Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About TrevorW2000
TrevorW2000
Explorer
Member since:
05-14-2013
10-12-2021
Community Statistics
| Posts | 7 |
| Solutions | 0 |
| Karma Given | 3 |
| Karma Received | 0 |
| Member Since | 05-14-2013 |
Activity Feed
- Posted Splunk Add-on for Microsoft Office 365 - Duplicate CAS Events on All Apps and Add-ons. 10-11-2021 10:20 AM
- Tagged Splunk Add-on for Microsoft Office 365 - Duplicate CAS Events on All Apps and Add-ons. 10-11-2021 10:20 AM
- Tagged Splunk Add-on for Microsoft Office 365 - Duplicate CAS Events on All Apps and Add-ons. 10-11-2021 10:20 AM
- Tagged Splunk Add-on for Microsoft Office 365 - Duplicate CAS Events on All Apps and Add-ons. 10-11-2021 10:20 AM
- Karma Re: Cisco IOS Version for mikaelbje. 06-05-2020 12:46 AM
- Karma Splunk 6.1 upgrade - "Splunk Installer was unable to set the CACLS on the Splunk files. Exitcode='13' for wpreston. 06-05-2020 12:46 AM
- Karma How to import Nessus reports and see results for evang_26. 06-05-2020 12:46 AM
- Posted Re: URL rewrite not properly handeled on All Apps and Add-ons. 07-14-2016 09:20 AM
- Posted How to monitor and alert when a certain process launches on a Windows 7 machine? on All Apps and Add-ons. 02-22-2016 08:53 AM
- Tagged How to monitor and alert when a certain process launches on a Windows 7 machine? on All Apps and Add-ons. 02-22-2016 08:53 AM
- Tagged How to monitor and alert when a certain process launches on a Windows 7 machine? on All Apps and Add-ons. 02-22-2016 08:53 AM
- Tagged How to monitor and alert when a certain process launches on a Windows 7 machine? on All Apps and Add-ons. 02-22-2016 08:53 AM
- Tagged How to monitor and alert when a certain process launches on a Windows 7 machine? on All Apps and Add-ons. 02-22-2016 08:53 AM
- Tagged How to monitor and alert when a certain process launches on a Windows 7 machine? on All Apps and Add-ons. 02-22-2016 08:53 AM
- Posted Re: What would be the best regex syntax to filter out 2 or more remote addresses for specific hosts in WinNetMon? on All Apps and Add-ons. 01-09-2015 02:48 PM
- Posted Re: What would be the best regex syntax to filter out 2 or more remote addresses for specific hosts in WinNetMon? on All Apps and Add-ons. 12-30-2014 02:03 PM
- Posted What would be the best regex syntax to filter out 2 or more remote addresses for specific hosts in WinNetMon? on All Apps and Add-ons. 12-30-2014 11:12 AM
- Tagged What would be the best regex syntax to filter out 2 or more remote addresses for specific hosts in WinNetMon? on All Apps and Add-ons. 12-30-2014 11:12 AM
- Tagged What would be the best regex syntax to filter out 2 or more remote addresses for specific hosts in WinNetMon? on All Apps and Add-ons. 12-30-2014 11:12 AM
- Tagged What would be the best regex syntax to filter out 2 or more remote addresses for specific hosts in WinNetMon? on All Apps and Add-ons. 12-30-2014 11:12 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
10-11-2021
10:20 AM
We have Cloud App Security (CAS) Alerts set to be pulled at an interval of every 5 minutes. This was the default when we set it up. What we're finding is that the same alert is being pulled every 5 minutes. The alert ID and URL are both identical, so is all the content. Here's the inputs.conf snippet: [splunk_ta_o365_cloud_app_security://CAS_Alerts] content_type = Alerts index = o365 interval = 300 We're using the latest version of this app: https://splunkbase.splunk.com/app/4055/ From the log it does appear that the start time is incrementing, but something still isn't working as designed: 2021-10-11 11:57:29,339 level=INFO pid=30282 tid=MainThread logger=splunksdc.collector pos=collector.py:run:251 | | message="Modular input started." 2021-10-11 11:57:29,357 level=INFO pid=30282 tid=MainThread logger=splunk_ta_o365.common.settings pos=settings.py:load:36 | datainput=b'CAS_Alerts' start_time=1633971449 | message="Load proxy settings success." enabled=False host=b'' port=b'' username=b'' 2021-10-11 11:57:29,386 level=INFO pid=30282 tid=MainThread logger=splunk_ta_o365.common.portal pos=portal.py:get_cas_token_by_psk:177 | datainput=b'CAS_Alerts' start_time=1633971449 | message="Acquire cloud application access token success." 2021-10-11 11:57:29,653 level=INFO pid=30282 tid=MainThread logger=splunk_ta_o365.modinputs.cloud_app_security pos=cloud_app_security.py:_create_consumer:139 | datainput=b'CAS_Alerts' start_time=1633971449 | message="Start retrieving Cloud Application Security messages." portal_url=b'<redacted>' portal_region=b'<redacted>' 2021-10-11 11:57:29,653 level=INFO pid=30282 tid=MainThread logger=splunk_ta_o365.modinputs.cloud_app_security pos=cloud_app_security.py:run:46 | datainput=b'CAS_Alerts' start_time=1633971449 | message="Start recording Cloud Application Security messages." source=b'https://<redacted>.portal.cloudappsecurity.com/api/v1/alerts/' 2021-10-11 11:57:29,653 level=INFO pid=30282 tid=MainThread logger=splunk_ta_o365.common.portal pos=portal.py:get:630 | datainput=b'CAS_Alerts' start_time=1633971449 | message="Calling Cloud Application Security API." url=b'https://<redacted>.portal.cloudappsecurity.com/api/v1/alerts/' params={'$filter': datetime.datetime(2021, 10, 11, 16, 57, 29, 653529)} 2021-10-11 11:57:50,766 level=INFO pid=30282 tid=MainThread logger=splunksdc.collector pos=collector.py:run:254 | | message="Modular input exited." 