Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About Sagar0511
Sagar0511
Explorer
Member since:
10-17-2017
06-05-2020
Community Statistics
| Posts | 20 |
| Solutions | 0 |
| Karma Given | 2 |
| Karma Received | 1 |
| Member Since | 10-17-2017 |
Activity Feed
- Got Karma for Count Consecutive Failed Logins Events. 06-05-2020 12:49 AM
- Karma After creating and setting a new index in inputs.conf on the universal forwarder, why do I see no search results on the search head? for nce054. 06-05-2020 12:47 AM
- Karma Re: Sorting timechart series for sideview. 06-05-2020 12:45 AM
- Posted Re: How to keep configuration/settings persistent even after the server reboots? on Installation. 07-24-2018 03:49 AM
- Posted How to keep configuration/settings persistent even after the server reboots? on Installation. 07-23-2018 03:31 AM
- Tagged How to keep configuration/settings persistent even after the server reboots? on Installation. 07-23-2018 03:31 AM
- Tagged How to keep configuration/settings persistent even after the server reboots? on Installation. 07-23-2018 03:31 AM
- Tagged How to keep configuration/settings persistent even after the server reboots? on Installation. 07-23-2018 03:31 AM
- Posted Count Consecutive Failed Logins Events on Splunk Search. 06-18-2018 06:07 AM
- Tagged Count Consecutive Failed Logins Events on Splunk Search. 06-18-2018 06:07 AM
- Tagged Count Consecutive Failed Logins Events on Splunk Search. 06-18-2018 06:07 AM
- Tagged Count Consecutive Failed Logins Events on Splunk Search. 06-18-2018 06:07 AM
- Tagged Count Consecutive Failed Logins Events on Splunk Search. 06-18-2018 06:07 AM
- Posted Universal forward installed on windows server but can't get the logs for that server. on Getting Data In. 05-21-2018 06:15 AM
- Tagged Universal forward installed on windows server but can't get the logs for that server. on Getting Data In. 05-21-2018 06:15 AM
- Tagged Universal forward installed on windows server but can't get the logs for that server. on Getting Data In. 05-21-2018 06:15 AM
- Posted Re: Universal forwarder (Windows) does not send logs even though "active" on Getting Data In. 05-09-2018 11:35 PM
- Posted Re: Universal forwarder (Windows) does not send logs even though "active" on Getting Data In. 05-08-2018 03:38 AM
- Posted Universal forwarder (Windows) does not send logs even though "active" on Getting Data In. 05-07-2018 11:10 PM
- Tagged Universal forwarder (Windows) does not send logs even though "active" on Getting Data In. 05-07-2018 11:10 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 1 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
07-24-2018
03:49 AM
Any body can help to give the solution for this issue.
... View more
07-23-2018
03:31 AM
Hello Everyone,
In my environment, I have installed Splunk Enterprise OVA (standalone) and made as a Server and Windows 2012 (with universal forwarder) as client, but there was power suspended and the server had been rebooted with all the configurations, settings which was made all have been refreshed and set to default; So again I have to begin with the fresh configuration such as setting the IP address , mask address and etc.
So what is the correct way to keep these settings or configuration permanent/persistent even after the server reboots.
Tested:
Set the IP address and all other configuration.
Check the sevices
Set up the Universal forwarder again on the client.
Set the Allow rule for the for the IP address in IPtables services.
... View more
06-18-2018
06:07 AM
1 Karma
We have our test environment in which Splunk Enterprise OVA is installed as server and Windows server (with universal forwarder installed) which is client. From these windows server all the logs are forwarder. I want to find the the consecutive failed logins events within the time span of 1 min. If a next event is successful logon in the middle of the failed logins, it should ignored. Each event has a field which tells whether it was success or failure.
For Ex: I have tried using the below query.
1. index=wineventslog EventCode=4625 | eval Result=if((EventCode=4625), "FAILED", "SUCCESSFUL") | streamstats count time_window=1m | table Account_Name,Result,dest,ComputerName | dedup Account_Name
2. index=wineventslog EventCode=4625 | streamstats count time_window=1m | table Account_Name,action,dest,ComputerName | dedup Account_Name
Any help to resolve this issue.
Thanks
... View more
05-21-2018
06:15 AM
Hi Everyone,
I am testing universal forwarding in our testing environment and also installed universal forwarder in one of windows server, but can't get the desire logs.
My test environment included Splunk Enterprise OVA as server and Windows server (with universal forwarder installed) which is client. I had used the "deployment server" command(set deploy-poll) and then restart.
On Splunk OVA enterprise server
Added forwarder input using Settings -> "Data Inputs" -> "Forwarded Inputs" -> "Windows Event Logs"-> New (could see my desired deployment client in the list). Selected Application, security & system events.
Tested:
I had check the Eventviewer logs; there logs are generating
Check the Tcp dump; there is also logs are coming from the windows server.
Also I am geeting Messages:
Skipped indexing of internal audits event will keep dropping events until indexer congestion is remedied.check disk space and other issues that may cause indexer to block.
Forwarding the indexer group default-autolb-group blocked for 10 seconds.
