cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Search instead for 
Did you mean: 
Ask a Question
ldnail_at_TI
Path Finder
Member since: ‎08-28-2013
‎10-27-2022
Community Statistics
Posts 20
Solutions 2
Karma Given 2
Karma Received 1
Member Since ‎08-28-2013
Activity Feed
Topics I've Started
View All

Microsoft Office 365 Reporting Web Service ends wi...

by in All Apps and Add-ons
‎10-21-2022 12:58 PM
‎10-21-2022 12:58 PM
  Microsoft Office 365 Reporting Web Service works fine with an "Index Once" config where Start date/time & End date/time are defined. Set this to Continuously Monitor and it appears to fail...  This connector is defaults with empty start or end date/time fields 2022-10-21 13:36:54,969 INFO pid=15262 tid=MainThread file=splunk_rest_client.py:_request_handler:99 | Use HTTP connection pooling 2022-10-21 13:36:54,970 DEBUG pid=15262 tid=MainThread file=binding.py:get:695 | GET request to https://127.0.0.1:8089/servicesNS/nobody/TA-MS_O365_Reporting/storage/collections/config/TA_MS_O365_Reporting_checkpointer (body: {}) 2022-10-21 13:36:54,971 DEBUG pid=15262 tid=MainThread file=connectionpool.py:_new_conn:941 | Starting new HTTPS connection (1): 127.0.0.1:8089 2022-10-21 13:36:54,973 DEBUG pid=15262 tid=MainThread file=connectionpool.py:_make_request:442 | https://127.0.0.1:8089 "GET /servicesNS/nobody/TA-MS_O365_Reporting/storage/collections/config/TA_MS_O365_Reporting_checkpointer HTTP/1.1" 200 5564 2022-10-21 13:36:54,974 DEBUG pid=15262 tid=MainThread file=binding.py:get:695 | GET request to https://127.0.0.1:8089/servicesNS/nobody/TA-MS_O365_Reporting/storage/collections/config/ (body: {'count': -1, 'offset': 0, 'search': 'TA_MS_O365_Reporting_checkpointer'}) 2022-10-21 13:36:54,974 DEBUG pid=15262 tid=MainThread file=binding.py:new_f:74 | Operation took 0:00:00.003694 2022-10-21 13:36:54,976 DEBUG pid=15262 tid=MainThread file=binding.py:new_f:74 | Operation took 0:00:00.002273 2022-10-21 13:36:54,976 DEBUG pid=15262 tid=MainThread file=connectionpool.py:_make_request:442 | https://127.0.0.1:8089 "GET /servicesNS/nobody/TA-MS_O365_Reporting/storage/collections/config/?count=-1&offset=0&search=TA_MS_O365_Reporting_checkpointer HTTP/1.1" 200 4716 2022-10-21 13:36:54,978 DEBUG pid=15262 tid=MainThread file=binding.py:get:695 | GET request to https://127.0.0.1:8089/servicesNS/nobody/TA-MS_O365_Reporting/storage/collections/data/TA_MS_O365_Reporting_checkpointer/O365_Message_Trace_obj_checkpoint_oauth (body: {}) 2022-10-21 13:36:54,979 DEBUG pid=15262 tid=MainThread file=connectionpool.py:_make_request:442 | https://127.0.0.1:8089 "GET /servicesNS/nobody/TA-MS_O365_Reporting/storage/collections/data/TA_MS_O365_Reporting_checkpointer/O365_Message_Trace_obj_checkpoint_oauth HTTP/1.1" 404 140 2022-10-21 13:36:54,980 DEBUG pid=15262 tid=MainThread file=connectionpool.py:_new_conn:941 | Starting new HTTPS connection (1): login.windows.net:443 2022-10-21 13:36:54,980 DEBUG pid=15262 tid=MainThread file=base_modinput.py:log_debug:298 | _Splunk_ Proxy is enabled: web:8080 2022-10-21 13:36:54,980 DEBUG pid=15262 tid=MainThread file=base_modinput.py:log_debug:298 | _Splunk_ Getting proxy server. 2022-10-21 13:36:54,980 DEBUG pid=15262 tid=MainThread file=base_modinput.py:log_debug:298 | _Splunk_ message trace URL: https://reports.office365.com/ecp/reportingwebservice/reporting.svc/MessageTrace?