Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About antifreke
antifreke
Path Finder
Member since:
10-03-2011
11-19-2020
Community Statistics
| Posts | 20 |
| Solutions | 1 |
| Karma Given | 1 |
| Karma Received | 1 |
| Member Since | 10-03-2011 |
Activity Feed
- Got Karma for Optiv Threat Intel: Why are there no logs formed?. 06-05-2020 12:48 AM
- Karma Re: How to edit my search to get a count of FieldA per FieldB and per FieldC where the number of FieldB is greater than 3? for somesoni2. 06-05-2020 12:47 AM
- Posted Optiv Threat Intel: Why are there no logs formed? on Splunk Dev. 02-16-2017 07:53 AM
- Tagged Optiv Threat Intel: Why are there no logs formed? on Splunk Dev. 02-16-2017 07:53 AM
- Tagged Optiv Threat Intel: Why are there no logs formed? on Splunk Dev. 02-16-2017 07:53 AM
- Tagged Optiv Threat Intel: Why are there no logs formed? on Splunk Dev. 02-16-2017 07:53 AM
- Posted Re: What is the most efficient way to combine a Websense index and lookup? on Splunk Search. 02-01-2017 05:09 AM
- Posted Re: What is the most efficient way to combine a Websense index and lookup? on Splunk Search. 01-31-2017 11:46 AM
- Posted What is the most efficient way to combine a Websense index and lookup? on Splunk Search. 01-31-2017 11:15 AM
- Tagged What is the most efficient way to combine a Websense index and lookup? on Splunk Search. 01-31-2017 11:15 AM
- Tagged What is the most efficient way to combine a Websense index and lookup? on Splunk Search. 01-31-2017 11:15 AM
- Posted Re: Why is my forwarding configuration not forwarding data? on Getting Data In. 01-12-2017 06:47 AM
- Posted Re: Why is my forwarding configuration not forwarding data? on Getting Data In. 01-12-2017 06:37 AM
- Posted Why is my forwarding configuration not forwarding data? on Getting Data In. 01-11-2017 12:58 PM
- Tagged Why is my forwarding configuration not forwarding data? on Getting Data In. 01-11-2017 12:58 PM
- Tagged Why is my forwarding configuration not forwarding data? on Getting Data In. 01-11-2017 12:58 PM
- Tagged Why is my forwarding configuration not forwarding data? on Getting Data In. 01-11-2017 12:58 PM
- Posted Unable to find distsearch.conf file on my system and it is causing an error. Are my inputs and outputs configurations correct? on Getting Data In. 12-09-2016 09:48 AM
- Tagged Unable to find distsearch.conf file on my system and it is causing an error. Are my inputs and outputs configurations correct? on Getting Data In. 12-09-2016 09:48 AM
- Posted Re: How to troubleshoot configuration mismatch in inputs.conf and outputs.conf? on Getting Data In. 12-08-2016 10:10 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 1 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
02-16-2017
07:53 AM
1 Karma
I am having some difficulty with the OpTiv Threat Intel app and am troubleshooting why there are no logs formed. I have minimal data in the troubleshooting section that gives me the following 3 lines:
[*] Starting python threat list script.
[*] Starting python get alerts script.
[*] Looking for old log files to clear.
I've changed these over to the full path for the Windows machine:
./bin/getalerts.py:38: splunk_home = '/opt/splunk'
./bin/starter_script.sh:5:THREAT_SCRIPT_PATH="/opt/splunk/etc/apps/optiv_threat_intel/bin/optiv_threat_lists.py"
./bin/starter_script.sh:6:RSS_SCRIPT_PATH="/opt/splunk/etc/apps/optiv_threat_intel/bin/getalerts.py"
./bin/starter_script.sh:7:#LOG_FOLDER="/opt/splunk/etc/apps/optiv_threat_intel/bin/"
./bin/starter_script.sh:8:LOG_FOLDER="/opt/splunk/var/log/splunk/"
./bin/starter_script.sh:9:PYTHON="/opt/splunk/bin/splunk cmd python"
./bin/optiv_threat_lists.py:64: splunk_home = '/opt/splunk'
Reset and reloaded, and nothing populates. I've uninstalled and done a clean reinstall with the same results. There are no log files created in the var/log directory to assist with trouble shooting. Any help would be greatly appreciated.
