Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Are you a member of the Splunk Community?
Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- About manuelostertag
manuelostertag
Path Finder
Member since:
09-11-2019
12-27-2024
Community Statistics
| Posts | 21 |
| Solutions | 0 |
| Karma Given | 11 |
| Karma Received | 2 |
| Member Since | 09-11-2019 |
Activity Feed
- Karma Re: Read error when exporting to CSV file for linuxchuck. 12-03-2024 04:19 AM
- Got Karma for Unknow command (__f!=v) in search log at job inspector. 08-29-2024 02:16 PM
- Posted Re: Monitoring of activity - Synology NAS DSM 6.2 on Installation. 05-04-2023 08:19 AM
- Karma Re: Is there a way to retrieve the messages from the banner at the top of the UI and email me a report on them? for martin_mueller. 05-04-2023 02:21 AM
- Karma Re: Is there a way to retrieve the messages from the banner at the top of the UI and email me a report on them? for yannK. 05-04-2023 02:21 AM
- Posted Re: How to start splunk Enterprise (8.x) on linux server? on Installation. 04-24-2023 04:32 AM
- Posted Re: Error in savedsearches.conf- Invalid key in stanza - splunk_instrumentation - savedseaches.conf v8.2.9 on Splunk Enterprise. 02-23-2023 12:07 AM
- Posted Re: Error in savedsearches.conf- Invalid key in stanza - splunk_instrumentation - savedseaches.conf v8.2.9 on Splunk Enterprise. 11-16-2022 07:54 AM
- Posted Unknow command (__f!=v) in search log at job inspector on Splunk Search. 05-18-2021 01:34 AM
- Karma Re: How can i get Splunk 8.0.5 to accept accented and special characters in a csv field name? for arowsell_splunk. 04-08-2021 01:08 AM
- Posted Re: How can i get Splunk 8.0.5 to accept accented and special characters in a csv field name? on Getting Data In. 04-07-2021 03:17 AM
- Posted Re: How can i get Splunk 8.0.5 to accept accented and special characters in a csv field name? on Getting Data In. 04-07-2021 02:34 AM
- Posted Re: How can i get Splunk 8.0.5 to accept accented and special characters in a csv field name? on Getting Data In. 03-24-2021 06:25 AM
- Got Karma for Re: Field extraction. 09-07-2020 07:42 AM
- Posted Re: Field extraction on Splunk Enterprise. 09-03-2020 06:15 AM
- Posted Re: Update Universal Forwarder on Deployment Architecture. 06-10-2020 09:09 AM
- Posted Re: Update Universal Forwarder on Deployment Architecture. 06-10-2020 08:46 AM
- Karma Re: How to trigger an alert when status field is true for more than 5 min for adonio. 06-05-2020 12:50 AM
- Karma Re: How to list duplicate alerts for richgalloway. 06-05-2020 12:50 AM
- Karma Re: Splunk table and regex filter for richgalloway. 06-05-2020 12:50 AM
Topics I've Started
05-04-2023
08:19 AM
Hi @Dawn , I think the usage of syslog and the Splunk UF could do the job. NAS sends data to syslog Splunk UF "collects" data from syslog and forward it to Splunk NAS -> syslog-ng <- Splunk UF -> Splunk (Enterprise|Cloud) Install and setup syslog (for e.g syslog-ng) on a server Install and setup Splunk UF on a server (this could be the same server as in step 1); the UF should monitor the file(s) which will created by the syslog-ng and forward them to you Splunk instance (Enterprise or Cloud) Configure your NAS to send the data to the syslog-ng server Here some useful links: https://community.splunk.com/t5/Getting-Data-In/Best-practices-Syslog-ng-to-splunk/m-p/470405 https://www.splunk.com/en_us/blog/tips-and-tricks/using-syslog-ng-with-splunk.html
... View more
04-24-2023
04:32 AM
Hi @ball , here you are: https://docs.splunk.com/Documentation/Splunk/latest/Admin/StartSplunk
... View more
02-23-2023
12:07 AM
Luckily, the error is solved in 8.2.10 😅
... View more
11-16-2022
07:54 AM
@rvanythanks for the community entry, this has taken away the doubts about ourselves 🙂 And first thought something went wrong during installation on our system, but we found the "problem" on all of our server. With a patch (bash script) we fixed the "typo" (we don't know if it has a negative impact on Splunk's behaviour or it is just an typo) and change the sha256sum of the file in the manifest file so that no error message comes up when Splunk starts. This should have been noticed by Splunk when testing the software.
