Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About adamschmitz
adamschmitz
Path Finder
Member since:
04-24-2015
06-05-2020
Community Statistics
| Posts | 12 |
| Solutions | 1 |
| Karma Given | 0 |
| Karma Received | 0 |
| Member Since | 04-24-2015 |
Activity Feed
- Posted Re: Splunk App for Windows Infrastructure: Why is there no data under Group Policy (GPO) Changes? on All Apps and Add-ons. 02-10-2016 06:15 AM
- Posted Re: Splunk App for Windows Infrastructure: Why is there no data under Group Policy (GPO) Changes? on All Apps and Add-ons. 02-04-2016 02:15 PM
- Posted Re: Splunk App for Windows Infrastructure: Why is there no data under Group Policy (GPO) Changes? on All Apps and Add-ons. 02-04-2016 01:53 PM
- Posted Re: Splunk App for Windows Infrastructure: Why is there no data under Group Policy (GPO) Changes? on All Apps and Add-ons. 02-04-2016 01:50 PM
- Posted Searching results after dnslookup on Splunk Search. 02-04-2016 07:24 AM
- Tagged Searching results after dnslookup on Splunk Search. 02-04-2016 07:24 AM
- Tagged Searching results after dnslookup on Splunk Search. 02-04-2016 07:24 AM
- Posted Re: How do I extract these 3 separate fields from Retina syslog output? on Splunk Search. 02-02-2016 01:42 PM
- Posted How do I extract these 3 separate fields from Retina syslog output? on Splunk Search. 02-02-2016 12:45 PM
- Tagged How do I extract these 3 separate fields from Retina syslog output? on Splunk Search. 02-02-2016 12:45 PM
- Tagged How do I extract these 3 separate fields from Retina syslog output? on Splunk Search. 02-02-2016 12:45 PM
- Tagged How do I extract these 3 separate fields from Retina syslog output? on Splunk Search. 02-02-2016 12:45 PM
- Tagged How do I extract these 3 separate fields from Retina syslog output? on Splunk Search. 02-02-2016 12:45 PM
- Posted Re: SCCM App for Splunk: Why am I getting create collection lookup error "command="dbquery", A database error occurred: Invalid object name..."? on All Apps and Add-ons. 02-02-2016 10:03 AM
- Posted Re: SCCM App for Splunk: Why am I getting create collection lookup error "command="dbquery", A database error occurred: Invalid object name..."? on All Apps and Add-ons. 02-01-2016 09:52 AM
- Posted Re: SCCM App for Splunk: Why am I getting create collection lookup error "command="dbquery", A database error occurred: Invalid object name..."? on All Apps and Add-ons. 02-01-2016 08:02 AM
- Posted Re: SCCM App for Splunk: Why am I getting create collection lookup error "command="dbquery", A database error occurred: Invalid object name..."? on All Apps and Add-ons. 01-28-2016 10:56 AM
- Posted SCCM App for Splunk: Why am I getting create collection lookup error "command="dbquery", A database error occurred: Invalid object name..."? on All Apps and Add-ons. 01-28-2016 07:49 AM
- Tagged SCCM App for Splunk: Why am I getting create collection lookup error "command="dbquery", A database error occurred: Invalid object name..."? on All Apps and Add-ons. 01-28-2016 07:49 AM
- Tagged SCCM App for Splunk: Why am I getting create collection lookup error "command="dbquery", A database error occurred: Invalid object name..."? on All Apps and Add-ons. 01-28-2016 07:49 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 |
02-10-2016
06:15 AM
Yes I submitted a ticket. I was told to run a diag on my splunk server which ended up hanging and never completing.
I emailed the rep and informed him/her of this and haven't received any word back. I've loved Splunk up to the point of having to actually open tickets with them. I find that it's mostly a 1 day response time on any email I submit.
I will update this post with any findings.
... View more
02-04-2016
02:15 PM
Yes I am. Verified at few instances of that entry in the event log.
... View more
02-04-2016
01:53 PM
I've done the above and it still doesnt populate the dashboard as mentioned above.
... View more
02-04-2016
01:50 PM
I'm in the same boat. It's the only piece of the infrastructure app that I don't have working.
... View more
02-04-2016
07:24 AM
I'm trying to figure out a way to search/report on syslog data by machine name when the original input is IP only.
Example:
Feb 4 08:41:11 10.5.3.62 2016- 2- 4 14:41:14 event XYZ happened on ip 10.5.12.231.
