Activity Feed
- Got Karma for Re: Should a deployment server delete an application?. 01-20-2025 07:09 AM
- Got Karma for Re: Forwarder Output Compression Ratio. 04-21-2023 07:01 AM
- Got Karma for Re: How to get average response time (95%,99% and 100%). 11-09-2022 06:58 PM
- Got Karma for Re: How can I search for events that do not contain a field?. 05-03-2022 03:17 AM
- Got Karma for Re: How to use lookup to rationalize an entered MAC address in a search triggered from a view in user interface. 11-26-2020 12:04 AM
- Got Karma for Re: How to make a search case-sensitive?. 10-28-2020 03:26 AM
- Got Karma for Re: Top percentage from stats output?. 10-26-2020 08:13 PM
- Karma Re: Anyone have apps, whitepaper, wikis, or resources on Splunk and Pivotal Cloud Foundry? for ChrisG. 06-05-2020 12:49 AM
- Karma Will Cisco Security Suite work on Splunk 7? for lycollicott. 06-05-2020 12:49 AM
- Karma Re: Will Cisco Security Suite work on Splunk 7? for wahmad_splunk. 06-05-2020 12:49 AM
- Karma Re: Change Refresh Progress bar to spinning wheel in Splunk dashboard for niketn. 06-05-2020 12:49 AM
- Karma Re: getting 404 not found for TA-cisco-esa for rpille_splunk. 06-05-2020 12:49 AM
- Karma Re: Index gz archive files from Storage Account via Splunk Add-on for Microsoft Cloud Services not working for jconger. 06-05-2020 12:49 AM
- Karma What are Splunk Validated Architectures and where can I find them? for s2_splunk. 06-05-2020 12:49 AM
- Got Karma for Re: getting 404 not found for TA-cisco-esa. 06-05-2020 12:49 AM
- Karma Is Cisco Security Suite 3.1.1 supported in Splunk 6.4.2? for neelu123. 06-05-2020 12:48 AM
- Karma Re: How do I extract two different variations of a timestamp from the same sourcetype? for sowings. 06-05-2020 12:48 AM
- Karma Re: I've installed the Splunk Add-on for Cisco ESA on my search head, but do I need to install it on my indexers as well? for rpille_splunk. 06-05-2020 12:48 AM
- Karma How can I collect an API token from the user when not running the Splunk Add-on Builder in test mode? for sschall13. 06-05-2020 12:48 AM
- Karma Re: Download Splunk Conf 2016 Session materials for ChrisG. 06-05-2020 12:48 AM
Topics I've Started
Subject | Karma | Author | Latest Post |
---|---|---|---|
1 | |||
3 | |||
1 | |||
0 | |||
0 | |||
1 | |||
1 | |||
1 | |||
4 |
03-08-2018
07:39 AM
1 Karma
It may help others to reproduce if they know what version of add-on & Splunk are being used.
... View more
07-25-2017
08:26 AM
It would be easier at search time. From the small data sample we can see it would likely make the most sense to have each line with its own timestamp indexed as a separate event and then stitch transactions together in ad hoc searches or reports using the stats command or transaction command.
... View more
07-25-2017
07:06 AM
I was able to get it working using this props config, though admittedly I don't have the full data set.
SHOULD_LINEMERGE=FALSE
LINE_BREAKER=([\r\n]+)\d{2}\/\d{2}\/\d{4}\s\d{1,2}:\d{1,2}:\d{1,2}\shost=.*\sSMB\dEnabled
... View more
12-13-2016
09:19 AM
1 Karma
Beatus is right. Your sourcetype is transforming after the nullQueue routing. You should be able to resolve by making the nullQueue routing regex more specific and moving it to the source stanza in props. Something like this...