2021-10-11 12:02:26,129 level=INFO pid=31032 tid=MainThread logger=splunksdc.collector pos=collector.py:run:251 | | message="Modular input started." 2021-10-11 12:02:26,274 level=INFO pid=31032 tid=MainThread logger=splunk_ta_o365.common.settings pos=settings.py:load:36 | datainput=b'CAS_Alerts' start_time=1633971746 | message="Load proxy settings success." enabled=False host=b'' port=b'' username=b'' 2021-10-11 12:02:26,303 level=INFO pid=31032 tid=MainThread logger=splunk_ta_o365.common.portal pos=portal.py:get_cas_token_by_psk:177 | datainput=b'CAS_Alerts' start_time=1633971746 | message="Acquire cloud application access token success." 2021-10-11 12:02:26,574 level=INFO pid=31032 tid=MainThread logger=splunk_ta_o365.modinputs.cloud_app_security pos=cloud_app_security.py:_create_consumer:139 | datainput=b'CAS_Alerts' start_time=1633971746 | message="Start retrieving Cloud Application Security messages." portal_url=b'<redacted>' portal_region=b'<redacted>' 2021-10-11 12:02:26,574 level=INFO pid=31032 tid=MainThread logger=splunk_ta_o365.modinputs.cloud_app_security pos=cloud_app_security.py:run:46 | datainput=b'CAS_Alerts' start_time=1633971746 | message="Start recording Cloud Application Security messages." source=b'https://<redacted>.portal.cloudappsecurity.com/api/v1/alerts/' 2021-10-11 12:02:26,574 level=INFO pid=31032 tid=MainThread logger=splunk_ta_o365.common.portal pos=portal.py:get:630 | datainput=b'CAS_Alerts' start_time=1633971746 | message="Calling Cloud Application Security API." url=b'https://<redacted>.portal.cloudappsecurity.com/api/v1/alerts/' params={'$filter': datetime.datetime(2021, 10, 11, 17, 2, 26, 574478)} 2021-10-11 12:02:48,135 level=INFO pid=31032 tid=MainThread logger=splunksdc.collector pos=collector.py:run:254 | | message="Modular input exited."
... View more
Labels
- Labels:
-
troubleshooting
07-14-2016
09:20 AM
The problem is that Internet Explorer doesn't support a JavaScript method (startsWith) that is used to do the redirect. It should work in Chrome or Firefox. You can also make it work in IE by adding a script to override the startsWith function.
More details here: http://stackoverflow.com/questions/30867172/code-not-running-in-ie-11-works-fine-in-chrome
The file you would need to edit is splunk_app_windows_infrastructure\appserver\templates\navredirect.tmpl.
I made the change to the JavaScript and it now works fine in Internet Explorer.
... View more
02-22-2016
08:53 AM
I need to monitor and alert on a single process on a single Windows 7 machine. All I need to alert on is when it launches. Is there an easy way to do this within Splunk? I know I can do process monitoring via the Windows Infrastructure app, but I don't see any way to limit the collection to a single process, etc. I also really don't care about performance details.
Thanks,
Trevor
... View more
01-09-2015
02:48 PM
I am still working with this. That solution may be effective but I'm afraid the traffic would overrun the indexer in a full deployment scenario. The WinNetMon only allows a regex for RemoteAddress instead of whitelist/blacklisting. I may try to cut it off there by only logging remote hosts from certain subnets or somehow adding a range or set of ranges that would cut off that one IP address.
If I don't find an answer by the end of the month, I'll mark Rich's answer as accepted. Any further ideas though would be appreciated.
Thanks!
... View more
12-30-2014
02:03 PM
So, just to make sure I understand completely...
In props.conf, on the indexer (not the universal forwarder), add the following:
[WinNetMon://inbound]
TRANSFORMS-null= setnull
[WinNetMon://outbound]
TRANSFORMS-null= setnull
Then in transforms.conf (again on the indexer):
[setnull]
REGEX = RemoteAddress=(192\.168\.0\.1|127\.0\.0\.1)
DEST_KEY=queue
FORMAT=nullQueue
... View more
12-30-2014
11:12 AM
We're just now starting to enable some of the Windows Monitoring inputs to prepare for a deployment of the Splunk App for Windows Infrastructure. Not surprisingly, enabling the Network Monitor (WinNetMon stanzas) chewed right through our daily index license on a virtual server. That virtual server uses an offload server to handle AV scanning, so the top remoteAddress is to that offload scan server and the localhost address. What I'd like to do is filter those addresses out so we can still use the Network Monitoring, but we lose the stuff that we don't care about. I imagine we'll have the same issue on AD servers and we'll need to filter out other AD servers for replication purposes.
The remoteAddress portion of a WinNetMon configuration in inputs.conf seems to indicate that it accepts regular expressions. I'm not a RegEx expert by any means, so I'm looking for some help. What is the best format for a line that would filter out 2 or more remote addresses?
The following doesn't seem like it would do the job based on some regex testers out there:
remoteAddress = (!(192..168.0.1|127.0.0.1))
Thanks!
... View more
05-14-2013
01:15 PM
Is there an app or already configured out-of-the-box setup for getting Cisco IOS version numbers for Cisco Routers/Switches/Firewalls on a network? We're currently sending syslog data to Splunk, but that's it.
... View more
- Tags:
- cisco
Labels
- Labels:
-
other
