Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About JimDeich
JimDeich
Path Finder
Member since:
05-10-2011
06-05-2020
Community Statistics
| Posts | 22 |
| Solutions | 1 |
| Karma Given | 0 |
| Karma Received | 2 |
| Member Since | 05-10-2011 |
Activity Feed
- Got Karma for Re: Filter strings of event before index. 06-05-2020 12:46 AM
- Got Karma for Trouble With Captchas on edit. 06-05-2020 12:46 AM
- Posted Re: $SPLUNK_HOME/etc/local/default use? on Getting Data In. 06-11-2015 04:14 PM
- Posted Re: $SPLUNK_HOME/etc/local/default use? on Getting Data In. 06-11-2015 03:59 PM
- Posted Re: $SPLUNK_HOME/etc/local/default use? on Getting Data In. 06-11-2015 03:51 PM
- Posted $SPLUNK_HOME/etc/local/default use? on Getting Data In. 06-11-2015 02:36 PM
- Tagged $SPLUNK_HOME/etc/local/default use? on Getting Data In. 06-11-2015 02:36 PM
- Tagged $SPLUNK_HOME/etc/local/default use? on Getting Data In. 06-11-2015 02:36 PM
- Posted Re: Why did my Splunkforwarder stop with the error "WatchedFile - About to assert due to: destroying state while still cached..." in the splunkd.log? on Monitoring Splunk. 04-11-2015 09:43 AM
- Posted Re: Cisco ASA 5520 -- Problem -- no IOS - linemerge on All Apps and Add-ons. 04-02-2015 07:50 PM
- Posted Re: Cisco ASA 5520 -- Problem -- no IOS - linemerge on All Apps and Add-ons. 04-01-2015 10:22 PM
- Posted Re: Cisco ASA 5520 -- Problem -- no IOS - linemerge on All Apps and Add-ons. 04-01-2015 09:22 PM
- Posted Re: Cisco ASA 5520 -- Problem -- no IOS - linemerge on All Apps and Add-ons. 03-31-2015 01:20 PM
- Posted Re: Cisco ASA 5520 -- Problem -- no IOS - linemerge on All Apps and Add-ons. 03-31-2015 06:48 AM
- Posted Re: Cisco ASA 5520 -- Problem -- no IOS - linemerge on All Apps and Add-ons. 03-31-2015 02:03 AM
- Posted Re: Cisco ASA 5520 -- Problem -- no IOS - linemerge on All Apps and Add-ons. 03-31-2015 01:58 AM
- Posted Re: Cisco ASA 5520 -- Problem -- no IOS - linemerge on All Apps and Add-ons. 03-30-2015 10:12 PM
- Posted Re: Cisco ASA 5520 -- Problem -- no IOS - linemerge on All Apps and Add-ons. 03-30-2015 05:06 AM
- Posted Re: Cisco ASA 5520 -- Problem -- no IOS - linemerge on All Apps and Add-ons. 03-29-2015 10:41 PM
- Posted Re: Does Splunk Add-on for Cisco ASA change the sourcetype for those logs then on and can it change the sourcetype for logs already indexed? on All Apps and Add-ons. 03-24-2015 06:29 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 1 | |||
| 0 |
06-11-2015
04:14 PM
I'm starting to think it's a typo and maybe the mean /etc/system/local . Thanks for running to check on it.
... View more
06-11-2015
03:59 PM
All, I appreciate the general help, but I am looking for a specific answer for the directory :
$SPLUNK_HOME/etc/local/default use .
This is NOT $SPLUNK_HOME/etc/system/local/
... View more
06-11-2015
03:51 PM
Appreciated, but I need a specific answer for this directory and am NOT finding one. Do you know the purpose of this dir? This is not $SPLUNK_HOME/etc/system/local it is: $SPLUNK_HOME/etc/local . I am fairly familiar with most config dir.