... View more
05-09-2018
11:35 PM
I was able to fix the mentioned problem which was I was facing (for solving the forwarder not sending the logs though it is "active") from one of the reference link
Thanks.
... View more
05-08-2018
03:38 AM
check etc/apps/ on the UF to confirm the inputs configuration was indeed correctly pushed from your deployment server -->It is showing the index name which has been created.
check splunkd.log on both splunk instances for errors
In Splunk OVA(Linux System) --> WARN Tcpoutput - Forwarding the indexer group xxxxxx blocked for
xxxx seconds
In Windows System --> There is no error
Are the internal logs from the UF getting forwarded to the Enterprise instance? --> No
confirm universal forwarder runs under an account that has permissions to read the event logs --> checked and it is running as SYSTEM User.
... View more
05-07-2018
11:10 PM
Hi Folks,
I am testing log forwarding using universal forwarder from Windows to Splunk but can't seem to receive any logs.
My test environment has Splunk Enterprise OVA (standalone) as server and Windows 2012 (with universal forwarder) as client.
Steps i followed (not necessarily in that order):
On Windows client (Universal forwarder):
* Installed Universal forwarder
* configured as deployment client
* Added firewall rule to allow destination port 9997
* checked using "splunk list forward-server" to confirm server is listed in "active" section
On Splunk OVA enterprise server
* Configured listening on port 9997 using web console
* Added forwarder input using Settings -> "Data Inputs" -> "Forwarded Inputs" -> "Windows Event Logs" (could see my desired deployment client in the list). Selected Application, security & system events
* Stopped iptables service (just to ensure its not blocking traffic)
* Followed this link to receive logs from forwarder
Testing:
* created user in windows (client) and checked local event logs. Local log can be seen in "Security" events
* Ran search in server (web console) to see this event. It says "no events found" for the specific index
... View more
12-05-2017
09:42 PM
The Query had successfully executed and desired result has been achieved. Thank you very much.
... View more
11-28-2017
05:24 AM
Yes, the event timestamp is 26Oct2017,23:59:00. The header is present in the csv log file but I have extracted the field names by doing field extraction; so in that there is no need of headers. There is no cplogs(Sourcetype) mentioned in the props.conf which has been uploaded in the previous post.
... View more
11-27-2017
10:26 PM
The device is not sending the logs directly to splunk server. Instead i have a csv log file which i let rsyslog (on another ubuntu system) send to the splunk server. Hence the _time value is the rsyslog transmit time, whereas the Time is the actual log timestamp.
Sample log (1 event) below:
<133>Oct 23 07:25:25 ubuntu CPFW, 217,26Oct2017,23:59:00,eth1-02,10.2.2.189,Log,Accept,53,54080,10.28.0.16,165.21.100.88,udp,203,,203-CBIG-SIN-Consolidation,,service_id: domain-udp,Security Gateway/Management,,
rsyslog time is Oct 23 07:25:25 = _time
actual log time is 23:59:00 = Time
I have used field extraction feature of splunk to specify the comma delimited nature of the log. The result of the field extraction is shown in my original post.
Below props.conf file from Splunk/etc/system/local
[Hostnames]
DATETIME_CONFIG =
INDEXED_EXTRACTIONS = csv
KV_MODE = none
NO_BINARY_CHECK = true
SHOULD_LINEMERGE = false
category = Structured
description = Comma-separated value format. Set header and other settings in "Delimited Settings"
disabled = false
pulldown_type = true
[CBIG-SIN_Log1 Updated]
DATETIME_CONFIG =
INDEXED_EXTRACTIONS = csv
KV_MODE = none
NO_BINARY_CHECK = true
SHOULD_LINEMERGE = false
category = Structured
description = Comma-separated value format. Set header and other settings in "Delimited Settings"
disabled = false
pulldown_type = true
[csv]
DATETIME_CONFIG =
FIELD_DELIMITER = space
FIELD_QUOTE = "
NO_BINARY_CHECK = true
disabled = false
[CBIG_SING_Log1]
DATETIME_CONFIG =
FIELD_DELIMITER = space
FIELD_QUOTE = "
INDEXED_EXTRACTIONS = csv
KV_MODE = none
NO_BINARY_CHECK = true
SHOULD_LINEMERGE = false
category = Structured
description = Comma-separated value format. Set header and other settings in "Delimited Settings"
disabled = false
pulldown_type = true
[test1]
DATETIME_CONFIG =
FIELD_DELIMITER = ,
FIELD_QUOTE = "
INDEXED_EXTRACTIONS = csv
KV_MODE = none
NO_BINARY_CHECK = true
SHOULD_LINEMERGE = false
category = Structured
description = Comma-separated value format. Set header and other settings in "Delimited Settings"
disabled = false
pulldown_type = true
[test]
DATETIME_CONFIG =
FIELD_DELIMITER = ,
FIELD_QUOTE = "
INDEXED_EXTRACTIONS = csv
KV_MODE = none
NO_BINARY_CHECK = true
SHOULD_LINEMERGE = false