... View more
02-01-2017
05:09 AM
I figured out why it wasn't working, my file wasn't recognized as a .csv. that's fixed and this query works perfectly! Thanks!
... View more
01-31-2017
11:46 AM
I am not using any of the websense apps. We are building out a custom application and all of our data is in a single location under index=websense
... View more
01-31-2017
11:15 AM
We all know Websense has categories numbers instead of the category and child_category names. So, I have a question on combining this data. Instead of altering props.conf (no app, just using generic search), what is the most efficient way to combine the following:
index=websense
lookup file WS_Category.csv
I want to be able to replace the category numbers in the websense index with the names in the csv. There category (index) field is directly relational to the ID (csv) field in the lookup. Ideally I'd like the data in my results to show up with a category name (Adult Material, Education, Government, etc) instead of a 1,41,1508, 201, etc. Thoughts?
... View more
01-12-2017
06:47 AM
So, should I return the outputs.conf files in the indexers back to their default?
I have the distributed search setup on the Search Head. I think I was looking at this architecture completely wrong and misunderstanding the data flow.
I looked at my searc head and did a query for index=network and it works. I was looking at this entire thing backwards. Thank you!!
... View more
01-12-2017
06:37 AM
So the data stays on the indexers, and the search head performs searches from there to the indexers?
... View more
01-11-2017
12:58 PM
Good afternoon, working on setting up the final piece of Splunk infrastructure and I have come across a little speed bump. The design is simple, Single Search Head, Dual Indexers, Syslog server (RH). I have data moving from the Syslog server to both indexers, but not from the indexers to the Search Head. My outputs on the indexer are as follows:
[tcpout]
defaultGroup = my_searchhead
indexAndForward = true
maxQueueSize = 500KB
forwardedindex.0.whitelist = .*
forwardedindex.1.whitelist = network1
forwardedindex.2.whitelist = guestnetwork
forwardedindex.3.whitelist = network2
forwardedindex.filter.disabled = true
[tcpout:my_searchhead]
server = x.x.x.x:9998
Search head Inputs has the following:
[splunktcp://9998]
Do I need to tweak anything else? Am I missing something really simple and over complicating it?
... View more
12-09-2016
09:48 AM
I'm having an issue getting the data in my .log files into splunk. I've tested connections, there are no firewall issues and my list-forward returned Active, but not forwarding.
Logs are stored at /var/og/rsyslog/firewall.log
inputs.conf
[monitor:///var/log/rsyslog/firewall.log]
disabled=false
index=firewall
sourcetype=syslog
outputs.conf
[tcpout]
defaultgroup= indexer
autoLB=true
[tcpout=indexer]
disabled=false
server=x.x.x.20:9997
When I open my splunkd-utility.log, I get a WARN for UserManagerPro - can't [distributedSearch] stanza in distsearch.conf
There is no distsearch.conf file on this system that I can find. Is my error coming from a misconfigured inputs/outputs configuration, or lack of this missing file?
... View more
12-08-2016
10:10 AM
Alright, I have that up.. but I think I figured out part of my problem in rsyslog.conf. Does the following look like I did this correctly?
if $fromhost-ip startswith 'x.x.x.23; then /var/log/rsyslog/devices.log
&~
... View more
12-07-2016
01:29 PM
Background, I am not an engineer and have little engineering experience. In setting up my instance, I have a question about the .Conf files.
Search Head - x.x.x.25
Syslog Server - x.x.x.24
Indexer 1- x.x.x.23
if I'm forwarding syslog data on udp 514, I have the following:
inputs.conf
[udp://514]
connection_host=dns
index=syslog
sourcetype=syslog
outputs.conf
[syslog:syslogGroup]
server = x.x.x.23:9997
[tcpout:indexer1]
server:x.x.x.23:9997
When I run list forward-server, I get the following:
Active forwards: none
configured but inactive: x.x.x.23:9997
Any ideas how I got this mismatch and what I need to do do make them active? I currently have no issues with networking, no firewalls, and can openly ping between devices. Thoughts?
