About mailmetoramu

mailmetoramu · ‎12-06-2021

Hello Giuseppe, Thanks for ur time on this. Tried the query u provided, but getting "No results found. Try expanding the time range". Tried expanding time range also but no luck. Need search query which can give a stats data like below : All Index : Date/Time : SourceType : Time Range will be : 1st Nov to 1st Dec 2021

mailmetoramu · ‎12-06-2021

Hello All, Need an search query where i can see all the index logs by |stats by count, date, index. Tried the below search query but it didnt helped : index= * source=*license_usage.log type="Usage" splunk_server=* earliest=-2month@d | eval Date=strftime(_time, "%Y/%m/%d") | eventstats sum(b) as volume by idx, Date | eval MB=round(volume/1024/1024,5) | timechart first(MB) AS volume by idx

mailmetoramu · ‎11-04-2020

Hello All, Actually i have an lookup table DIUSERS.csv, i would like to build a query as like below : index=* |inputlookup DIUSERS.csv|stats count by src dest user name action index But its not working, Please let me know the correct queries. Thanks.

mailmetoramu · ‎11-04-2020

Thanks for the reply, i got ur baseline. The query which i have mentioned is already working but i need some suggestions how to tweak the query. Again pasting my query below, please give me an query which would cover my requirement. index=* user= apptusr user=oracleapp user=oracledb user=oracleftp |stats count by src dest user name action

mailmetoramu · ‎11-04-2020

Looking for an search query to monitor some bunch of users on all indexes activity. Tried the below one but couldn't get my actual requirement , let me know some more efficient queries to get this. index=* user= apptusr user=oracleapp user=oracledb user=oracleftp |stats count by src dest user name action index

mailmetoramu · ‎06-29-2020

Hello All, Any findings for this would be appreciated. Thanks

mailmetoramu · ‎06-26-2020

Hello All, We do have an centralized syslog receiver named "spl-fwdser" which receives the logs from various devices and pushes into Splunk instances. Recent days triggering so many auto incidents for "Disk Space" issue with the description saying "Failed to run script". I checked and found there is no disk space on the server. Now all the incidents which has been triggered has been auto closed by ServiceNOW ticketing system with notes saying "Incident resolved due to clear alert from monitoring". Please let me know what causing this server to trigger so many auto incidents and how to fix this issue. Thanks Everyone.

mailmetoramu · ‎05-20-2019

Hello All, I m getting duplicate events for my O365 logs.Have checked from my O365 side configurations and seems everything fine from O365 end. Is this something need to corrected from Splunk side ?? Thanks, Ramu.R

mailmetoramu · ‎05-14-2019

Hello, Is it possible to generate alert (detection) from Splunk for firewall traffic related to particular customer based on destination IP? Just to understand the possibility from Splunk side. Please Clarify. Thanks, Ramu.R

mailmetoramu · ‎05-02-2019

Windows Server actually ..!!

mailmetoramu · ‎05-02-2019

Hello All, In one of my server the access has been given to Adam, Brian and Charlie on the host "xyxxac.bus.com". I need to know who have added these members into that server, Please let me know the exact Splunk query. Also i have installed Splunk UF software on this server last week only, is it possible to pull the logs from this server for last month ?? Thanks, Ramu.R

mailmetoramu · ‎04-16-2019

Not working ..!!

mailmetoramu · ‎04-15-2019

Hello All, Need a Splunk query that show all users who’ve reset their password since 4/15 @ 11am ET. Thanks, Ramu.R

mailmetoramu · ‎03-27-2019

We currently have MS O365 EMS E3 License which includes Azure AD P1 licensing and enabled to all E3 licenses users.

mailmetoramu · ‎03-22-2019

Hello All, Issue 1: Looking at my configuration for O365 and we have everything enabled that we possibly can. I then checked the internal logs, and there is a message we are seeing pop up quite often which I will paste below. This indicates there may be a permissions issue in O365 that is not allowing us to pull certain events. The only documentation I can find on how to set that up is available here: https://docs.splunk.com/Documentation/AddOns/released/MSO365/ConfigureappinAzureAD O365PortalError: 401:{"error":{"code":"AF10001","message":"The permission set () sent in the request does not include the expected permission."}} Issue 2 : Also we are supposed to get an alert on "MaliciousEmailSubmission"when a user submitted phishing or malware email, even we are not getting that alert too. Please let me know what may be issue here. Thanks, Ramu.R

mailmetoramu · ‎03-20-2019

Hi Nickhill, Yeah you are right, this is not exactly something around Splunk, but found the issue as some OS related bug issue and got fixed. Thanks again coming forward. Regards, Ramu.R