transforms.conf
[force_sourcetype_for_cisco_asa]
DEST_KEY = MetaData:Sourcetype
REGEX = %ASA-\d-\d{6}
FORMAT = sourcetype::cisco:asa
[removeDNS]
REGEX = %ASA-\d-\d{6}.*[/(]53[)\s]
DEST_KEY = queue
FORMAT = nullQueue
props.conf
[syslog]
TRANSFORMS-force_sourcetype_for_cisco = force_sourcetype_for_cisco_asa,force_sourcetype_for_cisco_pix,force_sourcetype_for_cisco_fwsm
TRANSFORMS-asa_toss_dns = removeDNS
[cisco:asa]
KV_MODE = auto
... View more
11-30-2016
04:18 PM
I've edited my original answer (above) with the code that works - and why.
... View more
11-29-2016
03:33 PM
Okay, I think I've re-produced. I believe in test mode, the below code would correctly log the single value access_token but when it runs as a defined input, the access_token returned is actually a dictionary containing all the input's access_token values (including the TAB_example used in test mode). I've contacted the developer of the add-on builder with this info to learn recommendation for addressing the invoking input stanza in that dictionary. I'll update this answer when I hear back.
opt_access_token = helper.get_arg('access_token')
helper.log_info("opt_access_token={}".format(opt_access_token))
... View more
11-23-2016
08:56 AM
Are you using Add-on Builder 2.0?
In 2.0, the Add-on Builder leverages Single Instance mode by default. This basically means the mod input script is called once for ALL the inputs. This means ALL configurations for the input are provided to the script from the helper functions, as a dictionary.
Here is the code I'm now using to work that way. Since it checks for whether or not helper returns a dictionary, the code works in both test mode (returns single value) and for configured inputs (returns a dictionary).
def collect_events(helper, inputs, ew):
"""Implement your data collection logic here"""
stanzas = helper.input_stanzas
for stanza_name in stanzas:
opt_access_token = helper.get_arg('access_token')
if type(opt_access_token)==dict:
opt_access_token = opt_access_token[stanza_name]
# ALL the other pre-tasks, API querying, && event writing
... View more
09-22-2016
11:52 AM
If I understand correctly, one way would be to use the stats to get min & max per server and then use eval command to calculate total transactions for each. Example:
... | stats min(ID_Number) as min_id max(ID_Number) as max_id by server
| eval num_transactions = max_id - min_id
| table server num_transactions
... View more
09-22-2016
11:41 AM
You can use Splunk's command line to do this by invoking an _internal call ...
$SPLUNK_HOME/bin/splunk _interncal call /authentication/users/test_user -post:force-change-pass "true"
... View more
09-07-2016
09:54 AM
Great! Thank you for the update.
... View more
09-07-2016
04:50 AM
Hi crbrown68. A bit more information may help troubleshoot this issue.
1) What version of Cisco Security Suite you're presently using?
2) What version of the ASA Add-on are you presently using?
3) What is the output of this command in your Splunk environment?
$SPLUNK_HOME/bin/splunk btool --debug eventtypes list cisco-firewall
... View more
08-23-2016
06:15 AM
Depending on your goals, the metadata command may work
| metadata type=hosts | convert ctime(firstTime) ctime(lastTime) | rename firstTime as oldestData lastTime as newestData | table host *Data
Edited to add: I missed the second part of your question. You may want to additionally leverage the metasearch command: http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Metasearch
Off the top of my head, you could join result sets from both metadata and metasearch commands. An example showing first and last timestamp of events from each host having syslog data would look like this:
| metasearch sourcetype=syslog | dedup sourcetype host | join host [| metadata type=hosts] | convert ctime(firstTime) ctime(lastTime) | rename firstTime as oldestData lastTime as newestData | table sourcetype host *Data
... View more
08-22-2016
09:26 AM
That is a search time configuration. It allows knowledge objects to work for both source types.
To have the source type identified correctly for new data as it is indexed, you will need to set the source type correctly on the first machine that does parsing.
