About jon_d_irish_ctr

jon_d_irish_ctr · ‎05-16-2018

Thanks for the comments everyone! I did get it working using nikenilay's example.

jon_d_irish_ctr · ‎05-16-2018

Hello, I have the following search string, but "_time" keeps coming up blank. It appears that something is "clearing" it, but I can't figur eout what. sourcetype=cisco:asa dest_ip="xxx.xxx.0.0/16" NOT "Failover primary closed" | stats count by src_ip,dest_ip | eval Connections = count | iplocation src_ip | where Country = "China" OR Country = "Iran" OR Country = "Iraq" OR Country = "Russia" OR Country = "Brazil" OR Country = "North Korea" | lookup dnsLookup ip as src_ip | eval ExtFQDN=if(isnotnull(host),host,src_ip) | eval ExtIPCity=if(City="","Not available",City) | eval ExtIPRegion=if(Region="","Not available",Region) | table Country ExtIPRegion ExtIPCity src_ip ExtFQDN dest_ip Connections _time | dedup src_ip dest_ip Thanks, Jon

jon_d_irish_ctr · ‎05-10-2018

Here is another thought. What is I wrote out the results of the iplookup command to a lookup file via the outputlookup command. Next, if I do a search against that lookup file with the lookup command, would I then be able to use the highlight command?

jon_d_irish_ctr · ‎05-10-2018

Thanks for the suggestion, I will give this a shot.

jon_d_irish_ctr · ‎05-10-2018

I want to setup a search that determines which countries have connected to my network over the past "x" hours, and then I want to highlight the table line if a specified country shows up. Here is the search I have so far: sourcetype=cisco:asa dest_ip="X.X.0.0/16" NOT "Failover primary closed" | iplocation src_ip | stats count by Country | sort - count | dedup Country | highlight "CountryName" I get the table, but the highlighting never happens even if I pick a country that shows up in the table. Last, I would like for this search to trigger an alert and email the alert if the specified country is in the table. Thanks! Jon

jon_d_irish_ctr · ‎03-30-2018

Hi David, We are running Splunk Enterprise v6.4. Yes, we are not seeing any issues (that we are currently aware of). Thanks, Jon

jon_d_irish_ctr · ‎03-29-2018

Recently I upgraded our search heads with Splunk Security Essentials v2.0. Now, when Splunk restarts, I see errors referencing Splunk Security Essentials. The error recommends running btool, and the results are: Checking: /opt/splunk/etc/apps/Splunk_Security_Essentials/default/app.conf Checking: /opt/splunk/etc/apps/Splunk_Security_Essentials/default/collections.conf Checking: /opt/splunk/etc/apps/Splunk_Security_Essentials/default/commands.conf Checking: /opt/splunk/etc/apps/Splunk_Security_Essentials/default/distsearch.conf Checking: /opt/splunk/etc/apps/Splunk_Security_Essentials/default/macros.conf Checking: /opt/splunk/etc/apps/Splunk_Security_Essentials/default/transforms.conf Checking: /opt/splunk/etc/apps/Splunk_Security_Essentials/default/ui-tour.conf Invalid key in stanza [contents-tour] in /opt/splunk/etc/apps/Splunk_Security_Essentials/default/ui-tour.conf, line 5: otherAuto (value: 1). Invalid key in stanza [contents-tour] in /opt/splunk/etc/apps/Splunk_Security_Essentials/default/ui-tour.conf, line 8: skipText (value: Skip tour). Did you mean 'stepClickElement'? Did you mean 'stepClickEvent'? Did you mean 'stepElement'? Did you mean 'stepPosition'? Did you mean 'stepText'? Invalid key in stanza [contents-tour] in /opt/splunk/etc/apps/Splunk_Security_Essentials/default/ui-tour.conf, line 17: doneText (value: Start Exploring). Invalid key in stanza [contents-tour] in /opt/splunk/etc/apps/Splunk_Security_Essentials/default/ui-tour.conf, line 18: doneURL (value: /app/Splunk_Security_Essentials/contents). Invalid key in stanza [showcase_simple_search-tour] in /opt/splunk/etc/apps/Splunk_Security_Essentials/default/ui-tour.conf, line 45: skipText (value: Skip tour). Did you mean 'stepClickElement'? Did you mean 'stepClickEvent'? Did you mean 'stepElement'? Did you mean 'stepPosition'? Did you mean 'stepText'? Invalid key in stanza [showcase_first_seen_demo-tour] in /opt/splunk/etc/apps/Splunk_Security_Essentials/default/ui-tour.conf, line 72: skipText (value: Skip tour). Did you mean 'stepClickElement'? Did you mean 'stepClickEvent'? Did you mean 'stepElement'? Did you mean 'stepPosition'? Did you mean 'stepText'? Invalid key in stanza [showcase_standard_deviation-tour] in /opt/splunk/etc/apps/Splunk_Security_Essentials/default/ui-tour.conf, line 96: skipText (value: Skip tour). Did you mean 'stepClickElement'? Did you mean 'stepClickEvent'? Did you mean 'stepElement'? Did you mean 'stepPosition'? Did you mean 'stepText'? I talked to a Splunk engineer about this (I thought it was Splunk supported). and he said the following: This message below indicates that it is malformed. Usually, this means there is some misspelling of the key or that line is deprecated Invalid key in stanza [contents-tour] in /opt/splunk/etc/apps/Splunk_Security_Essentials/default/ui-tour.conf, So, if this is indeed from something within the code, and Splunk wrote the code, but Splunk does not support the app, how does it get fixed?