... View more
05-18-2021
01:34 AM
1 Karma
Hello, I've create a search which contains (...(CallerCountry="CN")). When I take a look in the search log in the job inspector (to getting information about my search), I wonder why Splunk change the original (...(CallerCountry="CN")) to (...(__f!=v OR CallerCountry="CN")). The result of this search is "better" then the result of my original search. Did anybody knows what __f!=v means? I couldn't find anything about it in the Splunk documentation? PS: I use Splunk Enterprise 8.0.8 Thanks for your support Manuel
... View more
Labels
- Labels:
-
search job inspector
04-07-2021
03:17 AM
Hello @andrewtrobec , I've tested HEADER_FIELD_ACCEPTABLE_SPECIAL_CHARACTERS = . and it doesn't work (I think this has something to do with ACSI above 128). But if I use HEADER_FIELD_ACCEPTABLE_SPECIAL_CHARACTERS = ä,Ä,ü,Ü,ö,Ö,ß it worked 👍 @arowsell_splunkare there any disadvantage of using this? Regards Manuel
... View more
04-07-2021
02:34 AM
Hello @arowsell_splunk , Thanks for the hint, but in my case this solves not the problem., cause (https://docs.splunk.com/Documentation/Splunk/8.0.8/Admin/Propsconf😞 * This setting only supports characters with ASCII codes below 128. The German character like (ä, ü, ß, etc.) are above 128. Regards Manuel
... View more
03-24-2021
06:25 AM
Hello @andrewtrobec , after the upgrade from Splunk 7.2.10 to 8.0.8 I run into the same problem. On the day I switch from 7 to 8, the problem starts. Were you able to solve the problem in the meantime? Regards Manuel
... View more
09-03-2020
06:15 AM
1 Karma
Hi @mbasharat, try this one: \<.*\>(?<Fieldtoextract>.*)\<.*\>
... View more
06-10-2020
09:09 AM
Thanks for the fast response, I will check if his is a solution for us. Manuel
... View more
06-10-2020
08:46 AM
Hi @gcusello, I have to update a lot of Windows UF and try the new app in the splunk base (https://splunkbase.splunk.com/app/5003); this app distribute the installation itself from the Deployment Server to the UF and run the installation. I did not get the installation to run, it seems the SplunkForwarder Service cannot perform an installation. If I run the scripts manually, it works. Did you know if an installation via the SplunkForwarder Service is possible? Thanks Manuel
... View more
03-18-2020
02:10 AM
Thanks, that solves the problem I've been struggling with.
... View more
12-20-2019
05:59 AM
Indeed, I didn't think to solve it with split 🙂
In this case split vs regex:
"Too easy - let's muddle it up some..."
... View more
12-11-2019
08:42 AM
If you want to make it shorter you could also use (?i) (where i means: insensitive. Case insensitive match (ignores case of [a-zA-Z])
(?i)(?<cpu>intel)
Here you could test it:
https://regex101.com/r/3pCOHf/1
... View more
10-30-2019
02:32 AM
@mdorobek
Thanks, works under 7.2.8 like a charm.
... View more
09-13-2019
06:28 AM
Hi Gregg,
thanks for the hint, it seems this tool could solve my problem described at 771002.
I will take a look at this tool.
... View more
09-12-2019
08:31 AM
Hi,
to "extract" the device name, please try this regex:
"\w.+"="(?P<device_name>.+)"
The value will be stored in device_name.
Here you can test the regex https://regex101.com/r/LNP0Ia/1
... View more
09-11-2019
07:50 AM
Hello,
like described above, I have tried the INGEST_EVAL command. I forgot to mention, that I also create the entry in the fields.conf:
[c_ip_hash]
INDEXED=true
... View more
09-11-2019
01:29 AM
Hello,
I has to anonymize the client ip in ms:iis log files at indexing time, so it must not be possible to determine the original client ip address.
It's not so easy, because it's not allowed to replace the last segment of the client ip address with xxx, because evaluations (session duration etc.) take place based on the client ip address. So that's no conclusions about the address is possible, the address should be hashed (md5, Sha256, etc.)
Example of the log file before the anonymization:
2019-09-08 00:17:21 127.0.0.1 GET /media/our_company/luanda.jpg - 443 - 111.22.33.44 Mozilla/5.0+(Windows+NT+10.0;+Win64;+x64)+AppleWebKit/537.36+(KHTML,+like+Gecko)+Chrome/75.0.3770.142+Safari/537.36 https://www.google.com/ 200 0 0 1109
Example of the log file after the anonymization:
2019-09-08 00:17:21 127.0.0.1 GET /media/our_company/luanda.jpg - 443 - 5F3999E8BDD23B Mozilla/5.0+(Windows+NT+10.0;+Win64;+x64)+AppleWebKit/537.36+(KHTML,+like+Gecko)+Chrome/75.0.3770.142+Safari/537.36 https://www.google.com/ 200 0 0 1109
I try to anonymize the data on the UF, which is installed on the MS Windows IIS server, and on the Indexer (which runs under rhel 7) I did not succeed.
Steps I have tried on the UF and Indexer
On the UF I tried to anonymize the ip with the ingest_eval command in the tranfsforms.conf, but with this, the _raw data will not be modified:
[hash_client-ip]
INGEST_EVAL = c_ip_hash=substr(md5(c_ip),1,15)
In the next step I try to use unarchive_cmd in the props.conf in the source stanza and try to call a powershell or a python script, but nothing happend:
[source:://C:\Splunk\Test_iis_data\u_ex*.log]
invalid_cause = archive
unarchive_cmd = $SPLUNK_HOME/bin/StringMD5_Hash.py
NO_BINARY_CHECK = true
priority = 10002
sourcetype = test_spezial
I also try it with the SEDCMD in the propf.conf, but I don't know how to calculate the md5 inside the command.
Now my question:
How can I anonymize the data (with hashing) before indexing?
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
12-27-2024
06:20 AM
|
Karma given to
