Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About bkwoka
bkwoka
Explorer
Member since:
12-30-2017
06-05-2020
Community Statistics
| Posts | 8 |
| Solutions | 1 |
| Karma Given | 1 |
| Karma Received | 0 |
| Member Since | 12-30-2017 |
Activity Feed
- Karma Re: How do I create a field that contains the differences between 2 other multi value (MV) fields? for kamlesh_vaghela. 06-05-2020 12:50 AM
- Posted Use same input stanza across multiple apps on Deployment Architecture. 01-08-2019 12:03 PM
- Tagged Use same input stanza across multiple apps on Deployment Architecture. 01-08-2019 12:03 PM
- Tagged Use same input stanza across multiple apps on Deployment Architecture. 01-08-2019 12:03 PM
- Tagged Use same input stanza across multiple apps on Deployment Architecture. 01-08-2019 12:03 PM
- Tagged Use same input stanza across multiple apps on Deployment Architecture. 01-08-2019 12:03 PM
- Posted Deploy Splunk UBA in Mixed Server OS env? on All Apps and Add-ons. 11-08-2018 12:15 PM
- Tagged Deploy Splunk UBA in Mixed Server OS env? on All Apps and Add-ons. 11-08-2018 12:15 PM
- Tagged Deploy Splunk UBA in Mixed Server OS env? on All Apps and Add-ons. 11-08-2018 12:15 PM
- Tagged Deploy Splunk UBA in Mixed Server OS env? on All Apps and Add-ons. 11-08-2018 12:15 PM
- Posted Re: How do I create a field that contains the differences between 2 other multi value (MV) fields? on Splunk Search. 10-08-2018 06:42 AM
- Posted Re: How do I create a field that contains the differences between 2 other multi value (MV) fields? on Splunk Search. 10-05-2018 08:41 AM
- Posted Re: How do I create a field that contains the differences between 2 other multi value (MV) fields? on Splunk Search. 10-04-2018 04:44 PM
- Posted How do I create a field that contains the differences between 2 other multi value (MV) fields? on Splunk Search. 10-04-2018 08:06 AM
- Tagged How do I create a field that contains the differences between 2 other multi value (MV) fields? on Splunk Search. 10-04-2018 08:06 AM
- Tagged How do I create a field that contains the differences between 2 other multi value (MV) fields? on Splunk Search. 10-04-2018 08:06 AM
- Tagged How do I create a field that contains the differences between 2 other multi value (MV) fields? on Splunk Search. 10-04-2018 08:06 AM
- Posted Re: scripted input does not produce same results as running script manually on Splunk Dev. 12-31-2017 08:00 AM
- Posted scripted input does not produce same results as running script manually on Splunk Dev. 12-30-2017 08:14 PM
- Tagged scripted input does not produce same results as running script manually on Splunk Dev. 12-30-2017 08:14 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
01-08-2019
12:03 PM
I am looking to use multiple [WinEventLog://Security] inputs. For example I would like one inputs.conf to be capturing event 6278 in one app and capturing 4724, 4722, 4725 in a separate app. The problem is that Splunk is only using the last input stanza and so it seems to be impossible to have multiple apps with the [WinEventLog://Security] stanza even though they capture different events, have different sourcetypes and send to different indexes.
... View more
11-08-2018
12:15 PM
My current environment is 2 splunk servers. One acting as a search head / indexer and one acting as a heavy forwarder. I have multiple UF clients pointing to the HF which filters and forwards to the indexer. Both of the servers are Windows Server 2016. I am looking into what would be needed to start using UBA. I see that it requires a *nix server. Could I deploy a second indexer on a *nix server and use that for UBA and continue to use the Windows search head?