... View more
06-11-2015
02:36 PM
I have an app (Cloudpassage) that instructs to put a props.conf file in $SPLUNK_HOME/etc/local/default . I am not familiar with this dir and
cannot find much about it in documents. Does this have something to do with web interaction or modular inputs?
Plenty of somewhat similar dirs $SPLUNK_HOME/etc/system/local, $SPLUNK_HOME/etc/apps/appname/default,
$SPLUNK_HOME/etc/apps/appname/local ..
Non of our splunk install every have: $SPLUNK_HOME/etc/local .
Thanks!
... View more
04-11-2015
09:43 AM
I know this mean the file was in a transient state but I need a work-around for this also. It seem splunk should just drop the file and
go on.
... View more
04-02-2015
07:50 PM
Mikael -- This was it! I looked at our Fireeye logs and it looks like they could tolerate normal linebreaking. So I added a local dir override to the linebreaking under props.conf in the fireeye app.
[syslog]
LINE_BREAKER = ([\r\n]+)
Thanks!!! Thanks for hanging in! Happy Easter !
Jim
...
... View more
04-01-2015
10:22 PM
This is a promising tip. I can't even see what they are trying to do with that line break . The regex is
(?!pattern)
a perl negative look-ahead assertion, but it's not followed by a pattern, so I don't think it would ever catch a line break.
A little to late here (NJ, USA) to try tonight.
... View more
04-01-2015
09:22 PM
Here is the btool output for syslog on one of our indexers.
./splunk cmd btool props list syslog --debug
/opt/splunk/etc/apps/Splunk_TA_cisco-asa/default/props.conf [syslog]
/opt/splunk/etc/system/default/props.conf ANNOTATE_PUNCT = True
/opt/splunk/etc/system/default/props.conf BREAK_ONLY_BEFORE =
/opt/splunk/etc/system/default/props.conf BREAK_ONLY_BEFORE_DATE = True
/opt/splunk/etc/system/default/props.conf CHARSET = UTF-8
/opt/splunk/etc/system/default/props.conf DATETIME_CONFIG = /etc/datetime.xml
/opt/splunk/etc/apps/Splunk_TA_nix/default/props.conf EVAL-action = if(app="su" AND isnull(action),"success",action)
/opt/splunk/etc/apps/Splunk_TA_nix/default/props.conf EVAL-signature = if(isnotnull(inbound_interface),"firewall",null())
/opt/splunk/etc/system/default/props.conf HEADER_MODE =
/opt/splunk/etc/system/default/props.conf LEARN_SOURCETYPE = true
/opt/splunk/etc/apps/TA-FireEye_v3/default/props.conf LINE_BREAKER = ((?!))
/opt/splunk/etc/system/default/props.conf LINE_BREAKER_LOOKBEHIND = 100
/opt/splunk/etc/apps/Splunk_TA_nix/default/props.conf LOOKUP-action_for_syslog = nix_action_lookup vendor_action OUTPUTNEW action
/opt/splunk/etc/system/default/props.conf MAX_DAYS_AGO = 2000
/opt/splunk/etc/system/default/props.conf MAX_DAYS_HENCE = 2
/opt/splunk/etc/system/default/props.conf MAX_DIFF_SECS_AGO = 3600
/opt/splunk/etc/system/default/props.conf MAX_DIFF_SECS_HENCE = 604800
/opt/splunk/etc/system/default/props.conf MAX_EVENTS = 256
/opt/splunk/etc/system/default/props.conf MAX_TIMESTAMP_LOOKAHEAD = 32
/opt/splunk/etc/system/default/props.conf MUST_BREAK_AFTER =
/opt/splunk/etc/system/default/props.conf MUST_NOT_BREAK_AFTER =
/opt/splunk/etc/system/default/props.conf MUST_NOT_BREAK_BEFORE =
