Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About jclehmuth
jclehmuth
Path Finder
Member since:
10-01-2012
06-05-2020
Community Statistics
| Posts | 36 |
| Solutions | 2 |
| Karma Given | 1 |
| Karma Received | 6 |
| Member Since | 10-01-2012 |
Activity Feed
- Got Karma for Re: Where to find dashboard source files in a Splunk 5.x distributed search environment on Unix?. 04-23-2022 04:02 AM
- Karma Re: Why does the Splunk Add-on for Tenable stops ingesting data randomly? for nickhills. 06-05-2020 12:49 AM
- Got Karma for Why does the Splunk Add-on for Tenable stops ingesting data randomly?. 06-05-2020 12:49 AM
- Got Karma for Why does the Splunk Add-on for Tenable stops ingesting data randomly?. 06-05-2020 12:49 AM
- Got Karma for Re: Where to find dashboard source files in a Splunk 5.x distributed search environment on Unix?. 06-05-2020 12:47 AM
- Got Karma for How to convert _time to a human readable format and display Time and Date in a single value panel?. 06-05-2020 12:47 AM
- Got Karma for Re: Is the Splunk Add-on for Nessus supported on Windows?. 06-05-2020 12:47 AM
- Posted Re: Why does the Splunk Add-on for Tenable stops ingesting data randomly? on All Apps and Add-ons. 03-16-2018 07:06 AM
- Posted Re: Why does the Splunk Add-on for Tenable stops ingesting data randomly? on All Apps and Add-ons. 02-16-2018 03:49 AM
- Posted Why does the Splunk Add-on for Tenable stops ingesting data randomly? on All Apps and Add-ons. 02-15-2018 06:13 AM
- Tagged Why does the Splunk Add-on for Tenable stops ingesting data randomly? on All Apps and Add-ons. 02-15-2018 06:13 AM
- Tagged Why does the Splunk Add-on for Tenable stops ingesting data randomly? on All Apps and Add-ons. 02-15-2018 06:13 AM
- Tagged Why does the Splunk Add-on for Tenable stops ingesting data randomly? on All Apps and Add-ons. 02-15-2018 06:13 AM
- Tagged Why does the Splunk Add-on for Tenable stops ingesting data randomly? on All Apps and Add-ons. 02-15-2018 06:13 AM
- Posted Re: How to find the last login over an IP's client range on Security. 05-16-2017 07:06 AM
- Posted Re: Why is my Splunk Enterprise Security 4.0.0 installation failing? on Splunk Enterprise Security. 02-10-2016 12:35 PM
- Posted Re: Is the Splunk Add-on for Nessus supported on Windows? on All Apps and Add-ons. 10-21-2015 10:52 AM
- Posted Re: Unable to Export to CSV with error "File not found" on Getting Data In. 09-16-2015 07:22 AM
- Posted Re: Unable to Export to CSV with error "File not found" on Getting Data In. 09-16-2015 07:14 AM
- Posted Re: Unable to Export to CSV with error "File not found" on Getting Data In. 09-16-2015 07:09 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 2 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 0 | |||
| 0 |
03-16-2018
07:06 AM
I haven't had the issue in a while however, if it is an authentication issue we have an idea of what the problem may be. Our security center drops connection to AD on occasion, we have a ticket open with Tenable to help resolve the issue.
Thanks for pointing that out.
... View more
02-16-2018
03:49 AM
This add-on is really frustrating...
I came in this morning and it is working again. The majority of our scans run at night, so my usual setting to check for data is about every six hours, I went to adjust the check for data setting then I went to monitor the sourcetype for updates. The last logs came in at 0100, I have no idea what is going on with this add-on.
... View more
02-15-2018
06:13 AM
2 Karma
I've searched through the answers and most suggestions are: to disable and then enable the input, change the Start Time, some have even re-installed the app. For a while, I only had to open the input in the GUI which resets it, and that would work to get the data coming in again. Yesterday when, I restarted Splunk for another reason, data started to come again. I've tried everything but reinstalling the add-on this morning with no luck. I am running 5.1.2 for the add-on and my Splunk version is 7.0.1.
Here is the error I'm getting, I have double checked the user name and password both of which have not been changed on Nessus/Security Center and in the Splunk configuration.
