Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About DJAXX03
DJAXX03
New Member
Member since:
04-18-2016
08-24-2023
Community Statistics
| Posts | 4 |
| Solutions | 0 |
| Karma Given | 0 |
| Karma Received | 0 |
| Member Since | 04-18-2016 |
Activity Feed
- Posted Receiving JSON files from Azure containing multiple events in each file. How do I break these into unique events? on Getting Data In. 01-09-2017 02:02 PM
- Tagged Receiving JSON files from Azure containing multiple events in each file. How do I break these into unique events? on Getting Data In. 01-09-2017 02:02 PM
- Tagged Receiving JSON files from Azure containing multiple events in each file. How do I break these into unique events? on Getting Data In. 01-09-2017 02:02 PM
- Tagged Receiving JSON files from Azure containing multiple events in each file. How do I break these into unique events? on Getting Data In. 01-09-2017 02:02 PM
- Tagged Receiving JSON files from Azure containing multiple events in each file. How do I break these into unique events? on Getting Data In. 01-09-2017 02:02 PM
- Tagged Receiving JSON files from Azure containing multiple events in each file. How do I break these into unique events? on Getting Data In. 01-09-2017 02:02 PM
- Posted Re: Error reading log from an azure storage account using TA-Azure on All Apps and Add-ons. 09-19-2016 11:51 AM
- Posted Re: Is there a limit on the amount of blacklist entries under [WinEventLog://Security]? on Getting Data In. 08-30-2016 10:30 AM
- Posted Is there a limit on the amount of blacklist entries under [WinEventLog://Security]? on Getting Data In. 08-30-2016 08:02 AM
- Tagged Is there a limit on the amount of blacklist entries under [WinEventLog://Security]? on Getting Data In. 08-30-2016 08:02 AM
- Tagged Is there a limit on the amount of blacklist entries under [WinEventLog://Security]? on Getting Data In. 08-30-2016 08:02 AM
- Tagged Is there a limit on the amount of blacklist entries under [WinEventLog://Security]? on Getting Data In. 08-30-2016 08:02 AM
- Tagged Is there a limit on the amount of blacklist entries under [WinEventLog://Security]? on Getting Data In. 08-30-2016 08:02 AM
Topics I've Started
01-09-2017
02:02 PM
I am pulling in JSON files into Splunk from Microsoft Azure. Each JSON files contains multiple events and time stamps.
Below is an example of a JSON file that is being pulled in. When I look into Splunk, I get a single event with 3 different entries for each field extraction listed.
I would like to get 3 different events based on the eventTimestamp and data for each event.
Is there a way to do this on the Universal Forwarder or in props.conf?
If so, could someone provide some guidance.
Note: I have the sourcetype = _json in the inputs.conf on the universal forwarder pulling this information.
{
"Records": [
{
"authorization": {
"action": "Microsoft.Authorization/roleAssignments/write",
"scope": "/subscriptions/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx/resourceGroups/default/providers/Microsoft.Network/virtualNetworks/network1/subnets/subnet1/providers/Microsoft.Authorization/roleAssignments/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
},
"eventTimestamp": "2017-01-05T22:17:19.4925915Z",
"submissionTimestamp": "2017-01-05T22:17:40.0170745Z",
"subscriptionId": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
"tenantId": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
},
{
"authorization": {
"action": "Microsoft.Authorization/roleAssignments/write",
"scope": "/subscriptions/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx/resourceGroups/default/providers/Microsoft.Network/virtualNetworks/network1/subnets/subnet1/providers/Microsoft.Authorization/roleAssignments/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
},
"eventTimestamp": "2017-01-05T22:17:20.4925915Z",
"submissionTimestamp": "2017-01-05T22:17:40.0170745Z",
"subscriptionId": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
"tenantId": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
},
{
"authorization": {
"action": "Microsoft.Authorization/roleAssignments/write",
"scope": "/subscriptions/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx/resourceGroups/default/providers/Microsoft.Network/virtualNetworks/network1/subnets/subnet1/providers/Microsoft.Authorization/roleAssignments/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
},
"eventTimestamp": "2017-01-05T22:17:22.9768133Z",
"submissionTimestamp": "2017-01-05T22:17:40.0141995Z",
"subscriptionId": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
"tenantId": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
}
]
}
... View more
09-19-2016
11:51 AM
Benedetta,
Did you ever get a resolution to this? I am having the same issue and can't collect logs as expected.
... View more
08-30-2016
10:30 AM
Rich,
I was hoping there was a better answer as I would rather filter on specific criteria associated with a Windows ID instead of all events per Windows ID. This limitation forces me to be less granular with filtering options.
Thanks for the the quick reply and information.
... View more
08-30-2016
08:02 AM
Is there a limit on the amount of blacklist entries that can be placed under " [WinEventLog://Security]" stanza.
It looks like I can only add 9 entries (blacklist1= to blacklist9=) If I add blacklist10= the line is ignored.
For example, the following format works.
[WinEventLog://Security]
blacklist1 = EventCode="4662" Message="Object Type:\s+(?!groupPolicyContainer)"
blacklist2 = EventCode="566" Message="Object Type:\s+(?!groupPolicyContainer)"
blacklist3 = EventCode="XXX" Message="XXXXXXXXXXXXXXXXXX"
blacklist4 = EventCode="XXX" Message="XXXXXXXXXXXXXXXXXX"
blacklist5 = EventCode="XXX" Message="XXXXXXXXXXXXXXXXXX"
blacklist6 = EventCode="XXX" Message="XXXXXXXXXXXXXXXXXX"
blacklist7 = EventCode="XXX" Message="XXXXXXXXXXXXXXXXXX"
blacklist8 = EventCode="XXX" Message="XXXXXXXXXXXXXXXXXX"
blacklist9 = EventCode=%^(4658|4663|5145|5156|5157)$%
If I add an additional blacklist10=, the line is ignored and the events are logged.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
08-24-2023
02:58 PM
|
