Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About dfigurello
dfigurello
Communicator
Member since:
05-15-2013
01-04-2021
Community Statistics
| Posts | 86 |
| Solutions | 3 |
| Karma Given | 35 |
| Karma Received | 22 |
| Member Since | 05-15-2013 |
Activity Feed
- Got Karma for Re: Active Directory not found. How to troubleshoot a problem in Splunk App for Windows Infrastructure?. 12-02-2020 10:40 PM
- Got Karma for Why am I unable to log in to the Splunk Mobile App using iOS (iPhone)?. 06-05-2020 12:48 AM
- Got Karma for Why am I unable to log in to the Splunk Mobile App using iOS (iPhone)?. 06-05-2020 12:48 AM
- Got Karma for Re: How to set colors for non-numeric values in single value visualizations?. 06-05-2020 12:48 AM
- Karma Re: Splunk DB Connect: How to collect data in EPO Database version 4.6.6 with Add-on for McAfee? for nkpiquette. 06-05-2020 12:47 AM
- Karma Re: Active Directory not found. How to troubleshoot a problem in Splunk App for Windows Infrastructure? for malmoore. 06-05-2020 12:47 AM
- Karma Re: How to join 2 searches and control table output to remove rows with null field values? for somesoni2. 06-05-2020 12:47 AM
- Karma Does the Splunk Add-on for Check Point OPSEC LEA support version R77.20? for gfreitas. 06-05-2020 12:47 AM
- Karma Re: How to categorize phone numbers in VOIP PABX logs in Splunk ? for sk314. 06-05-2020 12:47 AM
- Karma Splunk 6.x Dashboard Examples: How to include multiple ID's for different tables (inline icon) in javascript? for jonathan_yan5. 06-05-2020 12:47 AM
- Karma Re: Splunk 6.x Dashboard Examples: How to include multiple ID's for different tables (inline icon) in javascript? for baerts. 06-05-2020 12:47 AM
- Karma Re: How do you do sort values in format %m/%y ? for somesoni2. 06-05-2020 12:47 AM
- Karma Re: How do you do sort values in format %m/%y ? for lguinn2. 06-05-2020 12:47 AM
- Karma Re: Since our IIS log format changed, how do I tell Splunk to reindex IIS logs with a new format? for lguinn2. 06-05-2020 12:47 AM
- Karma Re: Is there any way to collect stream data if my splunk environment is windows-based? for mdickey_splunk. 06-05-2020 12:47 AM
- Karma Re: Is there any way to collect stream data if my splunk environment is windows-based? for dart. 06-05-2020 12:47 AM
- Karma Re: How to audit files in Splunk monitoring security events in windows 2012 server. for ahall_splunk. 06-05-2020 12:47 AM
- Karma Re: How do I correlate two fields from various sources? for lguinn2. 06-05-2020 12:47 AM
- Karma Re: How to create scatter graph correlating two data sources of transactions and average CPU usage? for lguinn2. 06-05-2020 12:47 AM
- Karma Re: How to edit my configuration to recognize the timestamp in CSV data? for woodcock. 06-05-2020 12:47 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 2 | |||
| 0 | |||
| 0 | |||
| 2 | |||
| 1 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
11-29-2016
03:41 PM
Hi Roy,
I will test it, tks for your help.
I am waiting my username to open a ticket on the Splunk Portal. 😉
Cheers!
... View more
11-02-2016
01:19 PM
Hi folks,
I installed a new environment on my computer using linux debian, splunk enterprise 6.5 and splunk add-on for mobile version 2.4 to simulate the scenario. I installed on a new iphone (iphone 6 and IOS 10 ) and I did download the splunk app on appstore but the error happened again.
I don't know but I think there is a bug with a new version using iphone models.
This scenario I did not use VPN.
Cheers,
... View more
11-02-2016
01:10 PM
Hi Roy,
The result was 404 not found.
I tried in same network's splunk without firewall, but the error had happened.
Just for information, I can access using android devices using the app.
The issue happens just on iphone devices.
... View more
10-28-2016
10:18 AM
hI jlanders,
I've tried connect in same network's splunk without firewall, but the error had happened.
Cheers!
... View more
10-28-2016
10:17 AM
Hi mmodestino,
Tks for your comment.
Are you able to reach the splunk search head in your browser?
Yes, i can.
After I've tried connect in same network's splunk without firewall, but the error had happened.
Cheers.
... View more
10-27-2016
02:06 PM
2 Karma
Hi splunkers,
I am doing a POC on a customer and the last test was mobile access using Android and iOS devices through SSL VPN.