/opt/splunk/etc/apps/Splunk_TA_nix/default/props.conf REPORT-0authentication_for_syslog = ssh-login-events, ssh-session-close, ssh-disconnect, sshd_authentication_kerberos_success, sshd_authentication_refused, sshd_authentication_tried, sshd_login_restricted, pam_unix_authentication_success, pam_unix_authentication_failure, sudo_cannot_identify, ksu_authentication, ksu_authorization, su_simple, su_authentication, su_successful, wksh_authentication, login_authentication
/opt/splunk/etc/apps/Splunk_TA_nix/default/props.conf REPORT-account_management_for_syslog = useradd, userdel
/opt/splunk/etc/apps/Splunk_TA_nix/default/props.conf REPORT-dest_for_syslog = host_as_dest
/opt/splunk/etc/apps/Splunk_TA_nix/default/props.conf REPORT-firewall = ipfw, ipfw-stealth, ipfw-icmp, pf
/opt/splunk/etc/apps/Splunk_TA_nix/default/props.conf REPORT-routing = iptables
/opt/splunk/etc/apps/Splunk_TA_nix/default/props.conf REPORT-signature_for_syslog_timesync = signature_for_nix_timesync
/opt/splunk/etc/apps/Splunk_TA_nix/default/props.conf REPORT-src_for_syslog = src_dns_as_src, src_ip_as_src, host_as_src
/opt/splunk/etc/system/default/props.conf REPORT-syslog = syslog-extractions
/opt/splunk/etc/system/default/props.conf SEGMENTATION = indexing
/opt/splunk/etc/system/default/props.conf SEGMENTATION-all = full
/opt/splunk/etc/system/default/props.conf SEGMENTATION-inner = inner
/opt/splunk/etc/system/default/props.conf SEGMENTATION-outer = outer
/opt/splunk/etc/system/default/props.conf SEGMENTATION-raw = none
/opt/splunk/etc/system/default/props.conf SEGMENTATION-standard = standard
/opt/splunk/etc/apps/TA-FireEye_v3/default/props.conf SHOULD_LINEMERGE = false
/opt/splunk/etc/system/default/props.conf TIME_FORMAT = %b %d %H:%M:%S
/opt/splunk/etc/system/default/props.conf TRANSFORMS = syslog-host
/opt/splunk/etc/apps/Splunk_TA_cisco-asa/default/props.conf TRANSFORMS-force_sourcetype_for_cisco = force_sourcetype_for_cisco_asa,force_sourcetype_for_cisco_pix,force_sourcetype_for_cisco_fwsm
/opt/splunk/etc/apps/TA-cisco_ios/default/props.conf TRANSFORMS-force_sourcetype_for_cisco_ios = force_sourcetype_for_cisco_ios, force_sourcetype_for_cisco_ios-xr, force_sourcetype_for_cisco_ios-xe
/opt/splunk/etc/apps/TA-FireEye_v3/default/props.conf TRANSFORMS-updateFireEyeSourcetypes = fix_FireEye_CEF_st, fix_FireEye_CSV_st, fix_FireEye_XML_st, fix_HX_CEF_st
/opt/splunk/etc/apps/TA-FireEye_v3/default/props.conf TRUNCATE = 0
/opt/splunk/etc/system/default/props.conf category = Operating System
/opt/splunk/etc/system/default/props.conf description = Output produced by many syslog daemons, as described in RFC3164 by the IETF
/opt/splunk/etc/system/default/props.conf detect_trailing_nulls = false
/opt/splunk/etc/system/default/props.conf maxDist = 3
/opt/splunk/etc/system/default/props.conf priority =
/opt/splunk/etc/system/default/props.conf pulldown_type = true
/opt/splunk/etc/system/default/props.conf sourcetype =
I'm also going to set up a test splunk just to look at these logs.
I greatly appreciate your sticking with this.
JIm
... View more
03-31-2015
01:20 PM
Line breaker is definitely in like that.
LINE_BREAKER=([\r\n]+)
What does this parm do? I don't know it ?
LINE_BREAKER_LOOKBEHIND=100
I am really wonder if the absence of year in the date is causing an issue.
