About PavelP

PavelP · ‎03-04-2024

please consider upvote a new Splunk idea to get more attention: https://ideas.splunk.com/ideas/EID-I-2226

PavelP · ‎03-03-2024

Affected are tstats/TERM/PREFIX and accelerated DM searches. This isn't limited to punycode domains; any value with continuous hyphens may be affected. Consider usernames, user-agents, URL paths and queries, file names, and file paths – the range of affected fields is extensive. The implications extend to premium apps like Enterprise Security, heavily reliant on accelerated DMs. Virtually every source and sourcetype could be impacted, including commonly used ones like firewall, endpoint, windows, proxy, etc. Here are a couple of examples to illustrate the issue: Working URL: hp--community.force.com Path: /tmp/folder--xyz/test-----123.txt, c:\Windows\Temp\test---abc\abc--123.dat Username: admin--haha User-Agent: Mozilla/5.0--findme

PavelP · ‎03-03-2024

Affected are tstats/TERM/PREFIX and accelerated DM searches. This isn't limited to punycode domains; any domain with continuous hyphens may be affected. Consider usernames, user-agents, URL paths and queries, file names, and file paths – the range of affected fields is extensive. The implications extend to premium apps like Enterprise Security, heavily reliant on accelerated DMs. Virtually every source and sourcetype could be impacted, including commonly used ones like firewall, endpoint, windows, proxy, etc. Here are a couple of examples to illustrate the issue: Working URL: https://hp--community.force.com Path: /tmp/folder--xyz/test-----123.txt, c:\Windows\Temp\test---abc\abc--123.dat Username: admin--haha User-Agent: Mozilla/5.0--findme

PavelP · ‎03-03-2024

Affected are tstats/TERM/PREFIX searches and accelerated DM searches. I haven't conducted a thorough check yet, but it seems that searches on accelerated DM may overlook fields with double dashes. This isn't limited to punycode domains; any field value with continuous hyphens may be affected. Consider usernames, user-agents, URL paths and queries, file names, and file paths – the range of affected fields is extensive. The implications extend to premium apps like Enterprise Security, heavily reliant on accelerated DMs. Virtually every source and sourcetype could be impacted, including commonly used ones like firewall, endpoint, windows, proxy, etc. Here are a couple of examples to illustrate the issue: Working URL: https://hp--community.force.com Path: /tmp/back--door/test-----backdoor.txt, c:\Windows\Temp\back--door\test---backdoor.exe Username: admin--backdoor User-Agent: Mozilla/5.0--backdoor

PavelP · ‎03-02-2024

Hey folks, breaking news for the TERM/PREFIX enthusiasts! Brace yourselves – our TERM searches cannot find punycode encoded domains! 🙂 xn--bcher-kva.de https://en.m.wikipedia.org/wiki/Punycode

PavelP · ‎03-02-2024

any ideas on TERM and PREFIX limitations with double dashes? cat /tmp/test.txt abc//xyz abc::xyz abc==xyz abc@@xyz abc..xyz abc--xyz abc$$xyz abc##xyz abc%%xyz abc\\xyz abc__xyz search abc--xyz # works TERM(abc--xyz) # doesn't work TERM(abc*) # works | tstats count by PREFIX(abc) # doesn't work for abc--xyz Both TERM and PREFIX work with other minor segmenters like dots or underscores.

PavelP · ‎01-30-2024

that looks great, thank you PickleRick! I modified it to "| foreach val1 val2" to avoid "Failed to parse templatized search for field 'previous_val1'" error. I need some time to adapt it to my real search, I'll get back

PavelP · ‎01-30-2024

something is missing here, there aren't any values in the column "changed"

PavelP · ‎01-30-2024

yes, the _time is not the time of change, I noticed it too. But overall the code reports summarized all changes per id: | table _time id changed The first data point is at 10:20:30, so the reported change at 10:20:56 is correct. I would be very interested in a solution involving "running changes". BTW never heard about the "autoregress" command, thx!