mailmetoramu · ‎03-19-2019

Hello All, Noticed some wiered issue in my Splunk environment, actually the issue is one of the user "Adam" have logged into a server, but the logs says source user "Adam" logged in as "Guest" as an user. NOTE : "Source User" ------> Adam and "User" -----> Guest both are different terms. Had an 1-1 discussion with the user " Adam " and he confirmed that he logged in with his user ID " Adam " only but not as Guest. Also checked in the server and confirmed that there was no such kind of "Guest" user account created on the server. Need to know the cause. Thanks, Ramu.R

mailmetoramu · ‎03-14-2019

In my Splunk environment Kaspersky logs, I was able to extract a few more fields based. However, looking at some of the logs, where viruses are found, I'm not sure what the action should be since there is nothing in the logs indicating what it should be. The logs that contain "GNRL_EV_VIRUS_FOUND" - the action is currently mapping to unknown with the automatic lookup that is in place. This is happening because we are not able to determine what action should be, i believe this should be mapped to "allowed", but not entirely sure. I was not able to find any Kaspersky documentation that would help determine this. Are you able to provide any Kaspersky documentation that could help? Also if any documentation regarding the logs for field mapping. Looking for your reply. Thanks, Ramu.R

mailmetoramu · ‎03-14-2019

Hi Nickhill, In my Splunk environment Kaspersky logs, I was able to extract a few more fields based. However, looking at some of the logs, where viruses are found, I'm not sure what the action should be since there is nothing in the logs indicating what it should be. The logs that contain "GNRL_EV_VIRUS_FOUND" - the action is currently mapping to unknown with the automatic lookup that is in place. This is happening because we are not able to determine what action should be, i believe this should be mapped to "allowed", but not entirely sure. I was not able to find any Kaspersky documentation that would help determine this. Are you able to provide any Kaspersky documentation that could help? Also if any documentation regarding the logs for field mapping. Looking for your reply. Thanks, Ramu.R

mailmetoramu · ‎03-12-2019

Hello Nickhill, Thanks a lot for the effort you are making to get this answer, you rock 🙂 Let me try this and keep you update with the progress. Thanks, Ramu.R

mailmetoramu · ‎03-12-2019

Did some research on this and came to know that it has been turn that off by default is because it causes a lot of lag with the events (minutes to hours) reaching Splunk. It can also cause resource issues as well as this is done at the universal forwarder level. Also, seeing that we do not have universal forwarders on all of your Windows hosts, we have installed UF on Windows event collector and getting the events to Splunk .I am not entirely sure this would work as expected. This is directly from the same link you sent: If you set this setting to 1, the input resolves the Active Directory Security IDentifier (SID) objects to their canonical names for a specific Windows Event Log channel. If you enable the setting, the rate at which the input reads events on high-traffic Event Log channels can decrease. Latency can also increase during event acquisition. This is due to the overhead involved in performing AD translations. I agree this was a great solution, but in my environment we need look for some other ways. Is there any other ways to get my request done apart from the solution you provided. Thanks, Ramu.R

mailmetoramu · ‎03-12-2019

Thanks a lot Nickhill, let me try this and will update you with the progress soon.

mailmetoramu · ‎03-11-2019

Hello All, I have an ongoing issue with my Splunk environment. Actually an user "Alex" have added remote desktop users "Brad" on a server "xyzabc.com" But when i m reviewing my splunk logs, it shows only user "Alex" details, its not showing the name of "Brad" in the logs. Instead of its showing only the Security ID of "Brad" Please let me know what causing this issue. Thanks, Ramu.R

mailmetoramu · ‎03-08-2019

Thank Youu

mailmetoramu · ‎03-08-2019

You mean to say again i need to pay 147.50 USD for retaking the Splunk Power user exam ????

Posts	56
Solutions	0
Karma Given	4
Karma Received	1
Member Since	‎03-19-2018

Online Status	Offline
Date Last Visited	‎12-06-2021 12:36 PM

All Index logs display by Stats by Date

Lookup Table

Splunk Search Query

Frequent Disk Space Issue - Service ECM Incidents

O365 Duplicate events

Splunk Alerts

Splunk Query

How to create a search that shows all users that h...

o365 Configuration

Guest User account Suspicious

Re: All Index logs display by Stats by Date

All Index logs display by Stats by Date

Lookup Table

Re: Splunk Search Query

Splunk Search Query

Re: Frequent Disk Space Issue - Service ECM Incid...

Frequent Disk Space Issue - Service ECM Incidents

O365 Duplicate events

Splunk Alerts

Re: Splunk Query

Splunk Query

Re: How to create a search that shows all users th...

How to create a search that shows all users that h...

Re: o365 Configuration

o365 Configuration

Re: Guest User account Suspicious

Guest User account Suspicious

Kaspersky GNRL_EV_VIRUS_FOUND "action" value

Re: Why are user details missing in the splunk log...

Re: Why are user details missing in the splunk log...

Re: Why are user details missing in the splunk log...

Re: Why are user details missing in the splunk log...

Why are user details missing in the splunk logs?

Re: What is the Spunk Power User exam retake polic...

Re: What is the Spunk Power User exam retake polic...