About realtimetechnol

realtimetechnol · ‎09-24-2020

Hi, I am almost there on this task but need some assitance please on how to target different indexes. I have a number of UF's sending WinEventLog to HF's. The HF has the prop/trans to send to two different instances. I now need to send it to different indexes i.e. instance1=indexa, instance2=indexb. This is my current props/transforms files. (hostname used initially to simplify) props.conf [host::hostname] TRANSFORMS-routing = dual_ship transforms.conf [dual_ship] REGEX=(.) DEST_KEY=_TCP_ROUTING FORMAT=group1, group2 Then I have outputs.conf with the groups within the tcpout stanzas. Thanks in advance 🙂

realtimetechnol · ‎07-08-2020

Hi All, I appreciate that there are tons of answers on this but I am having issues getting it to work! I have a csv named known-ip-addresses.csv it contains the same fields as those in the indexed data eventName, src, "user.Identity.arn" in exactly the same case and separated. The inputlookup works ok and I can search against values. I have not created a lookup definition In the indexed data we have a sourcetype with the same fields, I am trying to find any ip's (src field) that are not in the inputlookup. sourcetype=aws:cloudtrail eventName=ConsoleLogin NOT [inputlookup known-ip-addresses.csv | fields eventName, src, "user.Identity.arn" ] The result is that I am getting a mix of addresses that are in the csv as well as those that are not. Can anyone point me in the right direction? Thanks in advance.

realtimetechnol · ‎06-10-2020

Hi All, I am in the process of creating an app for AWS sources and one of the objectives is to alert when an account stops sending events. As there are a number of sources per account I have settled on the one source that all accounts provide, CloudTrail. There may be a flaw in my logic but I will continue for now. I have looked at the TA's data however we aggregate into a single account so this would not be representative. The feeds are via either the AWS TA or HEC. The problem I am having is to alert when the source stops, I have created a similar app to DMC i.e. a list of accounts feed into a lookup but the problem I am having is that unlike DMC there is no avg__tcp_kbps etc to understand if the feed has stopped. I also looked at taking the date_second, date_mday etc but need a way of updating the lookup csv with the values. My questions is, has anyone done anything similar with AWS feeds or are there some values around time that I could use? Thanks

realtimetechnol · ‎05-07-2020

Hi jkat54, If only I had access to the file system 😞 , this is a cloud (managed) deployment so unfortunately I only get to use the UI however, the TA's are on the SH for ES. This particular TA is the O365 Add-on https://splunkbase.splunk.com/app/4055/ Thanks for your help 🙂

realtimetechnol · ‎05-07-2020

Hey DalJeanis, Thanks for the response 🙂 Unfortunately I am unable to create apps on this SH as it is an ES SH under managed cloud 😞 I followed your thought process and looked at the source types producing some of the same fields, in this example I will use 'src_user'. Obviously there were loads as it is a CIM field, I then looked at what field aliases there were and again, lots of these exist and from many add-on's, I check global visibility and permissions, at this point I am going round in circles when I think what if I just create the field alias in the ES app - Wow!!, that worked but more interestingly is that all the other fields under the src* become available. Not sure what is going on here but that has to be a bug? unless you have any ideas I will log it as a ticket and see if I get an explanation. Thanks Again - 🙂

realtimetechnol · ‎05-06-2020

Hi, I wonder if anyone can help. Running a search in Splunk search & reporting I see all the fields as required using the sourcetype, index, source etc. Running the same search in ES (same search head), within the search and using the same search, I don't get all the same fields. Example being src_user, src_user_email. The following are true: Splunk TA is on both search heads Permissions on the TA are Global and read is available to all Using the same searches in verbose mode Checked that there are no field aliases etc in the UI This is a Splunk Cloud managed instance Any help would be very much appreciated 🙂

Posts	6
Solutions	0
Karma Given	2
Karma Received	0
Member Since	‎05-06-2020

Online Status	Offline
Date Last Visited	‎10-05-2020 11:07 AM

Sending WinEventLog to different instances and dif...

Finding ip's not in a inputlookup

AWS Missing feeds

Splunk ES Search - Sourcetype fields issue

Sending WinEventLog to different instances and dif...

Finding ip's not in a inputlookup

AWS Missing feeds

Re: Splunk ES Search - Sourcetype fields issue

Re: Splunk ES Search - Sourcetype fields issue

Splunk ES Search - Sourcetype fields issue

Are you a member of the Splunk Community?