jon_d_irish_ctr · ‎09-14-2017

After a little more research, I have determined that I don't want to be using the "appendcols" command as I really don't want to be adding the information to the results. I simply want to compare all inbound/outbound traffic from our LAN to the results of "fqdn" and then display any matches. Thus, I came up with this search: | inputlookup flash_mi-000085-mw | lookup dnsLookup host as fqdn | search sourcetype=cisco:asa dest_ip="X.X.0.0/16" OR src_ip = "X.X.0.0/16" AND fqdn | eval sans=("https://isc.sans.edu/ipinfo.html?ip="+ip) | eval cymon=("https://cymon.io/"+ip) | where fqdn!="" | table fqdn ip dest_ip sans cymon | rename cymon as "cymon(RIPE)" However, this is still not working.

jon_d_irish_ctr · ‎09-11-2017

I am getting the inputlookup and the dnsLookup to work properly now. The problem is trying to get my output to display only matches between the IP addresses resolved from the dnsLookup function and the IP addresses in my firewall logs. I made a couple of changes: I changed the transform and the lookup tables. I changed "host" to "fqdn" as "host" is also defined in the firewall logs so it was making the results rather odd. Anyway, after making that change, I tried this search: | inputlookup flash_mi-000085-mw | lookup dnsLookup host as fqdn | appendcols [search sourcetype=cisco:asa dest_ip="xxx.xxx.0.0/16"] | eval sans=("https://isc.sans.edu/ipinfo.html?ip="+ip) | eval cymon=("https://cymon.io/"+ip) | where fqdn!="" | table fqdn ip dest_ip sans cymon | rename cymon as "cymon(RIPE)"

jon_d_irish_ctr · ‎09-11-2017

So I am REALLY close now! I did have to make one change in the transform and the lookup table. I changed "host" to "fqdn" as "host" is also defined in the firewall logs so it was making the results rather odd. Anyway, after making that change, I tried this search: | inputlookup flash_mi-000085-mw | lookup dnsLookup host as fqdn | appendcols [search sourcetype=cisco:asa dest_ip="xxx.xxx.0.0/16"] | eval sans=("https://isc.sans.edu/ipinfo.html?ip="+ip) | eval cymon=("https://cymon.io/"+ip) | where fqdn!="" | table fqdn ip dest_ip sans cymon | rename cymon as "cymon(RIPE)" I just don't think it is matching correctly though. My intent is to display only the firewall traffic that matches an IP address resolved from the dnsLookup function.

jon_d_irish_ctr · ‎09-08-2017

So this is my final search string for just reviewing the data in the csv file: | inputlookup flash_mi-000085-mw | lookup dnsLookup host | where ip!= " " | eval sans=("https://isc.sans.edu/ipinfo.html?ip="+ip) | eval cymon=("https://cymon.io/"+ip) | table host ip sans cymon | rename cymon as "cymon(RIPE)" This provides all the "output" data that I need. Now, I need to add the firewall data and search for matches to the csv list. I know adding soutcetype=cisco:asa will pull all the firewall data in, I am just not sure yet how I will build this to search for matches. I'll have to think about this some more.

jon_d_irish_ctr · ‎09-08-2017

So I actually got it to work! I changed the inputlookup file headers one more time to: host, ip (I did this to match the fields defined in the dnsLookup transform stanza. After doing that, and restarting splunk, I then issued this search: | inputlookup flash_mi-000085-mw | lookup dnsLookup host | table host ip It actually returns a table with both the fqdn and it's corresponding IP address. It's great that this works, but I am not sure why it works.

jon_d_irish_ctr · ‎09-08-2017

I think my problem with the dnsLookup part is that there is a transform stanza already defined for it: [dnsLookup] external_cmd = external_lookup.py host ip fields_list = host, ip but the fields do not match the field I have in my lookup transform stanza even though I have fqdn's in my list, should I change the header from src_fqdn to ip, so that the dnsLookup stanza will match?

