About lloydd518

lloydd518 · ‎10-19-2018

This technique doen't seem very well documented... and it looks like splunk prefer you to perform this within a props.conf file. This answer presents people with an option how to do this from the virtual index UI for hadoop provider. In the UI, select settings----> virtual indexes. Ensure you have a data provider configured, that works... Then within the virtual indexes menu, create a new virtual index. This example is going to use the following folders /data/auditlogs/RHEL_syslog /data/auditlogs/WindowEvents Within the UI, an admin should enter the following HDFS path setting: /data/auditlogs/${sourcetype} The admin could apply a whitelist if only one of the folder is required to be searched .. By applying the ${sourcetype} variable in the UI... this will be written to a props.conf file... Whenever a search is performed across this virtual index, two sourcetypes should appear.

lloydd518 · ‎03-29-2018

Hunk does use the replication factor set in the configurations of hadoop client on the search head, however.... if you haven't set this to match the replication number of your hadoop cluster... your hadoop cluster will grumble about under replicated blocks caused by your Hunk searches because your Hunk searches will probably be requesting an arbritrary number like '10'. A way to override this and resolve the issue or prevent it in the future is... to add the following line to your virtual index provider settings. vix.mapreduce.client.submit.file.replication = 1 (or what ever your hadoop cluster replication number is)

lloydd518 · ‎04-18-2016

Sorry, should have been more specific. This is all work that is being carried out from inside the Splunk UI.. it throws an error/exception.. cannot delete the receiving port...when trying to remove the receiver port 9997. Wondered if it was a bug related to having not created my SSL receiving port in the UI (which you cant do anyway.. not a feature in the Splunk UI). Wondered if it was a bug whereby you create a receiver in the CLI then try to remove it via the Splunk UI.

lloydd518 · ‎04-12-2016

In your $splunk_home/etc/system/local/inputs.conf file... is it an SSL type [splunktcp-ssl:9997] listener ? [SSL] password=********(obfuscated out) rootCA = /some_file_path/cacert.pem serverCert = /some_file_path/server.pem Mine is.. and I'm having a similar issue to you. I'm using Splunk 6.3.2... what version are you using ?

lloydd518 · ‎08-28-2015

The time stamps you are seeing look correct. The event happened at local time 14 Aug 12:44 (-7) which should be 14 Aug 19:44 GMT When you log on to splunk with your user time zone setting ... You are also 5 hours 30 mins ahead of GMT... So your splunk server will show you a time stamp of when the event happened in your local time, so will show you 15 Aug 01:14 It's a matter of viewing logs across time zones.. Which somesoni2 was leading to.

lloydd518 · ‎08-26-2015

I am assuming you are using If you are using a Redhat, CentOS, Fedora distro which can use yum... The Splunk documentation states to use Oracles http://download.oracle.com/otn-pub/java/jdk/8u60-b27/jdk-8u60-linux-x64.rpm. OpenJDK packages may cause unknown issues. See http://docs.splunk.com/Documentation/DBX/1.2.0/DeployDBX/Deploymentrequirements For OpenJDK use yum list installed "java" This will list what java version is installed on your machine use yum search openjdk or yum search java-1.8.0 This will display whether java 8 is available in your repositories. You can also use yum deplist java-1.8.0-openjdk.x86_64 to list all the dependancies of that package... which will probably also need installing but which will / should be installed automatically if you use yum. Or if you download the oracle package. And place the oracle download onto your Linux machine. Then as a priviledged user (sudo or root), use rpm -i /folder_you_placed_the_rpm_on/jdk-8u60-linux-x64.rpm

lloydd518 · ‎08-19-2015

I don't think cron can quite meet your requirement but I have produced a couple of examples where we can try and manipulate cron which may help you solve your problem.. 57 7-23/6 * * * This schedule runs on the 57th minute of the the hour - between 7am and 11pm every 6 hours... So in splunk it fires at 7:57 13:57 19:57 And back to 7:57 the next day... 00 1-23/6 * * * This schedule runs at the start of the hour 00min between 1am and 11pm every 6 hours.... So in splunk it fires at 01:00 07:00 13:00 19:00 And back to 01:00 the next day... 00 5-24/6 * * * This schedule runs at the start of the hour 00min between 5am and 12am every 6 hours.... So in splunk it fires at 05:00 11:00 17:00 23:00 And back to 05:00 the next day... So this may help you but it can end up missing a period as in the first example which only fired 3 times as opposed to the next 2 examples which fired off 4 times... Hope this helps... lloydd518

lloydd518 · ‎08-17-2015

What platform or OS are you running Splunk on? What version of Java JRE are you running? What exact version of DB connect are you running? Please note Splunk DB Connect requirements extracted from https://splunkbase.splunk.com/app/958/ DB Connect 1.2.0 or higher is not compatible with Java 6 or 7. Use Java 8 instead. DB Connect 1.1.7 or lower is not compatible with Java 8. Use Java 6 or 7 instead. *DB Connect 1.1.4 or lower is not Splunk 6.2 compatible. DB Connect 1.1.5 or higher should be used with Splunk 6.2. *