category = Structured
description = Comma-separated value format. Set header and other settings in "Delimited Settings"
disabled = false
pulldown_type = true
[CBIG_SIN]
DATETIME_CONFIG =
FIELD_DELIMITER = space
FIELD_QUOTE = "
INDEXED_EXTRACTIONS = csv
KV_MODE = none
NO_BINARY_CHECK = true
SHOULD_LINEMERGE = false
category = Structured
description = Comma-separated value format. Set header and other settings in "Delimited Settings"
disabled = false
pulldown_type = true
[cbig_sin]
DATETIME_CONFIG =
FIELD_DELIMITER = space
FIELD_QUOTE = "
INDEXED_EXTRACTIONS = csv
KV_MODE = none
NO_BINARY_CHECK = true
SHOULD_LINEMERGE = false
category = Structured
description = Comma-separated value format. Set header and other settings in "Delimited Settings"
disabled = false
pulldown_type = true
[access_combined1]
DATETIME_CONFIG =
FIELD_DELIMITER = ,
FIELD_QUOTE = "
INDEXED_EXTRACTIONS = csv
KV_MODE = none
NO_BINARY_CHECK = true
SHOULD_LINEMERGE = false
category = Structured
description = Comma-separated value format. Set header and other settings in "Delimited Settings"
disabled = false
pulldown_type = true
edit: sourcetype for the events we are referring in this question is 'cplogs'.. which can't be seen in props.conf
... View more
11-27-2017
09:44 PM
apologies... edited my original post now to show more details (formerly hidden in image tag)
... View more
11-27-2017
04:31 AM
Hi Everyone
I am trying to create a timechart report and I want to display the Output of the Log event time field instead of _time which is uploaded event time. I tried with the timechart command but it couldn't work. I think by default it takes the field "_time". I have tried rename the logs Time(extarcetd from the Logs) to Time(Actual time of Logs) by the command "eval _time=Time".
Find the snapshot for the sample Log file data
... View more
10-24-2017
11:19 PM
Please find the below same Header and data for both the files
Header and data of first csv file
Number-Date-Time-Interface-Origin-Type-Action-Service-Source Port-Source-Destination-Protocol-Rule-Rule Name-Current Rule Number-User-Information-Product-SourceMachineName-Source User Name
1-16-Oct-17-23:58:58-eth2-xxxx-Log-Drop-xxxx-38611-hostxx.xx.xx.xx.static.arubacloud.de-xx.xx.xxx.xxx udp-26-26CBIG-SIN-Consolidation-NA-NA-Security Gateway/Management-NA-NA
2-16-Oct-17-23:59:00-eth1-xxxx-Log-Accep-xxxx-62006-Host_xx.xx.xx.xx.-SINDSITNCDB03AV_xx.xxx.xxx.xxx tcp-271- 271-CBIG-SIN-Consolidation-NA-inzone Internal outzone Externalservice_id: TCP_135-Security Gateway/Management-NA-NA
Header and Data of second csv file
Nr-Name-Type-Location-FW1-IP-Netmask-NATAddress-NATType-Members-Comment
1 Attack_IP_xx.x.xx.xxx host-NA-NA-xx.x.xx.xxx-NA-NA-NA-NA-NA
2 xx.xx.xx.xxx group-NA-NA-NA-NA-NA-NA-Net_xx.xx.x.x Net_xx.xx.x.x-x-NA
3 UFTP_xx.xx.xx.xxx host-NA-NA-xx.xx.xx.xxx-NA-NA-NA-NA-NA
... View more
10-23-2017
10:37 PM
Hi Everyone,
I have just installed the developer license in splunk but I am unable to login with my credentials. I have also tried to login from the Admin credentials also but it is owing Invalid username and password.
Any suggestions.
... View more
- Tags:
- splunk-enterprise
10-23-2017
03:06 AM
Header of file1: Date Time Interface Origin Type Action Service Source Port Source Destination Protocol Rule Rule Name Current Rule Number User Information Product Source Machine Name Source User Name
Header of file2: Name Type Location FW1 IP-Address Netmask NAT-Address NAT-Type Members Comment
In the result/Output I want both the result combining of File1 and File2. So it will be easy to search the hostnames/IP's
CBIG_SIN is the CSV file name.
... View more
10-23-2017
03:06 AM
Header of file1: Date Time Interface Origin Type Action Service Source Port Source Destination Protocol Rule Rule Name Current Rule Number User Information Product Source Machine Name Source User Name
Header of file2: Name Type Location FW1 IP-Address Netmask NAT-Address NAT-Type Members Comment
In the result/Output I want both the result combining of File1 and File2. So it will be easy to search the hostnames/IP's
CBIG_SIN is the CSV file name.
... View more
10-23-2017
02:19 AM
Hi Everyone,
I want to combine data from two .csv files which are "CBIG-SIN Updated" and "Hostnames Files" files names and the output should be displayed in one file with relevant information of each file. In both the files the Header names are different.
I have tried the commands such as inputlookup, inputcsv and then the append with the next file. But none of them are working.
... View more
10-17-2017
11:11 PM
May I know which firewalls logs are supported and which format it should be. In my organization there is Checkpoint firewall. The logs of it will get upload or not and in which format.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:03 AM
|
