Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About aberdamy
aberdamy
Explorer
Member since:
05-20-2013
06-05-2020
Community Statistics
| Posts | 19 |
| Solutions | 0 |
| Karma Given | 0 |
| Karma Received | 2 |
| Member Since | 05-20-2013 |
Activity Feed
- Got Karma for Re: Windows Failed Login Top Ten count. 06-05-2020 12:46 AM
- Got Karma for Re: Windows Failed Login Top Ten count. 06-05-2020 12:46 AM
- Posted Re: Windows Failed Login Top Ten count on Getting Data In. 04-11-2014 07:51 AM
- Posted Re: Windows Failed Login Top Ten count on Getting Data In. 04-11-2014 06:50 AM
- Posted Re: Windows Failed Login Top Ten count on Getting Data In. 04-10-2014 12:57 PM
- Posted Re: Windows Failed Login Top Ten count on Getting Data In. 04-10-2014 11:52 AM
- Posted Windows Failed Login Top Ten count on Getting Data In. 04-10-2014 09:40 AM
- Tagged Windows Failed Login Top Ten count on Getting Data In. 04-10-2014 09:40 AM
- Tagged Windows Failed Login Top Ten count on Getting Data In. 04-10-2014 09:40 AM
- Tagged Windows Failed Login Top Ten count on Getting Data In. 04-10-2014 09:40 AM
- Posted Re: Duplicate Field Extraction - Failed Logins in Windows 2008 Security Logs on Splunk Search. 04-10-2014 09:17 AM
- Posted Source = Other on All Apps and Add-ons. 04-08-2014 08:09 AM
- Tagged Source = Other on All Apps and Add-ons. 04-08-2014 08:09 AM
- Tagged Source = Other on All Apps and Add-ons. 04-08-2014 08:09 AM
- Tagged Source = Other on All Apps and Add-ons. 04-08-2014 08:09 AM
- Posted Re: Universal forwarder scripted install on Getting Data In. 04-08-2014 08:05 AM
- Posted Universal forwarder scripted install on Getting Data In. 04-03-2014 08:34 AM
- Tagged Universal forwarder scripted install on Getting Data In. 04-03-2014 08:34 AM
- Tagged Universal forwarder scripted install on Getting Data In. 04-03-2014 08:34 AM
- Tagged Universal forwarder scripted install on Getting Data In. 04-03-2014 08:34 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
04-11-2014
07:51 AM
yes, appears to have worked. Of course, as you can see the rex has been changed as well
... View more
04-11-2014
06:50 AM
2 Karma
Solution:
source="WinEventLog:Security" EventCode="4625" OR EventCode="529" | rex field=_raw max_match=99 "Account Name:\s+(? \w+\$?)" | eval UserName=coalesce(User_Name,Account_Name) | stats count by UserName |sort -count |head 10
... View more
04-10-2014
12:57 PM
Sorry I miss-typed that last one, the correct search string is below. I get results however it is missing the "4625" events. Conversely, if I rename as User_Name it does not include the "529" events
source="WinEventLog:Security" EventCode="4625" OR EventCode="529" | rex "(?ms)Account For Which Logon Failed.+?Account Name:s+(? V+)" |rename User_Name as Account_Name |stats count by Account_Name |sort -count |head 10
... View more
04-10-2014
11:52 AM
thank you for your reply, unfortunately putting |eval after rex did not work and using the rename function did not produce any results:
source="WinEventLog:Security" EventCode="4625" OR EventCode="529" | rex "(?ms)Account For Which Logon Failed.+?Account Name:s+(? V+)" |rename User_Name as Account_Name |stats count by USER |sort -count |head 10
... View more
04-10-2014
09:40 AM
I am trying to get the top 10 Failed Login count by User. The problem is that Windows 2008 uses "Account_Name" and Windows 2003 uses "User_Name" so I've used eval to combine the two fields but I am also using rex to go to the second instance of the Account_Name in the Windows 2008 event. The rex expression doesn't seem to work when I throw eval in there. Below is my search string, any suggestions?
