Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About shaileshmali
shaileshmali
Path Finder
Member since:
12-07-2012
07-25-2020
Community Statistics
| Posts | 17 |
| Solutions | 1 |
| Karma Given | 0 |
| Karma Received | 3 |
| Member Since | 12-07-2012 |
Activity Feed
- Got Karma for Re: Why is outer join not working to find how many IPs in a lookup file are not found in the metrics.log?. 06-05-2020 12:47 AM
- Got Karma for Re: how to pull the logs from Cisco Cloud Web Security storage architecture. 06-05-2020 12:47 AM
- Got Karma for Re: Splunk Web Third party certificate is not working. 06-05-2020 12:47 AM
- Posted Re: Help with Custom Search Please on Alerting. 03-22-2019 08:35 AM
- Posted How come strptime does not work for some days? on Splunk Search. 03-22-2019 08:13 AM
- Tagged How come strptime does not work for some days? on Splunk Search. 03-22-2019 08:13 AM
- Posted Why am I not able to save search in dashboard because of $ sign in search? on Dashboards & Visualizations. 05-26-2017 12:34 PM
- Tagged Why am I not able to save search in dashboard because of $ sign in search? on Dashboards & Visualizations. 05-26-2017 12:34 PM
- Tagged Why am I not able to save search in dashboard because of $ sign in search? on Dashboards & Visualizations. 05-26-2017 12:34 PM
- Posted How to edit my search to find percentage deviation between two values for each platform? on Splunk Search. 12-20-2016 08:19 AM
- Tagged How to edit my search to find percentage deviation between two values for each platform? on Splunk Search. 12-20-2016 08:19 AM
- Tagged How to edit my search to find percentage deviation between two values for each platform? on Splunk Search. 12-20-2016 08:19 AM
- Tagged How to edit my search to find percentage deviation between two values for each platform? on Splunk Search. 12-20-2016 08:19 AM
- Tagged How to edit my search to find percentage deviation between two values for each platform? on Splunk Search. 12-20-2016 08:19 AM
- Posted Re: How to execute external script to manipulate file from search command on Splunk Search. 06-23-2016 02:34 PM
- Posted Deployment client phone home on Deployment Architecture. 03-23-2016 03:01 PM
- Tagged Deployment client phone home on Deployment Architecture. 03-23-2016 03:01 PM
- Posted Re: Splunk Web Third party certificate is not working on Security. 09-28-2015 03:55 PM
- Posted Splunk Web Third party certificate is not working on Security. 09-28-2015 02:15 PM
- Tagged Splunk Web Third party certificate is not working on Security. 09-28-2015 02:15 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
03-22-2019
08:35 AM
try
sourcetype=alert_metadata | fields incident_id ( select fields in main search incident_id date/time, Alert Manager (AM) incident_id, alert name, Splunk/AM user, AM action, AM comment)
| join incident_id
[search sourcetype=incident_change | table incident_id ( select additional fields in subsearch ) ]
| table _time incident_id alert user action comment
... View more
03-22-2019
08:13 AM
There seems to be some issue with the strptime function. I'm not sure why it works for few days and does not work for few days.
works
index=_internal
| eval Disconnect_Time="02/05/2019 08:22:40"
| eval last_updated_date_epoch=strptime(Disconnect_Time,"%d/%m/%Y %H:%M:%S")
| eval now=now()
| eval diff=last_updated_date_epoch-now()
| eval duration=diff/3600/24
| table Disconnect_Time,last_updated_date_epoch,now,diff,duration
Does not work
index=_internal
| eval Disconnect_Time="02/13/2019 08:22:40"
| eval last_updated_date_epoch=strptime(Disconnect_Time,"%d/%m/%Y %H:%M:%S")
| eval now=now()
| eval diff=last_updated_date_epoch-now()
| eval duration=diff/3600/24
| table Disconnect_Time,last_updated_date_epoch,now,diff,duration
... View more
05-26-2017
12:34 PM
Not able to save search in dashboard because of $ sign in search query.