PavelP · ‎01-29-2024

great! thank you

PavelP · ‎01-25-2024

any ideas how can I use foreach to "collect" all changes (using mvappend)? My current attempt works only if I restrict foreach to one specific field (e.g. "a") and even then it shows just one change pro id: | foreach a [ eval changed = if ( previous_<> != <> , mvappend(changed, "<>") , 0) ] | search changed!=0 | stats values(changed) values(id) by _time

PavelP · ‎01-25-2024

Hello, I'm looking of your insights to pinpoint changes in fields over time. Events structured with timestamp, ID, and various fields. Seeking advice on constructing a dynamic timeline to identify altered values and corresponding fields. Example events below: 10:20:30 25/Jan/2024 id=1 a=1534 b=253 c=384 ... 10:20:56 25/Jan/2024 id=1 a=1534 b=253 c=385 ... 10:20:56 25/Jan/2024 id=2 a="something" b=253 c=385 ... 10:21:35 25/Jan/2024 id=2 a="something" b=253 c=385 ... 10:22:56 25/Jan/2024 id=2 a="xyz" b="-" c=385 ... Desired result format: 10:20:56 25/Jan/2024 id=1 changed field "c" 10:22:56 25/Jan/2024 id=2 changed field "a", changed field "b" My pseudo SPL to find changed events: ... | streamstats reset_on_change=true dc(*) AS * by id | foreach * [ ??? ] With hundreds of fields per event, seeking efficient method - considering a combination of streamstats, foreach, transaction or stats. Insights appreciated.

PavelP · ‎09-30-2023

Soon or later the default.xml need to be deleted to allow new menu items from an updated app to appear.

PavelP · ‎09-30-2023

Thank you Giuseppe, just voted for your EID-I-72 idea.. Then I'll stay with modifying menu using UI. The problem is there is no way to delete local/data/ui/nav/default.xml using UI. Or there is a workaround?

PavelP · ‎09-30-2023

I want to allow user to change/switch the nav bar by clicking a button on the setup page. What is the easiest way to create a setup page (html + js) that changes the app's navigation menu bar (nav/default.xml)? from: <nav> <view name="summary"/> <collection label="NEW"> <view name="summary_new"/> </collection> </nav> to: <nav> <view name="summary_new"/> <collection label="OLD"> <view name="summary"/> </collection> </nav> Currently the user must use UI to create a custom navigation setting (by creating local/data/ui/nav/default.xml).

PavelP · ‎07-20-2023

Hello @Berfomet96 double check that your system has both an issuing CA and a mcafee (=trellix) CA: you can download them here: USERTrust RSA Certification Authority https://ssl-tools.net/subjects/cd30d24c343a82ab1f0570158ad7a107762992e9 McAfee OV SSL CA 2: https://ssl-tools.net/subjects/f9e20cf9be7fd75c16fbd6144aca78546e526e06 Google for "add trusted ca certificates linux" to find a step by step instruction depending on your linux distro.

PavelP · ‎06-04-2023

Hello @fmcgheeSplunk truncated logs can by caused by the UDP transport but most common on indexer. Have you installed an add-on also on indexer to apply magic 6 settings for the ingestion? Duplicate proxy log is a common issue for high rate log inputs, when the same url requested by the same user multiple times per second, to confirm it you can add millisecond resolution to the timestamp. Is it cloud or on premise proxy? How you transfer logs from proxy to splunk, using syslog or UF? Have you run through this onboarding checklist: http://proxy-test.com/README.html#onboarding_checklist

PavelP · ‎10-21-2022

if you can define hosts using a wildcard (as in your example hostA to hostZ): | metasearch index=IndexA host=host* | stats values(host) AS host if host* is to broad then you can restrict it with | where host IN or similar

PavelP · ‎06-02-2022

it is a cloud environment, classic experience, so no luck with btool :-(. All what we have is an option to query /servicesNS/-/-/configs/conf-props REST endpoint I have no doubts to solve this problem on CLI if it were on premise setup...