Could :
MAX_DAYS_AGO=2000
affect this?
I'll ask the guy doing the syslog to add the date business.
This is a tough one, I think I'll try support too.
Thanks Again!
... View more
03-31-2015
06:48 AM
The MAX_TIMESTAMP_LOOKAHEAD did not seem to help . Thanks again .
... View more
03-31-2015
02:03 AM
Here is an full set of 8 lines grouped together :
3/31/15
4:52:24.000 AM
Mar 31 04:52:24 10.232.1.103/10.232.1.103 %ASA-7-713236: IP = 68.172.254.106, IKE_DECODE RECEIVED Message (msgid=108dc641) with payloads : HDR + HASH (8) + NOTIFY (11) + NONE (0) total length : 80
Mar 31 04:52:24 10.232.1.103/10.232.1.103 %ASA-7-715047: Group = idtuser, Username = olanger, IP = 68.172.254.106, processing hash payload
Mar 31 04:52:24 10.232.1.103/10.232.1.103 %ASA-7-715047: Group = idtuser, Username = olanger, IP = 68.172.254.106, processing notify payload
Mar 31 04:52:24 10.232.1.103/10.232.1.103 %ASA-7-715075: Group = idtuser, Username = olanger, IP = 68.172.254.106, Received keep-alive of type DPD R-U-THERE (seq number 0x4f9430dd)
Mar 31 04:52:24 10.232.1.103/10.232.1.103 %ASA-7-715036: Group = idtuser, Username = olanger, IP = 68.172.254.106, Sending keep-alive of type DPD R-U-THERE-ACK (seq number 0x4f9430dd)
Mar 31 04:52:24 10.232.1.103/10.232.1.103 %ASA-7-715046: Group = idtuser, Username = olanger, IP = 68.172.254.106, constructing blank hash payload
Mar 31 04:52:24 10.232.1.103/10.232.1.103 %ASA-7-715046: Group = idtuser, Username = olanger, IP = 68.172.254.106, constructing qm hash payload
Mar 31 04:52:24 10.232.1.103/10.232.1.103 %ASA-7-713236: IP = 68.172.254.106, IKE_DECODE SENDING Message (msgid=bba9f381) with payloads : HDR + HASH (8) + NOTIFY (11) + NONE (0) total length : 80
The earlier example had more lines yet.
... View more
03-31-2015
01:58 AM
Here is an example of a set of lines wrongly being collapsed into a single event .
3/31/15
4:52:40.000 AM
Mar 31 04:52:40 10.232.1.103/10.232.1.103 %ASA-7-713236: IP = 200.89.4.66, IKE_DECODE RECEIVED Message (msgid=4993fc3e) with payloads : HDR + HASH (8) + NOTIFY (11) + NONE (0) total length : 80
Mar 31 04:52:40 10.232.1.103/10.232.1.103 %ASA-7-715047: Group = 200.89.4.66, IP = 200.89.4.66, processing hash payload
Mar 31 04:52:40 10.232.1.103/10.232.1.103 %ASA-7-715047: Group = 200.89.4.66, IP = 200.89.4.66, processing notify payload
Mar 31 04:52:40 10.232.1.103/10.232.1.103 %ASA-7-715075: Group = 200.89.4.66, IP = 200.89.4.66, Received keep-alive of type DPD R-U-THERE (seq number 0x5c59444a)
Mar 31 04:52:40 10.232.1.103/10.232.1.103 %ASA-7-715036: Group = 200.89.4.66, IP = 200.89.4.66, Sending keep-alive of type DPD R-U-THERE-ACK (seq number 0x5c59444a)
While in this case the lines grouped all have the same time stamp, that is not always the case.
I think it' s likely that the absence of a year in the time stamps is part of the issue.
I'll try your suggestion for MAX_TIMESTAMP_LOOKAHEAD .
Thanks!
