About Unister

Unister · ‎10-19-2018

The python variable DEFAULT_DROPEXP contains fieldnames to delete when creating a notable event. As it contains date_*, you cannot directly use the date in a notable event suppression. But if you add | rename date_hour as orig_date_hour, date_minute as orig_date_minute, date_wday as orig_date_wday to the end of your correlation search, you can use the renamed fields in the notable event suppression: `get_notable_index` orig_host=YOURHOST orig_date_hour=6 orig_date_minute>=25

Unister · ‎10-19-2018

the linked page only shows how to set an Expiration Time. The author wants to suppress eventX between 03:00 and 03:59 every day. I had done this with date_hour in my event_suppression. On a new installation this does not work anymore because the field date_hour is not added to notable events anymore...

Unister · ‎06-13-2016

I know my answer is a little late, but maybe it is helping someone else. If you started the search exactly like you showed, the or must be in uppercase: eventtype=firewall-deny OR signature=firewall

Unister · ‎02-09-2016

Hello, I want to disable weak ciphers for Splunk forwarder ports on my 6.3.3 indexer. The following snippet does not work in my inputs.conf. The default ciphers are still enabled: [splunktcp-ssl:9997] connection_host = ip [SSL] cipherSuite = ALL:!ADH:!aNULL:!eNULL:!EXP:!LOW:+MEDIUM:+HIGH:!SEED:!3DES:!MD5:!RC4:!SRP #cipherSuite = CAMELLIA256-SHA serverCert = $SPLUNK_HOME/etc/auth/server.pem sslVersions = *,-ssl2,-ssl3,-tls1.0,-tls1.1 Even changing cipherSuite to CAMELLIA256-SHA does nothing: $ ~/bin/splunk cmd openssl s_client -connect localhost:9997 | grep Cipher New, TLSv1/SSLv3, Cipher is AES256-GCM-SHA384 Cipher : AES256-GCM-SHA384 It is working for the web and management ports (web.conf + server.conf). According to this question it should work like I did it: https://answers.splunk.com/answers/134053/ciphersuite-in-various-conf-files.html

Unister · ‎02-17-2014

I tried it with a new app or with etc/apps/search/local but it isn't working. I tried finding the position where the log line is split at = but I cannot find it. There are multiple transforms but none is used for syslog...

Unister · ‎02-17-2014

I'd like to parse some data provided by syslog. The format is: date host service: key1=value1 key2=value2 key3=value3 key3=value4 Most fields are parsed correctly, apart from key3 which I want to be a multi value field. Splunk (5 and 6) parses this as key3=value3 and not key3=(value3 value4) . I can change the input data format after the colon, but I think I saw some log line that created a multi value field where the input log had two keys with the same name. I cannot identify these lines with their own source/sourcetype, so I'd like to use something that works with sourcetype=syslog.

Unister · ‎02-16-2014

I had the same problem. The events are generated by SA-Eventgen . To disable this behavior you can configure the app via GUI or insert this in etc/apps/SA-Eventgen/local/inputs.conf : [script://./bin/eventgen.py] disabled = 1 In my case the events are coming from the PCI app with its sub apps.

Posts	7
Solutions	0
Karma Given	12
Karma Received	0
Member Since	‎02-03-2014

Online Status	Offline
Date Last Visited	‎06-05-2020 02:03 AM

Why is splunktcp-ssl + ciphersuite not working to ...

How to easily parse syslog data into multi value f...

Re: Suppress Notable Event during certain time slo...

Re: Suppress Notable Event during certain time slo...

Re: signature not searchable

Why is splunktcp-ssl + ciphersuite not working to ...

Re: How to easily parse syslog data into multi val...

How to easily parse syslog data into multi value f...

Re: Remove generic index data.