About danielransell

danielransell · ‎04-08-2020

Image overlay could probably work. I think more than anything I was looking for a way to organize the data differently than I could with a chart or stats command where all the values are returned in a single row. I wish I could attach an image here rather than just hyperlink to sites - I've put together a functional option using a dashboard and 6 Single Visualization panels each representing an area (short and deep, left middle and right). Currently the dashboard is driven by user selectable dropdowns where a player, offense, defense, and/or pass result (complete, incomplete, touchdown, interception, 2 pt try) can be used to filter the data. I can assign colors to the visualization based on value - to do it dynamically, I can probably convert the raw count of passes to a ratio of passes based on target (e.g. short middle) and color based on ranges.

danielransell · ‎04-08-2020

I tried installing the Shapester App on my home setup and can't seem to get it to load properly. I'm running 8.0.2 and supported versions for the Shapester app are limited to 6.3 to 6.6.

danielransell · ‎04-08-2020

I'm actually just referencing the project Splunk did a few years ago to market Machine Learning capabilities. My project is a combination of personal interests, NFL and Splunk. I use Splunk at work, but not for playing around with NFL stats.

danielransell · ‎04-08-2020

When I started looking into Splunk Docs, most things were pointing to GIS and actual map data. Are you aware of any examples that I can mimic or Splunk Docs that I may have just missed?

danielransell · ‎04-08-2020

The result of my search right now is a chart with a row for each quarterback (I don't know if I can actually insert a table, but an excerpt of the data is below). I have applied a heatmap overlay over the entire chart, which is nice - but I'd like to make it more intuitive visually. My Search: index=nfl IsPass=1 |chart count over player by PassType usenull=f My Output player DEEP LEFT DEEP MIDDLE DEEP RIGHT SHORT LEFT SHORT MIDDLE SHORT RIGHT 1-C.NEWTON 4 1 9 30 11 36 1-K.MURRAY 31 19 44 166 81 179 2-A.MCCARRON 0 0 0 0 1 0 2-B.ALLEN 6 4 8 22 15 36 2-B.HOYER 8 2 8 10 15 23 Splunk actually did something similar a few years ago I'm not looking to overlay it on a football field like the splunk example. I'm just trying to format the three deep pass categories as row 1, and the three short pass categories as row 2. Currently I'm only picturing this as one output - so I can either specify a single player earlier in the search pipeline or run the stats against all or a set of players.

danielransell · ‎04-07-2020

I've been playing around a bit with some NFL statistical data (source data is from http://nflsavant.com/about.php). Each passing play has a field called PassType where the six possible values are short left, short middle, short right and deep left, deep middle, and deep right. I'd like to make a choropleth style heat map or table to visualize the data. The visualization would be two rows and three columns. Deep passes on top, short passes on bottom with left right and middle where you'd expect. Is the best way to visualize this data with a cloropleth map? Is there something easier/better? EDIT: I've kind of worked through this. First I started by getting my data into single number visualizations where they are organized is a logical manner (deep passes on top, short on bottom, left, right and middle respectively). Then I kind of figured out how to do custom placemarks in a kml file to do the heat map. This was quite the mental exercise but I think I'm kind of there - the end result isn't as pretty as I was hoping, but it is fun to play with the data.

danielransell · ‎11-04-2019

Another way to do this I just learned from my own Splunk Answers question is the method of |stats count(eval(condition)) as countName. Try this search out and see if it works for you: index="myIndex" sourcetype=source1 OR sourcetype=source2 | stats count(eval(sourcetype=source1)) AS "Number of Source 1 Events", count(eval(sourcetype=source2)) AS "Source2 Events" I used different "AS" formats to help breakdown the search - that way you can see what has changed and modify on your own. Anyway, this will add to your total only if the eval condition is true. The inner eval condition could just as easily be EventCode=4624 or anything else you'd like to count - the as is just formatting.

