About syazwani

syazwani · ‎02-29-2024

Hi, Why my CIDR matching in not following the lookup content? Query i used is as below: | makeresults | eval ip="10.10.10.10" | lookup testip ip OUTPUTNEW description Result should look like this: ip Description 10.10.10.10 New But the real output look like this: ip Description 10.10.10.10 New In Progress Closed I have check my lookup and its clearly state the Description for IP Range 10.10.10.10/27 is "New". Please help and thanks!

syazwani · ‎11-30-2023

Hi, how can we reset password for admin user from CLI. Currently i have indexer using Splunk 9.1.1 in testing environment and i forgot the username and password. There were some bin command that will prompt for Splunk username and password, so i need to reset the username and password. Please help. Thank you.

syazwani · ‎10-16-2023

Hi @PickleRick, Noted on this. Yes I am using the Splunk App for Salesforce and it is using the "distance" command. Seems like they dont have a documentation for this app. Btw thankyou for your feedback.

syazwani · ‎10-16-2023

Hi @inventsekar , Thank you for your feedback. Yes, I'm currently using the Splunk App for Salesforce and this is our first time installing it. On the Splunk warning message, it didnt mentioned any details, only as the above screenshot. I did check on the search.log, they error show "syntax error - script (path)". I guess i need to fine tuned the query or is there any other way I can work on?

syazwani · ‎10-15-2023

Hi peeps, I receive below error while running a query. below is my query; eventtype=sfdc-login-history | iplocation allfields=true SourceIp | eval cur_t=_time | streamstats current=t window=2 first(lat) as prev_lat first(lon) as prev_lon first(cur_t) as prev_t by Username | eval time_diff=cur_t - prev_t | distance outputField=distance inputFieldlat1=lat inputFieldLat2=prev_lat inputfieldLon1=lon inputFieldLon2=prev_lon | eval time_diff=-1*time_diff | eval ratio = distances3600/time_diff | where ratio> 500 | geostats latfield=lat longfield=lon count by Application

syazwani · ‎09-08-2023

Hi, HTTP 503 Service Unavailable -- {"messages":[{"type":"ERROR","text":"This node is not the captain of the search head cluster, and we could not determine the current captain. The cluster is either in the process of electing a new captain, or this member hasn't joined the pool"}]} We received this error on one of the Search head cluster member. Is there any way to troubleshoot this? Please assist. Thankyou.

syazwani · ‎08-23-2023

Hi, anyone know how to hide/remove the option label on Single Visualisation mode in Dashboard Studio? I want to hide the search, expand, reload and download option. Thanks.

syazwani · ‎02-27-2023

Hi, I want to create an alert with two condition to meet by sequence before the alert can trigger. We are using eventID for each condition. First condition: eventID 4625 count more than 10 by source ip Second condition: eventID 4624 count more than 1 by source ip I want the query to meet the first condition, followed by second condition and populate a result. Please assist. Thank you.

syazwani · ‎02-19-2023

Hi @batabay, thank you for the response. It works!

syazwani · ‎02-15-2023

Hi, I need help to extract a value from field named "message". Field "message" value is as below: The process C:\Windows\system32\winlogon.exe (PRD01) has initiated the power off of computer PC01 on behalf of user ADMIN JABATAN for the following reason: No title for this reason could be found The process C:\Windows\system32\shutdown.exe (PRD01) has initiated the restart of computer PC01 on behalf of user ADMIN\SUPPORT for the following reason: No title for this reason could be found The process C:\Windows\system32\shutdown.exe (PRD01) has initiated the restart of computer PC01 on behalf of user admin for the following reason: No title for this reason could be found The value i want to extract is: newField ADMIN JABATAN ADMIN\SUPPORT admin Please assist. Thanks.

syazwani · ‎01-11-2023

Hi, have you found solution for this? Im currently facing the same issue. Need to add more information.

syazwani · ‎12-12-2022

Hi, Somehow, resync the KV store doesnt work for me. Ive reached to Splunk support and we had resolved the issue. What we did was: 1. regenerating server.pem file -stop splunk service - go to cd /opt/splunk/etc/auth and rename the server.pem file to server.pemck -start splunk 2. clean the kv store locally (on the problematic instance) - ./splunk stop - ./splunk clean kvstore --local -./splunk start Hope this helps. Thanks.

syazwani · ‎12-12-2022

Hi @richgalloway , yea i did configure from the UI for HEC. And we face an error from Splunk "server are busy". We tried to look at the input.conf and some stanza are missing. We figure out that we need http stanza set the token name. But we dont know the correct format for the stanza. We have look into splunk documentation, somehow it didnt help us. Anyway, did you know the format stanza for it?

