About defikes

defikes · ‎03-19-2021

I am new to using the Transfroms.conf and props.conf to manipulate data. The issue we are experiencing is in our WinEventLog data, we have a field that comes over as Creator Process Name Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe However most of the correlation searches are looking for process name, parent process name, etc. I have created a field alias to have the Creator Process Name also follow parent process name. I am trying to use Transforms and props in order to drop most of the file path for process name field, for example: Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe Process Name: splunkd.exe Here is my current entry in Transfroms.conf [Creator_Process_Name_as_process_name] SOURCE_KEY = Creator_Process_Name REGEX = \t\w:.*[\\](?<process_name>.*)\n FORMAT = process_name::$1 and in Props.conf TRANSFORMS-Creator_Process_Name_as_process_name = Creator_Process_Name_AS_process_name Doesn't seem to be working like it should, I actually do get a process name populated but it is the whole flie path. Regex101 seems to show the Regex to be correct in just pulling the .exe

defikes · ‎03-12-2021

Thank you for that insight. This appears to have worked

defikes · ‎03-11-2021

Good Afternoon, We are attempting to get our Stealthwatch data into Splunk. We are in Cloud 8.1 one so the only Add-on available is the Technology add-on for Cisco Stealthwatch from a 3rd party. Technology Add-on for Cisco Stealthwatch Data Exporter | Splunkbase We have installed the Data Exporter on our Flow Collector and confirmed that Docker Container is working. Based on the Data Exporter documentation I installed a Get-Flows script that is pulling data but I am not sure it is pulling everything and the format is clunky. I am curious if anyone has experience with getting Stealthwatch data into Splunk Cloud with this App and what is the best way to do it.

defikes · ‎03-11-2021

Good Morning, We are having a bit on an issue with our data "layout". In our wineventlogs we have a field in the XML called Parent Process Name but shows up in our events as Creation Process Name. The issue we are having is our correlation searches are using the Parent Process Name to find certain events so this isn't matching up. I am curious the best way to make sure that Parent Process Name field stays named in this setup and not changed to Creation Process Name. I have attempted to turn on the rendered XML in order to have it come over in this format but to no avail. I have also thought about using transfroms and props.conf but not sure where the switch is taking place. Field Example: Creator Process Name: C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe The way that data is flowing is UF ----> Heavy Forwarder ------> Splunk Cloud Field example would be:

defikes · ‎12-01-2020

Thank you for the reply. I checked and all seems to be well with this. However, looking through the logs again I did see an error where it is Enqueing a very large log file (the one it is sending to the cloud) and has a large number of bytes to read, so that appears to be causing some issues as I think it may be getting backed up and not sending. I checked and we have 2 parallel ingestion pipelines and our max throughput is 0.

defikes · ‎12-01-2020

Hello, We have a Splunk Cloud that is replacing our On-prem. We currently have firewall logs going to a Syslog server that is then being sent to Splunk Cloud. We have installed the App/Add-on on the search head and it is mostly being used for CIM as the rsyslog is doing most of the work. We have an issue where we are not seeing any new data in our Splunk Cloud. I have checked the rsyslog.conf and everything appears right as far as what file path it is monitoring and what IP's it is getting it from. I have checked and confirmed all new logs are still going to the syslog server and data is is still going to our on-prem server. It would appear to be some disconnect between the Syslog server and our splunk cloud, but not 100% what else to check at this moment

Posts	6
Solutions	0
Karma Given	2
Karma Received	0
Member Since	‎12-01-2020

Online Status	Offline
Date Last Visited	‎03-19-2021 11:54 AM

Using Transfroms.conf to drop parts of a file path

Stealthwatch data into Splunk Cloud

Renaming Fields in Data

Why are Palo Alto logs not showing in Splunk Cloud...

Using Transfroms.conf to drop parts of a file path

Re: Renaming Fields in Data

Stealthwatch data into Splunk Cloud

Renaming Fields in Data

Re: Palo Alto logs not showing in Splunk Cloud

Why are Palo Alto logs not showing in Splunk Cloud...