Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About jhilton90
jhilton90
Path Finder
Member since:
07-05-2022
11-27-2023
Community Statistics
| Posts | 75 |
| Solutions | 0 |
| Karma Given | 9 |
| Karma Received | 1 |
| Member Since | 07-05-2022 |
Activity Feed
- Posted Re: Resolving Error when using VirusTotal TA? on All Apps and Add-ons. 11-27-2023 06:53 AM
- Posted ServiceNow Logs aren't being parsed properly on Splunk Cloud Platform. 09-25-2023 03:43 AM
- Posted Re: How to integrate Splunk with ServiceNow? on Splunk Enterprise. 09-19-2023 02:32 AM
- Posted Re: How can I see what my universal and heavy forwarders are ingesting and sending on Splunk Search. 09-05-2023 08:13 AM
- Posted Re: How can I see what my universal and heavy forwarders are ingesting and sending on Splunk Search. 09-05-2023 07:00 AM
- Posted How can I see what my universal and heavy forwarders are ingesting and sending on Splunk Search. 09-05-2023 02:57 AM
- Karma Re: How to combine multiple alerts into one single alert for ITWhisperer. 08-22-2023 01:21 AM
- Posted Re: How to combine multiple alerts into one single alert on Other Usage. 08-21-2023 03:25 AM
- Posted Re: How to combine multiple alerts into one single alert on Other Usage. 08-21-2023 02:26 AM
- Posted Re: How to combine multiple alerts into one single alert on Other Usage. 08-18-2023 01:51 AM
- Posted How to combine multiple alerts into one single alert on Other Usage. 08-18-2023 01:34 AM
- Karma Re: Table doesn't display redirect_uri for gcusello. 08-15-2023 02:31 AM
- Posted Re: Table doesn't display redirect_uri on All Apps and Add-ons. 08-15-2023 02:29 AM
- Posted Why does the table not display the redirect_uri? on All Apps and Add-ons. 08-15-2023 02:16 AM
- Karma Re: How do I get the difference between the number of events for ITWhisperer. 08-07-2023 01:24 AM
- Posted Re: How do I get the difference between the number of events on Splunk Search. 08-04-2023 08:15 AM
- Posted Re: How do I get the difference between the number of events on Splunk Search. 08-04-2023 07:10 AM
- Posted Re: How do I get the difference between the number of events on Splunk Search. 08-04-2023 06:23 AM
- Posted How do I get the difference between the number of events on Splunk Search. 08-04-2023 04:51 AM
- Posted Re: How do I extract certain fields into a KV Store and then perform checks against that KV Store on Splunk Search. 07-13-2023 01:22 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
11-27-2023
06:53 AM
Unfortunately not no
... View more
09-25-2023
03:43 AM
We are currently ingesting ServiceNow Logs through the Splunk Add-on for Service Now TA. However, the logs aren't being parsed properly, as they are in a raw log format, which makes it increasingly difficult to build any kind of dashboard etc. Does anyone have any knowledge or experience in changing ServiceNow logs from a raw format to a structured format? Any help would be greatly appreciated
... View more
Labels
- Labels:
-
administration
-
configuration
-
other
09-05-2023
07:00 AM
Thanks Giuseppe, How do I actually go about finding out what local logs it's reading?
... View more
09-05-2023
02:57 AM
I'm trying to produce an architecture diagram of our Splunk environment and I want to know what each of our universal forwarders and heavy forwarders are ingesting and sending. I'm looking in inputs and outputs.conf but they are of no use. Is there a way to view what each forwarder is ingesting and sending, whether that be via the command line or in Splunk itself?
... View more
08-21-2023
03:25 AM
I'll let you tomorrow at 9am, which is when it's set run but i think this will have sorted it! Thanks
... View more
08-21-2023
02:26 AM
I made a mistake, it was actually set to "Each result". I've set it to Once now though
... View more
08-18-2023
01:51 AM
Hi ITWhispere The trigger is set to Once
... View more
08-18-2023
01:34 AM
I have an alert set up to detect multiple invalid user credential sign in attempts, which runs once every 24 hours at 9am. However, once 9am rolls around I get an excessive number of alert emails for each of the invalid user credential sign in attempts. I'd love it if there was just one email with all the alerts listed in the email
... View more
Labels
- Labels:
-
alert action
-
email
08-15-2023
02:16 AM
Can anyone tell me why my table doesn't display the redirect_uri?