For the customer we installed Splunk Enterprise 6.5 and the Splunk Add-on for Mobile Access version 2.4.
First of all, with Android devices, the test was all ok using VPN SSL, but when I tried using iphone 7 (IOS), I could not sign in.
The message was:
Sign in Failed. Login Failed. Contact
your system administrator.
To test, I connected to his internal network (same network of Splunk server) and the error happened again.
My app configuration is:
user: admin
Host URL: http://10.32.20.61:8000
Let me know if you guys need more information.
Cheers,
... View more
04-14-2016
06:47 AM
1 Karma
Hi lsaad,
You could try this:
<dashboard>
<label>teste</label>
<row>
<panel>
<single>
<search>
<query>sourcetype=memoryerrordapp | stats count as test | rangemap field=test elevated=0-199 severe=200-400 default=low | replace 0 with "text here"</query>
<earliest>0</earliest>
<latest></latest>
</search>
<option name="colorBy">value</option>
<option name="colorMode">none</option>
<option name="drilldown">none</option>
<option name="numberPrecision">0</option>
<option name="showSparkline">1</option>
<option name="showTrendIndicator">1</option>
<option name="trendColorInterpretation">standard</option>
<option name="trendDisplayMode">absolute</option>
<option name="unitPosition">after</option>
<option name="useThousandSeparators">1</option>
<option name="linkView">search</option>
<option name="classField">range</option>
<option name="field">teste</option>
<option name="useColors">0</option>
</single>
</panel>
</row>
</dashboard>
... View more
12-14-2015
03:54 PM
Hi Splunkers,
I have three sources in my Splunk deployment:
(all_cardnumbers.csv, fraud_detect1_card.csv and fraud_detect1_card.csv)
all_cardnumbers_card
1111#####1010
1111#####1011
1111#####1012
1111#####1013
1111#####1014
1111#####1015
fraud_detect1_card
1111#####1012
1111#####1013
and the last one fraud_detect2_card source:
1111#####1014
1111#####1015
I'd like to create a new field called no_fraud with the results:
1111#####1010
1111#####1011
Can you guys help me to do a search for this?
Cheers.
... View more
- Tags:
- difference
- search
12-12-2015
03:38 AM
Hi ssievert,,
I am sorry but i did make a mistake when I put here in answers, please disregard it.
Tks.
... View more
12-12-2015
03:37 AM
Hi Woodcock,
I am sorry but i did make a mistake when I put here in answers, please disregard it.
Tks.
... View more
12-11-2015
07:48 PM
Hi splunkers,
I would like to remove headers from a Cisco file. I've tried transforms configurations, but I can't get it work.
I ran a search to troubleshoot: index=_internal sourcetype=splunkd ignoreComments , with the following results:
-0200 ERROR regexExtractionProcessor - REGEX field must be specified
tranform_name=ignoreComments
Please find below details of the configurations:
C:\Program Files\Splunk\etc\apps\search\local\inputs.conf
[monitor://c:\cisco\*]
sourcetype = cisco_teste
disabled = false
index = treinamento
C:\Program Files\Splunk\etc\apps\search\local\props.conf
[cisco_teste]
TRANSFORMS-noComments = ignoreComments
C:\Program Files\Splunk\etc\apps\search\local\tranforms.conf
[ignoreComments]
REGEX = ^#
DEST_KEY = queue
FORMAT = nullQueue
Let me know if you guys need anything else, I really appreciate the help.
Cheers,
... View more
10-11-2015
09:08 AM
Hi Badri,
I'd seen this topic and I followed all the steps but I didn't had success.
I am trying with Splunk 6.3 in Windows and Linux too.
Regards,
... View more
10-09-2015
02:17 PM
2 Karma
Hi Splunkers,
How can I get date from filename and time from inside the logs.
For example:
I have a file named LOG_09-10-2015.TXT and inside the log it contains something like:
23450001 value value value value
23450001 value value value value
I'd like to get the date from filename "09-10-15" and the time from file "23:45:00.01".
I tried many configurations but I didn't had suscess.
I changed the configuration at datetime.xml:
I put in "C:\Program Files\Splunk\etc\apps\search\local"
<define name="_masheddate3" extract="day, month, year">
<text><![CDATA[(?:^|source:).*?\d[0-9]-\d[0-9]-\d[0-9]]]></text>
(...)
<use name="_masheddate3"/>
My props.conf is:
[logs_test]
DATETIME_CONFIG=C:\Program Files\Splunk\etc\apps\search\local\datetime.xml
Let me know if you guys need more information,
Thanks for any suggestions.
... View more
07-17-2015
01:25 PM
Hi Splunkers,
is there a bug at the windows app ?
