Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About frizzoS3
frizzoS3
New Member
Member since:
09-07-2017
06-05-2020
Community Statistics
| Posts | 14 |
| Solutions | 0 |
| Karma Given | 0 |
| Karma Received | 0 |
| Member Since | 09-07-2017 |
Activity Feed
- Posted Error message: domain needs 'min' and 'max' fields on Security. 09-29-2017 08:46 AM
- Tagged Error message: domain needs 'min' and 'max' fields on Security. 09-29-2017 08:46 AM
- Posted Re: Is there a difference between guided and manual mode? Is there a difference between real-time and continuous? on Splunk Search. 09-28-2017 12:32 PM
- Posted Is there a difference between guided and manual mode? Is there a difference between real-time and continuous? on Splunk Search. 09-28-2017 09:32 AM
- Tagged Is there a difference between guided and manual mode? Is there a difference between real-time and continuous? on Splunk Search. 09-28-2017 09:32 AM
- Tagged Is there a difference between guided and manual mode? Is there a difference between real-time and continuous? on Splunk Search. 09-28-2017 09:32 AM
- Tagged Is there a difference between guided and manual mode? Is there a difference between real-time and continuous? on Splunk Search. 09-28-2017 09:32 AM
- Tagged Is there a difference between guided and manual mode? Is there a difference between real-time and continuous? on Splunk Search. 09-28-2017 09:32 AM
- Tagged Is there a difference between guided and manual mode? Is there a difference between real-time and continuous? on Splunk Search. 09-28-2017 09:32 AM
- Posted Re: How do I resolve this message: "maximum number of concurrent auto-summarization searches on this instance has been reached" on Splunk Search. 09-28-2017 09:27 AM
- Posted Re: How do I resolve this message: "maximum number of concurrent auto-summarization searches on this instance has been reached" on Splunk Search. 09-28-2017 08:44 AM
- Posted How do I resolve this message: "maximum number of concurrent auto-summarization searches on this instance has been reached" on Splunk Search. 09-27-2017 02:09 PM
- Tagged How do I resolve this message: "maximum number of concurrent auto-summarization searches on this instance has been reached" on Splunk Search. 09-27-2017 02:09 PM
- Posted Re: Why does it say there are events but then it says "No results found"? on Splunk Search. 09-21-2017 01:02 PM
- Posted Why does it say there are events but then it says "No results found"? on Splunk Search. 09-21-2017 12:17 PM
- Tagged Why does it say there are events but then it says "No results found"? on Splunk Search. 09-21-2017 12:17 PM
- Tagged Why does it say there are events but then it says "No results found"? on Splunk Search. 09-21-2017 12:17 PM
- Tagged Why does it say there are events but then it says "No results found"? on Splunk Search. 09-21-2017 12:17 PM
- Posted How can I search based on PCI requirements without using the Splunk App for PCI Compliance? on All Apps and Add-ons. 09-21-2017 10:55 AM
- Tagged How can I search based on PCI requirements without using the Splunk App for PCI Compliance? on All Apps and Add-ons. 09-21-2017 10:55 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
09-29-2017
08:46 AM
Hi
I have run the following search ( Endpoint - Malware Daily Count - Context Gen) verified from a couple of different sources, and get the above mentioned error message....any advice?
| tstats `summariesonly` dc(Malware_Attacks.signature) as infection_count from datamodel=Malware.Malware_Attacks
where earliest=-31d@d latest=-1d@d Malware_Attacks.action=allowed by Malware_Attacks.dest,_time
span=1d | stats sum(infection_count) as total_infection_count by _time
| stats count,median(total_infection_count) as median by _time
| eval min=0 | eval max=median*2 | xsCreateDDContext name=count_1d container=malware type=domain
terms="minimal,small,medium,large,extreme" scope=app app=SA-NetworkProtection | stats count
... View more
- Tags:
- splunk-enterprise
09-28-2017
12:32 PM
Hi
I am trying to change the Scheduling on a correlation search to Continuous from Real Time, and I am getting a field " Fields to Group by" in order to save the search.
