About MHibbin

MHibbin · ‎10-10-2018

Thanks @kmorris & @adonio, our on-premise solution is running on very very old hardware, some of which is unsupported, so management keen to get that closed down rather than running for another year. Environment is not clustered.

MHibbin · ‎10-10-2018

Hey there, Has anyone taken the challenge of migrating historic indexed data from on-premise Splunk Enterprise to Splunk Cloud? Happy with doing heavy lifting, etc., just trying to plan out the process of getting moved over. Thanks, Matt

MHibbin · ‎08-22-2015

It turns out the correlation searches didn't like the eventtype, I have temporary work around and will have to revisit this at a later date.

MHibbin · ‎08-22-2015

Thanks @ekost & @jbrodsky, I have just configured a test instance with version 3.3.1 and this solution appears to be working correctly. In our current version the log_review.conf file does not have the same contents (namely missing table_attributes and event_attributes ) Looks like I will have to schedule in some upgrade work! Thanks for your help. Best, Matt

MHibbin · ‎08-20-2015

@ekost, My correlation search is generating all the fields required (i.e. I could add them to the title/description as variables), however I would like them to appear under "Additional Fields", where there is currently items such as: Destination Destination Expected Destination Requires AntiVirus Process User Obviously these are fields that are referenced in the CIM; I would like to add ones, e.g: IOC Source IOC Description IOC Classification IOC Date Etc, The intention is that I we can add these fields to the notables/events in Incident Review, so that the review is more streamlined and also so that we can create workflow actions on the IOC themselves (e.g. Open Source checks, checks on other systems internally, etc.) for each instance. We do have other use cases, not just IOC information. Hope this is a bit clearer. Thanks, Matt

MHibbin · ‎08-19-2015

Thanks @esix, My log_review.conf file only has the following: [notable_editing] allow_urgency_override=true [comment] minimum_length=20 is_required=false I also used btool to identify any other instances, however, that was the only one. So don't really have much to go on.

MHibbin · ‎08-19-2015

Hi, We have a requirement to add some additional fields to events under "Incident Review" for IOCs (I have looked at some of the mappings in notables2.html ), however, they don't give us quite enough flexibility. How do I add these additional fields under the heading "Additional Fields" (e.g. dest displays as "Destination")? I have had a look at the following however changing the HTML or log_review.conf did not appear to make any difference: http://answers.splunk.com/answers/183891/configuring-additional-fields-for-a-notable-event.html?utm_source=typeahead&utm_medium=newquestion&utm_campaign=no_votes_sort_relev Thanks, MHibbin

MHibbin · ‎08-19-2015

@jbrodsky what is the expected format of this? - I haven't found any documentation on this yet. I have added some field names as their own stanzas, however, it is not generating in Incident Review. How do you map the field names to the meaningful names (i.e. like the defaults; e.g. dest maps to Destination)?

MHibbin · ‎06-10-2015

There may be an easier way (I like to take obscure routes) but I would: Create a custom command that maintains an eventtype(s) Link that custom command to the form Have the script to a comma-seperated list and update the eventtype(s). HTH, MHibbin

MHibbin · ‎06-08-2015

Scheduled searches, 16 cores, Custom DM, Not accelerated 🙂

MHibbin · ‎06-08-2015

Hi, I've hit a bit of a road block trying to set up some custom correlation searches, which are very similar to others that work successfully. The data model is configured and generates events; and I have a pivot search that generates events. When setting up others, this worked fine, however, on the last two I've tried setting, it appears to not be generating events. The time frame is the last 60 minutes, and the notable has some variables. The inspector shows that it is not able to find events (considering the search runs fine in flashtimeline). I know it is a bit ambiguous, but is there anything obvious I could be missing? hmmm.... Thanks. 🙂

MHibbin · ‎01-14-2015

Just come across this blog article: http://blogs.splunk.com/2011/08/02/splunk-rest-api-is-easy-to-use/ At the moment I have appended my URI with ?output_mode=json&count=0 , which seems to work. Still, I am curious to know what was wrong in the first place, unless this is the correct method, and I have misread the documentation.

MHibbin · ‎01-14-2015

Hi, I am trying to get some results out of Splunk using the REST API, I have the following in my script: uri = "/services/search/jobs/" + str(sid) + "/results" data = urllib.urlencode({"count":"0", "output_mode":"csv"}) response, content = h.request(base_url + uri, "get", data) However, it is only downloading 100 results (101 rows including header). I'm probably overlooking something as I've only started really using the interface. Any thoughts, on why I'm still getting the default number of results. Thanks, MHibbin

MHibbin · ‎10-28-2013

Hi, I've configured Splunk to forward data to a third party system we use. I can see on the packet captures that the traffic is being sent to the host, however, I am seeing more data than I would like going to this host. I would only like our ASA traffic to go to this host, however, I am seeing all sorts of data being sent. I was not expecting this based on the following configuration files: outputs.conf - [syslog] defaultGroup = syslog_out [syslog:syslog_out] server=1.2.3.4:514 type=udp priority = NO_PRI props.conf - [cisco_asa] TRANSFORMS-routing=syslog_routing transforms.conf [syslog_routing] REGEX="^[^\%]+\%ASA" DEST_KEY=_SYSLOG_ROUTING FORMAT=syslog_out N.B: the regex is there as I thought it might be an issue with just using " . " for the "cisco_asa" sourcetype (not that it should matter). I've clearly missed something here, so any help would be grateful. Thanks, mhibbin

MHibbin · ‎10-18-2013

... Who wouldn't want Splunk all over there undies.... so wrong. -.-

MHibbin · ‎10-15-2013

have you looked in the splunk logs for anything? have you restarted splunk? - does it complain about dirty indexes is this a historical problem? or recent one? - any changes around the time of occurrence?