$filter=StartDate eq datetime'2022-10-16T13:36:54.979985Z' and EndDate eq datetime'2022-10-16T14:36:54.979985Z' 2022-10-21 13:36:54,980 DEBUG pid=15262 tid=MainThread file=base_modinput.py:log_debug:298 | _Splunk_ Start date: 2022-10-16 13:36:54.979985, End date: 2022-10-16 14:36:54.979985 2022-10-21 13:36:55,142 DEBUG pid=15262 tid=MainThread file=connectionpool.py:_make_request:442 | https://login.windows.net:443 "POST /2445612c-659f-4f0e-a8b2-51087c624102/oauth2/token HTTP/1.1" 200 1815 2022-10-21 13:36:55,144 DEBUG pid=15262 tid=MainThread file=base_modinput.py:log_debug:298 | _Splunk_ Proxy is enabled: web:8080 2022-10-21 13:36:55,144 DEBUG pid=15262 tid=MainThread file=base_modinput.py:log_debug:298 | _Splunk_ Getting proxy server. 2022-10-21 13:36:55,145 DEBUG pid=15262 tid=MainThread file=connectionpool.py:_new_conn:941 | Starting new HTTPS connection (1): reports.office365.com:443 2022-10-21 13:36:59,928 DEBUG pid=15262 tid=MainThread file=connectionpool.py:_make_request:442 | https://reports.office365.com:443 "GET /ecp/reportingwebservice/reporting.svc/MessageTrace?$filter=StartDate%20eq%20datetime'2022-10-16T13:36:54.979985Z'%20and%20EndDate%20eq%20datetime'2022-10-16T14:36:54.979985Z' HTTP/1.1" 200 216 2022-10-21 13:36:59,930 DEBUG pid=15262 tid=MainThread file=base_modinput.py:log_debug:298 | _Splunk_ max date before getting message: 2022-10-16 13:36:54.979985 I changed the Start date/time 2022-10-19 00:00:00 2 full days ago, so I don't bump against the 7 day boundary. 2022-10-21 13:40:31,102 DEBUG pid=15810 tid=MainThread file=base_modinput.py:log_debug:298 | _Splunk_ message trace URL: https://reports.office365.com/ecp/reportingwebservice/reporting.svc/MessageTrace?$filter=StartDate eq datetime'2022-10-19T00:00:00Z' and EndDate eq datetime'2022-10-19T01:00:00Z' 2022-10-21 13:40:31,102 DEBUG pid=15810 tid=MainThread file=base_modinput.py:log_debug:298 | _Splunk_ Start date: 2022-10-19 00:00:00, End date: 2022-10-19 01:00:00 2022-10-21 13:40:31,103 DEBUG pid=15810 tid=MainThread file=connectionpool.py:_new_conn:941 | Starting new HTTPS connection (1): login.windows.net:443 2022-10-21 13:40:31,339 DEBUG pid=15810 tid=MainThread file=connectionpool.py:_make_request:442 | https://login.windows.net:443 "POST /2445612c-659f-4f0e-a8b2-51087c624102/oauth2/token HTTP/1.1" 200 1815 2022-10-21 13:40:31,341 DEBUG pid=15810 tid=MainThread file=base_modinput.py:log_debug:298 | _Splunk_ Proxy is enabled: web:8080 2022-10-21 13:40:31,341 DEBUG pid=15810 tid=MainThread file=base_modinput.py:log_debug:298 | _Splunk_ Getting proxy server. 2022-10-21 13:40:31,342 DEBUG pid=15810 tid=MainThread file=connectionpool.py:_new_conn:941 | Starting new HTTPS connection (1): reports.office365.com:443 2022-10-21 13:40:34,302 DEBUG pid=15810 tid=MainThread file=connectionpool.py:_make_request:442 | https://reports.office365.com:443 "GET /ecp/reportingwebservice/reporting.svc/MessageTrace?$filter=StartDate%20eq%20datetime'2022-10-19T00:00:00Z'%20and%20EndDate%20eq%20datetime'2022-10-19T01:00:00Z' HTTP/1.1" 200 122 2022-10-21 13:40:34,303 DEBUG pid=15810 tid=MainThread file=base_modinput.py:log_debug:298 | _Splunk_ max date before getting message: 2022-10-19 00:00:00 I've not been able to determine what the comment "_Splunk_ max date before getting message: <2022-10-19 00:00:00>" The lookup TA_MS_O365_Reporting_checkpointer shows a row with _key <nameofinput>_once_checkpoint_oauth which looks to be from when I did the Index Once. Would some who's running Continuously Monitor please take a look into lookup TA_MS_O365_Reporting_checkpointer & let me know what _key name & state columns indicate for where _key = *_checkpoint_* Of course, if someone has experienced the same & figured this out, I'd appreciate any words of wisdom.   ... View more
Labels

