Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About tevgey23
tevgey23
Explorer
Member since:
01-19-2012
06-05-2020
Community Statistics
| Posts | 19 |
| Solutions | 0 |
| Karma Given | 0 |
| Karma Received | 2 |
| Member Since | 01-19-2012 |
Activity Feed
- Got Karma for Hard limit on whitelist for deployment server. 06-05-2020 12:46 AM
- Got Karma for Hard limit on whitelist for deployment server. 06-05-2020 12:46 AM
- Posted Re: Exclude tar files in inputs.conf on Getting Data In. 10-29-2013 02:31 PM
- Posted Exclude tar files in inputs.conf on Getting Data In. 10-29-2013 01:52 PM
- Tagged Exclude tar files in inputs.conf on Getting Data In. 10-29-2013 01:52 PM
- Posted Re: Extract IP address and user name for log on Splunk Search. 05-16-2013 06:34 PM
- Posted Extract IP address and user name for log on Splunk Search. 05-16-2013 06:05 PM
- Tagged Extract IP address and user name for log on Splunk Search. 05-16-2013 06:05 PM
- Tagged Extract IP address and user name for log on Splunk Search. 05-16-2013 06:05 PM
- Tagged Extract IP address and user name for log on Splunk Search. 05-16-2013 06:05 PM
- Posted Nessus app on All Apps and Add-ons. 09-04-2012 11:43 AM
- Tagged Nessus app on All Apps and Add-ons. 09-04-2012 11:43 AM
- Posted Re: Top DNS queries from DNS logs on Getting Data In. 08-15-2012 11:20 AM
- Posted Top DNS queries from DNS logs on Getting Data In. 08-15-2012 09:38 AM
- Tagged Top DNS queries from DNS logs on Getting Data In. 08-15-2012 09:38 AM
- Posted Re: NTP field extraction on Splunk Search. 08-14-2012 02:13 PM
- Posted NTP field extraction on Splunk Search. 08-14-2012 11:48 AM
- Tagged NTP field extraction on Splunk Search. 08-14-2012 11:48 AM
- Posted Re: How do I install the Cisco Firewall add-on? on Getting Data In. 08-06-2012 12:59 PM
- Posted Do the splunk indexers need to be stopped before rolling hot buckets to warm ? on Deployment Architecture. 08-02-2012 06:09 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 2 | |||
| 0 | |||
| 0 |
10-29-2013
01:52 PM
Hello,
Is there a way to "blacklist" or exclude tar.gz file with in a monitored directory in
the inputs.conf file.
For example.. I would like to monitoring /var/log/syslog/*
but not all the rotated tar files which have been created.
Just the .log file which have been created that day
... View more
- Tags:
- inputs.conf
05-16-2013
06:34 PM
Thank you for the reply. Seems to come up with an error
...| regex "(?i) ive - [(?P [^]]+)"
"Error in 'SearchOperator:regex': Usage: regex "(=|!=)
... View more
05-16-2013
06:05 PM
Im trying to extract the IP address in the [] and the user name which follows it.
I tried a few different regex with no success.,
Any recommendations ?
May 16 15:39:57 192.x.x.x Juniper: 2013-05-16 16:39:58 - ive - [24.x.x.x] bob_b(Company - OTP)[VIT Users] - Key Exchange number 1 occured for user with NCIP 192.x.x.x
... View more
09-04-2012
11:43 AM
Hello,
I'm using the Nessus app and wanted to know if its possible to make any
of the reports actionable in splunk when a port opens or the nessus report finds
a new vul
... View more
- Tags:
- nessus
08-15-2012
09:38 AM
Hello,
I wanted to know what would be the best way to see the top 20 FQDN coming from DNS
To get to the results below I had to run this command
index="MyDNSlog" sourcetype=dns | rex mode=sed "s/\(\d+\)/./g"
8/15/2012 10:27:11 AM 08E8 PACKET 000000000443D750 UDP Snd 192.168.44.2 0f93 R Q [8085 A DR NOERROR] A .google.com.
host=MYDNS Options| sourcetype=dns Options| source=C:\dir\dns444.log Options| timeendpos=22 Options
How can I further extract the domain name in order to view top 20 DNS queries
Thank you
... View more
- Tags:
- dns
08-14-2012
02:13 PM
When I run the search I get the same results. Should I be inputting any other parameters ?
... View more
08-14-2012
11:48 AM
Hello,
I wanted to know what would be the best way to extract the st (stratum) field from the
NTP event (in this case its 2). My goal is to get alerted when it turns 16 to notify my when NTP is out of sync
Here is the log as it gets indexed in splunk
remote refid st t when poll reach delay offset jitter
==============================================================================
*192.168.1.25 124.16.150.20 2 u 56 64 377 0.249 16.252 6.991
host=hostname Options| sourcetype=ntp Options|
Thank you,
... View more
- Tags:
- field-extraction
08-06-2012
12:59 PM
Is there a way to use this app with another index. I have a syslog server which collects all the ASA logs and than a local forwarder on that host sends the data to Splunk. Reason being is that I have 3 indexers and would like to load balance the traffic. Also the search head is not licensed to index that amount of data
... View more
08-02-2012
06:09 AM
I need to roll some hot buckets from hot to cold and I wanted to know if the splunk indexers need
to be stopped before hand ?
... View more
- Tags:
- db-roll
07-10-2012
01:17 PM
Yep I gave that a try but it seems the logs are set up a bit different
[09/Jul/2012:18:42:10 -0400] "GET/manual/ru/ja/mod/mod_status.html HTTP/1.1" 404 321 "-" "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0)"
As you can see there is no "status" so 40* returns a lot of false positives.
Any other recommendations ?
... View more
07-10-2012
12:38 PM
Im trying to use Splunk to detect a network scan using http logs. Ive been playing with the syntax
for some time but cant get it quite right.
What would the syntax be to alert on 20 server errors (i.e 503 or 404) if logged with in a 3 min window
I rather not use real time alerting as it may require more resources but im open to suggestions
Using search count with Apache logs
Thank you,
... View more
- Tags:
- alert
04-22-2012
04:34 AM
2 Karma
Hello,
Is there a hard limit on the number of servers you can have per whitelist class
Seems I cant add more then ten, does that sound right ???
... View more
- Tags:
- whitelist
04-20-2012
04:40 AM
Currently were using a script within puppet to identify those containers, does the deployment server support such a script. I guess what I can do is pupptize the host, install the forwarder,
and then if its a container Ill add the serverclass and deployment configuration files, from there
the Splunk server can populate the inputs.conf file. Does that sound like something that would work?
... View more
04-19-2012
02:16 PM
Is it possible to create different classes of servers so when the forwarder checks in, it get a specific configuration for the inputs.conf file.
So the goal here would be to have all the mail servers have a set of inputs.conf file
and the webservers have their own and so on..
... View more
04-19-2012
02:09 PM
Can Splunk deployment server detect a container ID in a virtual environment, which was created... say by openvz, and apply the inputs.conf file to that container? This is necessary since the containers keep changing.
... View more
- Tags:
- inputs.conf
02-14-2012
04:33 AM
Is there a way to set up an alert through the deployment monitor (or anywhere), to generate an alert when a forwarder stops monitoring a host or sending data ?
... View more
