About dperre_splunk

dperre_splunk · ‎12-10-2019

For anyone who comes across this issue I solved it in my docker container by running the following command. sudo ln -s /opt/splunk/bin/splunk /bin/splunk Change the first part to match your own directory that you are running Splunk

dperre_splunk · ‎11-12-2019

For anyone coming past this post. Here is the answer https://docs.splunk.com/Documentation/Splunkbase/splunkbase/SBAPI/AbouttheSplunkbaseEntitlementAPI

dperre_splunk · ‎10-06-2019

Just in case someone comes across this issue in the future. This is how I solved the problem. Enabled debug for the HttpInputDataHandler log file. Searched for the following index=_internal HttpInputDataHandler source="/opt/splunk/var/log/splunk/splunkd.log" "reply: 7" This showed me the source ip address that was making the call. Reply 7 is incorrect index as referred in the following article https://docs.splunk.com/Documentation/Splunk/7.3.1/Data/TroubleshootHTTPEventCollector#Possible_error_codes

dperre_splunk · ‎08-19-2019

To avoid anyone experiencing any pain in trying to solve this problem here is what you need to do. Under server.conf add the following lines [httpServer] crossOriginSharingPolicy = * Under web.conf add the following lines [settings] crossOriginSharingPolicy = * Under inputs.conf add the following lines [http] crossOriginSharingPolicy = * Then in javascript this will work var xhttp = new XMLHttpRequest(); xhttp.open("POST", "https://yourservername.local/services/collector", true); xhttp.setRequestHeader("Authorization", "Splunk YOURHECCODE"); xhttp.setRequestHeader('Content-Type', 'application/x-www-form-urlencoded'); xhttp.send(JSON.stringify({ "event": "THE STRING YOU WANT TO SEND" })); Now these settings will work but you should think about crossOriginSharingPolicy before allowing everything. The docs helped me in this one. Also, if you want to test this at home with a self signed certificate you can run ngrok to help you out with the following code ./ngrok http https://127.0.0.1:8088

dperre_splunk · ‎08-19-2019

Can anyone share some sample javascript code to send data over javascript to Splunk to avoid CORS (Cross Origin Resource Sharing). I am thinking of embedding this code in an app.

dperre_splunk · ‎08-19-2019

Hey sbimizry, To rephrase your question, you would like individual colours for particular nodes? Is that right? If so, it may not be possible without some heavy development work as there is no concept of a node settings guide as all data is read in a row by row format.

dperre_splunk · ‎06-20-2019

@noelflorendo This will need to be on a heavy forwarder with dbconnect installed 🙂

dperre_splunk · ‎06-19-2019

Hey pcyr. Do you have Splunk Add-on for CIM installed? Another got you is that you need to go into the index settings and select an index and press save

dperre_splunk · ‎04-01-2019

Done. Check it out and let me know if you have any issues. 🙂

dperre_splunk · ‎03-31-2019

Hey Arist, Certainly will. I have added new features like node pinning and just need to do some more testing to get it integrated into 7.2.

dperre_splunk · ‎03-20-2019

Hi arrangineni. I had a look at the docs here https://docs.splunk.com/index.php?title=Documentation:Forwarder:Forwarder:InstallaWindowsuniversalforwarderfromthecommandline:7.1.0#Supported_command_line_flags It seems that the default is not to enable perfmon. Are you sure that your deployment server is not enabling this?

dperre_splunk · ‎07-13-2018

Hi back at you :). Proper Fix In my situation the problem was with my configuration of HEC . Under Data Inputs >> HTTP Event Collector >> Global Settings I needed to enable SSL. Workaround If I wanted to not have SSL (bad practice) I would need to update my collectd settings under /etc/collectd.conf like below. ############################################################################## # Customization for Splunk # #----------------------------------------------------------------------------# # This plugin sends all metrics data from other plugins to Splunk via HEC. # ############################################################################## <Plugin write_splunk> server "192.168.X.X" port "8088" token "HECTOKEN" ssl true verifyssl false </Plugin> To ############################################################################## # Customization for Splunk # #----------------------------------------------------------------------------# # This plugin sends all metrics data from other plugins to Splunk via HEC. # ############################################################################## <Plugin write_splunk> server "192.168.X.X" port "8088" token "HECTOKEN" ssl false verifyssl false </Plugin>

