About nembela

nembela

Thanks for the answer. The saved search is working just fine since this accident. For testing reason I created a new index and rerun the search with the relevant timeframe. It was working fine with the test index. However when I rerun the search to send the missing events to the real destination index, nothing happens. The search gives results but these results don't show up in the destination index. I found this log event: 06-21-2024 09:55:08.916 +0200 INFO SavedSearchHistory - pruning saved search history for savedsearch_id=<my_user_name>;vpn;SUM - VPN - Logout events reason=user=<my_user_name> does not exist It looks like as if something happened to my user during this period.

nembela

Hi, I use collect for to create a summary about VPN login and logout events. This worked fine but on last week I have 24 hours of logout events missing. Meanwhile the summary of login events were created. I checked the search without the collect command and it gives the correct output. I tried it with a test index and it worked too. But when I run the search for the missing timeframe nothing appears in the destination index. Do you have any advice what else could I check? Thanks

nembela · ‎09-21-2023

Hi, I found a problem in Splunk DB connect when I tried to add a new input. I can add new connections and the current inputs are working. But when I try to add new input or try to use the “SQL Explorer” after choosing connection I get a “Cannot get schemas“ error message. In the _internal index I found this error message: „Unable to get schemas metadata java.sql.SQLException: Non supported character set (add orai18n.jar in your classpath): EE8ISO8859P2” After this I updated DB Connect and the Oracle JDBC drivers but it did not help. I consulted our DB admins. As it turned out these DBs really differ when it comes to character encoding (EE8ISO8859P2 vs. UTF8). Of course the orai18n.jar file is there with the driver. I found this in the documentation: https://docs.splunk.com/Documentation/DBX/3.14.1/DeployDBX/Troubleshooting#Unicode_decode_errors "Splunk DB Connect requires you to set up your database connection to return results encoded in UTF-8. Consult your database vendor's documentation for instructions about how to do this." Is it possible that DB Connect can only handle Oracle DB with UTF-8 encoding? Thanks, László

nembela · ‎01-23-2023

Hi, I also have/had this problem and only modification of the default/props.conf solved the problem. @davidoff96: Luckily the "MAX_TIMESTAMP_LOOKAHEAD" value is not a problem because createdDateTime is the second field in the raw json data.

nembela · ‎12-07-2021

Hi, Thanks for the ideas. I'll try to answer the questions in one post. @isoutamo: We have regulations that requrire the collection of logs from environments where the data is not fully anonimized (e.g. staging and test). But we can use the same Splunk instance for all these logs. @gcusello: Because these are standard OS logs, the same teams need to access/monitor them. We don't need to give access to developers because there are no application logs. @ITWhisperer: Do you want to be able to distinguish which environment an event came from? Yes Do you want to be able to mix events from different environments into the same search/dashboard? Yes Can you use the host field to determine which environment the event came from, e.g. by a simple lookup? Yes, but it will need definitely some manual work Are the log formats the same across all environments? Yes, normal Linux and Windows OS logs

nembela · ‎12-07-2021

Hi, Till now we only collected logs from production servers with Splunk. But soon we will onboard the system logs from non-prod (Linux, Windows) servers. What is the best way to differentiate between the logs from different environents? different index? All these logs have the same retention time different sourcetype? All the logs are system logs (Windows, Linux) eventtype? a dedicated "environment" field? tagging? Thanks, Laci

nembela · ‎10-04-2021

Hi, I havethe following search index="windows" source=WinEventLog:Security ([| inputlookup windows_group_change_events | where group_action like "member added" or group_action like "member removed" | fields EventCode ]) NOT src_user=portalsync | ldapfilter search="(&(objectClass=group)(cn=$Group_Name$))" attrs="distinguishedname,description, info" | eval _raw = json_object("time", _time, "action_by", src_user, "event_code", EventCode, "group", mvindex(Security_ID, 2), "member", mvindex(Security_ID, 1),"orig_sourcetype", sourcetype, "orig_host", host, "dn", distinguishedName, "desc", description, "info", info ) | fields _time, _raw | collect index=windows_ad_summary addtime=0 source="windows_group_management" I try to save the group membership change events to a different index for long-term retention. I got the original idea from here: https://conf.splunk.com/files/2017/slides/using-splunk-enterprise-to-optimize-tailored-longterm-data-retention.pdf My problem is that this search always returns "no results". If I omit the "fields" and "collect" commands it returns results as intended. Also if I omit the "ldapfilter" command it works just fine. Do you have any idea what is the problem with the combination of "ldapfilter" and "fields"? Thanks, Laszlo Edit: I'm using Splunk 8.0.9

nembela · ‎10-04-2021

Hi, There is a setting in serverclass.conf that has this function: excludeFromUpdate Documentation: https://docs.splunk.com/Documentation/Splunk/8.2.2/Updating/Excludecontent Hope this helps

nembela · ‎03-23-2021

According to the documentation the "where" or "regex" command should be used: https://docs.splunk.com/Documentation/Splunk/latest/Search/Wildcards#Searching_for_the_asterisk_character