Re: Splunk Add-on for Microsoft Office 365 Reporti...

by in All Apps and Add-ons
‎10-21-2022 11:14 AM
‎10-21-2022 11:14 AM
I was using the wrong ID for the Client ID. Make sure you use the Application (client) ID   ... View more

Re: routing and transforming to two different inde...

by in Splunk Search
‎08-18-2021 02:24 PM
‎08-18-2021 02:24 PM
I didn't see that in the forest of trees... thanks. ... View more

Routing and transforming to two different indexers...

by in Splunk Search
‎08-18-2021 12:13 PM
‎08-18-2021 12:13 PM
Today I have a custom sourcetype = custom:access_combined this is routed in its entirety at the heavy forwarder to two different index clusters. Indexer1 is the dev team, indexer2 is ops. So the problem I'm running into is that I'd like to: - route a full copy to indexer1 - for indexer2, run through transforms and drop a bunch of noise (like 75%) ops doesn't need to nullqueue Any ideas on how to approach this?      ... View more
Labels

Re: SEDCMD Help

by in Getting Data In
‎06-08-2021 10:57 AM
‎06-08-2021 10:57 AM
Thats pretty much the same result as the last and its trips everything but the first field. Results with your SEDCMD 5/28/21 3:32:29.100 PM   May 28 15:32:30 palohost 1 host = pdq source = palohost-0528-15.log sourcetype = pan:log Source log line: May 28 15:32:30 palohost 1,2021/05/28: 20:32:29,011901036309,TRAFFIC,end,2305,2021/05/28 20:32:29,<someip>,<someip>,0.0.0.0,0.0.0.0,<rule>,<user>,,<protocol>,<virtualsystem>,EXTTUNNEL,EXTINSIDE,tunnel,ethernet0/0,,,150000,,50000,443,0,0,,tcp,allow,143734,112711,31023,340,2021/05/28 20:30:59,75,<classification>,,,,,,,211,129,<action>,123,456,0,0,,palohost,from-policy,,,0,,0,,N/A,0,0,0,0,<some guid>,0,0,,,,,,, Here is what I want it to look like without the first field. 5/28/21 3:32:29.100 PM   ,2021/05/28: 20:32:29,011901036309,TRAFFIC,end,2305,2021/05/28 20:32:29,<someip>,<someip>,0.0.0.0,0.0.0.0,<rule>,<user>,,<protocol>,<virtualsystem>,EXTTUNNEL,EXTINSIDE,tunnel,ethernet0/0,,,150000,,50000,443,0,0,,tcp,allow,143734,112711,31023,340,2021/05/28 20:30:59,75,<classification>,,,,,,,211,129,<action>,123,456,0,0,,palohost,from-policy,,,0,,0,,N/A,0,0,0,0,<some guid>,0,0,,,,,,, host = xxx source = palohost-0528-15.log sourcetype = pan:traffic     ... View more