My customer is having a problem generating reports on Windows app.
His version the app is:
1.1.3 of Splunk App for Windows Infrastructure
4.7.5 of Splunk Add-On
Any idea to solve the problem?
Cheers,
... View more
06-11-2015
01:47 PM
Hi gerisplunk,
Splunk for fortinet just support fortios version 4 and this app is incompatible with fortios 5.
In "Splunk for Fortinet FortiOS 5", you have a new extractions based on the FortiOS 5 new log format.
Installation Instructions:
The Splunk for FortiOS 5 can be installed by either the Splunk app setup screen, or by manually installing and configuring the app.
Once the app is installed, you need to configure the FortiGate firewall to send the logs to Splunk (udp/513 port). Below is shown the required commands to configure the firewall to send the logs (at date, FortiOS 5 do not support syslog configuration in the Web UI):
config log syslogd setting
set status enable
set server splunk_ip
set port 513
end
I love create my own dashboards and then I create my apps, because splunk is esay. Enjoy it.
Just check this ebook:
http://www.splunk.com/goto/book
Cheers!
... View more
05-29-2015
10:17 AM
1 Karma
Hi Splunkers,
I would like to get a answer.
I am reading the docs about Net App for Splunk.
In section "Supported NetApp Versions", I have the following items:
NetApp® Data ONTAP® versions 8.0.2, 8.0.3, and version 8.2 in 7-mode only
NetApp® Data ONTAP® versions 8.2 in mode cluster.
I am studying to put my storage environment into to splunk but actually I have the 8.3 version in mode cluster.
is there a problem works 8.3 version in Cluster mode ?
My best regards,
... View more
05-21-2015
02:17 PM
Hi Woodcock,
I made a mistake.
Thank you for your help
Cheers!
... View more
05-21-2015
01:41 PM
Hi Splunkers,
I have a structure data on .csv that contains the follows fields:
2014/10/01-07:16:31,0.121,1.1,S,0.0,0,1,1,1,0,0,1,0,1,S
2014/10/01-07:16:31 - it's my timestamp.
I tried add data on Splunk but I can't recognise the timestamp with my regex:
My regex is:
\d{4}\/\d{2}\/\d{2}\-\d{2}\:\d{2}\:\d{2}
I verified on http://www.regexr.com/.
this is my props.conf
TIME_PREFIX = \d{4}\/\d{2}\/\d{2}\-\d{2}\:\d{2}\:\d{2}
FIELD_DELIMITER = ,
FIELD_QUOTE = '
INDEXED_EXTRACTIONS = csv
KV_MODE = none
NO_BINARY_CHECK = true
SHOULD_LINEMERGE = false
category = Structured
disabled = false
pulldown_type = true
How can I edit my configuration to recognize the timestamp?
... View more
04-08-2015
07:36 AM
Hi all,
Can splunk read exchange logs like audit logs on event log of windows. I don't have Exchange premium app, but i'd like to start to monitor and create my own dashboards. I don't have expertise in development, just in SPL. My idea is to collect all data like application logs, security logs and create it.
How do you guys monitor this kind environment ?
Thank you in advance.
Cheers!
... View more
02-12-2015
06:06 PM
Hello splunkers,
I know that is impossible install Stream_TA_Splunk on Windows Servers.
In my case, my splunk server is installed on Windows Server, but i have most linux servers in my environment like databases, web servers and so on. I would like to collect stream data in this linux servers in my Splunk.
Is there any way to collect stream data if my splunk environment is windows-based?
My scenario is:
Search Head + index (Windows) <==================> Web Server (Linux), Mysql (Linux)....
Cheers,
... View more
- Tags:
- Splunk Stream
- windows
11-13-2014
05:43 AM
Hi Dungpv,
have you enable audit policies in AD environment ?
Try run the follow search:
index=* source=WinEventLog:Security
What's the result?
Cheers!
... View more
11-13-2014
05:27 AM
Hi everyone,
I am installing splunk in new a customer, who have SQL Server, but the version is standard.
The customer's dba told me, that was impossible to follow the procedures because the limitations of standard version? Is there limitations with a standard version?
is there any method to monitor these servers?
Cheers!
... View more
10-30-2014
11:24 AM
Thanks a lot too Somesoni2.
:)
... View more
10-30-2014
11:23 AM
Hi Richgalloway!
it worked really well!
Thanks a lot.
... View more
10-30-2014
05:43 AM
Hi richgalloway,
It just example, because I can't show real address ip.
I am changing the values (address ip) in transforms.conf, according with requirements.
Tks,
... View more
