About Haleb

Haleb

It works, thanks!

Haleb

Hello there! After following this docs https://docs.splunk.com/Documentation/Splunk/9.2.1/Security/Howtoself-signcertificates, https://docs.splunk.com/Documentation/Splunk/9.2.1/Security/HowtoprepareyoursignedcertificatesforSplunk, https://docs.splunk.com/Documentation/Splunk/9.2.1/Security/SecureSplunkWebusingasignedcertificate for SSL certificate installation I receive an error message when I tried to restart Splunk: Cannot decrypt private key in "/opt/splunk/etc/auth/mycerts/myServerPrivateKey.key" without a password web.conf [settings] enableSplunkWebSSL = true privKeyPath = /opt/splunk/etc/auth/mycerts/myServerPrivateKey.key serverCert = /opt/splunk/etc/auth/mycerts/splunkCert.pem Any solutions for this issue will be appreciated!

Haleb

I need to connect data from a third party application via HEC to Splunk. It sends data in this format 1 event per request: { "field1":"value", "field2":"value" } After looking at the documentation for HEC, I discovered that for events to work correctly, they must have the following format: { "event":{ "field1":"value", "field2":"value" } } Otherwise I receive an error: {"text":"No data","code":5} I don't have the ability to change the event format on the third-party application side. How can this problem be solved?

Haleb

I need to bring events related to creating and changing a user in the application to this CIM (Change->Account Management). To do this, I need the following values to be specified in the action field - acl_modified, cleared, created, deleted, modified, stopped, lockout, read, logoff, updated, started, restarted, unlocked according to this documentation. The problem is that the action field already exists in events with the following values - create, delete and it is used not only to describe actions with users but also for other objects. What method can you recommend to make the field CIM compliant? Event example: { [-] action: delete actor_details: { [+] } actor_uuid: 11111111 location: { [+] } object_details: { [+] } object_type: user #Also can be item, vault, etc object_uuid: 333333333 session: { [+] } timestamp: 33213123 uuid: 4444444 }

Haleb · ‎02-09-2024

I have the following SPL search. index="cloudflare" | top ClientRequestPath by ClientRequestHost | eval percent = round(percent,2) | rename count as "Events", ClientRequestPath as "Path", percent as "%" Wich give me this result. I also need to group it by 10m time range and calculate the difference in percents between 2 previous time ranges for every line. Help me figure out how do that, thx.

Haleb · ‎02-02-2024

I need to calculate the average number of events in the last hour and compare it with the number of events in the last 10 minutes for each host. index="cloudflare" | spath path=ClientRequestHost output=host | stats count as event_count by host | eval avg_count_of_events = round(event_count/6) | map search="search index=cloudflare ClientRequestHost=$host$ earliest=-10min | stats count as last_count_of_events | eval host=$host$ | eval avg_count_of_events=$avg_count_of_events$ | eval event_count=$event_count$ " | eval percent_of_increase = round((last_count_of_events/avg_count_of_events)*100)-100 | table host avg_count_of_events last_count_of_events percent_of_increase Is the more effective way to do that?

Haleb · ‎01-22-2024

Please advise on the optimal solution for this business task. I have a set of events with the following fields: city: Almaty country: KZ latitude: 43.2433 longitude: 76.8646 region: Almaty What would be the best approach to obtain the field indicating the local time of these events using the provided information?

Posts	7
Solutions	0
Karma Given	6
Karma Received	0
Member Since	‎01-22-2024

Online Status	Offline
Date Last Visited	a week ago

Splunk SSL certificate decryption error

HEC event field

How to make action field CIM compliant

Difference between count of events grouped by host...

Count events for two period of time

Best practice to get local time of event

Re: Splunk SSL certificate decryption error