About DyJohnnY

DyJohnnY · ‎06-20-2011

Anyone, any thoughts on this? thanks, ionut

DyJohnnY · ‎06-07-2011

hi, To clear up a few things: NO WMI filtering is done, i'm using the inputs file to explicitly disable it. I've updated the files we use: http://www.megafileupload.com/en/file/315727/local2-rar.html This is how we want to use splunk http://imageshack.us/photo/my-images/848/splunklogicaldiagram.jpg/ We want to send all failure audit to one Splunk indexer We want to send some failure success events from the security Log to another splunk indexer server. We want to drop all other success audit events. thank, ionut

DyJohnnY · ‎06-06-2011

Hi, I've been using for 1 year or so a configuration for my splunk forwarders as it is in this link: http://www.megafileupload.com/en/file/315637/local-rar.html I store everything in /etc/system/local/* The files above are merged with files those that splunk creates when it installs itself. lately (i think starting with some 4.1.x version of splunk, on windows 2008 R2 domain controllers i no longer get the results I want: I want splunk to filter out all success audit events from the security logs and only send over failed audits. This however is not working, i get the entire output of the security logs which in turn is making us go over our quota for indexed data. Could anyone take a look at the configuration files and tell me what should be changed in order to get splunk to filter out failed audits? The config files are also supposed to filter out some audit success events, that is also not working, but that is secondary concern, first I'd like him to just make this simple failed audit/sucess audit filter that has been working fine for over 1 year. thanks, ionut

DyJohnnY · ‎09-01-2010

Great, didn't know you could do that, will give it a try.

DyJohnnY · ‎08-30-2010

Hi, Is there a way to have this search do following: get me all sources that related to windows (win*) - then calculate the total, if the total is greater than 10kbps - send alert. I also want the search to create a stacked report My search string is this: index="_internal" (source=/metrics.log OR source=\metrics.log) group="per_sourcetype_thruput" series=win* | timechart span="10m" per_second(kb) by series | addtotals fieldname=Total label=all the custom search condtion is Where Total>10 I ran this task as scheduled and I'm getting all the results, not just the ones above 10k. If I run this in the search box I get the correct results: index="_internal" (source=/metrics.log OR source=\metrics.log) group="per_sourcetype_thruput" series=win* | timechart span="10m" per_second(kb) by series | addtotals fieldname=Total label=all | where Total>10 but I don't know how to implement it using saved searches, and have it triggered if I actually have some results (splunk lets me trigger it if I get a certain number of events, not "results") thanks

DyJohnnY · ‎08-30-2010

Hi guys, Thanks a lot for the feedback, in the end we kind of figured it out how to do it, based on the basic splunk examples on the documentation and your feedback here. Question can be closed now, hope it will help someone else aswell

DyJohnnY · ‎08-10-2010

Hi, We now have a setup in which we use splunk like this. Forwarders deployed on windows Domain Controllers, that receive every log except success audit events. Success audit events are dumped using props.conf files and transforms.conf files. configuration is below. props.conf [WinEventLog:Security] TRANSFORMS-set = Dump_Success_Audit transforms.conf [WinEventLog:Security] TRANSFORMS-set = Dump_Success_Audit [Dump_Success_Audit] REGEX = (?m)(?i)^Type=(Success Audit) DEST_KEY = queue FORMAT = nullQueue outputs.conf [tcpout] defaultGroup = splunk_5514 disabled = false [indexAndForward] index = false [tcpout:splunk_5514] server=X.X.X.X:5514 heartbeatFrequency=45 maxQueueSize=100500 What we want is following: keep the current configuration (or its results) but also capture some "Success Audit Events" (we will do the filtering based on event ids) and send just those events to another splunk instance. Does anyone know how we can approach this problem? Thanks for the help.

Posts	7
Solutions	0
Karma Given	0
Karma Received	2
Member Since	‎08-10-2010

Online Status	Offline
Date Last Visited	‎06-05-2020 02:02 AM

splunk 4.1.x .conf files no longer working with sp...

How to receive alert when number of kbps of indexe...

How to configure forwarder to send different infor...

Re: splunk 4.1.x .conf files no longer working wit...

Re: splunk 4.1.x .conf files no longer working wit...

splunk 4.1.x .conf files no longer working with sp...

Re: How to receive alert when number of kbps of in...

How to receive alert when number of kbps of indexe...

Re: How to configure forwarder to send different i...

How to configure forwarder to send different infor...