PavelP · ‎06-02-2022

SA-IdentityManagement is a hidden app, there are no way to just "create" KO in it using UI. This app comes with ES (actually a part of ES setup) and should not be modified by user. I can positive confirm there is no other user that could do this intentionally. Any other ideas?

PavelP · ‎06-02-2022

Environment: Splunk ES SH running in cloud (Classic experience). There are two apps for a particular sourcetype (let's call it "sourcetype-x"): TA-customer-props (the old one) zzz-customer_props (the new one) Settings > Sourcetype > sourcetype-x > edit > Advanced > adding some new extractions and evals When I'm trying to dump all props using REST API call, I see that my settings are merged in a SA-IdentityManagement , how come? As far I know, the SA-IdentityManagement should contain lookups only. Is the any way to "de-configure" sourcetype-x from TA-customer-props and SA-IdentityManagement and leave it's configuration in zzz-customer_props only?

PavelP · ‎06-04-2020

Hello @suzyd, sar files are binary and cannot be read by Splunk as such. You need to use sar or sadf command to convert them into text. You can convert sar raw files on the source system or push them on the universal or heavy forwarder via rsync/scp/etc. and process there. I've tried various methods but ended with real time push using scripting input: https://splunkbase.splunk.com/app/1803/#/details You can modify this app for your need as required.

PavelP · ‎06-02-2020

Hello @joshnetwolf what are the last lines in the output of ./splunk start? what does the env variable $INSTANCE_ID contains? After any environment variables are expanded, the server name (if not an IPv6 address) can only contain letters, numbers, underscores, dots, and dashes. The server name must start with a letter, number, or an underscore.

PavelP · ‎05-31-2020

@vrajshekar the second link is not available: The message you are trying to access is not available.

PavelP · ‎05-29-2020

difficult to say without seeing your data, but seems to be not a splunk issue. Have you tried ask on McAfee community forum: ePO: https://community.mcafee.com/t5/ePolicy-Orchestrator/bd-p/epolicy-orchestrator SIEM: https://community.mcafee.com/t5/Security-Information-and-Event/bd-p/siem If you post there, please leave a link here, so everybody can benefit.

Posts	411
Solutions	62
Karma Given	82
Karma Received	56
Member Since	‎12-03-2013

Online Status	Offline
Date Last Visited	‎03-07-2024 04:37 PM

TERM and PREFIX cannot find string with two dashes

Tracking Field Changes in Events

Setup page to change app's navigation

Why is it that on my Splunk Cloud: settings get me...

Order of execution / precedence of multiple TRANSF...

Invalid key in stanza .. in props.conf

Re: TERM and PREFIX cannot find string with two da...

Re: TERM and PREFIX cannot find string with two da...

Re: TERM and PREFIX cannot find string with two da...

Re: TERM and PREFIX cannot find string with two da...

Re: TERM and PREFIX cannot find string with two da...

TERM and PREFIX cannot find string with two dashes

Re: Tracking Field Changes in Events

Re: Tracking Field Changes in Events

Re: Tracking Field Changes in Events

Re: Tracking Field Changes in Events

Re: Tracking Field Changes in Events

Tracking Field Changes in Events

Re: Setup page to change app's navigation

Re: Setup page to change app's navigation

Setup page to change app's navigation

Re: Having trouble with SSL Certificates while try...

Re: App for McAfee/SkyHigh Web Gateway (MWG/SWG/SS...

Re: How to create a search to find the matching ho...

Re: Why is it that on my Splunk Cloud: settings ge...

Re: Splunk Cloud: settings get merged into SA-Iden...

Why is it that on my Splunk Cloud: settings get me...

Re: Can I upload raw SAR text files to Splunk?

Re: Why does Splunk forwarder fail to keep running...

Re: Splunk DB Connect & McAfee ePO integration: Ho...

Re: Splunk DB Connect & McAfee ePO integration: Ho...