Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About marcos_eng1
marcos_eng1
Explorer
Member since:
11-04-2019
03-04-2024
Community Statistics
| Posts | 24 |
| Solutions | 0 |
| Karma Given | 3 |
| Karma Received | 0 |
| Member Since | 11-04-2019 |
Activity Feed
- Posted How Can IBM Qradar SIEM Integrates with Splunk SOAR? on Splunk Search. 05-04-2022 03:10 PM
- Tagged How Can IBM Qradar SIEM Integrates with Splunk SOAR? on Splunk Search. 05-04-2022 03:10 PM
- Posted Re: How to sort on single value in trellis? on Dashboards & Visualizations. 04-16-2021 07:44 AM
- Posted Re: Monitor csv files directory Tail Reader Problem on Getting Data In. 10-29-2020 09:46 AM
- Karma Re: Monitor csv files directory Tail Reader Problem for alonsocaio. 10-29-2020 09:46 AM
- Posted Re: Monitor csv files directory Tail Reader Problem on Getting Data In. 10-29-2020 08:07 AM
- Posted Re: Monitor csv files directory Tail Reader Problem on Getting Data In. 10-29-2020 08:05 AM
- Posted Monitor csv files directory Tail Reader Problem on Getting Data In. 10-27-2020 11:56 AM
- Posted Re: How to capture the date on line 3 of a csv file, while the header fields begin on line 5 on Splunk Search. 09-04-2020 08:43 AM
- Posted Re: How to capture the date on line 3 of a csv file, while the header fields begin on line 5 on Splunk Search. 09-04-2020 08:39 AM
- Posted How to capture the date on line 3 of a csv file, while the header fields begin on line 5 on Splunk Search. 09-03-2020 01:46 PM
- Tagged How to capture the date on line 3 of a csv file, while the header fields begin on line 5 on Splunk Search. 09-03-2020 01:46 PM
- Posted Re: Can Universal Forwarder listen to an udp port and forward to Indexer? on Deployment Architecture. 09-01-2020 08:30 AM
- Posted Re: Can Universal Forwarder listen to an udp port and forward to Indexer? on Deployment Architecture. 09-01-2020 08:27 AM
- Karma Re: Can Universal Forwarder listen to an udp port and forward to Indexer? for isoutamo. 09-01-2020 08:24 AM
- Posted Re: Can Universal Forwarder listen to an UDP port and forward to the indexer? on Deployment Architecture. 09-01-2020 08:07 AM
- Posted Re: Can Universal Forwarder listen to an udp port and forward to Indexer? on Deployment Architecture. 08-30-2020 09:23 PM
- Posted Re: Can Universal Forwarder listen to an udp port and forward to Indexer? on Deployment Architecture. 08-25-2020 05:29 PM
- Posted Re: Can Universal Forwarder listen to an udp port and forward to Indexer? on Deployment Architecture. 08-25-2020 11:39 AM
- Posted Re: Can Universal Forwarder listen to an udp port and forward to Indexer? on Deployment Architecture. 08-25-2020 11:35 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
05-04-2022
03:10 PM
Hello Splunkers, I have client that already has a IBM Qradar SIEM and wants to Integrates with Splunk SOAR (formely name as Splunk phantom). Can you guys tell me if is it possible and how to implement it? Regards, Marcos Pereira
... View more
- Tags:
- SOAR
Labels
- Labels:
-
other
04-16-2021
07:44 AM
Can you please give a more detailed example, I am trying to use it with no sucess.
... View more
10-29-2020
09:46 AM
I worked.....Thanks @alonsocaio
... View more
10-29-2020
08:07 AM
@alonsocaio Also the csv files are not bigger than 17KB
... View more
10-29-2020
08:05 AM
Hello @alonsocaio, I am using the inputs.conf in a standalone server. Please, see my internal logs related the tailreader fail: 10-27-2020 16:02:40.320 -0300 ERROR TailReader - File will not be read, seekptr checksum did not match (file=/opt/POC_Chiller/POC_CH1_CAP_TOTAL_B.csv). Last time we saw this initcrc, filename was different. You may wish to use larger initCrcLen for this sourcetype, or a CRC salt on this source. Consult the documentation or file a support case online at http://www.splunk.com/page/submit_issue for more info. 10-27-2020 15:03:14.788 -0300 INFO WatchedFile - File too small to check seekcrc, probably truncated. Will re-read entire file='/opt/POC_Chiller/POC_CH1_CAP_TOTAL_B.csv'.