... View more
10-08-2018
06:42 AM
Here are the first 3 rows
IdentityReference : BUILTIN\Administrators FileSystemRights : FullControl IsInherited : False InheritanceFlags : ContainerInherit, ObjectInherit PropogationFlags : AccessControlType : Allow
IdentityReference : CREATOR OWNER FileSystemRights : FullControl IsInherited : False InheritanceFlags : ContainerInherit, ObjectInherit PropogationFlags : AccessControlType : Allow
IdentityReference : NT AUTHORITY\SYSTEM FileSystemRights : FullControl IsInherited : False InheritanceFlags : ContainerInherit, ObjectInherit PropogationFlags : AccessControlType : Allow
IdentityReference : BUILTIN\Administrators FileSystemRights : FullControl IsInherited : False InheritanceFlags : ContainerInherit, ObjectInherit PropogationFlags : AccessControlType : Allow
IdentityReference : CREATOR OWNER FileSystemRights : FullControl IsInherited : False InheritanceFlags : ContainerInherit, ObjectInherit PropogationFlags : AccessControlType : Allow
IdentityReference : NT AUTHORITY\SYSTEM FileSystemRights : FullControl IsInherited : False InheritanceFlags : ContainerInherit, ObjectInherit PropogationFlags : AccessControlType : Allow
IdentityReference : BUILTIN\Administrators FileSystemRights : FullControl IsInherited : False InheritanceFlags : ContainerInherit, ObjectInherit PropogationFlags : AccessControlType : Allow
IdentityReference : CREATOR OWNER FileSystemRights : FullControl IsInherited : False InheritanceFlags : ContainerInherit, ObjectInherit PropogationFlags : AccessControlType : Allow
IdentityReference : NT AUTHORITY\SYSTEM FileSystemRights : FullControl IsInherited : False InheritanceFlags : ContainerInherit, ObjectInherit PropogationFlags : AccessControlType : Allow
... View more
10-05-2018
08:41 AM
This gave me a lot of insight and direction as to what I need to do. I am now running into an issue where mvfind() isn't returning an index even when the fields match. For example here is the command I am running:
index=sacl_audit NOT (Object_Name="E:\\System Volume Information\\*")
| lookup ConvertSDDL sddl_format AS Original_Security_Descriptor OUTPUT human_format AS original
| lookup ConvertSDDL sddl_format AS New_Security_Descriptor OUTPUT human_format AS new
| makemv original delim="|"
| makemv new delim="|"
| eval row=1
| accum row
| eval originalTemp = original
| eval newTemp = new
| mvexpand originalTemp
| eval originalS = mvfind(new,originalTemp)
| table row,original,new,originalTemp,originalS
I am not sure if I can attach pictures but in the following screenshot you can see how the first row isn't working but the second row is.
... View more
10-04-2018
04:44 PM
Close. Ideally if MVFieldOld has [A, B, C] and MVFieldNew has [C, D, E] I would like MVDiff to have something like [-A, -B, +D, +E]. Similar to the diff() command.
... View more
10-04-2018
08:06 AM
I have a search that returns two multi value fields. I am looking to create a third field which would contain the differences between the two MV fields. I was hoping to use something like diff() but that only works for comparing events. Ideally the format would be similar to diff() but would compare fields in one event instead of across different events.
index=sacl_audit NOT (Object_Name="E:\\System Volume Information\\*")
| lookup ConvertSDDL sddl_format AS Original_Security_Descriptor OUTPUT human_format AS original
| lookup ConvertSDDL sddl_format AS New_Security_Descriptor OUTPUT human_format AS new
| makemv original delim="|"
| makemv new delim="|"
... View more
12-31-2017
08:00 AM
I figured it out. The script is running with system32 as the working directory. I assumed it would be running in the /bin of the app. Once I hardcoded the absolute path it worked.
... View more
12-30-2017
08:14 PM
I have a python script that queries a mongo database and pulls all the results since the last time the script ran. it then stores the date of the last event it pulled to a text file to reference later. When I run this script manually it works exactly as intended. When it runs through Splunk it never creates the text document that contains the last date pulled and for some reason it only returns the last document when it should return multiple events.
my configuration is as follows:
inputs.conf
[script://$SPLUNK_HOME/etc/apps/xdrip_mongo/bin/entries.py]
disabled = false
interval = 30
source = xdrip
sourcetype = mellitus_entry
props.conf
[mellitus_entry]
SHOULD_LINEMERGE = false
and the relevant portion of python:
try:
f_lastDate = open('lastDate.txt', 'r')
s_lastDate = f_lastDate.read()
try:
int_lastDate = int(s_lastDate)
except ValueError:
int_lastDate = 0
except IOError:
int_lastDate = 0
s_lastDate = str(int_lastDate)
f_lastDate = open('lastDate.txt', 'w')
for doc_entry in entries.find({'date': {"$gt": int_lastDate}}):
print "_id = %s, date = %s, dateString = %s, device = %s," \
"direction = %s, filtered = %s, noise = %s, rssi = %s," \
"sgv = %s, type = %s, unfiltered = %s" % \
(doc_entry['_id'],
doc_entry['date'],
doc_entry['dateString'],
doc_entry['device'],
doc_entry['direction'],
doc_entry['filtered'],
doc_entry['noise'],
doc_entry['rssi'],
doc_entry['sgv'],
doc_entry['type'],
doc_entry['unfiltered'])
s_lastDate = str(doc_entry['date'])
f_lastDate.write(s_lastDate)
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:03 AM
|