nembela · ‎03-23-2021

It turned out that it was a bug in DB connect (DBX-5327) that was fixed in 3.4.2

nembela · ‎03-17-2021

Hi, I have applications that log login events as multiple events. Example: [07B0:007E-19E8] 2021.03.17 11:59:01 Opened session for User Name/HEXP/HU (Release 8.0.2FP6) [07B0:007E-19E8] 2021.03.17 11:59:01 ATTEMPT TO ACCESS SERVER by User Name/HEXP/HU was denied [07B0:007E-1408] 2021.03.17 11:59:01 Closed session for User Name/HEXP/HU Databases accessed: 0 Documents read: 0 Documents written: 0 This is an unsuccessful login event. when the login is successful, only the first event is logged. I can connect these events with transaction, which is ok for some reporting purposes. But if I use transaction then I can't tag these events and I can't make the logs CIM compliant. Is there a way to handle these kind of situations? Or it is not possible to tag these kind of events correctly? Thanks, László

nembela · ‎03-10-2021

Thanks for the suggestion. I tried to exchange the conditions but it did not help. The result was the same.

nembela · ‎03-10-2021

Hi, I have the following problem with rising input creation. If I try to add the following query as a rising input, I receive an error: SELECT * FROM DIARY WHERE DIARY_DATE > ? AND TABLE_ID = 3 ORDER BY DIARY_DATE ASC But the following query works: SELECT * FROM DIARY WHERE DIARY_DATE > ? ORDER BY DIARY_DATE ASC "Step 4" fails when I click "next" on the "New input" screen, however the query runs fine. According to the documentationit is permitted to use complex WHERE clauses: "Use other advanced SQL features in the WHERE clause—for example a CASE statement." Do you have any idea what went wrong here? Thanks, László

nembela · ‎05-29-2020

Hi, I installed Splunk Security Essentials 3.1.1. The app runs just fine. But Data inventory doesn't work for me. The automated introspection never finishes and manually added sources keep disappearing. But there is no error message. Is there a way to debug this app? Does it generate logs? Thanks

nembela · ‎04-17-2019

I don't know if this problem relevant yet but I had the same problem. Splunk support found an undocumented paramater for this in savedseaches.conf: action.script.maxtime The maximum amount of time a script action takes before the action is canceled. The valid format is number followed by a time unit ("s", "m", "h", or "d"). I hope it helps.

nembela · ‎07-20-2017

It turned out that this can't be done. When you filter Windows XML event logs through inputs.conf not all fields can be used that are listed in the documentation: http://docs.splunk.com/Documentation/Splunk/6.6.2/Admin/Inputsconf#Event_Log_whitelist_and_blacklist_formats (for example "Message" field is not available as a key but "EvenctCode" is) In this case the only solution is nullqueue filtering.

nembela · ‎06-06-2017

I have the following inputs.conf stanza: [WinEventLog://Security] disabled = 0 start_from = oldest current_only = 0 evt_resolve_ad_obj = 0 checkpointInterval = 5 blacklist1 = EventCode="4662" Message="Object Type:(?!\s*groupPolicyContainer)" blacklist2 = EventCode="^(4624|4634)$" index = wineventlog renderXml=true It works fine and filters out eventcodes 4624 and 4634, but I'd like to filter these events only when LogonType equals 3. Since there is no Message field in XML event logs, I don't know how add this condition to blacklist2. Any idea? Thanks in advance

nembela · ‎07-15-2011

Hi, My solution is not to elegant, but it works. I configured the performance monitoring on the Splunk indexer from web UI. The I copied the required stanzas from the perfmon.conf of the indexer to the splunk forwarder: $SPLUNKFORWARDER_HOME/etc/systekm/local/perfmon.conf For example: [PERFMON:Available Memory] counters = Available Bytes disabled = 0 interval = 10 object = Memory index = performance We use different index for performance data because of the different archiving policy I hope it helps you

nembela · ‎05-30-2011

My problem is the following: When I install an universal forwader to a windows host it begins to forward every log entry from the event logs. But I don't need the entries that are older than 10 days. I tried the following props.conf file (both on the indexer and the forwarder): [default] MAX_DAYS_AGO = 10 But it still forwards every entry. What have I done wrong? Thanks in advance

Posts	19
Solutions	2
Karma Given	7
Karma Received	4
Member Since	‎05-19-2011

Online Status	Offline
Date Last Visited	2 weeks ago

Strange behaviour of collect command

Splunk DB Connect character encoding problem

Separating logs from different environments

Modification of the "_raw" field

Transaction-like login events

Splunk DB Connect rising input creation problem

Splunk Security Essentials: Data inventory doesn't...

How can I filter windows XML event logs?

How NOT to index old logs

Re: Strange behaviour of collect command

Strange behaviour of collect command

Splunk DB Connect character encoding problem

Re: Splunk TA for Microsoft Office 365 can't parse...

Re: Separating logs from different environments

Separating logs from different environments

Modification of the "_raw" field

Re: TA deployed with Deployment Server - Where can...

Re: Is there a way to only search * (asterisk)?

Re: Splunk DB Connect rising input creation proble...

Transaction-like login events

Re: Splunk DB Connect rising input creation proble...

Splunk DB Connect rising input creation problem

Splunk Security Essentials: Data inventory doesn't...

Re: Is there a time limit on saved search scripts?

Re: How can I filter windows XML event logs?

How can I filter windows XML event logs?

Re: Universal Forwarder (Windows) dont forward per...

How NOT to index old logs