... View more
10-27-2020
11:56 AM
I am monitoring a directory with 101 csv file with the same format but I am having only 49 of them indexed. When I start up the splunk I get warn message from TailReader - Could not send data to output queue (parsingqueue), retrying.... Sample of csv files: Timestamp,Value (%) 21-Sep-20 6:38:00 AM BRT,0.0 21-Sep-20 6:39:00 AM BRT,0.0 21-Sep-20 6:40:00 AM BRT,0.0 21-Sep-20 6:41:00 AM BRT,0.0 21-Sep-20 6:42:00 AM BRT,0.0 21-Sep-20 6:43:00 AM BRT,0.0 21-Sep-20 6:44:00 AM BRT,0.0 21-Sep-20 6:45:00 AM BRT,0.0 21-Sep-20 6:46:00 AM BRT,0.0 21-Sep-20 6:47:01 AM BRT,0.0 Timestamp,Value (%) 21-Sep-20 6:38:00 AM BRT,0.0 21-Sep-20 6:39:00 AM BRT,0.0 21-Sep-20 6:40:00 AM BRT,0.0 21-Sep-20 6:41:00 AM BRT,0.0 21-Sep-20 6:42:00 AM BRT,0.0 21-Sep-20 6:43:00 AM BRT,0.0 21-Sep-20 6:44:00 AM BRT,0.0 21-Sep-20 6:45:00 AM BRT,0.0 21-Sep-20 6:46:00 AM BRT,0.0 21-Sep-20 6:47:01 AM BRT,0.0 [porto_file_csv] BREAK_ONLY_BEFORE_DATE = DATETIME_CONFIG = HEADER_FIELD_LINE_NUMBER = 13 INDEXED_EXTRACTIONS = csv KV_MODE = none LINE_BREAKER = ([\r\n]+) NO_BINARY_CHECK = true SHOULD_LINEMERGE = false category = Structured description = Comma-separated value format. Set header and other settings in "Delimited Settings" disabled = false pulldown_type = true EXTRACT-Chiller,Variavel = /opt/POC_Chiller/POC_(?P<Chiller>CH\d)_(?P<Variavel>\w+) in source REPORT-poc_porto = REPORT-poc_porto [monitor:///opt/POC_Chiller] disabled = false host = test4 index = test_porto sourcetype = porto_file_csv Note: I also have tried to monitor the files with default csv sourcetype and again it didn't work. Any help, would very appreciated! Marcos Pereira
... View more
Labels
- Labels:
-
inputs.conf
09-04-2020
08:43 AM
Header is fixed.
... View more
09-04-2020
08:39 AM
Thanks....I am not really good with SEDCMD. I would really appreciate if you could provide the step by step procedure. Thanks in Advance
... View more
09-03-2020
01:46 PM
Dear Community, I Have a csv file with no timestamp with the data, I only have a timestamp on the beggining of the file (Line 3). So, How do I capture the date on line 3 of a csv file, while the header fields begin on line 5 and following data begins on line 6? See the data as follow: CHILLER_01 slot:/Drivers/NiagaraNetwork/TA_WEB2_CAG/points/ARQUITETURA/POC$2dCHILLERS/CHILLER_01 02-Jun-20 2:55 PM BRT ?NOME DO PONTO,VALOR "ALARME,""0.00""" "CAP_TOTAL,""0.00""" "CAP_TOTAL_A,""0.00""" "CAP_TOTAL_B,""0.00"""
... View more
- Tags:
- inputs.conf
Labels
- Labels:
-
field extraction
09-01-2020
08:30 AM
Hello Soutamo, after many unsucessful tries I changed the udp port to a higher port and fortunatelly is working now.