lloydd518 · ‎08-14-2015

A quick and dirty method would be to insert a filter before or after we table the results... some search highlighting individual IP's by field clientIP | eval voipnet=if(cidrmatch("111.111.0.0/16",clientIP),client ip,"") | eval tecnet=if(cidrmatch("222.222.0.0/16",clientIP),client ip,"") | eval secnet=if(cidrmatch("333.333.0.0/16",clientIP),clientIP,"") | search voipnet!="" OR tecnet!="" OR secnet!="" | table clientIP,clientSplunkName,clientNetworkName,voipnet,tecnet,secnet | dedup clientIP The filter ensures that results where all 3 fields are empty, are excluded from the final results.. Hopefully! 🙂

lloydd518 · ‎08-14-2015

This is a bit quick and dirty but... sourcetype=your_sourcetype src_ip=":"

lloydd518 · ‎08-14-2015

Hi there... As per http://docs.splunk.com/Documentation/Splunk/6.2.4/SearchReference/CommonEvalFunctions Cidrmatch returns true or false and works well nested in an "if" statement So in order to add knowledge to your data.. You could try some search highlighting individual IP's by field clientIP | eval voipnet=if(cidrmatch("111.111.0.0/16",clientIP),client ip,"") | eval tecnet=if(cidrmatch("222.222.0.0/16",clientIP),client ip,"") | eval secnet=if(cidrmatch("333.333.0.0/16",clientIP),clientIP,"") | table clientIP,clientSplunkName,clientNetworkName,voipnet,tecnet,secnet | dedup clientIP Each eval works if cidrmatch matches the clientIP again the iprange. It passes true to the if statement. The if statement then makes sure that voipnet = clientIP because the result true was returned. If the cidrmatch returns false... Then voipnet is still created but is empty... You can still search voipnet= "". Your table should pull all results together. It's probably not the prettiest way to do this, there may even be a more efficient way. Hope this helps...

lloydd518 · ‎08-14-2015

Hi As per this question http://answers.splunk.com/answers/90569/event-count-per-user-per-hour.html sourcetype=your_sourcetype earliest=-48h latest=-24h | bucket _time span=1h | stats count by _time | sort - count This will count the events per hour between 48 hours ago to 24 hours ago... (change this as you see fit or remove earliest and latest) If you want to average all of those results, you would add the stats avg(count) at the end of the search: sourcetype=your_sourcetype earliest=-48h latest=-24h | bucket _time span=1h | stats count by _time | stats avg(count) This will average out the number of events per hour... If you have a specific event you are looking for, that would go at the beginning: sourcetype=your_sourcetype earliest=-48h latest=-24h some_thing_that_I'm_trying_to_match | bucket _time span=1h | stats count by _time | sort - count sourcetype=your_sourcetype earliest=-48h latest=-24h some_thing_that_I'm_trying_to_match | bucket _time span=1h | stats count by _time | stats avg(count)

lloydd518 · ‎08-14-2015

Thank you also.. for the cool apps you and your colleagues are churning out. Regards lloydd518

lloydd518 · ‎08-13-2015

Hi there, I may have noticed an error / typo with one of the preloaded feeds in Splunk and in the app documentation and just wanted to check with the author. The feed is configured as guest.EmergineThreats_rules Should it be guest.EmergingThreats_rules as per the hailataxii.com site. Many thanks

lloydd518 · ‎09-05-2012

Have you made your searches write their output to two separate XML files? eval output_file="flash_map1_data.xml" | eval app="amMap" | lookup geoip clientip as src_ip | mapit..... eval output_file="flash_map2_data.xml" | eval app="amMap" | lookup geoip clientip as src_ip | mapit And edit the HTML flash code to read from these two separate files?

lloydd518 · ‎09-05-2012

Hi, I had a play with multicoloured dots today following the above answer and i found a slightly better method by using movie_color=case(somefield=number or "string", "#colour",someotherfield=number or "string","#colour", 1=1,"#colour for everything else") This way you can have as many Boolean cases as you need rather than nested if statements. Regards Lloyd

Posts	16
Solutions	4
Karma Given	3
Karma Received	10
Member Since	‎05-13-2012

Online Status	Offline
Date Last Visited	‎10-27-2022 11:19 AM

SPLICE Preloaded feeds - config error

Re: How to specify source type for virtual indexes...

Re: What block replication factor does Hunk use in...

Re: When I try to add or delete port 9997, why do ...

Re: When I try to add or delete port 9997, why do ...

Re: Why is the indexed time not matching the time ...

Re: Splunk DB Connect 1: Why am I getting "The Jav...

Re: How do I schedule a cron job to run every 6 ho...

Re: Splunk DB Connect 1: Why am I getting "The Jav...

Re: How to create a field based on cidrmatch in Sp...

Re: How do i search for IPv6 addresses from my src...

Re: How to create a field based on cidrmatch in Sp...

Re: How to search the count and average count of e...

Re: SPLICE Preloaded feeds - config error

SPLICE Preloaded feeds - config error

Re: AmMap realtime view is not showing the locatio...

Re: How do I use the Splunk for amMap app posted o...