cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Search instead for 
Did you mean: 
Ask a Question
masplunk
Explorer
Member since: ‎02-14-2013
‎02-24-2023
Community Statistics
Posts 6
Solutions 1
Karma Given 2
Karma Received 3
Member Since ‎02-14-2013
Activity Feed
View All

Re: Lookup not returning results that are listed i...

by in Splunk Search
‎06-18-2015 12:06 PM
‎06-18-2015 12:06 PM
this last step seemed to get little more reliable results, looks like specifying the field helped. Thanks... ... View more

Re: Lookup not returning results that are listed i...

by in Splunk Search
‎05-05-2015 10:47 AM
‎05-05-2015 10:47 AM
Search Striing: index=xxx-xx* (Failed_su OR "invalid user" OR "illegal user" NOT "Element Check" NOT input_* NOT Postponed NOT keyboard-interactive) NOT [|inputlookup linuxlookupname] | table _time, host, src_ip, user, vendor_action, linux_message | sort -_time Here is a sample output (sorry about the terrible format) _time host src_ip user vendor_action linux_message Tue May 10.193.XXX.XXX vagrant Invalid user Invalid user vagrant from 10.193.XXX.XXX Tue May 10.193.XXX.XXX vagrant Invalid user Invalid user vagrant from 10.193.XXX.XXX Tue May 10.193.XXX.XXX admin Invalid user Invalid user admin from 10.193.XXX.XXX Tue May 10.193.XXX.XXX pi Invalid user Invalid user pi from 10.193.XXX.XXX The csv lookup table has the one feild (src_ip) and I have edited it on the server manually and removed/readded the IP in question but it still continues to show up Thanks ! ... View more

Re: Lookup not returning results that are listed i...

by in Splunk Search
‎05-05-2015 09:42 AM
‎05-05-2015 09:42 AM
Search Striing: index=xxx-xx* (Failed_su OR "invalid user" OR "illegal user" NOT "Element Check" NOT input_* NOT Postponed NOT keyboard-interactive) NOT [|inputlookup linuxlookupname] | table _time, host, src_ip, user, vendor_action, linux_message | sort -_time Here is a sample output (sorry about the terrible format) _time host src_ip user vendor_action linux_message Tue May 10.193.XXX.XXX vagrant Invalid user Invalid user vagrant from 10.193.XXX.XXX Tue May 10.193.XXX.XXX vagrant Invalid user Invalid user vagrant from 10.193.XXX.XXX Tue May 10.193.XXX.XXX admin Invalid user Invalid user admin from 10.193.XXX.XXX Tue May 10.193.XXX.XXX pi Invalid user Invalid user pi from 10.193.XXX.XXX The csv lookup table has the one feild (src_ip) and I have edited it on the server manually and removed/readded the IP in question but it still continues to show up Thanks ! ... View more

Lookup not returning results that are listed in th...

by in Splunk Search
‎05-05-2015 07:23 AM
‎05-05-2015 07:23 AM
I have a lookup based on a csv that is a list of IPs with one heading (src_ip) and my seach is built to notify on failed logins, but to exclude the lookup. So at then end of the search string i put NOT [|inputlookup lookupname] this seems to work and excludes most of the IPs in the list. My question is It does not exclude ALL IPs on the list? Ive verifed that they are indeed in the lookup.csv file that i based it on, but it still does not exclude them. If anyone has any ideas I would greatly appreciate it !! Thanks. ... View more

Re: Splunk App for Enterprise Security: Threat lis...

by in Splunk Enterprise Security
‎10-30-2014 08:55 AM
2 Karma
‎10-30-2014 08:55 AM
2 Karma
Splunk support answered my questions nicely. Threatlists are downloaded to: /opt/splunk/var/lib/splunk/modinputs/threatlists To check download date / size, do a ls -lthr. If the dates are current, sizes normal then all is functioning as it should. The reason we may not be seeing data in our dashboards, is there may be no data in our system that matches the threatlists. To test this I plan on creating a custom threat list with an IP i know we see activity on and hope to see it. ... View more

Splunk App for Enterprise Security: Threat lists a...

by in Splunk Enterprise Security
‎10-29-2014 11:06 AM
1 Karma
‎10-29-2014 11:06 AM
1 Karma
New splunk user here and i am hoping someone can help with ES / threatlist problem. After installing ES and setting up threatlists they appeared to be working correctly, but only a few show up in the dashboard (threatlist activity). I found threatlists in /opt/splunk/etc/apps/SA-Threatintelligence/lookups, but they are all empty and say "intentionally left empty" and when we do |inputlookup threatlistxxx.csv it gives no results. I can see from some searches that they ARE downloading and the sizes but I am trying to find out where they are downloaded to? So i am having trouble figuring out why they are not showing up in the dashboards? Any help would be greatly appreciated ! ... View more
Contact Me
Online Status
Offline
Date Last Visited
‎02-24-2023 01:39 PM
Karma from
View All
Karma given to
View All