filter the r...

Re: In the present version of Tenable Add-On for S...

Re: Extract field using rex

Extract field using rex

Re: deploymentclient.conf getting overwritten

Re: Regex help

Regex help

Re: deploymentclient.conf getting overwritten

Re: deploymentclient.conf getting overwritten

deploymentclient.conf getting overwritten

Re: Splunk not indexing text file

Splunk not indexing text file

Re: Splunkbase Add on ServiceNow

Re: Splunkbase Add on ServiceNow

Re: Splunkbase Add on ServiceNow