About gooza

gooza · ‎12-05-2016

I agree with lguinn , white listing will solve the problem ( it did for me , the only thing I need to make sure is that the monitored folder is a little bit different for example - input.conf: [monitor:///home/gcaaxfer/data/] disabled = false host_segment = 3 index = my_index sourcetype = my_request whitelist = (sm_nr_.*\.csv) crcSalt = <SOURCE> [monitor:///home/gcaaxfer/data] disabled = false host_segment = 3 index = my_index sourcetype = my_request whitelist =(sm_.*tickets\.csv) crcSalt = <SOURCE> notice that one of the monitored path has '/' at the end and one without. this enabled me to monitor easily different files in the same directory

gooza · ‎04-24-2014

will do , thanks MuS

gooza · ‎04-23-2014

ok ,thanks for the replay, I hope splunk will add it in the future. if anyone else need this feature please vote up this question so splunk can see the need.

gooza · ‎04-23-2014

Hi we have many sources that sends us a lot of similar events (DNS for example) a.host.com 1.1.1.1 a.host.com 1.1.1.1 a.host.com 1.1.1.1 Is there a way for me to aggregate the events to one single event and just add the count of events that happened (lets say in one minute) ? so I will only index: a.host.com 1.1.1.1 count=3 Is it possible to do this in splunk ( maybe with regex in transforms)? For now we are depended on 3rd party agents like arcsight in front of splunk to do the aggregation - I would really like to see this feature in splunk Any ideas?

gooza · ‎08-05-2013

change the URL https://mysplunk:8000/en-US/

gooza · ‎07-24-2013

Can you find the AfterGlow.py file in your Splunk directory? It's in your $SPLUNK_HOME/etc/apps/afterglow/appserver/modules/AfterGlow directory. make sure that line 88: neato = os.path.join(neato_path,"neato") is the following: neato = os.path.join(neato_path,"neato.exe")

gooza · ‎05-04-2013

correct. just paste it in, you can always ask an enhancement request that someone will just add a button for it 🙂

gooza · ‎05-02-2013

have you tried adding showsource=t in the url http://splunk-base.splunk.com/answers/1/how-can-i-convert-simple-view-xml-to-advanced-xml

gooza · ‎04-25-2013

What about filtering the messages in the relevant apps with application.js as suggested in: http://splunk-base.splunk.com/answers/3123/message-module-filter-values

gooza · ‎12-11-2012

Thanks , I moved it to the linux machine and it worked from there

gooza · ‎12-10-2012

Hi, I'm trying to use the splunk for netwitness app (I'm using splunk on windows) but it is not working with the following error messages: ERROR: Couldn't execute summary query. Existing... ERROR: urlopen error [Error 10060] A connection attempt failed because the connected party did not properly respond after a period of time... took 6.125 seconds to run, 0 bytes read No New sessions to read nwsdk.conf file in the local directory configuration: [rest] top_level_url=http://10.10.10.1:50105 username=myusername password=mypassword last_sid_file=c:\.last_sessionid no_sid_file=-2 (tried also using 0 here ) no_sid_seconds_back=300 max_meta=50000 write_to_file_every_x=500 I have no problems connecting the netwitness via the web anyone had any luck with this app ?

gooza · ‎08-14-2012

install it on the search head since it reports the fields you want, on the indexer (OR splunk forwarder if you use one) you make the necessary changes to the relevant stanza for time recognition. [stanzaname] TIME_PREFIX = \s(end|rt)= TIME_FORMAT = %10S%3n MAX_TIMESTAMP_LOOKHEAD = 350 the max timestamp lookahead length changes according to the CEF data received

gooza · ‎05-31-2012

do you mean: enabling-real-time-backfill more can be found on : Real-time_backfill

gooza · ‎05-31-2012

Yes , just make sure you mark the "Enable summary indexing" when you schedule the saved search Setting up summary index searches in splunk web

gooza · ‎05-30-2012

What I do is create the saved search ,schedule it from now on and use the backfill only once with the earliest time I want ( use the -et ) and the latest (the -lt) is just before the time I started the schedule search, add the -j switch to speed things up with the Maximum number of concurrent searches to run ..and that is it I don't use the backfill again. more on backfill

gooza · ‎05-15-2012

OK , did you succeeded in running the script manually via the CLI splunk cmd python .bin\heartbeat.py maybe that will give you some errors to follow on ...