jon_d_irish_ctr · ‎09-08-2017

so I got the first part of this working by making a couple of changes. First I changed the extension of the file from .txt to .csv. I also changed the header from host to src_fqdn. Here is what the new .csv file looks like: src_fqdn axxxxxxxxx.com gxxxxxxxxx.com hxxxxxxxxx.com kxxxxxxxxx.com oxxxxxxxxx.com pxxxxxxxxx.com pdxxxxxxxx.com prxxxxxxxx.com rxxxxxxxxx.com txxxxxxxxx.com And here is what the transform stanza looks like: [000085] filename = 000085.csv index_fields_list = src_fqdn outputlookup_check_permission check_permission I have verified that the inputlookup is working with this: | inputlookup flash_mi-000085-mw which results in: src_fqdn axxxxxxxxx.com gxxxxxxxxx.com hxxxxxxxxx.com kxxxxxxxxx.com oxxxxxxxxx.com pxxxxxxxxx.com pdxxxxxxxx.com prxxxxxxxx.com rxxxxxxxxx.com txxxxxxxxx.com Now, I have all my values "read-into" splunk as src_fqdn. Next, I need to convert them to IP addresses with the built-in "dnslookup" function. However, I cannot figure out how to get this to work.

jon_d_irish_ctr · ‎09-08-2017

I had looked at that earlier, but I was not sure I was implementing it properly. I created a copy of the csv file with only the field host on the first line and then renamed it to 000085.txt: host axxxxxxxxx.com gxxxxxxxxx.com hxxxxxxxxx.com kxxxxxxxxx.com oxxxxxxxxx.com pxxxxxxxxx.com pdxxxxxxxx.com prxxxxxxxx.com rxxxxxxxxx.com txxxxxxxxx.com I then issue this search: | inputlookup flash_mi-000085-mw-dns.txt | table host However, I don't get any results. Shouldn't it list the vlaues of 000085.txt?

jon_d_irish_ctr · ‎09-08-2017

That doesn't quite seem to work. I am trying to break this down into two different stages. First, I just want to verify that I am getting the contents of 000085.csv read into splunk. Once I am sure that is working right, I will then try to feed those results into the dnslookup function. Couldn't I verify that the table has been read in correctly with this string: | lookup 000085.csv host OUTPUT host | table host

jon_d_irish_ctr · ‎09-07-2017

I have read through that document a couple of times. I think what is really confusing me is how I can read in the csv file full of domain names before I then run them through the dnslookup function.

jon_d_irish_ctr · ‎09-07-2017

I think what is really confusing me is how I can read in the csv file full of domain names BEFORE I then run them through the dnslookup function.

jon_d_irish_ctr · ‎09-07-2017

My problem is that I am not exactly sure how to utilize it. I have read the "Splunk Enterprise Knowledge Manager Manual" and I have tried to match up with the instructions in it. So far, I have tried this: I have a csv file (/opt/splunk/etc/system/lookups/000085.csv that looks like this: host, ip axxxxxxxxx.com gxxxxxxxxx.com hxxxxxxxxx.com kxxxxxxxxx.com oxxxxxxxxx.com pxxxxxxxxx.com pdxxxxxxxx.com prxxxxxxxx.com rxxxxxxxxx.com txxxxxxxxx.com The transform, located at: /opt/splunk/etc/system/local has this stanza: [dnsLookup] external_cmd = external_lookup.py host ip fields_list = host, ip My search string looks like: sourcetype=cisco:asa | lookup 000085.csv as src_host OUTPUT src_host as host | lookup dnsLookup host as host_match | table host_match I have changed everything so many times that I am sure that I have messed something up. Thanks, Jon

jon_d_irish_ctr · ‎09-07-2017

I have a csv file with domain names. I need to search my firewall traffic to see if any traffic matches to/from any of these domains. The firewall logs only contain IP addresses, so I have to convert the domain names to IP addresses before searching for matches against the logs. I was hoping I could do this with the built-in "dnslookup" function. However, I am not having any luck getting this to work. I would appreciate any help! Thanks, Jon

jon_d_irish_ctr · ‎07-13-2017

Thanks for all the suggestions everyone! I just found what I was looking for. I "greped" for a value that I have created when I configured the app, and I found that these values are held in: /opt/splunk/etc/apps/splunk_app_for_nix/lookups/dropdowns.csv. I then copied it over to the DS at: /opt/splunk/etc/deployment-apps/splunk_app_for_nix/lookups and then I restarted the deployment server service with: /opt/splunk/bin/splunk reload deploy-server. I then went to a Search Head that I have not used before, and all of my settings are there!