Re: SEDCMD Help

by in Getting Data In
‎06-08-2021 06:48 AM
‎06-08-2021 06:48 AM
@kamlesh_vaghela wrote: ok @ldnail_at_TI  What is your expected OP from above screen? KV "   I only want to capture      Jan 7 10:19:47 palohost 1 " which would then be deleted in sedcmd ... View more

Re: SEDCMD Help

by in Getting Data In
‎06-08-2021 06:18 AM
‎06-08-2021 06:18 AM
that captures everything afterwards   thanks ... View more

SEDCMD Help

by in Getting Data In
‎06-07-2021 11:18 AM
‎06-07-2021 11:18 AM
I am attempting to use SEDCMD on ingest to eliminate extra "data" from my logs (and license). This will be running on Heavy Forwarder. Turns out SEDCMD only works on _raw during ingest which is complicated with the Palo TA as it separates CONFIG, THREAT, TRAFFIC, etc.. into their own sourcetypes, so I have to operate off of sourcetype=pan:log which looks like this:     Jan 7 10:19:47 palohost 1,2021/06/07: 15:19:46,011901036309,GLOBALPROTECT,... Jan 7 10:19:47 palohost 1,2021/06/07: 15:19:46,011901036309,HIPMATCH,... Jan 7 10:19:47 palohost 1,2021/06/07: 15:19:46,011901036309,CONFIG,... Jan 7 10:19:47 palohost 1,2021/06/07: 15:19:46,011901036309,THREAT,... Jan 7 10:19:47 palohost 1,2021/06/07: 15:19:46,011901036309,TRAFFIC,...     I need to perform the SEDCMD only on lines with a TRAFFIC in the 4th field, which I can identify just fine with:          ^(?:[^,]*,){3}TRAFFIC     The challenge begins here. I need to capture the first field, which is from start of the line up to the first comma. So for this line:      Jan 7 10:19:47 palohost 1,2021/06/07: 15:19:46,011901036309,TRAFFIC,... I only want to capture      Jan 7 10:19:47 palohost 1 Any advise? ... View more
Labels

Re: Computing column differences

by in Splunk Search
‎03-11-2021 07:47 AM
‎03-11-2021 07:47 AM
that did the trick... thanks a bunch. ... View more

Computing column differences

by in Splunk Search
‎03-09-2021 08:38 AM
‎03-09-2021 08:38 AM
This is result of a query that reflects license consumption by day Index 3/2/2021 3/3/2021 3/4/2021 3/5/2021 3/6/2021 3/7/2021 3/8/2021 index01 0.018006 0.018128 0.018065 0.018035 0.017944 0.017985 0.018042 index02 0.014985 0.009444 0.054803 0.010401 0.006807 0.005035 0.008998 index03 3.468919 3.674277 3.786565 3.133193 2.151094 2.548173 4.531934 index04 0.084911 0.082637 0.090785 0.062404 0.012795 0.031198 0.084129   I'm try to compute a daily difference so we can easily spot variance/trend with the result looking something like this: Index 3/2/2021 3/3/2021 dif day 1 3/4/2021 dif day 2 3/5/2021 dif day 3 3/6/2021 dif day 4 3/7/2021 dif day 5 3/8/2021 dif day 6 index01 0.018006 0.018128 -0.00012 0.018065 0.00006 0.018035 0.00003 0.017944 0.00009 0.017985 -0.00004 0.018042 -0.00006 index02 0.014985 0.009444 0.005541 0.054803 -0.04536 0.010401 0.04440 0.006807 0.00359 0.005035 0.00177 0.008998 -0.00396 index03 3.468919 3.674277 -0.20536 3.786565 -0.11229 3.133193 0.65337 2.151094 0.98210 2.548173 -0.39708 4.531934 -1.98376 index04 0.084911 0.082637 0.002274 0.090785 -0.00815 0.062404 0.02838 0.012795 0.04961 0.031198 -0.01840 0.084129 -0.05293   The query I started from is below & I've tried 20 ways to Sunday get a difference column, but no joy index=_internal source=*license_usage.log* type=Usage earliest=-7d@d latest=@d host=licenseserver | eval GB=round(b/1024/1024/1024,6) | bucket span=1d _time | eval Time=strftime(_time,"%m/%d/%y") | chart sum(GB) AS volume_GB over Time by idx limit=0 | transpose 0 column_name=Index header_field=Time   I'm not married to chart or transpose, its just where it all started.   Any suggestions? ... View more
Labels