match(RelativeURI,"/identity/enhanced-authentication/tasks/~/search") AND match (HttpMethod,"POST"), "TASK1",
match(RelativeURI,"/identity/enhanced-authentication/tasks$") AND match (HttpMethod,"POST"), "TASK2",
match(RelativeURI,"/identity/enhanced-authentication/tasks/*") AND match (HttpMethod,"POST"), "TASK3",
match(RelativeURI,"/identity/enhanced-authentication/tasks$") AND match (HttpMethod,"GET"), "TASK4",
match(RelativeURI,"/identity/enhanced-authentication/tasks/*") AND match (HttpMethod,"GET"), "TASK5")
... View more
12-20-2016
08:19 AM
How do I find % deviation between 2 values for each platform? I am able to get deviation, but when i want deviation only for each platform, I do not want values for one platform compared with another platform. Is this possible in Splunk?
Current search:
index="test" OR index="test" Api=* (EventStreamData.eventName="5000027")
| bucket _time span=15m
| rename EventStreamData.response.userStatusCode{} as userStatusCode1 | rename EventStreamData.args.customerLoginRequest.signInPlatform as signInPlatform1
| eval PLATFORM=if((Api_Key="SICAPP" AND signInPlatform="Card"),"COS",if((Api_Key="SICAPP" AND signInPlatform="ENTERPRISE"),"EASE Web", if((Api_Key="SICAPP" AND signInPlatform="OLBank"), "OLBR",))
| eval SuccessVolume=if(DISPOSITION="SUCCESS",1,0)
| eval PolicyVolume=if(DISPOSITION="POLICY",1,0)
| eval DefectVolume=if(DISPOSITION="DEFECT",1,0)
| stats sum(SuccessVolume) as Success avg(SuccessVolume) as avg by _time,PLATFORM | sort PLATFORM
| fillnull
| delta avg as change
| fillnull
| eval change_percent=round(change/avg*100,0)
... View more
06-23-2016
02:34 PM
I have splunk script below which takes input can you help how to use splunk intersplunk for this script to take input and provide output
def base36encode(number):
if not isinstance(number, (int, long)):
raise TypeError('number must be an integer')
if number < 0:
raise ValueError('number must be positive')
alphabet, base36 = ['0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ', '']
while number:
number, i = divmod(number, 36)
base36 = alphabet[i] + base36
return base36 or alphabet[0]
def base36decode(number):
return int(number, 36)
print(base36encode(1412823931503067241))
print(base36decode('AQF8AA0006EH'))
... View more
03-23-2016
03:01 PM
Hi
I want to change deployment client setting to make sure phone home interval changes to 300s. Will these settings bellow work .
How will i validate this is working.
[root@server0002 local]# more deploymentclient.conf
[target-broker:deploymentServer]
targetUri = SDWUtil.xyz.com:8089
[deployment-client]
phoneHomeIntervalInSecs=300
... View more
- Tags:
- deployment
09-28-2015
03:55 PM
1 Karma
1) I copied p7b file sent by Symantec to windows machine and followed process given in link below to extract file SDWSearch.cer in pem format.
http://support.citrix.com/article/CTX124783
2) Then instead on concatenating files as directed by splunk , i used file extracted from step above as cacert file
privKeyPath = etc/auth/certs/SDWSearch.key
caCertPath = etc/auth/certs/SDWSearch.cer
This solution worked for me. It seems cer file extracted from p7b has all details in it and not need of concatenate files to create pem.
... View more
09-28-2015
02:15 PM
1) I created private key SDWSearch.key
2) Removed password is removed from key
3) Generated SDWSearch csr
4) Uploaded on Symantec portal for certificate
5) Received server certificate .p7b format and root certificate in pem format
6) Extract server certificate file from .p7b using
openssl pkcs7 -print_certs -in certificate.p7b -out SDWSearch.cer
7) Concatenated all files into SDWSearch.pem
SDWSearch.cer SDWSearch.Key CA.pem > SDWSearch.pem
😎 Tested certificate using SDWSearch.pem and SDWSearch.Key
openssl x509 -in SDWSearch.key -text
openssl x509 -in SDWSearch.pem -text
9) Configured splunk web.conf, restarted splunk service
10) Tried to access splunk server from Firefox.