I do a dnslookup to convert the IP to the name. Since our naming convention tells me what OS the computer has I want to be able to search on the machine name to filter by OS type. This way I can see event XYZ happened on these 14 Macs or these 5 Windows machines and create dashboards based on that information.
I tried subsearches but that didn't seem to get me anywhere.
Thanks.
... View more
02-02-2016
01:42 PM
Both ways worked but I like the props.conf method.
Thanks to both of you! Time for me to learn how to do extractions.
... View more
02-02-2016
12:45 PM
I'm trying to extract the below syslog messages from Retina network scanner into 3 separate fields. Each time I start the extraction, I get the below message.
The extraction failed. If you are extracting multiple fields, try removing one or more fields. Start with extractions that are embedded within longer text strings
Here are a few samples.
Feb 1 13:33:23 10.5.3.62 2016- 2- 1 19:33:24 Retina: Retina has found Medium Severity audit SSL/TLS RC4 Cipher Suites Supported on ip 10.5.1.47.
Feb 1 13:31:49 10.5.3.62 2016- 2- 1 19:31:50 Retina: Retina has found Low Severity audit TFTP Server Detected on ip 10.5.3.2.
Feb 1 13:33:21 10.5.3.62 2016- 2- 1 19:33:22 Retina: Retina has found Medium Severity audit SSL Weak Cipher Suite Encryption Algorithm Key Length Supported on ip 10.5.1.47.
Feb 1 13:33:20 10.5.3.62 2016- 2- 1 19:33:21 Retina: Retina has found Medium Severity audit SSL Weak Cipher Suite Supported on ip 10.5.1.47.
Jan 20 04:34:30 10.5.3.62 2016- 1-20 10:34:32 Retina: Retina has found High Severity audit Microsoft Office Remote Code Execution - 3114553 Office 2010 on ip 10.5.3.67.
The 3 fields I want to extract are severity (High, Medium, Low), the vulnerability which is all text between the work 'audit' and the word 'on', the last field is the ip address.
I can get it to extract the severity, but it fails doing the other 2 fields.
Any help would be appreciated.
Thanks.
... View more
02-02-2016
10:03 AM
Setup a Splunk instance on Windows and the app worked perfectly immediately after setup.
Not sure if it's conclusive but this app doesn't appear to play nicely with Linux.
... View more
02-01-2016
09:52 AM
I created my read_only account, for the SCCM app to use, with the Default database in SQL set to Master instead of the SCCM database.
I changed the Default database setting and re-saved the external database setup in Splunk The reports in the SCCM app starting working correctly.
The dashboards are still not populating data however...on to the next step.
... View more
02-01-2016
08:02 AM
This is the query the app is trying to run. Pulled it from the apps macros.conf file.
dbquery sccm_database SELECT collectionid, resourceid FROM v_ClientCollectionMembers | outputlookup sccm_collectionmembership.csv
sccm_database points to the correct database and db connect validates that connection when adding it.
I can run the SQL query against the database manually and it returns data correctly.
SELECT collectionid, resourceid FROM v_ClientCollectionMembers
Everything checks out so I'm still at a loss as to why the app would comeback with invalid object name. Unless it's something to do with it being SQL Server 2012 and DB Connect 1.
In the event anyone is having similar issues I'll continue to update this thread.
... View more
01-28-2016
10:56 AM
I found the error in my ways there. The stanzas within sccm's inputs.conf file need to be copied into /opt/splunk/etc/apps/dbx/local/inputs.conf to create the database inputs. Make sense now.
On to the next problem.
When running the lookup reports in the sccm app i get zero results found for the Locations lookup.
The create collection membership lookup gives me this error - command="dbquery", A database error occurred: Invalid object name 'v_ClientCollectionMembers'
create collection lookup gives this error - command="dbquery", A database error occurred: Invalid object name 'v_Collection'
... View more
01-28-2016
07:49 AM
I'm going through the dev post found here - http://devpost.com/software/splunk-sccm-64z3c
This may be my inexperience with Splunk or general vagueness of the instructions. Not sure which but I have Splunk DB Connect set up and connected to my SCCM database. The SCCM app is installed then I get hung up on step 6 which says:
Step 6- In the sccm directory it creates, you will find a inputs.conf file in the root of the directory. DBConnect does not recognize dmon-tail inputs from the app, so you will need to add the stanzas to your inputs.conf located in /opt/splunk/etc/apps/dbx/local or C:\Program Files\Splunk\etc\apps\dbx\local directory.
What stanzas do I need to add?
Again this is probably simple, but given my lack of Splunk knowledge, I'm stuck here.
Any help or guidance is appreciated.
Thanks.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:03 AM
|