MHibbin · ‎10-14-2013

@adityapavan18, again I'm not sure, as I only one indexer to play around with at the moment, but perhaps the following, seems odd to me that it has the server field if it is localized to one server... | eventcount summarize=false index=* report_size=true | eval MB=(size_bytes/1024)/1024 | stats sum(MB) by index, server

MHibbin · ‎10-14-2013

The eventcount command may be what you need: http://docs.splunk.com/Documentation/Splunk/6.0/SearchReference/Eventcount Haven't tried it against multiple indexers however. This command requires a " | " before the command to run. Hope this helps.

MHibbin · ‎10-11-2013

I would configure this setting to true and following the backoff setting in the outputs.conf.spec file: http://docs.splunk.com/Documentation/Splunk/6.0/Admin/Outputsconf

MHibbin · ‎10-11-2013

I would set up a forwarder on some utility server somewhere near the firewalls, and configure the outputs.conf file to send to your two indexer. You will need to make sure you turn off the autoLB feature in the outputs.conf file to stop the forwarder switching between the two. Outputs.conf.spec: "http://docs.splunk.com/Documentation/Splunk/6.0/Admin/Outputsconf" Example configuration on UF: inputs.conf: [udp://514] disabled = false sourcetype = syslog connection_host = none outputs.conf: [tcpout] defaultGroup=indexers [tcpout:indexers] server=<indexer1>:9997, <indexer2>:9997 autoLB=false Restart of Splunkd on the forwarder. Hope this helps, MHibbin

MHibbin · ‎10-02-2013

The following link for the tutorialdata.zip file: http://docs.splunk.com/Documentation/Splunk/latest/PivotTutorial/GetthetutorialdataintoSplunk#Download_the_sample_data_file The following link for the prices.csv.zip file: http://docs.splunk.com/Documentation/Splunk/latest/PivotTutorial/AddlookupfilestoSplunk#Download_the_lookup_file Hope this helps, Matt

MHibbin · ‎10-02-2013

Glad that worked for you. I would say that may be one for support.

MHibbin · ‎10-01-2013

Try running the installation file from an elavated Command Prompt, using the msiexec /i command - try that with acceptlicense parameter /quiet flag, etc.

MHibbin · ‎09-30-2013

Upgrading from 4.3.4 to 5.0.4, couldn't see anything in the logs other than the inputs starting up. I'll try the logging.

MHibbin · ‎09-27-2013

Hi guys, I have started upgrading our Windows forwarders, and have seen issues with the regmon process (splunk-regmon.exe)maxing out the CPU usage on the hosting server. The only workaround I have at the moment is to disable the input script at the system level. This is not ideal as we monitor the changes in the registry. This has had the same effect on Windows 2003, 2008 R2, and 2012. Is this a known issues (I have checked the release notes, but couldn't see anything)? Is there a work-around that can enable us to use this feature without maxing out the CPU? If it is a bug, where do I find the submission form? - it's been a long time since I've looked at the form. Thanks, MHibbin

Posts	562
Solutions	87
Karma Given	241
Karma Received	360
Member Since	‎11-03-2011

Online Status	Offline
Date Last Visited	‎12-22-2022 05:03 AM

How do you migrate historic data from on-prem Splu...

Splunk App for Enterprise Security: How to add add...

Splunk App for Enterprise Security: How to trouble...

REST API: Why am I hitting a limit of 100 exported...

Forwarding to syslog stream

Windows regmon process maxing CPU usage

Forwarding syslog to 3rd Party system

Splunk stopped receiving forwarder connections

Controls over data integrity

Index freezing - event or bucket timestamp

Re: How do you migrate historic data from on-prem ...

How do you migrate historic data from on-prem Splu...

Re: Splunk App for Enterprise Security: How to tro...

Re: Splunk App for Enterprise Security: How to add...

Re: Splunk App for Enterprise Security: How to add...

Re: Splunk App for Enterprise Security: How to add...

Splunk App for Enterprise Security: How to add add...

Re: Configuring "additional fields" for a notable ...

Re: How can a user define a list of field values a...

Re: Splunk App for Enterprise Security: How to tro...

Splunk App for Enterprise Security: How to trouble...

Re: REST API: Why am I hitting a limit of 100 expo...

REST API: Why am I hitting a limit of 100 exported...

Forwarding to syslog stream

Re: T-shirt recommendation

Re: Only 30 days searchable on any index

Re: How to calculate the index size from all index...

Re: How to calculate the index size from all index...

Re: Backoff setting of universal forwarder

Re: Sending firewall syslogs to multiple splunk se...

Re: prices.csv.zip

Re: Install Splunk 6 on Windows 2008 R2

Re: Install Splunk 6 on Windows 2008 R2

Re: Windows regmon process maxing CPU usage

Windows regmon process maxing CPU usage