gooza · ‎05-03-2012

have you tried collecting the syslogs and using splunk cisco-security-suite

gooza · ‎04-03-2012

use lookup tables , list the product id you're looking for in csv and add a seen field to it: productid,seen 645,1 423,1 and so on then run the search activated=true | lookup yourlookuptable productid OUTPUT seen | Where seen!=1 you can read more on lookup tables at: docs.splunk.com

gooza · ‎03-29-2012

add to your props.conf file under the relevent stanza the row: REPORT-cefevents = cefHeaders,cefKeys you can read more on props.conf at splunk Documentation

gooza · ‎03-15-2012

try: yoursearch | rex mode=sed "s/\"\"/\"/g"

gooza · ‎02-23-2012

no , the tcpout redirect the data to different TCP ports on the indexer and each port has its own source type and index

gooza · ‎02-23-2012

also there is a newer script by zpavic: see his answer to my question : link:remove duplicates on specific dates

gooza · ‎02-23-2012

try this : http://splunk-base.splunk.com/apps/22899/remove-duplicate-event-data-from-index

gooza · ‎02-23-2012

I'm trying to use the heavy forwarder to route data to different indexes based on values in _raw , is this possible ? the configuration files are: inputs.conf: [tcp://9997] sourcetype = FromFooandBarbysinglehost props.conf: [FromFooandBarbysinglehost] BREAK_ONLY_BEFORE = ^ TRANSFORMS-routing = FromFoo,FromBar transforms.conf: [FromFoo] REGEX = (?i) From|.+?Foo DEST_KEY = _TCP_ROUTING FORMAT = outtoFoo [FromBar] REGEX = (?i) From|.+?Bar DEST_KEY = _TCP_ROUTING FORMAT = outtoBar outputs.conf: [tcpout:outtoFoo] server = 10.10.10.10:1111 sendCookedData = false [tcpout:outtoBar] server = 10.10.10.10:2222 sendCookedData = false in the indexer 10.10.10.10 the TCP port 1111 is indexed to foo index , and 2222 is indexed to Bar index) me problem is that I see both foo data and bar data in both indexes , it is like there is no termination to the transforms process and both are sent to both ports. I double checked my REGEX in the search bar in splunk and it does show only the relevant data what am I missing ?

gooza · ‎11-22-2011

I solved it by role mapping via the authentication.conf file.

Posts	44
Solutions	7
Karma Given	56
Karma Received	29
Member Since	‎07-14-2010

Online Status	Offline
Date Last Visited	‎10-22-2023 04:02 AM

Event aggregation before Indexing

splunk for netwitness not working

heavy forwarder to route base on _raw values

Configure Ldap role mapping showing only 999 itea...

Tags VS lookup tables? - performance wise

is it possible to parse and index snort payload ?

is it possible to run remove duplicates on specifi...

how to delete duplicate events

Re: How to edit inputs.conf to monitor multiple fi...

Re: Event aggregation before Indexing

Re: Event aggregation before Indexing

Event aggregation before Indexing

Re: _time different format???

Re: AfterGlow not working with Win7

Re: unable to convert any saved dashboard to advan...

Re: unable to convert any saved dashboard to advan...

Re: stop all users seeing a license warning messag...

Re: splunk for netwitness not working

splunk for netwitness not working

Re: How-To Install (SearchHead/Indexer) Common Eve...

Re: Different ways of populating a summary index

Re: Different ways of populating a summary index

Re: Different ways of populating a summary index

Re: Pinger configuration on windows

Re: monitor cisco switch environment

Re: splunk query with specific product id count

Re: How to get data data from ArcSight Connectors

Re: Replace string

Re: heavy forwarder to route base on _raw values

Re: Delete duplicate events

Re: Delete duplicate events

heavy forwarder to route base on _raw values

Re: Configure Ldap role mapping showing only 999 ...