Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About cmeisch
cmeisch
Path Finder
Member since:
04-09-2014
a week ago
Community Statistics
| Posts | 26 |
| Solutions | 1 |
| Karma Given | 10 |
| Karma Received | 0 |
| Member Since | 04-09-2014 |
Activity Feed
- Posted Re: After upgrade to 9.1.2 all users try to execute "admin_all_objects" on Splunk Enterprise. a week ago
- Tagged Re: After upgrade to 9.1.2 all users try to execute "admin_all_objects" on Splunk Enterprise. a week ago
- Tagged Re: After upgrade to 9.1.2 all users try to execute "admin_all_objects" on Splunk Enterprise. a week ago
- Posted Re: After upgrade to 9.1.2 all users try to execute "admin_all_objects" on Splunk Enterprise. a week ago
- Posted Re: Where does the incident review saved filters get saved to? on Splunk Enterprise Security. 03-04-2024 09:12 AM
- Karma Re: Where does the incident review saved filters get saved to? for ccl0utier. 06-13-2023 07:00 PM
- Karma Re: Does outputlookup append or overwrite? for inventsekar. 04-27-2023 07:49 AM
- Posted Re: Where does the incident review saved filters get saved to? on Splunk Enterprise Security. 04-27-2023 07:35 AM
- Posted Re: Where does the incident review saved filters get saved to? on Splunk Enterprise Security. 04-27-2023 04:29 AM
- Posted Where does the incident review saved filters get saved to? on Splunk Enterprise Security. 04-11-2023 07:44 AM
- Posted Enterprise Security Incident Review Default Filter: What conf file is that store in? on Splunk Enterprise Security. 03-16-2023 02:56 PM
- Karma Re: How to change the event time of ES Incident Review for aakwah. 03-14-2023 02:28 PM
- Posted Re: WARN SearchResultsCSVSerializer - CSV file contains invalid field '', ignoring column. on Splunk Enterprise. 05-05-2022 01:18 PM
- Karma Re: Splunk query to check which user disabled/enabled alert. for SanjayReddy. 03-08-2022 07:46 AM
- Posted Re: Splunk query to check which user disabled/enabled alert. on Splunk Search. 03-08-2022 07:45 AM
- Posted Re: Splunk query to check which user disabled/enabled alert. on Splunk Search. 03-08-2022 06:51 AM
- Posted Where is the Windows DHCP Lease_duration field in UBA? on All Apps and Add-ons. 02-28-2022 01:34 PM
- Tagged Where is the Windows DHCP Lease_duration field in UBA? on All Apps and Add-ons. 02-28-2022 01:34 PM
- Posted Re: how can i list all indexes and sourcetypes?! on Splunk Search. 08-26-2021 05:03 PM
- Karma Re: hitting refresh when doing a https://<ip>:8000/debug/refresh comes back with html code and not results for richgalloway. 08-18-2021 04:40 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
a week ago
I put a ticket into Splunk and found that its a "known" bug that is not in their normal KBDB but they will work to get it there, in the mean time per support and @SierraX confirming, upgrading to 9.1.3 resolved the issue. I have requested if Splunk would be able to divulge what the bug was. Waiting for response. Thanks @SierraX for your response... funny I got your response and Splunk support's response in at the same time... (Scary... LOL)
... View more
- Tags:
- bug
- SPL-246383
a week ago
In looking for an audit event we saw this behavior too... anyone else? Did you get a response outside of your query?
... View more
03-04-2024
09:12 AM
SO Rock On! from the GUI one is able to create a default view and pass that to all the users. Bummer in that it looks like those settings are in a KV Store somewhere and not in a CONF?
... View more
04-27-2023
07:35 AM
Thank you sir!!!
... View more
04-27-2023
04:29 AM
Thanks for the response and info @ccl0utier !!! My goal is to set a default filter for all who log into this ES. Is this possible?
... View more
04-11-2023
07:44 AM
I want to create a default search filter for ALL users that go into ES Incident Review. You can create a new filter but this I believe gets saved in your profile... I go into /splunk/etc/users and I would think the app that supports incident review would have it but nope. Ideas?
... View more
Labels
03-16-2023
02:56 PM
In Incident Review, one can create a filter and save it as a default. Where does it store that configuration so I can push it across multiple ES instances?
... View more
Labels
05-05-2022
01:18 PM
How did you know which csv file?
... View more
03-08-2022
07:45 AM
Thanks for the response. What I am trying to do is to see when a rule has been enabled\disabled and by who. I Your suggestion will give me who has disabled\enabled but I am trying to figure out what was enabled\disabled... BUT I am closer thanks to you!