source="WinEventLog:Security" EventCode="4625" OR EventCode="529" |eval USER=coalesce(Account_Name,User_Name) | rex "(?ms)Account For Which Logon Failed.+?Account Name:\s+(? \V+)" |stats count by USER |sort -count |head 10
... View more
04-10-2014
09:17 AM
How do I combine this with the "User_Name" field from the Windows 2003 "529" events? I want to create a top 10 count by the UserName + Account_Name
... View more
04-08-2014
08:09 AM
I am getting a Source of "Other" in my license usage report. How can I find out what that is?
... View more
04-08-2014
08:05 AM
We are rolling the Universal Forwarder out via SCCM and we have a batch file that looks at the Operating system architecture and writes to the "/etc/system/local inputs.conf" file to monitor the firewall log if it is a Windows 2003 system. Would the splunk_internal call command work with this? If so, where would I insert it? Part of batch:
start /wait msiexec /i splunkforwarder-6.msi
INSTALLDIR="%PROGRAMFILES%\SplunkUniversalForwarder" RECEIVING_INDEXER="server:9997" WINEVENTLOG_APP_ENABLE=1 WINEVENTLOG_SEC_ENABLE=1 WINEVENTLOG_SYS_ENABLE=1 DISPLAY_WINDOWS_TA_DIALOG=1 LAUNCHSPLUNK=0 /quiet
... View more
04-03-2014
08:34 AM
Does anyone know if it is possible to automatically add the current_only = [0|1] attribute in a scripted Universal Forwarder install? The inputs.conf I am referencing is located here:
C:\Program Files (x86)\SplunkUniversalForwarder\etc\apps\Splunk_TA_windows\local\inputs.conf
[WinEventLog://Application]
disabled = 0
current_only = 1
[WinEventLog://Security]
disabled = 0
current_only = 1
[WinEventLog://System]
disabled = 0
current_only = 1
... View more
04-01-2014
12:50 PM
Thank you for your response however I'm not sure what you're saying here could you please clarify?
... View more
04-01-2014
05:47 AM
So do we change the props.conf on the forwarder or indexer? Also, are these two separate workarounds that will solve the issue or are they to be used together?
... View more
03-31-2014
01:39 PM
which inputs.conf should I change this in the apps or the system/local directory?
... View more
03-25-2014
08:01 AM
Can anyone point me to official documentation where it says that the internal index is not counted against your Splunk license?
thanks
... View more
Labels
- Labels:
-
license
03-18-2014
09:18 AM
ok thank you for the reply. it looks like I cannot use the persistent queue for my Windows events or the Monitor Stanza so is there any way to increase the 'in memory' queue for the universal forwarder?
... View more
03-17-2014
02:28 PM
Where does the Universal forwarder cache its data if the indexer is down?
... View more
03-17-2014
01:16 PM
Ahh, this line at the end says it all:
Note: As a best practice, it is recommended that indexers be at the same or higher version level than the forwarders they're receiving data from.
This means that we should upgrade the indexer too.
thanks for the help!
... View more
03-17-2014
01:01 PM
Is the 6.0.2 Universal forwarder compatible with the 6.0.1 indexer?
In other words, are the latest universal forwarders compatible with older indexer versions?
thanks
... View more
10-18-2013
06:33 AM
Thanks for your reply. When you say "slow down the system" are you referring to the indexer or the domain controller after you installed the forwarder? Logging is already turned on for all of our dc's.
thanks
... View more
10-16-2013
01:10 PM
Does anyone know if there are any docs out there that describe the design/architecture of the Universal forwarder and Technology Add-on for Windows? Has anyone had any issues with these forwarders on domain controllers? Does the agent leave anything behind when it is uninstalled?
thanks in advance,
aberdamy
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:04 AM
|