dperre_splunk · ‎07-13-2018

Hi there, I have used the script that is contained within the Splunk app for infrastructure and couldnt see the entities populating. After I went to the troubleshooting page located here and looked in the collectd.log I noticed the following error. How can I fix this? [machine]# tail -f /etc/collectd/collectd.log [2018-07-13 18:36:52] [error] write splunk plugin: curl_easy_perform failed with status 35 [2018-07-13 18:37:02] [error] write splunk plugin: curl_easy_perform failed with status 35 [2018-07-13 18:37:12] [error] write splunk plugin: curl_easy_perform failed with status 35

dperre_splunk · ‎07-01-2018

Can you share some sample data?

dperre_splunk · ‎07-01-2018

Hey fhetterscheid. I have pushed a change to the latest release of Force Directed App. It will be fixed in version 2.0.1. The fix was to delete the savedsearches.conf as I have already created defaults in code for the visualizations so the configuration was superfluous. Hope this helps. 🙂

dperre_splunk · ‎06-20-2018

Hey AzJimbo, I am the app developer of this app :). If you update to the latest version click the following Format | Format | Pan/Zoom -> Click Enabled. I have tested this on MacOS in Chrome and Firefox. Let me know if that works.

dperre_splunk · ‎06-05-2018

Hi rameshren what version of Splunk do you have? It could be possible that you are using the new release with a default password policy.

dperre_splunk · ‎06-05-2018

Have you tried enabling arrows on the visualisation? That will show you link direction 🙂

dperre_splunk · ‎06-05-2018

Hi h52huang, Mickey here and I am the developer of the app. So what you are asking could be done technically but it would break the exisiting functionality. Colouring is dynamic at this point in time so the viz will try and colour groups of nodes together If you could describe why you want to distinguish these types of connections that would help me understand the problem

dperre_splunk · ‎05-28-2018

Very late to be responding to this question. However, for someone in the future. I have made updates to my force directed app that allows multi tier relationships to be built. Check the details tab on how to write the search. https://splunkbase.splunk.com/app/3767/

dperre_splunk · ‎01-09-2018

Here is a script that may work for you :). Notes: Change the name of the host and index. Depending on how busy your SharePoint server is the max_rows may not be enough so keep an eye on this [OuterSharepointDB] connection = SharepointDB host = SharepointDBHostname index = sharepoint interval = 58 max_rows = 1000 mode = batch query = SELECT SiteId, ItemId, ItemType, UserId, AppPrincipalId, MachineName, MachineIp, DocLocation, LocationType, Occurred, Event, EventName, EventSource, SourceName, tp_SiteID, tp_ID, tp_DomainGroup, tp_Deleted, tp_SiteAdmin, tp_IsActive, tp_Login, tp_Title, tp_Email, tp_Notes, tp_Token, tp_ExternalTokenLastUpdated, PortalURL, PortalName FROM "WSS_Content_SCP"."dbo"."AuditData" WITH (NOLOCK) LEFT JOIN "WSS_Content_SCP"."dbo"."UserInfo" ON "WSS_Content_SCP"."dbo"."AuditData"."UserId" = "WSS_Content_SCP"."dbo"."UserInfo"."tp_ID" LEFT JOIN "WSS_Content_SCP"."dbo"."AllSites" ON "WSS_Content_SCP"."dbo"."AuditData"."SiteId" = "WSS_Content_SCP"."dbo"."AllSites"."Id" WHERE "WSS_Content_SCP"."dbo"."AuditData"."Occurred" > DATEADD(minute, -60, GETDATE() ) AND "WSS_Content_SCP"."dbo"."AuditData"."UserId" = "WSS_Content_SCP"."dbo"."UserInfo"."tp_ID" AND "WSS_Content_SCP"."dbo"."AuditData"."SiteId" = "WSS_Content_SCP"."dbo"."UserInfo"."tp_SiteID" AND UserId!=1 AND tp_Title NOT LIKE 'System Account' AND tp_Title NOT LIKE 'NT AUTHORITY\LOCAL SERVICE' ORDER BY "WSS_Content_SCP"."dbo"."AuditData"."Occurred" DESC

dperre_splunk · ‎01-09-2018

Hi There, I am looking for a way to get SharePoint audit data into Splunk via DBConnect. Does anyone have a working script that I can use?

