About christophe_clem

christophe_clem · ‎02-18-2016

Nope, nothing else seems to be listening (or try to) on port TCP/9998.

christophe_clem · ‎12-31-2015

Problem solved ! | eval lastmc=MESSAGE_CLASS | streamstats current=f count last(MESSAGE_CLASS) as lastmc by Calling_Station_ID | eval consecutive=if(lastmc=MESSAGE_CLASS,1,0) | search consecutive=0 | stats first(MESSAGE_CLASS) AS prevmc first(count) AS count by Calling_Station_ID | search prevmc="Passed-Authentication" First eval is only here for the second eval, in other words: the first event is consecutive to himself. I compute a "consecutive" field as you've done, and then I only keep lines where consecutive=0 . After that, I use a stats to select the first (newest) line and get the count of previous events. Finally, I keep lines where prevmc="Passed-Authentication" , meaning previous events were "Failed-Attempt". Thank you guys for your help 🙂

christophe_clem · ‎12-30-2015

I can't use a transaction because events can be separated by a long time. Here is an example of data : _time MESSAGE_CLASS Calling_Station_ID 2015-12-30 16:38:44.948 Failed-Attempt 00-11-22-33-44-55 2015-12-30 16:38:44.920 Failed-Attempt 00-11-22-33-44-55 2015-12-30 16:18:49.794 Passed-Authentication 00-11-22-33-44-55 2015-12-30 16:18:44.715 Failed-Attempt 00-11-22-33-44-55 2015-12-30 16:18:44.686 Failed-Attempt 00-11-22-33-44-55 2015-12-30 15:58:49.494 Failed-Attempt 66-77-88-99-AA-BB 2015-12-30 15:58:44.458 Passed-Authentication 66-77-88-99-AA-BB 2015-12-30 15:58:44.430 Failed-Attempt 66-77-88-99-AA-BB And what I want in output : Calling_Station_ID Last Failures 00-11-22-33-44-55 2 66-77-88-99-AA-BB 1

christophe_clem · ‎12-30-2015

Hello, I want to count consecutive events that have common values of multiple fields. I can do partially the stuff with dedup X Y consecutive=true but it does not count removed events. I can do the other part with stats count by X Y but it does not take in account the "consecutive" part. In practice, my data is radius authentication logs, X is the authentication result and Y is the user. I need to count for each user the number of failed authentications without success authentication after. I thought I could do this with a subsearch which give the _time of the latest success authentication for each user and then count the failed authentications that follow. But I can't find how to make a subsearch that produce a query like ( ( user="bob" AND _time>xxx ) OR ( user="alice" AND _time>yyy) )