Error from browser:
Secure Connection Failed
The connection to server1.abc.com was interrupted while the page was loading.
The page you are trying to view cannot be shown because the authenticity of the received data could not be verified.
Please contact the website owners to inform them of this problem.
11) No clue from webservice.log file. Seems splunk is listening on 443, not sure why I am not able to connect.
2015-09-28 20:31:02,143 INFO [5609a384ce25ef510] root:597 - CONFIG: x_frame_options_sameorigin (bool): True
2015-09-28 20:31:02,144 INFO [5609a384ce25ef510] root:632 - DJANGO: configuring...
2015-09-28 20:31:02,262 INFO [5609a384ce25ef510] root:674 - DJANGO: not starting, found no apps
2015-09-28 20:31:02,263 INFO [5609a384ce25ef510] root:138 - ENGINE: Bus STARTING
2015-09-28 20:31:02,275 INFO [5609a384ce25ef510] root:138 - ENGINE: Started monitor thread '_TimeoutMonitor'.
2015-09-28 20:31:02,483 INFO [5609a384ce25ef510] root:138 - ENGINE: Serving on 0.0.0.0:443
2015-09-28 20:31:02,483 INFO [5609a384ce25ef510] root:138 - ENGINE: Bus STARTED
... View more
08-21-2015
10:44 AM
This solution worked for me -
Download these libraries in /lib dir
libpamc.so.0.82.1
libpam_misc.so.0.82.0
libpam.so.0.82.2
libaudit.so.1.0.0
Create Symbolic lync
ln -s libpamc.so.0.82.1 libpamc.so.0
ln -s libpam_misc.so.0.82.0 libpam_misc.so.0
ln -s libpam.so.0.82.2 libpam.so.0
ln -s libaudit.so.1.0.0 libaudit.so.1
check ls -al in /lib dir
lrwxrwxrwx 1 root root 17 Aug 21 16:15 libpamc.so.0 -> libpamc.so.0.82.1
-rwxr-xr-x 1 root root 13764 Aug 21 16:11 libpamc.so.0.82.1
lrwxrwxrwx 1 root root 21 Aug 21 16:18 libpam_misc.so.0 -> libpam_misc.so.0.82.0
-rwxr-xr-x 1 root root 9704 Aug 21 16:11 libpam_misc.so.0.82.0
lrwxrwxrwx 1 root root 16 Aug 21 16:18 libpam.so.0 -> libpam.so.0.82.2
-rwxr-xr-x 1 root root 50816 Aug 21 16:12 libpam.so.0.82.2
lrwxrwxrwx 1 root root 17 Aug 21 16:29 libaudit.so.1 -> libaudit.so.1.0.0
-rwxr-xr-x 1 root root 112224 Aug 21 16:27 libaudit.so.1.0.0
... View more
07-06-2015
11:49 AM
Has anybody been able to make this app work. my authentication works , i get kb downloaded , but vulnerability data download does not work.
Even though api access was enabled vulnerability data download was not working , Qualys support did fix this issue , API error has stopped but still vulnerability download is not working. i am still following up with Qualys to check if still they need to make any config changes on their side.
... View more
05-29-2015
12:27 PM
I am not able to configure heavy forwarder inputs.conf file to receive encrypted traffic.
1) config inputs.conf on heavy forwarder is given below. but netstat -an does not show heavy forwarder is listening on port 9998
[splunktcp-ssl:9998]
compressed = true
[SSL]
password = $1$YJqLPm4skNlFOQ==
rootCA = /opt/splunk/etc/certs/ca.pem
serverCert = /opt/splunk/etc/certs/splunk-dev.pem
2) On universal forwarder I am using app with outputs.conf
[tcpout]
defaultGroup = splunkssl
sendCookedData = true
dnsResolutionInterval = 300
[tcpout:splunkssl]
compressed = true
server = heavy forwarder name :9998
sslCertPath = C:\Program Files\SplunkUniversalForwarder\etc\apps\FW_DEV_NA_Encrypt\default\certs\splunk-dev.pem
sslPassword = testmy123
sslRootCAPath = C:\Program Files\SplunkUniversalForwarder\etc\apps\FW_DEV_NA_Encrypt\default\certs\ca.pem
sslVerifyServerCert = false
... View more
05-29-2015
12:15 PM
I went through security guide and blogs on splunk , but I am still not clear how to encrypt communication between splunk deployment server and deployment client
1) Does by default splunk encrypts this communication using default certificates
2) if no just by adding this stanza in /opt/splunk/etc/system/local/server.conf on deployment server will it start working.