2018-02-15 14:01:33,278 +0000 log_level=ERROR, pid=338, tid=Thread-4, file=ta_data_collector.py, func_name=index_data, code_line_no=118 | [stanza_name="Vulnerability" data="sc_vulnerability" server="SecuirtyCenter"] Failed to index data
Traceback (most recent call last):
File "/opt/splunk/etc/apps/Splunk_TA_nessus/bin/splunk_ta_nessus/splunktaucclib/data_collection/ta_data_collector.py", line 115, in index_data
self._do_safe_index()
File "/opt/splunk/etc/apps/Splunk_TA_nessus/bin/splunk_ta_nessus/splunktaucclib/data_collection/ta_data_collector.py", line 148, in _do_safe_index
self._client = self._create_data_client()
File "/opt/splunk/etc/apps/Splunk_TA_nessus/bin/splunk_ta_nessus/splunktaucclib/data_collection/ta_data_collector.py", line 95, in _create_data_client
self._checkpoint_manager)
File "/opt/splunk/etc/apps/Splunk_TA_nessus/bin/splunk_ta_nessus/splunktaucclib/data_collection/ta_data_client.py", line 55, in __init__
self._ckpt)
File "/opt/splunk/etc/apps/Splunk_TA_nessus/bin/splunk_ta_nessus/ta_tenable_sc_data_collector.py", line 18, in do_job_one_time
return _do_job_one_time(all_conf_contents, task_config, ckpt)
File "/opt/splunk/etc/apps/Splunk_TA_nessus/bin/splunk_ta_nessus/ta_tenable_sc_data_collector.py", line 53, in _do_job_one_time
logger_prefix=logger_prefix)
File "/opt/splunk/etc/apps/Splunk_TA_nessus/bin/splunk_ta_nessus/security_center.py", line 219, in get_security_center
sc.login(username, password)
File "/opt/splunk/etc/apps/Splunk_TA_nessus/bin/splunk_ta_nessus/security_center.py", line 46, in login
self._token = str(result['token'])
KeyError: 'token'
... View more
05-16-2017
07:06 AM
sundareshr search worked, minus the small error...
| stats latest(_time) as Time latest(Account_Name) latest(Security_ID) by src_ip | fieldformat Time=strftime(Time, "%m/%m/%Y %H:%M:%S")
should be | stats latest(_time) as Time latest(Account_Name) latest(Security_ID) by src_ip | fieldformat Time=strftime(Time, "%m/%d/%Y %H:%M:%S")
... View more
02-10-2016
12:35 PM
Try going to searching and reporting and running the following search
| testessinstall
http://docs.splunk.com/Documentation/ES/latest/Install/InstallEnterpriseSecurity
... View more
10-21-2015
10:52 AM
1 Karma
btran-
The nessus add-on utilizes Splunk's built in python, which doesn't come with universal forwarders. You have to use a full Splunk instance.
"This add-on does not support universal forwarders for data collection because the add-on requires Python."
http://docs.splunk.com/Documentation/AddOns/latest/Nessus/InstalltoSearchHead
... View more
09-16-2015
07:22 AM
Sorry, not sure what to tell you then, maybe there is a glitch in the matrx
... View more
09-16-2015
07:14 AM
Sounds like it might be a permission issue (either Splunk or computer), have you exported anything before.
... View more
09-16-2015
07:09 AM
Are you using the export button or outputing to a Lookup table?
... View more
09-11-2015
07:03 AM
"When you forward structured data to an indexer, Splunk Enterprise does not parse this data once it arrives at the indexer, even if you have configured props.conf on that indexer with INDEXED_EXTRACTIONS. Forwarded data skips the following queues on the indexer, which precludes any parsing of that data on the indexer:
parsing
aggregation
typing
The forwarded data must arrive at the indexer already parsed."
http://docs.splunk.com/Documentation/Splunk/6.1.4/Forwarding/Routeandfilterdatad
An expensive work around could be done by adding this to the inputs.conf
[splunktcp://9998]
route=has_key:_utf8:parsingQueue;has_key:_linebreaker:parsingQueue;absent_key:_utf8:parsingQueue;absent_key:_linebreaker:parsingQueue
Found here:
http://answers.splunk.com/answers/97918/reparsing-cooked-data-coming-from-a-heavy-forwarder-possible.html
http://answers.splunk.com/answers/5528/forwarding-select-data-in-my-environment.html
... View more
09-11-2015
05:57 AM
It sounds like the OP has a remote Splunk instance and is forwarding data from that instance to his main instance. He wants to force the data coming from the remote instance into a certain "special" index and not into the main/default/or whatever index the remote instance is putting the data into.
If parsing is already done by something else then the indexer is going to ignore the props and transforms, so I see why you said that they can be forgotten. But he has the index in inputs and it seems that it still isn't working.