Re: Box App for Splunk?

by in All Apps and Add-ons
‎09-30-2020 07:08 AM
‎09-30-2020 07:08 AM
Sorry, I don't see "Accept" any where. ... View more

Re: Splunk Add-on for Box: Inputs panel stuck "Loa...

by in All Apps and Add-ons
‎06-18-2020 08:07 AM
‎06-18-2020 08:07 AM
Found it in release notes: 2020-02-04 ADDON-25183, ADDON-25885 Addons UI is not compatible with Splunk 7.3.3 and Splunk 7.3.4 ... View more

Splunk Add-on for Box: Inputs panel stuck "Loading...

by in All Apps and Add-ons
‎05-29-2020 11:13 AM
‎05-29-2020 11:13 AM
When I select the Inputs panel, it gets stuck at Loading. I've worked around this on the back end, but I would like to ensure this works for my prod box. Any suggestions? ... View more
Labels

Re: Box App for Splunk?

by in All Apps and Add-ons
‎05-29-2020 10:19 AM
‎05-29-2020 10:19 AM
I found a copy on Github @ https://github.com/splunk/splunk-app-box ... View more

Box App for Splunk?

by in All Apps and Add-ons
‎05-29-2020 10:12 AM
‎05-29-2020 10:12 AM
Got the Box Add-on working, now for reporting, but cannot find the Box App for Splunk? Is there replacement? ... View more
Labels

Re: TrendMicro ServerProtect Logs?

by in Getting Data In
‎04-11-2019 08:46 AM
‎04-11-2019 08:46 AM
Sadly, no. ... View more

scheduled on HF

by in All Apps and Add-ons
‎02-18-2019 02:43 PM
‎02-18-2019 02:43 PM
Using latest addon, my Heavy Fowarders log this at Splunk start: 02-18-2019 13:34:14.338 -0600 INFO ModularInputs - No stanzas found for scheme "autofocus_export" in inputs.conf at script (re)start. 02-18-2019 13:34:14.338 -0600 INFO ExecProcessor - New scheduled exec process: python /opt/splunk/etc/apps/Splunk_TA_paloalto/bin/autofocus_export.py 02-18-2019 13:34:14.338 -0600 INFO ExecProcessor - interval: run once How do I stop this? inputs.conf has been removed. ./splunk btool inputs list doesn't reflect anything from the TA. ... View more

TrendMicro ServerProtect Logs?

by in Getting Data In
‎05-11-2018 01:23 PM
‎05-11-2018 01:23 PM
Anyone have any luck getting TrendMicro ServerProtect logs? The logs appear to be stored in binary format. ... View more

Palo Alto Networks App for Splunk: Deployment in S...

by in All Apps and Add-ons
‎03-27-2018 02:38 PM
‎03-27-2018 02:38 PM
In a distributed search head environment, where do configure the wildfire api key in the Add-on to ensure search head replication? ... View more
Contact Me
Online Status
Offline
Date Last Visited
‎10-27-2022 02:34 PM
Karma given to