... View more
08-17-2016
08:46 AM
My answer above is for indexing the data with correct source type (cisco:asa:textmail). If you're trying to rename ironport during search time operations (for data already indexed as ironport) you may update your props.conf on the search head with this configuration.
[ironport]
rename = cisco:esa:textmail
... View more
08-17-2016
08:40 AM
rpille is right about which Splunk instances the TA should reside.
Yet the props you've defined on the search head is an input phase configuration. Since the search head is not involved in the input, that configuration is ignored. The source type update via props.conf needs to take place on the heavy forwarder and be scoped to a source because parsing phase configurations with a sourcetype setting must be scoped to a source.
[source::tcp:514]
sourcetype = cisco:esa:textmail
This extra props may be skipped by updating the local inputs.conf on the heavy forwarder (to set source type further upstream)
[tcp://514]
sourcetype = cisco:esa:textmail
... View more
08-04-2016
07:04 AM
Hi Hungham, Cisco Security Suite is community supported. Because it had some compatibility issues with recent improvements to related technology add-ons, it has been temporarily removed from Splunkbase. It will be added back to Splunkbase once its knowledge objects are updated so its dashboards again populate correctly.
... View more
08-01-2016
12:42 PM
Hi Neelu123, I have not found anything that does not work with Cisco Security Suite (CSS) 3.1.1 & Splunk Enterprise 6.4.2 in a lab with eventgen data.
Yet an absence of evidence is not evidence of absence, so your milage may vary. If you do find anything not working, please update this thread (CSS is presently community supported).
NB: CSS 3.1.1 does not report fully with the latest technology add-ons for WSA & ISE (CSS was using eventtypes from those TA's that are no longer present and that affects some of the searches & dashboards). I have sent an update of CSS to its owner that removes those dependencies.
... View more
03-07-2016
01:29 PM
This looks similar to a bug (ADDON-6014) that was encountered after upgrade to Splunk 6.3 (the root cause was a newer version of Python in Splunk 6.3 which contained changes to the urllib2 library that TA uses).
That was resolved in Cisco IPS version 2.1.5 -- which you mention you have in your original question.
My initial hypothesis would be that the IPS query code was not updated appropriately. Was the IPS TA installed from scratch or upgraded from a previous version? Either should be fine but I'm trying to learn more about the environment to determine what could be causing this. Do you have a support case open? In this specific case, it may be easier to help by reviewing a diag.
... View more
02-08-2016
09:09 AM
1 Karma
Thank you for this post, secfrit. I've filed an internal bug against this. If you're speaking with support, they can look it up as ADDON-7743.
... View more
12-09-2015
10:33 AM
Hi @nickpayze, can you try adding a start_by_shell=false to the [aws_cloudwatch_logs] configuration in inputs.conf and re-starting Splunk?
... View more
12-09-2015
10:00 AM
Ubuntu's dash shell returns a different SIGTERM than bash, resulting in orphaned input processes. This was meant to have been resolved in TA version 2.0.1 (which is why rpille asked which version). At first glance, it appears this condition is being detected and partially handled (additional processes aren't spawned when orphaned processes exist, yet the orphaned process is not terminated). I'll file a new bug for this and explore workarounds.
... View more
12-09-2015
09:49 AM
What OS is being used to host Splunk?
... View more
07-23-2015
09:03 AM
2 Karma
If your search head is setup as a forwarder, the summary index will be populated on the indexers. It sounds like this is what you want. That configuration (Forwarding Search Head data to Indexers) is considered a best practice. Additional information on why (& how to set that up) may be found here: http://docs.splunk.com/Documentation/Splunk/6.2.4/DistSearch/Forwardsearchheaddata.
... View more
07-20-2015
04:34 AM
And you're running the search from an Administrator account or User account ? Does this search return any results:
| metadata type=sourcetypes | search sourcetype=mcafee*
... View more
07-17-2015
07:05 AM
Do you get results if you search by index time instead? Try "index=* sourcetype=mcafee:epo _index_earliest=-7d"
... View more