... View more
03-30-2015
10:12 PM
The props.conf is on the indexer(s) not the light forwader.
The time stamps don't have the year. With you asking about them, and from some reading, I am thinking maybe failur to extract them is casusing the multi-line log.
I'll check with the guy that set ups the syslog piece about adding a second date / time stamp.
Thanks for helping ! more guidance appreciated.
... View more
03-30-2015
05:06 AM
I appreciate the help ..
Monitor Stanza:
[monitor:///data/newlogs/cisco/.log]
disabled = false
host_regex=([^\/]).\d{4}-\d{2}-\d{2}.log
index = ios
sourcetype = syslog
local props.conf for cisco:asa :
[cisco:asa]
CHARSET = utf-8
SHOULD_LINEMERGE=false
LINE_BREAKER = ([\r\n]+)
TIME_PREFIX = ^
TIME_FORMAT = %b %d %H:%M:%S
MAX_EVENTS = 1
Sample data, each line end with 0A \n
Mar 29 00:00:01 10.232.1.103/10.232.1.103 %ASA-7-713236: IP = 169.132.18.1, IKE_DECODE RECEIVED Message (msgid=7b412844) with payloads : HDR + HASH (8) + NOTIFY (11) + NONE (0) total length : 80
Mar 29 00:00:01 10.232.1.103/10.232.1.103 %ASA-7-715047: Group = N2Pprod2, Username = cconti, IP = 169.132.18.1, processing hash payload
Mar 29 00:00:01 10.232.1.103/10.232.1.103 %ASA-7-715047: Group = N2Pprod2, Username = cconti, IP = 169.132.18.1, processing notify payload
Mar 29 00:00:01 10.232.1.103/10.232.1.103 %ASA-7-715075: Group = N2Pprod2, Username = cconti, IP = 169.132.18.1, Received keep-alive of type DPD R-U-THERE (seq number 0xced72762)
Mar 29 00:00:01 10.232.1.103/10.232.1.103 %ASA-7-715036: Group = N2Pprod2, Username = cconti, IP = 169.132.18.1, Sending keep-alive of type DPD R-U-THERE-ACK (seq number 0xced72762)
Mar 29 00:00:01 10.232.1.103/10.232.1.103 %ASA-7-715046: Group = N2Pprod2, Username = cconti, IP = 169.132.18.1, constructing blank hash payload
Mar 29 00:00:01 10.232.1.103/10.232.1.103 %ASA-7-715046: Group = N2Pprod2, Username = cconti, IP = 169.132.18.1, constructing qm hash payload
Mar 29 00:00:01 10.232.1.103/10.232.1.103 %ASA-7-713236: IP = 169.132.18.1, IKE_DECODE SENDING Message (msgid=4d9922d2) with payloads : HDR + HASH (8) + NOTIFY (11) + NONE (0) total length : 80
Mar 29 00:00:03 10.232.1.103/10.232.1.103 %ASA-7-713236: IP = 47.16.183.44, IKE_DECODE RECEIVED Message (msgid=2460272) with payloads : HDR + HASH (8) + NOTIFY (11) + NONE (0) total length : 80
Mar 29 00:00:03 10.232.1.103/10.232.1.103 %ASA-7-715047: Group = idtremote, Username = christina.rudczynski, IP = 47.16.183.44, processing hash payload
Mar 29 00:00:03 10.232.1.103/10.232.1.103 %ASA-7-715047: Group = idtremote, Username = christina.rudczynski, IP = 47.16.183.44, processing notify payload
Mar 29 00:00:03 10.232.1.103/10.232.1.103 %ASA-7-715075: Group = idtremote, Username = christina.rudczynski, IP = 47.16.183.44, Received keep-alive of type DPD R-U-THERE (seq number 0x27b70150)
Mar 29 00:00:03 10.232.1.103/10.232.1.103 %ASA-7-715036: Group = idtremote, Username = christina.rudczynski, IP = 47.16.183.44, Sending keep-alive of type DPD R-U-THERE-ACK (seq number 0x27b70150)
Mar 29 00:00:03 10.232.1.103/10.232.1.103 %ASA-7-715046: Group = idtremote, Username = christina.rudczynski, IP = 47.16.183.44, constructing blank hash payload
Mar 29 00:00:03 10.232.1.103/10.232.1.103 %ASA-7-715046: Group = idtremote, Username = christina.rudczynski, IP = 47.16.183.44, constructing qm hash payload
Mar 29 00:00:03 10.232.1.103/10.232.1.103 %ASA-7-713236: IP = 47.16.183.44, IKE_DECODE SENDING Message (msgid=e16bf0d4) with payloads : HDR + HASH (8) + NOTIFY (11) + NONE (0) total length : 80
Mar 29 00:00:04 10.232.1.103/10.232.1.103 %ASA-7-713236: IP = 169.132.18.1, IKE_DECODE RECEIVED Message (msgid=6654134b) with payloads : HDR + HASH (8) + NOTIFY (11) + NONE (0) total length : 80
Nothing more sensetive than name
The data is being handled by the: Splunk_TA_cisco-asa app.