[sslConfig]
enableSplunkdSSL = true
sslKeysfile = forwarder.pem
sslKeysfilePassword = password
caCertFile = cacert.pem
caPath = C:Program FilesSplunkUniversalForwarderetcappsapp-namelocal
3) I see splunk answers for same topic. Some of them also mention outputs.conf on universal agent. We are configuring splunk deployment server to deployment client communication, why outputs.conf is needed for this communication.
In my setup I have universal forwarder reporting to heavy forwarder and I just want to encrypt traffic between deployment client and deployment server.
... View more
05-27-2015
08:45 AM
1 Karma
Thanks acharlieh
Your solution worked for me.
to make it simpler I modified syslog lookup to use hostip field name instead of Ip.
index=_internal source="/opt/splunk/var/log/splunk/metrics.log*" "group=udpin_connections" | fields hostip | dedup hostip | eval reported="yes" | append [inputlookup syslog_lookup | eval known="yes"] | stats first(*) as * by hostip | fillnull value="no" reported known | where reported="no" OR known="no"
... View more
05-26-2015
12:03 PM
I modified lookup column name from ip to hostip. now both lookup as well as logs have hostip field. I tried search as you suggested but I get outcome as 37 which is common ip's between logs and lookup . I want exactly opposite result , ip which are in lookup but not in logs.
index=_internal source="/opt/splunk/var/log/splunk/metrics.log*" "group=udpin_connections" NOT [| inputlookup syslog_lookup | fields hostip| dedup hostip | return hostip] | stats count by hostip
... View more
05-26-2015
11:30 AM
I am trying to write a search that will give me syslog log sources not sending logs to splunk
I have 1) metrics logs with information on udp log sources.
2) syslog_lookup with list of syslog devices integrated with splunk
I am trying to see how many of ip's in lookup file are not found in metrics logs, but i always get results with all the entries in lookup file. syslog sources sending data should not be shown in this search
| inputlookup syslog_lookup | fields Ip,Data_Source| dedup Ip | rename Ip as hostip | join type=outer hostip [ search index=_internal source="/opt/splunk/var/log/splunk/metrics.log*" "group=udpin_connections"] | fields Ip,Data_Source,hostip
... View more
04-29-2015
01:29 PM
1 Karma
CWS log collection is working now . I followed steps below
1) Update s3util.py
file path /opt/splunk/etc/apps/Splunk_TA_aws/bin/taaws/s3util.py
change the connect_s3 line to:
def connect_s3(key_id,secret_key,session_key,host="vault.scansafe.com",is_secure=True):
2) Use app UI setup option to configure
Friendly Name = test
AWS Account Key ID = Enter key ID
AWS Account Secret Key = Enter Secret key
3) Create inputs.conf file in app local directory
/opt/splunk/etc/apps/Splunk_TA_aws/local
[aws_s3://CWSlogExtraction_input]
aws_account = test (same as Friendly Name used in step2)
sourcetype = aws:s3
initial_scan_datetime = default
max_items = 100000
max_retries = 10
queueSize = 128KB
persistentQueueSize = 24MB
interval = 18000
recursion_depth = -1
character_set = auto
is_secure = True
host_name = vault.scansafe.com
bucket_name = Enter bucket id
key_name = cws-logs/
4) Restart splunk service
5) To verify the files are being accessed and indexed from the cloud bucket, access the "aws_s3.log" and verify the entries in the log show the files contained in the bucket.
6) Check on Searchhead index=main and source starting with source="s3://
... View more
04-29-2015
08:17 AM
i keep getting error when i enable disable input from UI
Error occurred attempting to disable : In handler 'aws_s3': The following required arguments are missing: aws_account, bucket_name..
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
07-25-2020
09:15 AM
|