dperre_splunk · ‎12-17-2017

Just in case someone else comes across this issue, the way I fixed this was to run 'sudo chown -R splunk:splunk /opt/splunk. The issue started when I ran a setcap command.

dperre_splunk · ‎11-13-2017

Just in case anyone comes past this link looking for a working Force Directed Viz, here is my new app that has force directed packaged as a visualization. No customization needed :). May the force be with you! https://splunkbase.splunk.com/app/3767/

dperre_splunk · ‎11-08-2017

For people who are looking to create a single line event from Cisco ESA data here is a search I have found to work. If you want to collect the data into a summary index add | collect index=email_summary to the end of the search changing the index name. sourcetype="cisco:esa:textmail" | eventstats values(src) AS cs_ip BY icid | eventstats values(dest) AS ss_ip BY dcid | eval recipient_count=mvcount(recipient) | stats values(internal_message_id) AS tmpMID values(icid) AS icid values(sender) AS sender values(recipient) AS recipient values(message_size) AS message_size values(av_verdict) as av_verdict values(response) AS response values(message_subject) as message_subject values(cs_ip) AS cs_ip values(ss_ip) AS ss_ip values(dcid) AS dcid BY internal_message_id | eval recipient_count=mvcount(recipient) | eval mid=tmpMID | mvexpand mid | eventstats values(tmpMID) AS tmp BY mid | eval t=mvjoin(tmp, " ") | rex field=sender "@(?.*)" | stats values(sender) AS sender values(sender_domain) AS sender_domain values(recipient) AS recipient values(message_subject) as subject values(av_verdict) as av_verdict max(message_size) AS message_size max(recipient_count) AS recipient_count values(internal_message_id) AS internal_message_id values(dcid) AS dcid values(response) AS response values(cs_ip) AS cs_ip values(ss_ip) AS ss_ip BY icid | search icid!=0

Posts	44
Solutions	3
Karma Given	3
Karma Received	18
Member Since	‎09-21-2016

Online Status	Offline
Date Last Visited	‎06-05-2020 02:04 AM

How do I send data to HTTP Event Collector via Jav...

Collectd Error After Install - curl_easy_perform s...

How do I collect SharePoint audit data using DBCon...

SCCM Package for deploying Splunk Universal Forwar...

Re: Error When running "npm run build" MAC

Re: wget, or curl splunk applications

Re: How do you track down HEC senders with bad ind...

Re: How do I send data to HTTP Event Collector via...

How do I send data to HTTP Event Collector via Jav...

Re: How to change color for select value in Force ...

Re: How do I collect SharePoint audit data using D...

Re: How to invoke adhoc queries

Re: Any chance of 7.2 support?

Re: Any chance of 7.2 support?

Re: SCCM Package for deploying Splunk Universal Fo...

Re: Collectd Error After Install - curl_easy_perfo...

Collectd Error After Install - curl_easy_perform s...

Re: calculate the percentage of sum of volume betw...

Re: Invalid key in stanza [default] (value: light...

Re: How can I use Pan Zoom on Force Directed Data ...

Re: cant able to login localhost8000 splunk enterp...

Re: Forced directed graph node color customization...

Re: Forced directed graph node color customization...

Re: In D3 force directed graph use recursive searc...

Re: How do I collect SharePoint audit data using D...

How do I collect SharePoint audit data using DBCon...

Re: /opt/splunk/bin/splunkd: error while loading s...

Re: Does anybody have a working example of a force...

Re: transaction not working for Cisco ESA data