syazwani · ‎12-08-2022

Hi, i need help on writing the [http] stanza in inputs.conf for HEC token configuration. Please assist. Thank you.

syazwani · ‎12-08-2022

Is there any workaround for this issue? Currently im also facing the same issue. Please help.

syazwani · ‎11-14-2022

Hi @yuanliu , thanks for reply. This solution worked. I try to do

syazwani · ‎11-14-2022

Hi peeps, Need help to do some query. Basically I'm trying to group some of field value in the 'Category' field into new fields call 'newCategory'. Below are the sample of data: The newCategory field will have the new count for each of the new field value (such as Anonymizers, Gambling, Malicious Site). Please help. Thank you.

syazwani · ‎10-20-2022

found the silly mistake... need to rename the _time column | table _time, user, values(accessIP), reason, count | rename user as Username, values(accessIP) as "Access IP", reason as "Reason", _time as Time and it worked.....

syazwani · ‎10-20-2022

Hi, I need help to fine tuned my SPL Query. _time field is not properly formatted when we configure it in dashboard. index=sslvpn sourcetype="sslvpnsourcetype" action=failure | iplocation accessIP | search Country ="Canada" | stats values(accessIP), count by user, _time, reason | eval _time=strftime(_time, "%d/%m/%Y %I:%M:%S %p") | table _time, user, values(accessIP), reason, count | rename user as Username, values(accessIP) as "Access IP", reason as "Reason", count as Count This is the result table(_time column) when running on search and reporting app: This is the result (_time column) when we configure in dashboard (Dashboard Studio): Please assist us. Thank you.

syazwani · ‎10-11-2022

Hi peeps, I want to join below information result in one table: 1st query index=sslvpn | iplocation src_ip | search Country != Malaysia | eval Country = if(isnull(Country),"unknown",Country) | table _time, user,src_ip,Country,action | rename user as "User ID", src_ip as "Source IP", action as "Status" 2nd query index=sslvpn group_path="ADL" | iplocation accessIP | where Country !="Malaysia" | table _time, user,accessIP,Country,action i try to join this table as below query: index=sslvpn | iplocation src_ip | search Country != Malaysia | eval Country = if(isnull(Country),"unknown",Country) | table _time, user,src_ip,Country,action | append [search index=sslvpn group_path="ADL" | iplocation accessIP | where Country !="Malaysia" | rename accessIP as src_ip] | rename user as "User ID", src_ip as "Source IP" action as "Status" but the result is not consist of 2nd query information. please help. thankyou.

syazwani · ‎10-11-2022

Hi, I need help to extract some field from below logs format. (Im so bad at this). Oct 11 16:06:24 123.12.123.12 SVPN-USR[29489]: {"id":"6767676767","msgid":"6767676767","userInfo":{"userName":"wani","groupId":1519,"groupPath":"/Group ADL/SSAeF","authMethods":""},"clientInfo":{"ip":"123.12.123.12","vip":"123.12.123.12","osType":"WINDOWS","macAddr":"","deviceID":""},"msg":"[accessIP: 123.12.123.129 virtualIP: 123.12.123.12] User wani for session XXXXXXXXXXXX visit ip source ->ip 123.12.123.12 port 10123!","timeStamp":1665475584,"time":"2022-10-11 16:06:24","type":"userlog","logSubType":"access_resource","rcip":"123.12.123.12","actionResult":"success"} Oct 11 16:06:24 123.12.123.12 SVPN-USR[29489]: {"id":"6767676767","msgid":"6767676767","userInfo":{"userName":"wani","groupId":1477,"groupPath":"/Group ADL/SSADS","authMethods":""},"clientInfo":{"ip":"123.12.123.12","vip":"123.12.123.12","osType":"WINDOWS","macAddr":"","deviceID":""},"msg":"[accessIP: 123.12.123.12 virtualIP: 123.12.123.12] User wani for session XXXXXXXXXXXX visit ip source ->ip 123.12.123.12 port 443!","timeStamp":1665475584,"time":"2022-10-11 16:06:24","type":"userlog","logSubType":"access_resource","rcip":"123.12.123.12","actionResult":"success"} I want to extract the action result value, for example: action_result = success Please help!

syazwani · ‎09-07-2022

Hi peeps, We were fine tuning the Notable Event, and there were fields that were not showing any values. Those fields are the Risk Score, Risk Event and Risk Object. We have configure the value under the Risk Analysis Tab. Please assist us on this. Thank you.