index=keycloak customerReferenceAccountId!=SERVICE* username!=test*@test.co.uk type=LOGIN*
| stats count(eval(type="LOGIN")) as successful_login count(eval(type="LOGIN_ERROR")) as login_error by username, ipAddress
| eval percentage_failure=((successful_login/login_error)*100)
| eval percentage_failure=round('percentage_failure', 2)
| where successful_login>0 AND login_error>7
| table username, ipAddress, redirect_uri, successful_login, login_error, percentage_failure
... View more
- Tags:
- splunk search
08-04-2023
08:15 AM
That's great that gives me the difference between the two days. Now I need to display it like the image
... View more
08-04-2023
07:10 AM
index=advanced_hunting EventCategory=AdvancedHunting-DeviceEvents
| streamstats window=2 current=f last(EventCategory) as previous_count
| eval change=EventCategory-previous_count Thanks
... View more
08-04-2023
06:23 AM
Perhaps this might help actually so currently I'm ingesting advanced hunting logs into an index=advanced_hunting and within that index there is EventCategory, which has different categories such as AdvancedHunting-DeviceEvents or AdvancedHunting-DeviceFileEvents. As well as other fields like Timestamp etc In the main dashboard, I've got a count of each of the EventCategory's which gives me the total number of events in each EventCategory, and I need to find a way to get the difference on a daily basis
... View more
08-04-2023
04:51 AM
I am ingesting advanced hunting logs and I have a main dashboard where I present the number of events per Event Category as single numbers. I want to be able to track the changes in the number of events. For instance, if Monday has 1,000,000 events but Tuesday has 2,000,000 events then the number of events has increased by 1,000,000. How can I work out the difference and display this on the main dashboard. Any help is greatly appreciated
... View more
07-13-2023
01:22 AM
Ideally I don't want to manually add field values to the kv store, I'd like the field values to be automatically added if they are not already in the KV Store.
... View more
07-12-2023
06:46 AM
So I'm ingesting advanced hunting logs into Splunk and one of the interesting fields is properties.InitiatingProcessSHA1, which is a hash of whatever file (properties.InitiatingProcessVersionInfoOriginalFileName) is being run on the end user's machine. I want to be able to extract the SHA1 value and FileName value into a KV Store and then be able to make queries against that KV store. For example, say there is a SHA1 hash for a file called text_program.exe, which has appeared in the logs: SHA1: 111111111111 FileName: test_program.exe I'd like to be able to extract the hash value as well as the file name into a KV Store, and make queries against the KV store. Because in the event that someone clicks on a phishing email and accidently downloads a program called text_program.exe and it has a hash value of 22222222222, I can investigate this. I'm just wondering what the best way to tackle this would be
... View more
Labels
- Labels:
-
field extraction
-
fields
-
lookup
07-11-2023
03:29 AM
Wow that worked! Thanks very much!
... View more
07-11-2023
03:14 AM
Hi Giuseppe, Thanks for the reply, the only issue I've ran into now is that other fields like properties.LocalIP and properties.RemoteIP that are present in both indexes come in as null. So I've modified the initial query a bit like so: index=advanced_hunting category=AdvancedHunting-DeviceNetworkEvents OR index=advanced_hunting category=AdvancedHunting-DeviceEvents
| rename
properties.DeviceName AS DeviceName
properties.InitiatingProcessAccountName AS AccountName
properties.LocalIP AS LocalIP
properties.Protocol AS Protocol
properties.RemoteIP AS RemoteIP
| table AccountName, DeviceName, LocalIP, RemoteIP The AccountName and DeviceName display values but for LocalIP and RemoteIP just display as null
... View more
07-10-2023
09:20 AM
I have Advanced Hunting logs that are being ingested into Splunk and one of the indexes is DeviceNetworkEvents, which has the following fields
- properties.DeviceName (The name of the device)
- properties.InitiatingProcessAccountName (The name of the user's account
Now, I want to format the data into a table that displays the device name and the account name, but Account Name fields are displayed as null.
However, in other indexes like "DeviceEvents" the properties.InitiatingProcessAccountName field and properties.DeviceName are both present and have actual values in them.
So I was going to use the "join" command but not sure if it would work or not.
Hoping someone can shine some light
... View more
06-21-2023
04:53 AM
I have installed and setup the VirusTotal TA with basic configuration i.e. API key and Max Batch Size just to test things.
However when I try to run the following command
index=advanced_hunting category="AdvancedHunting-UrlClickEvents" properties.UrlChain=*
| virustotal domain=properties.UrlChain
I get the following error
Error in 'virustotal' command: External search command exited unexpectedly with non-zero error code 1.
Streamed search execute failed because: Error in 'virustotal' command: External search command exited unexpectedly with non-zero error code 1.
I'm scrolling through Google but nothing is helping at the moment.
Was wondering if anyone else has experienced the same issue
... View more
Labels
- Labels:
-
configuration
-
installation
-
troubleshooting
06-21-2023
04:13 AM
I'm having the same issue on Splunk Cloud V9.0.2209.3. I'm trying to query some urls in our logs using the following command index=log_source category=log_category
| virustotal domain=properties.UrlChain I get the following errors: Error in 'virustotal' command: External search command exited unexpectedly with non-zero error code 1. Streamed search execute failed because: Error in 'virustotal' command: External search command exited unexpectedly with non-zero error code 1..
... View more
06-19-2023
07:10 AM
I have an index called index=advanced_hunting and in this index there is a field called category, where there are several categories like
AdvancedHunting-DeviceFileEvents
AdvancedHunting-DeviceNetworkEvents etc
I'm trying to look into the AdvancedHunting-DeviceFileEvents category to look at what files have been deleted, but the logs in that specific category don't feature the properties.AccountName i.e. the person, it does however, have a filed called properties.DeviceName.
However, the category of AdvancedHunting-DeviceLogonEvents does have a field called properties.AccountName, as well as properties.DeviceName.
So I was wondering if it's possible to connect the properties.AccountName and properties.DeviceName together so I can see who has deleted something
... View more
Labels
- Labels:
-
join
-
table
-
transaction
04-17-2023
08:06 AM
No it's okay you were right, I had a typo Thanks!
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
11-27-2023
10:14 AM
|