I have entered a couple of different field names, but to no avail as I keep getting the following message...."There was an error saving the correlation search."
Any suggestions?
Thank you
Frank
... View more
09-28-2017
09:32 AM
Guided and Manual Mode?
Real Time and Continuous?
Is one more efficient then the other?
Thank you.
Frank
... View more
09-28-2017
09:27 AM
Hi
I currently do not see any Data Model on the Indexer, or on the DS and SH.
Any other options to disabled these scheduled searches?
Regards
Frank
... View more
09-28-2017
08:44 AM
Hi
I currently do not see any Data Model on the Indexer, or on the DS and SH.
Any other options to disabled these scheduled searches?
Regards
Frank
... View more
09-27-2017
02:09 PM
The below searches appear on my Skip Ration report with the following messages:
The maximum number of concurrent historical scheduled searches on this instance has been reached, and
The maximum number of concurrent auto-summarization searches on this instance has been reached.
I cannot locate these searches under the App to which they seem to belong to, nor am I finding them in Data Models.
Any suggestions on how to terminate these searches?
Thank you.
ACCELERATE_A3F1133B-692A-49B4-98B0-C6FC50DFB20D_splunk_app_stream_nobody_615f5f04b93533e7_ACCELERATE
ACCELERATE_DM_DA-ESS-ThreatIntelligence_Threat_Intelligence_ACCELERATE
ACCELERATE_DM_DellNetworking_Dell_Events_ACCELERATE
ACCELERATE_DM_SA-NetworkProtection_Domain_Analysis_ACCELERATE
ACCELERATE_DM_SA-ThreatIntelligence_Incident_Management_ACCELERATE
ACCELERATE_DM_SA-ThreatIntelligence_Risk_ACCELERATE
ACCELERATE_DM_SA-UEBA_UEBA_ACCELERATE
ACCELERATE_DM_cisco_ios_Cisco_IOS_Event_ACCELERATE
... View more
- Tags:
- splunk-enterprise
09-21-2017
01:02 PM
| tstats summariesonly max(_time) as _time,values(All_Traffic.src_category) as src_category,values(All_Traffic.dest_category) as dest_category,count from datamodel=Network_Traffic.All_Traffic by All_Traffic.src,All_Traffic.dest,All_Traffic.transport,All_Traffic.dest_port | drop_dm_object_name("All_Traffic") | is_traffic_prohibited(dest_port) | search (is_prohibited!="false" OR is_secure!="unknown") | fields _time,src,src_category,dest,dest_category,transport,dest_port,is_prohibited,is_secure
... View more
09-21-2017
12:17 PM
After running a search, I have the below results:
112,471 events (9/20/17 2:00:00.000 PM to 9/21/17 2:10:07.000 PM
But when I click on the Events tab, I see this: No results found. even though the search is in verbose mode.
How can I review those 112,471 events?
... View more
09-21-2017
10:55 AM
If downloading the PCI App is not an option, what would be the best/fastest way to create an index, or to generate searches based on the PCI requirements?
... View more
09-18-2017
07:08 AM
Good Morning
I am currently not seeing any Sys logs coming from the FW...should I enable the following command?
splunk enable listen -auth :
This is the config on the inputs.conf file....
[udp://514]
disable = 0
Thank you
Frank
Thank you.
... View more
09-15-2017
01:01 PM
Hi
Thank you for the info.
Would I need to restart the indexer after updating the file?
... View more
09-15-2017
12:59 PM
HI
Thank you for that.
Would I need to restart the indexer after updating the inputs file?
... View more
09-15-2017
11:27 AM
I am trying to send logs from Cisco Meraki FW to our Splunk instance. No universal forwarder is on the FW. Can I still have the logs sent to Splunk?...would it be on port 514 or 9997?
Thank you
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:03 AM
|