syazwani · ‎08-23-2022

Hi peeps, Need help in extracting some fields; Sample logs: Aug 24 09:30:43 101.11.10.01 CEF:0|KasperskyLab|SecurityCenter|13.2.0.1511|GNRL_EV_ATTACK_DETECTED|Network attack detected|4|msg=User: NT AUTHORITY\\SYSTEM (System user)\r\nComponent: Network Threat Protection\r\nResult description: Blocked\r\nName: Scan.Generic.PortScan.TCP\r\nObject: TCP from 101.11.10.01 at 101.11.10.01:25\r\nObject type: Network packet\r\nObject name: TCP from 101.11.10.01 at 101.11.10.01\r\nAdditional: 101.11.10.01\r\nDatabase release date: 23/8/2022 12:26:00 PM rt=1661304218000 cs9=Workstation cs9Label=GroupName dhost=082HALIM141 dst=101.11.10.01 cs2=KES cs2Label=ProductName cs3=11.0.0.0 cs3Label=ProductVersion cs10=Network Threat Protection cs10Label=TaskName cs1=Scan.Generic.PortScan.TCP cs1Label=AttackName cs6=TCP cs6Label=AttackedProtocol cs4=2887053442 cs4Label=AttackerIPv4 cs7=25 cs7Label=AttackedPort cs8=2887125841 cs8Label=AttackedIP Aug 24 09:30:43 101.11.10.01 CEF:0|KasperskyLab|SecurityCenter|13.2.0.1511|GNRL_EV_ATTACK_DETECTED|Network attack detected|4|msg=User: NT AUTHORITY\\SYSTEM (System user)\r\nComponent: Network Threat Protection\r\nResult description: Blocked\r\nName: Scan.Generic.PortScan.TCP\r\nObject: TCP from 101.11.10.01 at 101.11.10.01:42666\r\nObject type: Network packet\r\nObject name: TCP from 101.11.10.01 at 101.11.10.01:42666\r\nAdditional: 101.11.10.01\r\nDatabase release date: 23/8/2022 12:26:00 PM rt=1661304218000 cs9=Workstation cs9Label=GroupName dhost=082HALIM141 dst=101.11.10.01 cs2=KES cs2Label=ProductName cs3=11.0.0.0 cs3Label=ProductVersion cs10=Network Threat Protection cs10Label=TaskName cs1=Scan.Generic.PortScan.TCP cs1Label=AttackName cs6=TCP cs6Label=AttackedProtocol cs4=2887053442 cs4Label=AttackerIPv4 cs7=42666 cs7Label=AttackedPort cs8=2887125841 cs8Label=AttackedIP I need help to extract the underline value for fields name TCP. Sample: TCP=101.11.10.01 Please help. Thanks.

syazwani · ‎06-21-2022

Hi @isoutamo, Thanks for replying. Our current environment is multisite indexer cluster environment and we will plan to decommission the system with hardware. Our target environment is also multisite indexer cluster with new hardware. We are not replacing the new environment, we are migration to new environment. We are planning to cutover to the new cluster approcahes. We are using the same OS and the splunk version will be from 8.2 to 8.3 We are going for online migration and we dont have a specific time period. Thank you.

syazwani · ‎06-21-2022

Hi peeps, I need some information about migrating data from an instance in a cluster environment to a new cluster environment. I was unable to find documentation about this process, so I would like to get some advice or pros/cons details from the experts. Please help. Thank you.

Posts	48
Solutions	2
Karma Given	5
Karma Received	1
Member Since	‎09-06-2021

Online Status	Offline
Date Last Visited	‎03-01-2024 05:51 AM

cidr match is not properly working

Reset password in splunk for admin

Syntax Error while using "distance" command

Search Head Clustering not working properly

How to Remove option label in Dashboard Studio?

How to create an alert with two condition to meet ...

How to write regex to extract value in between two...

How to write http stanza in inputs.conf file for H...

How to group some of field value into new fields v...

_time field in not in proper format when display i...

cidr match is not properly working

Reset password in splunk for admin

Re: Syntax Error while using "distance" command

Re: Syntax Error while using "distance" command

Syntax Error while using "distance" command

Search Head Clustering not working properly

How to Remove option label in Dashboard Studio?

How to create an alert with two condition to meet ...

Re: How to write regex to extract value in between...

How to write regex to extract value in between two...

Re: How to customize Threat Activity dashboard by ...

Re: KV Store status failed

Re: How to write http stanza in inputs.conf file f...

How to write http stanza in inputs.conf file for H...

Re: KV Store status failed

Re: How to group some of field value into new fiel...

How to group some of field value into new fields v...

Re: _time field in not in proper format when displ...

_time field in not in proper format when display i...

How to join information into one table?

How to extract some field from below logs format?

Why aren't Risk Score, Risk Event and Risk Object ...

Help with ReGex for certain data

Re: How to migrate data in an indexer cluster to a...

How to migrate data in an indexer cluster to a new...