... View more
08-11-2015
05:04 AM
Here's what I have for the table, and what the data looks like
APS_UAID | accessor | CompltdDate | ScanResult | Vulnerabilities | appname | eventKey | dataType
001 | name 1 | 2015-03-04 17:51:00 | Failed | 16 | application A | 20150304Rescan | Pii,Pci,Whatever
001 | name 1 | 2015-08-19 9:18:00 | Failed | 28 | application A | 20150819Rescan| Pii,Pci,Whatever
001 | name 1 | 2014-11-22 14:30:00 | Failed | 71 | application A | 20141122Baseline| Pii,Pci,Whatever
I would like to organize this like-
appname | APS_UAID | Vulnerabilities per Assessment ID
name 1 | APS_3001 | 16 - 20150304Rescan
__________________________ | 28 - 20150819Rescan
__________________________ | 71 - 20141122Baseline
| stats count by appname APS_UAID Vulnerabilities eventKey | eval vuln_count=+Vulnerabilities+" Outstanding Vulnerabilities - - - "+eventKey | stats values(vuln_count) AS "Total Vulnerabilties per Assessment ID" by appname APS_UAID | eval unique_vulns=mvcount(vuln_count) | sort by eventKey, appname
That query will do that part of it, but it will show all of them. I need to only show more than 3 assessments where none of them = 0.
If there are more than 3 scans completed per App and they are still vulnerabilities. This is how we plan to keep application owners accountable for patching and securing their internet facing applications.
... View more
08-10-2015
11:07 AM
Good afternoon and happy monday!
I'm working on trying to figure out a way to do the following :
Count of vulnerabilities per eventKey, per Application where the number of eventKeys is greater than 3.
Basically, if a certain app has assessments performed more than 3 times and one of the vuln results is not 0, then we want to flag them as a security risk.
What I have so far, which isn't working:
search appname="*" eventtype="Complete" | dedup CompltdDate | stats dc(eventKey) by appname | eval vuln_count=+Vulnerabilities+" Outstanding Vulnerabilities - - - "+eventKey | stats values(vuln_count) AS Total_Vuln by appname APS_UAID | eval unique_vulns=mvcount(vuln_count) | sort = -unique_vuln
... View more
03-25-2015
08:14 AM
Alright, what I have now is the following:
index="acs_na" | timechart span=7d dc(nick) by address
This gives me the following:
address 1 address 2 address 3 address 4 null other address 5,6,7,8
week 1
week 2
week 3
I want to flip these, and do dates across the table, and have a list of the locations since we have 45 sites.
... View more
03-25-2015
06:49 AM
I'm wanting to pull up unique users per address over a period of time to see how many people are actually coming to work.
So far I have index=badge, fields for nick, and address, table address date_month count
... View more
03-25-2015
06:10 AM
I have a field named nick, yes
... View more
03-25-2015
05:52 AM
index="badge" | bucket _time span=30d | timechart dc(nick) by address | sort - count | head 1000
It didn't work, so I tried the one above. Right now it's giving me the following:
site 1 site 2 site 3
date 1 535
date 2 677
date 3 424
... View more
03-25-2015
04:51 AM
index="badge" | bucket _time span=30d | timechart count by _time, address | sort - count | head
What I want to do is get a chart that shows each address and the number of unique users per that address:
January February March
address 1 15 18 17
address 2 51 54 71
Essentially, this will let us see how many unique users are coming into work, and whether or not people are actually present to do their jobs. Any thoughts on this?
... View more
12-16-2014
05:11 AM
So, I'm having some tinkering issues and I wanted to see if I could get some assistance on this. What I have for my idea is the following:
Input bar (User ID)
Dashboard panel (VPN LOGS) | Dashboard panel (Antivirus LOGS)
Dashboard panel (AD Badge LOGS) | Dashboard panel (AD Last Login logs)
I have each of the searches setup in the Dashboards, but I'm having issues feeding that custom input bar down to those panels.
Ideally, I'd enter a username.. SmithMi and it would populate those 4 dashboard panels with his data.
Input Bar
Token = UID_tok
Default = Enter User ID
dashboard panel
index="vpnlogs_*" token="UID_tok" | table user src_country_name
Am I feeding this incorrectly?
... View more
04-10-2012
02:45 AM
It helps a bit. My primary problem is that I want to run a query, for say the following..
Certain department
Query for Malware
Query for Virus
Query for Trojans
Right now, all of it is grouped together into events.
... View more
04-10-2012
01:17 AM
All of the Event's in Splunk have MAL,WM,W32,Troj,CXmal,JS,or Vir in their name. Is there a way to separate all of these by type, or just look for a single type?
ie: See how many Malware have popped up in the last 24 hours
... View more
- Tags:
- events
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
11-19-2020
09:59 PM
|
