About ralam

ralam · ‎06-30-2024

You can use the sub-search method where the sub-search would detect password spray and pass the attempted source_ip and username combination to the main search which detects the successful logins. index = auth0 <successful login condition here> [ search index = auth0 <login attempts condition here> | eventstats dc(data.user_name) as unique_accounts by data.ip | where unique_accounts>10 | table data.ip,data.user_name ] | stats count by data.user_name,data.ip,<result,_time> #NOTE: <...> variable block

ralam · ‎06-30-2024

Hi Team, What I'm trying to achieve: Find the consecutive failure events followed by a success event. | makeresults | eval _raw="username,result user1,fail user2,success user3,success user1,fail user1,fail user1,success user2,fail user3,success user2,fail user1,fail" | multikv forceheader=1 | streamstats count(eval(result="fail")) as fail_counter by username,result reset_after="("result==\"success\"")" | table username,result,fail_counter Outcome: The counter (fail_counter) gets reset for a user (say user1) if the next event is a success event for a different user (say, user2). username result fail_counter user1 fail 1 user2 success 0 user3 success 0 user1 fail 1 <- counter reset for user1. It should be 2. user1 fail 2 It should be 3. user1 success 0 user2 fail 1 user3 success 0 user2 fail 1 user1 fail 1 Expected: The counter should not reset if the success event for user2 follows the failure event for user1. I would appreciate any help on this. Not sure what I'm missing here.

ralam · ‎12-14-2020

1) Datamodel acceleration is 100%. 2) With summariesonly=false option I got the same result. Action field did not populate.

ralam · ‎12-14-2020

Hello @richgalloway, Yeah, I enabled acceleration and it has been a week since i accelerated it. I can run searches on the datamodel using tsats command but it's only problem is that it won't populate action field in the result. You can see that in the first screenshot I shared.

ralam · ‎12-14-2020

Hello, I recently tuned my Authentication Datamodel and I cannot see any result in the action field while running a search. However I can see the result while using Pivot feature. FYI - I used Eval Expression feature while tuning this DM. case((sourcetype="linux" AND isnull(action)),"unknown",sourcetype="linux", action, sourcetype="AWS",action, (sourcetype="Okta" AND action="SUCCESS"), "success", (sourcetype="Okta" AND action="FAILURE"), "failure", (sourcetype="Duo" AND action="SUCCESS"), "success", (sourcetype="Duo" AND action="FAILURE"), "failure" )

ralam · ‎05-08-2020

Thank you @richgalloway. I have always believed that the bigger question has always a smaller answer. Your answer solved my bigger issue. However, one small problem, using your method I extracted many fields but facing a weird issue with "entityId":20575244 . I used "entityId\":(?<entityId>\d+)" for it which worked in search but the same failed while applying in the Field Extractor application. It could not match to a single event.

ralam · ‎05-08-2020

Dear All, I want to extract fields from the below events. The problem I'm facing is that the fields are not in harmony. For example, in event 1, "action" is the second last key however in event 2, it is the last one. Similarly, some of the fields that are available in event 2, do not exist in event 1. Can you guide me in extracting the fields from these events? Event 1 Fri May 08 11:44:37 PDT 2020|{"timestamp":1588963477939,"caller":"xyz@abc","applicationId":null,"applicationName":null,"action":"LOGIN","message":"User [xyz@abc] logged in successfully"} Event 2 Fri May 08 18:44:38 UTC 2020|{"timestamp":1588963478783,"caller":"xyz@abc","applicationId":20575244,"applicationName":"TIB_TST","entityType":"APPLICATION","entityId":20575244,"entityName":"TIB_TST","changes":[{"property":"name","value":"TIB_TST"}],"action":"OBJECT_CREATED"}

ralam · ‎01-03-2020

Hi There, I wanted to get a list of forwarders from the metric logs. The base logs have confused me a lot. Below is the sample. For the same hostname "hostname=ip-10-142-xx-29.us-west-2.compute.internal", I see different "sourceIp" & "sourceHost". Now can anybody help me understand which one is the actual identifier for a forwarder - sourceIp, sourceHost or the hostname? 01-03-2020 16:11:41.894 +0000 INFO Metrics - group=tcpin_connections, ingest_pipe=1, 10.xx.xx.107:6018:9997, connectionType=cooked, sourcePort=6018, sourceHost=10.xx.xx.107, sourceIp=10.xx.xx.107, destPort=9997, kb=1.6796875, _tcp_Bps=132.10136144345114, _tcp_KBps=0.12900523578462025, _tcp_avg_thruput=0.12900523578462025, _tcp_Kprocessed=1.6796875, _tcp_eps=0.5376218198279988, _process_time_ms=0, evt_misc_kBps=0, evt_raw_kBps=0, evt_fields_kBps=0, evt_fn_kBps=0, evt_fv_kBps=0, evt_fn_str_kBps=0, evt_fn_meta_dyn_kBps=0, evt_fn_meta_predef_kBps=0, evt_fn_meta_str_kBps=0, evt_fv_num_kBps=0, evt_fv_str_kBps=0, evt_fv_predef_kBps=0, evt_fv_offlen_kBps=0, evt_fv_fp_kBps=0, build=8f0ead9ec3db, version=7.1.1, os=xyz, arch=x86_64, hostname=ip-10-142-xx-29.us-west-x.compute.internal, fwdType=uf, ssl=true, lastIndexer=None, ack=true

ralam · ‎11-12-2019

Hello @Arpmjdr , One such app in Splunk to validate the Datemodel may be "Insight Analyzer" https://splunkbase.splunk.com/app/4618/. Its DataModel Coverage section would give you immense information on the coverage of each Datamodels that you have. Regards, Rehan

ralam · ‎07-17-2018

you can also achieve it using below query: tag=NginxLogs host=www* status=404 | stats count by status | eval total=[search tag=NginxLogs host=www* | stats count(src) as total | eval total="\"".total."\""| return $total] | eval percent=round((count/total)*100,2) | where percent>5 In my environment, this query ran faster. you can be more efficient if you mention index=xyz in your query. (in our case we did)

ralam · ‎02-15-2018

thanks 🙂

ralam · ‎02-15-2018

Hey Martin, The screenshot and the log message is on the deployment server. At "Settings -> Forwarder Management" I can see one "phoned" client.

ralam · ‎02-15-2018

Hi All, I just set up a deployment server, created server class and added a couple of deployment-apps and a forwarder to it. I believe it got deployed successfully as I can see the deployed configuration on the forwarder. However when I launch Deployment Client page it says DISABLED. Also If I see the splunkd.log I can see the error - DC:DeploymentClient - target-broker clause is missing. Would you be able to know where I'm wrong, Please?

Posts	13
Solutions	0
Karma Given	2
Karma Received	0
Member Since	‎02-15-2018

Online Status	Offline
Date Last Visited	‎07-01-2024 04:09 AM

streamstats | reset_after condition not applied wi...

The Action field shows no result while running a s...

Extracting Field from 2 different events

Getting List of the Universal forwarders

Why am I getting the error "disabled" when I launc...

Re: Modification of query for detecting Successful...

streamstats | reset_after condition not applied wi...

Re: The Action field shows no result while running...

Re: The Action field shows no result while running...

The Action field shows no result while running a s...

Re: Extracting Field from 2 different events

Extracting Field from 2 different events

Getting List of the Universal forwarders

Re: How to Validate Datamodel

Re: How to alert when http status=404 is over 5 pe...

Re: Why am I getting the error "disabled" when I l...

Re: Why am I getting the error "disabled" when I l...

Why am I getting the error "disabled" when I launc...