... View more
09-01-2020
08:27 AM
[root@uf01 ~]# ps -fe | egrep splunk root 31641 1 14 11:11 ? 00:02:08 splunkd -p 8089 restart root 31643 31641 0 11:11 ? 00:00:00 [splunkd pid=31641] splunkd -p 8089 restart [process-runner] root 31872 31269 0 11:26 pts/0 00:00:00 grep -E --color=auto splunk
... View more
09-01-2020
08:07 AM
On Premisses
... View more
08-30-2020
09:23 PM
Hello Soutamo, I was not able to make it work yet, if you could spare 5 min for a webex call, I would really apreciate. I am running splunk as root, as follow: [root@uf01 ~]# ps -fe | egrep splunk root 21115 1 0 Aug30 ? 00:00:15 splunkd -p 8089 start root 21117 21115 0 Aug30 ? 00:00:00 [splunkd pid=21115] splunkd -p 8089 start [process-runner] root 21543 21523 0 00:17 pts/0 00:00:00 grep -E --color=auto splunk [root@uf01 ~]# Once I am receiving events from a firewall, do I need to install any add-on on universar forwarder or config the props.conf on HF? I look forward to hearing from you soon. Marcos
... View more
08-25-2020
05:29 PM
Thanks, I am not familiar with shell commands and I was not able to run the tests. Could you guide me to test it with Cent OS? [root@uf01 ~]# echo "foo bar" | nc -u 127.0.0.1 514 -bash: nc: command not found [root@uf01 ~]# echo "foo bar" | nc -u 172.25.21.17 514 -bash: nc: command not found [root@uf01 ~]# $echo "foo bar" | nc -u 127.0.0.1 514 -bash: nc: command not found -bash: foo bar: command not found [root@uf01 ~]# echo "foo bar" | nc -u 127.0.0.1 1514 -bash: nc: command not found
... View more
08-25-2020
11:39 AM
Yes. I have looked for anything arriving in my test index and nothing has showed up.
... View more
08-25-2020
11:35 AM
Also Selinux is not configured
... View more
08-25-2020
11:33 AM
Firewall is disabled in both servers UF, HF and IDX, also all servers are in the same LAN [root@uf01 bin]# systemctl status firewalld ● firewalld.service Loaded: masked (/dev/null; bad) Active: inactive (dead) Aug 17 10:24:50 localhost.localdomain systemd[1]: Starting firewalld - dynamic firewall daemon... Aug 17 10:24:53 localhost.localdomain systemd[1]: Started firewalld - dynamic firewall daemon. Aug 17 10:33:49 localhost.localdomain systemd[1]: Stopping firewalld - dynamic firewall daemon... Aug 17 10:33:50 localhost.localdomain systemd[1]: Stopped firewalld - dynamic firewall daemon.
... View more
08-25-2020
11:23 AM
[root@uf01 ~]# cd /opt/splunkforwarder/bin/ [root@uf01 bin]# ./splunk btool inputs list udp --debug /opt/splunkforwarder/etc/system/default/inputs.conf [udp] /opt/splunkforwarder/etc/system/default/inputs.conf _rcvbuf = 1572864 /opt/splunkforwarder/etc/system/default/inputs.conf connection_host = ip /opt/splunkforwarder/etc/system/local/inputs.conf host = uf01 /opt/splunkforwarder/etc/system/default/inputs.conf index = default /opt/splunkforwarder/etc/apps/_server_app_teste_firewall/local/inputs.conf [udp://514] /opt/splunkforwarder/etc/system/default/inputs.conf _rcvbuf = 1572864 /opt/splunkforwarder/etc/apps/_server_app_teste_firewall/local/inputs.conf connection_host = ip /opt/splunkforwarder/etc/apps/_server_app_teste_firewall/local/inputs.conf disabled = false /opt/splunkforwarder/etc/system/local/inputs.conf host = uf01 /opt/splunkforwarder/etc/apps/_server_app_teste_firewall/local/inputs.conf index = test /opt/splunkforwarder/etc/apps/_server_app_teste_firewall/local/inputs.conf sourcetype = syslog
... View more
08-25-2020
09:44 AM
I already checked with tcpdump command and there is traffic. tcpdump -i any udp port 514
... View more
08-25-2020
09:31 AM
Thanks for advising. My UF, HF and IDX are in the same LAN and my Linux Firewall are disabled.
... View more
08-25-2020
09:30 AM
I have changed the stanza to [udp://:514] and still did not work.
... View more
08-25-2020
07:20 AM
Sure, here it is the Universal Forwarder inputs.conf: [udp://514] connection_host = ip index = test sourcetype = syslog disabled = false
... View more
08-25-2020
06:31 AM
Thanks for the reply. I still was not able make it work. Can anyone help with the step by step configuration? Note: I know how to config in full Splunk Enterprise Installation but to collect it with Universal Forwarder, it is my first time.
... View more
08-24-2020
04:38 PM
Hello Splunkers,
I have my firewall sending its logs to a CentOS server where I have the Splunk Universal forwarder configured to listen to UDP 514 and forward it to the indexer. Although I have reviewed the configuration I wasn't able to find the reason it is not working.
Note: I have tested the inputs and output.conf and It is working for the files I'm monitoring.
What am I missing here?
Any help would very much be appreciated!
... View more
Labels
- Labels:
-
indexer
-
other
-
universal forwarder
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
03-04-2024
05:57 PM
|