... View more
09-01-2015
12:58 PM
Were you able to find extractions for the BlueCat logs, or did you do them yourself?
... View more
08-31-2015
12:04 PM
The OU for the user base was changed to Domain Admins, and now it works.
... View more
08-19-2015
10:53 AM
Opened a ticket with support, will post the solution if we find one.
... View more
08-14-2015
11:58 AM
-0400 DEBUG ScopedLDAPConnection - strategy="ldaphost1" LDAP Server returned no entries in search for DN="CN=SPLUNK_IA_ADM,OU=Enterprise Security Groups,DC=xxx,DC=xxx,DC=xxxl" filter="(&(samaccountname=xxx)(cn=*))".
-0400 DEBUG ScopedLDAPConnection - strategy="ldaphost1" LDAP Server returned no entries in search for DN="CN=SPLUNK_IA_ADM,OU=Enterprise Security Groups,DC=xxx,DC=xxx,DC=xxx" filter="(&(cn=cn=xxx,ou=domain admins,dc=xxx,dc=xxx,dc=xxx)(samaccountname=*))".
-0400 DEBUG UserManagerPro - LoadLDAPUsersThread: strategy="ldaphost1" Attempting to get user="cn=xxx,ou=domain admins,dc=xxx,dc=xxx,dc=xxx" from LDAP to map to roles="admin"
... View more
08-14-2015
11:05 AM
I adjust the timelimit and network_timeout, they are no longer both 20... but everything else is the same.
... View more
08-14-2015
10:58 AM
[role_admin]
schedule_rtsearch = disabled
srchMaxTime = 8640000
[role_power]
srchIndexesDefault = *
srchMaxTime = 8640000
[role_atlas user]
cumulativeRTSrchJobsQuota = 0
cumulativeSrchJobsQuota = 0
importRoles = user
rtSrchJobsQuota = 1
srchMaxTime = 0
srchTimeWin = 360
... View more
08-14-2015
10:57 AM
[authentication]
authType = LDAP
authSettings = ldaphost1
[roleMap_ldaphost1]
admin = SPLUNK_IA_ADM
[ldaphost1]
SSLEnabled = 1
anonymous_referrals = 1
bindDN = CN=ldap sa\, splunk,OU=Enterprise Service Accounts,DC=xxx,DC=xxx,DC=xxx
bindDNpassword = $1$s0IT6ghwgSvOB9ADovClFg==
charset = utf8
emailAttribute = mail
groupBaseDN = OU=Enterprise Security Groups,DC=xxx,DC=xxx,DC=xxx
groupMappingAttribute = dn
groupMemberAttribute = member
groupNameAttribute = cn
host = x.x.x.x
nestedGroups = 0
network_timeout = 20
port = 636
realNameAttribute = cn
sizelimit = 5000
timelimit = 20
userBaseDN = OU=Enterprise Security Groups,DC=xxx,DC=xxx,DC=xxx
userNameAttribute = samaccountname
... View more
08-14-2015
10:49 AM
Yes and yes.
I can see the users when I select the group to map a role to, but I can't see them under the users and they are not able to sign in.
... View more
08-14-2015
09:59 AM
I'm trying to configure Splunk to allow LDAP authentication. I select "Configure Splunk to use LDAP and map groups" and then complete the LDAP strategy. I then select Map groups and map roles to groups. I am currently using one group as a test that has two users in it. I can see all the groups and my target group. I select my target group and give them a role. For testing purposes, I gave them the power role. I saved, backed out, and checked the user section, but they were not there. I reloaded authentication configuration and they were still not there. When I attempt to login with one of those users I receive the following errors:
-0400 ERROR UserManagerPro - LDAP Login Failed, could not find a valid user="xxx" on any configured servers
-0400 ERROR AuthenticationManagerLDAP - Could not find user ="xxx" with strategy="LDAP"
Also watching TCPdump on the server I can see the traffic going to the LDAP server while attempting to log in.
In short, I mapped groups to roles, but I am unable to login with any of those users.
... View more
12-19-2014
03:27 PM
That worked thanks. I can't believe I couldn't figure that out.
... View more
12-19-2014
01:12 PM
1 Karma
This sounds easy but I can't seem to figure it out. I'm creating an "Admin" dashboard and a couple of the panels are time last "x" tool ran. The most recent event received from host "x" is what I need to retrieve a time stamp from and post it in a panel.
Currently I have this
host ="10.0.33.210" | chart first(_time)
which outputs : 1418565983
How do I convert that into readable time and date?
I'm attempting to just use a single value panel.
Thanks in advance.
... View more