jon_d_irish_ctr · ‎07-13-2017

Hello, I double-checked, and I did not touch anything in the "default" folder. After configuring it on a search head, I copied these files: alert_overlay.conf headlines.conf macros.conf savedsearches.conf unix_setup.conf to the DS under /opt/splunk/etc/deployment-apps/splunk_app_for_nix/local. I then restarted the deployment server and it pushed these out to everything. The only part missing is that the "Categories" and "Groups" I defined under the Settings menu are not being copied. Thus, I am wondering what file contains these settings, so I can copy it up to the DS with the others.

jon_d_irish_ctr · ‎07-13-2017

Hello, Our environment consists of three independent search heads, 3 indexers in a cluster, and 1 cluster master. The deployment server resides on the cluster master. Yes, we use the DS to push apps to SH's, Indexers, Forwarders, etc. I was able to get the majority of the app working by installing it on a search head and then copying these files: alert_overlay.conf headlines.conf macros.conf savedsearches.conf unix_setup.conf to the DS under /opt/splunk/etc/deployment-apps/splunk_app_for_nix/local. I then restarted the deployment server and it pushed these out to everything. The only part missing is that the "Categories" and "Groups" I defined under the Settings menu are not being copied. Thus, I am wondering what file contains these settings, so I can copy it up to the DS with the others.

jon_d_irish_ctr · ‎07-12-2017

So I have setup both the Splunk TA for nix and Splunk App for Linux on my Deployment Server. It didn't take me long to discover that any time the DS pushed the app back out, all config settings on the client servers were overwritten with the default settings. I then configured the TA on a client and was able to locate the configuration files on the client and then copied them up to the DS. I then restarted the the deployment server service and the app was pushed out again. This time, the new settings went with it, and all is good! I the configured the Splunk App for Linux on a client and attempted the same thing by copying all the resulting settings files from: /opt/splunk/etc/apps/splunk_app_for_nix/local up to the DS and restarted the deployment server service. The app was pushed out again, but only some of the settings were pushed. Specifically, none of the "Category" entries I created on the Settings screen were pushed. Thus, it appears that these settings are not stored at: /opt/splunk/etc/apps/splunk_app_for_nix/local Does anyone happen to know where these are stored? Even better, is there a Splunk BBP describing "Splunk's" way of deploying pre-configured apps so that "all" settings are maintained? Thanks! Jon

jon_d_irish_ctr · ‎07-11-2017

So I know that this sounds odd. Our Deployment Server is located on our Indexer Cluster Master. We are running all our Splunk systems on RHEL and I would like to deploy the Splunk App for Linux. According to the documentation, the App is only installed on the Search Heads. However, the Add-on needs to be installed on everything linux. That being said, how do you deploy to the Deployment server itself? I created /opt/splunk/etc/system/local/deploymentclient.conf on the Deployment Server and restarted Splunk, but it never shows up as a Deployment Client. Is the proper way to do this, manually installing Apps and Add-Ons on the Deployment Server? Thanks, Jon

Posts	33
Solutions	1
Karma Given	0
Karma Received	3
Member Since	‎04-25-2013

Online Status	Offline
Date Last Visited	‎06-05-2020 02:03 AM

Why does the _time value keeps coming up blank?

How to highlight values from the iplocation comman...

Why is the upgrade to Splunk Security Essentials 2...

Looking for network traffic from a list of domain ...

Splunk App for Unix and Linux and Deployment Serve...

Can the Deployment Server also be a Deployment Cli...

Splunk for Cisco Identity Services (ISE) dashboard...

Re: Why does the _time value keeps coming up blank...

Why does the _time value keeps coming up blank?

Re: How to highlight values from the iplocation co...

Re: How to highlight values from the iplocation co...

How to highlight values from the iplocation comman...

Re: Why is the upgrade to Splunk Security Essentia...

Why is the upgrade to Splunk Security Essentials 2...

Re: Looking for network traffic from a list of dom...

Re: Looking for network traffic from a list of dom...

Re: Looking for network traffic from a list of dom...

Re: Looking for network traffic from a list of dom...

Re: Looking for network traffic from a list of dom...

Re: Looking for network traffic from a list of dom...

Re: Looking for network traffic from a list of dom...

Re: Looking for network traffic from a list of dom...

Re: Looking for network traffic from a list of dom...

Re: Looking for network traffic from a list of dom...

Re: Looking for network traffic from a list of dom...

Re: Looking for network traffic from a list of dom...

Looking for network traffic from a list of domain ...

Re: Splunk App for Unix and Linux and Deployment S...

Re: Splunk App for Unix and Linux and Deployment S...

Re: Splunk App for Unix and Linux and Deployment S...

Splunk App for Unix and Linux and Deployment Serve...

Can the Deployment Server also be a Deployment Cli...