christophe_clem · ‎10-21-2015

This is right after I configure it, even the setup page is not working after configuration ! The file inputs.conf contains this: [rpcstart://default] javahome = /usr/java/latest/ options = -Xmx1024m -XX:+UseConcMarkSweepGC useSSL = 0 proc_pid = 3839 Exception = 0 dbx2.log: 10/21/2015 17:03:51 [ERROR] [__init__.py] Socket error communicating with splunkd (error=('The read operation timed out',)), path = /servicesNS/admin/splunk_app_db_connect/db_connect/rpcserver 10/21/2015 17:03:51 [ERROR] [__init__.py] Splunkd daemon is not responding: ("Error connecting to /servicesNS/admin/splunk_app_db_connect/db_connect/rpcserver: ('The read operation timed out',)",) Traceback (most recent call last): File "/local/opt/splunk/lib/python2.7/site-packages/splunk/rest/__init__.py", line 185, in dispatch methodOutput = method() File "/local/opt/splunk/etc/apps/splunk_app_db_connect/bin/dbinfo.py", line 31, in handle_GET self.dbx2 = service.build_service(self.get_rpc_channel()) File "/local/opt/splunk/etc/apps/splunk_app_db_connect/bin/dbinfo.py", line 19, in get_rpc_channel rpc = utils.get_local_rpc(self.userName, self.sessionKey) File "/local/opt/splunk/etc/apps/splunk_app_db_connect/bin/dbx2/utils.py", line 170, in get_local_rpc ent = en.getEntities(["db_connect", "rpcserver"], namespace=namespace, owner=user, sessionKey=sessionKey) File "/local/opt/splunk/lib/python2.7/site-packages/splunk/entity.py", line 129, in getEntities atomFeed = _getEntitiesAtomFeed(entityPath, namespace, owner, search, count, offset, sort_key, sort_dir, sessionKey, uri, hostPath, **kwargs) File "/local/opt/splunk/lib/python2.7/site-packages/splunk/entity.py", line 222, in _getEntitiesAtomFeed serverResponse, serverContent = rest.simpleRequest(uri, getargs=kwargs, sessionKey=sessionKey, raiseAllErrors=True) File "/local/opt/splunk/lib/python2.7/site-packages/splunk/rest/__init__.py", line 479, in simpleRequest raise splunk.SplunkdConnectionException, 'Error connecting to %s: %s' % (path, str(e)) SplunkdConnectionException: Splunkd daemon is not responding: ("Error connecting to /servicesNS/admin/splunk_app_db_connect/db_connect/rpcserver: ('The read operation timed out',)",) 10/21/2015 17:03:51 [ERROR] [__init__.py] Socket error communicating with splunkd (error=('The read operation timed out',)), path = /servicesNS/admin/splunk_app_db_connect/db_connect/rpcserver 10/21/2015 17:03:51 [ERROR] [__init__.py] Splunkd daemon is not responding: ("Error connecting to /servicesNS/admin/splunk_app_db_connect/db_connect/rpcserver: ('The read operation timed out',)",) Traceback (most recent call last): File "/local/opt/splunk/lib/python2.7/site-packages/splunk/rest/__init__.py", line 185, in dispatch methodOutput = method() File "/local/opt/splunk/etc/apps/splunk_app_db_connect/bin/dbinfo.py", line 31, in handle_GET self.dbx2 = service.build_service(self.get_rpc_channel()) File "/local/opt/splunk/etc/apps/splunk_app_db_connect/bin/dbinfo.py", line 19, in get_rpc_channel rpc = utils.get_local_rpc(self.userName, self.sessionKey) File "/local/opt/splunk/etc/apps/splunk_app_db_connect/bin/dbx2/utils.py", line 170, in get_local_rpc ent = en.getEntities(["db_connect", "rpcserver"], namespace=namespace, owner=user, sessionKey=sessionKey) File "/local/opt/splunk/lib/python2.7/site-packages/splunk/entity.py", line 129, in getEntities atomFeed = _getEntitiesAtomFeed(entityPath, namespace, owner, search, count, offset, sort_key, sort_dir, sessionKey, uri, hostPath, **kwargs) File "/local/opt/splunk/lib/python2.7/site-packages/splunk/entity.py", line 222, in _getEntitiesAtomFeed serverResponse, serverContent = rest.simpleRequest(uri, getargs=kwargs, sessionKey=sessionKey, raiseAllErrors=True) File "/local/opt/splunk/lib/python2.7/site-packages/splunk/rest/__init__.py", line 479, in simpleRequest raise splunk.SplunkdConnectionException, 'Error connecting to %s: %s' % (path, str(e)) SplunkdConnectionException: Splunkd daemon is not responding: ("Error connecting to /servicesNS/admin/splunk_app_db_connect/db_connect/rpcserver: ('The read operation timed out',)",) 10/21/2015 17:03:52 [ERROR] [__init__.py] Socket error communicating with splunkd (error=('The read operation timed out',)), path = /servicesNS/nobody/splunk_app_db_connect/db_connect/rpcserver rpc.log: 2015-10-21 17:03:37 DEBUG ServiceResponder:396 - Request name: getServerStatus. 2015-10-21 17:03:37 DEBUG ServiceResponder:405 - Request parameter(0): class [Ljava.lang.String; = [[HOSTNAME, HOME, SPLUNK_WEB_NAME, SPLUNK_HOME, SPLUNK_SERVER_NAME, TERM_SESSION_ID]]. 2015-10-21 17:03:47 DEBUG ServiceResponder:396 - Request name: getServerStatus. 2015-10-21 17:03:47 DEBUG ServiceResponder:405 - Request parameter(0): class [Ljava.lang.String; = [[SPLUNK_HOME]]. 2015-10-21 17:03:57 DEBUG ServiceResponder:396 - Request name: getServerStatus. 2015-10-21 17:03:57 DEBUG ServiceResponder:405 - Request parameter(0): class [Ljava.lang.String; = [[HOSTNAME, HOME, SPLUNK_WEB_NAME, SPLUNK_HOME, SPLUNK_SERVER_NAME, TERM_SESSION_ID]]. 2015-10-21 17:04:03 DEBUG ServiceResponder:396 - Request name: getServerStatus. 2015-10-21 17:04:03 DEBUG ServiceResponder:405 - Request parameter(0): class [Ljava.lang.String; = [[SPLUNK_HOME]].

christophe_clem · ‎10-20-2015

Hello, I have an issue with Splunk DB Connect 2 on Splunk 6.3.0, running on Red Hat Enterprise Linux 6.6 x64 : the RPC service seems to be running but is very (very very) slow and almost each request ends up with a timeout. In the Settings page, I got this message after some seconds: Splunkd daemon is not responding: ("Error connecting to /servicesNS/nobody/splunk_app_db_connect/db_connect/rpcserver/default?output_mode=json: ('The read operation timed out',)",) In the logs, there is the same message, but no other error. I tried Oracle JRE and openJDK, but the result is the same. I tried Oracle JRE 8u60 and 8u31. I would like to try JRE i586 but the installation of the RPM fails. The server has 8 CPU cores and 4 GB of memory. Kind regards, Christophe

christophe_clem · ‎03-15-2013

Hi, I encountered the same problem, I didn't have the previous version of the App and my SmartCenter is fresh installed. I lost many hours to debug Splunk and I finally try something on the SmartCenter. I edited the file $FWDIR/conf/fwopsec.conf and added these 2 lines: lea_server auth_port 18184 lea_server auth_type sslca Run cpstop and cpstart and now everything works fine, logs are in Splunk 🙂 The documentation said "Confirm that the fwopsec.conf file has no entries related to lea_server." but it does not work if all lines are commented. Hope this could help you, Christophe

Posts	7
Solutions	1
Karma Given	0
Karma Received	4
Member Since	‎05-30-2012

Online Status	Offline
Date Last Visited	‎10-14-2020 10:58 AM

Dedup consecutive values and count removed

Splunk DB Connect 2 RPC Service not responding

Re: Splunk DB Connect 2 RPC Service not responding

Re: Dedup consecutive values and count removed

Re: Dedup consecutive values and count removed

Dedup consecutive values and count removed

Re: Splunk DB Connect 2 RPC Service not responding

Splunk DB Connect 2 RPC Service not responding

Re: OPSEC LEA with CheckPoint: SIC ERROR 119 - SIC...