... View more
03-08-2022
06:51 AM
Has this been answered... I am looking for the same thing as to WHO has done what?
... View more
02-28-2022
01:34 PM
We are getting the DHCP logs from Windows. I am trying to ingest these logs into UBA however UBA requires the lease_duration. Where is this field... None of my logs has this or the alert code for it.
... View more
Labels
- Labels:
-
configuration
-
other
08-26-2021
05:03 PM
So this is a great search. But I want to limit the search to a spacific index cluster. So say I have indexers call na-idx01, na-idx02, na-idx03, ... This is an idx cluster of a separate business unit that a SH is peering to as well as other BU's cluster. splunk_server=na* is normally what I would do to only search at that BU. How can I use the |tstats search but only for that cluster?
... View more
08-06-2021
09:38 AM
Bringing this back to life: 1) It looks like with ES 6.4, Splunk brought the solution of Entity Zones. I personally have not played with it yet but will be very soon. https://docs.splunk.com/Documentation/ES/6.6.0/Admin/Entityzones So at first glance this looks like the solution if you are just playing with ES. Now we bring in the big wrench like UBA. I have not found yet a solution to have multiple tenants going into one UBA. You will have ip overlap issue... Has anyone have more to add to this and\or do we know if there is a solution or one coming down the pipe?
... View more
07-21-2021
11:33 AM
That's what I was figuring too... just thought I would ask... Thank you sir!
... View more
07-21-2021
11:18 AM
Just a chunk of it: <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<!--
This is a static HTML string template to render errors. To edit this
template, see appserver/mrsparkle/lib/error.py.
-->
<html xmlns="http://www.w3.org/1999/xhtml" xmlns:splunk="http://www.splunk.com/xhtml-extensions/1.0" xml:lang="en">
<head>
<meta http-equiv="content-type" content="text/html; charset=utf-8" />
<meta name="referrer" content="never" />
<meta name="referrer" content="no-referrer" />
<link rel="shortcut icon" href="/en-US/static/@1DFADEF526D35B848D39CC925C3BDD5AC0B3129CEAEB32338B2606924BEAB6E2.3/img/favicon.ico" />
<title>The server encountered an unexpected condition which prevented it from fulfilling the request. - Splunk</title>
<style>
@font-face {
font-family: "Splunk Sans";
src: url('/static/fonts/proxima-regular-webfont.woff') format('woff');
font-weight: 400;
font-style: normal;
}
@font-face {
font-family: "Splunk Mono";
src: url('/static/fonts/inconsolata-regular.woff') format('woff');
font-weight: 400;
font-style: normal;
... View more
- Tags:
- troubleshooting
07-21-2021
08:12 AM
I tried to search this and didnt find anything so apologies if its been already answered. If we run that URL one will get a page with a refresh button. We hit the button and what's returned is a bunch of HTML code. Has anyone experienced this and how was this resolved? Running Splunk 8.2
... View more
- Tags:
- troubleshooting
Labels
- Labels:
-
troubleshooting
10-21-2020
03:37 PM
Looks like the link is no longer working or never worked in the past (there isnt a splunk-base.splunk.com anymore it seams.
... View more
04-23-2020
07:50 PM
well I missed this: https://splunkbase.splunk.com/app/2680/
Will check this out.
... View more
04-23-2020
07:32 PM
I didnt see anything that addressed the GTM though. Did I miss it?
... View more
04-23-2020
06:35 PM
We have an idea to use the logs from these systems for DDOS detections. Was wondering if anyone has props\transfers that will parse\normalize\model them?
... View more
07-15-2019
03:59 AM
Anyone know why tags would not work?
... View more
07-11-2019
04:54 AM
I have it coming in from various sources (not just FW). But if I had to guess it correlates the source to dest information and the data that is transferred within that session.
... View more
07-11-2019
04:49 AM
This question is old but never answered:
Short answer... NO in most cases. UBA is a separate platform from SPLUNK core (UBA runs on top of Hadoop if you will). After going through the setup of UBA, etc I can tell you that you will want the system(s) running UBA to be its own separate instance. See the sizing guide: Install guide
... View more
05-17-2019
11:39 AM
We are getting them via DB connect. We have the DBA create a table for us to read off of (try to make sure we are not going to negatively effect the DB performance.
The logs come in pretty straight but we need to prop\transforms things to adjust fields, etc... but no biggy.
... View more
05-15-2019
04:58 AM
For reasons I cannot explain yet... The field extraction for Event_Description will not work if the word Malicious is right after Web Attack. Any help would be appreciated.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
a week ago
|
Karma given to