I really cannot see why he lines a re not being split to single lines .
You help is much appreciated!
Jim
... View more
03-29-2015
10:41 PM
So I have installed the: Splunk_TA_cisco-asa app and the app is correctly identifying logs that are cisco-ass as sourcetype cisco:asa .
The defualt props.conf for these has SHOULD_LINEMERGE = false , but lines are being merged irregularly .
The data is come in from file monitor reads but they are identified as sourcetype=syslog .
Lines end with 0A aka \n , but I have tried multiple ways to get it to stop the inappropriate line merges, but
it's not working .
Thanks!
... View more
03-24-2015
06:29 AM
I don't find that rename clause in the app.
$ pwd
/home/jimd/splunkTAasa/Splunk_TA_cisco-asa/default
$ grep -i rename props.conf
$
... View more
03-19-2015
09:28 PM
Hi new to Cisco for Splunk.
We have Cisco ASA 5520 Fire Wall logs flowing to the app. They are not being converted to converted to sourcetype=cisco:ios, but are remaining syslog AND are being left with long multi-line events that should not be multi-line .
Is this just another log format or could I make some adjustment?
I see there is an ASA app but that is not for version 6.
http://answers.splunk.com/answers/124715/splunk-6-with-cisco-asa.html
Should I just set these up as sourcetype syslog with line-merge turned off?
==> Also some logs handled by the app and change to sourcetype cisco:ios look like they may have excessive line-merging. Does line breaking sometimes need adjusted for the app?
... View more
11-04-2014
06:53 PM
1 Karma
It seems like the poster was just looking to remove PART of a log or event, but the answer given will remove the ENTIRE EVENT .
... View more
05-19-2014
07:26 AM
1 Karma
I'm gettging 100% Captcha rejection trying to posting an edit of an earlier post
... View more
- Tags:
- captcha
05-14-2014
08:19 AM
Last week, I installed several instances of Linux Splunk 6.1 from tars an initial install, I was advised by support late in the week that the release had some serious issues at the UI level, maybe others.
Am I better of upgrading my new instances to 6.1.1, or ripping out 6.1 and doing a new install of 6.1.1? I had to put in a significant number of modifications.
If I do the upgrade, how do I proceed and is there documentation. I am having trouble finding it.
... View more
05-09-2014
12:41 PM
Back in Version 3, on the main search screen, you would see a not "x of y" servers . For example, "5 of 5" Servers. If one was not responding, you could pull down a tab and immediately see which one.
This was a good idea, and meant your users would immediately see any issue. I would like to suggest seeing it come back.
... View more
12-02-2013
01:31 PM
For version 6.0 I put in the changes in Manager » User interface » Views
on but the default still shows as "All time"
Are there other views to be added for Splunk 6 ?
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:02 AM
|