danielransell · ‎11-04-2019

Thanks for all the help in this. Ultimately, my data did not match your example well - so I made a couple more field extractions and it worked. Originally I created 59 field extractions for each audit policy subcategory. Then Account Lockout would have a value of Success and Failure, and so on and so on 58 more times. In order to get my report in a manner that I like, I added an extraction for the Audit Policy Name (AuditPolicy_SubCategory in the code below), so that would equal Account Lockout, then I added an extraction for the Audit Policy Value (AuditPolicyValue below), so that would equal Success, Success and Failure, Failure or No Auditing. With these extractions in place, my final search looks like this: index=idx sourcetype=auditpolicy | dedup host, AuditPolicy_SubCategory | table AuditPolicy_SubCategory, AuditPolicyValue | stats count(eval(AuditPolicyValue="Success")) as Success, count(eval(AuditPolicyValue="Success and Failure)) as "Success and Failure", count(eval(AuditPolicyValue="Failure")) as Failure, count(eval(AuditPolicyValue="No Auditing")) as "No Auditing" by AuditPolicy_SubCategory Thanks for the help to4kawa. Marking yours as the answer and awarded some points.

danielransell · ‎11-02-2019

I think I see what’s going on - really looking forward to giving this a try on Monday.

danielransell · ‎11-01-2019

My sample data is supposed to be one big event. My dilemma is having ~60 field names. Your line 8 and 9 works great when each event has a Field value of a, b, c, d, e, f, g. You can then sum by each of those field values. Each event for me has ~60 key value pairs. It would be great if I could neatly display a single line for each field name (which corresponds to one of Windows Advanced Audit Policy names), and display dc(hosts) by the specific field name. I may just end up with a dashboard with 60 panels, incorporating your count functions. Alternatively, I may be able to get creative using a fieldsummary command, and using a lookup of the 60 fields I need, then messing with the values column. Just hoping there is a cleaner way.

danielransell · ‎10-31-2019

You search works well, but my problem is I do not have a field named Field in my results. Each of my fields are named differently. I started going down a path of fieldsummary to get a list of fieldnames and assign them to a new field, but I can't seem to figure it out.

danielransell · ‎10-31-2019

I'm working on creating either a report with a table or a dashboard to visualize the status of my Windows Audit Policy. The purpose of the report/dashboard is to measure compliance and detect any GPO/Configuration errors. I'm having trouble trying to identify how I'm going to figure out how to implement this. My events, after a transaction command, look like the following: Field: Values: Security_System_Extension Success and Failure System_Integrity Success and Failure Logon Success and Failure Logoff Failure DPAPI_Activity No Auditing ...and so on.... One way that I could working well is the following chart where the numbers are the result of a stats dc(host) or something: Chart . Success Failure Success and Failure No Auditing Security_System_Extension 4 0 100 0 System_Integrity 0 0 104 0 Logon 0 0 104 0 Another way involving an eval or replace on a by-field basis could be: Chart . Compliant Non-Compliant Security_System_Extension 100 4 System_Integrity 104 0 Logon 104 0 Currently, the only thing that I can think of is creating a dashboard with lots of panels - one for each field - | stats dc(host) by Security_System_Extension Security_System_Extension dc(host) Success 4 Success and Failure 100 Any recommendations on how to get something like depicted in the other examples?

danielransell · ‎08-29-2018

After collecting your events and specifying your fields you need to get a count of events by user. To do that you add the following after “fields user, _time”: |stats count by user | ...rest of search Once you have a count, you will likely want to only show users that have changed their password x number of times during your specified timeframe. To do that add the following after |stats count by user |where count > 24 |...rest of search. By adding that, only users who have changed their password more than 24 times will be returned. Try adding and tweaking those two suggestions and let us know if that gets you what you were looking for.

danielransell · ‎06-13-2018

You won't need anything special for the inputs.conf, something simple such as the line below should get you started. In mine, I specify the index, and I've also blacklisted events that are high volume with no value. [WinEventLog://Security] disabled = 0 In addition to enabling the input, you should verify that the audit policy is set correctly on the domain controller so that it is logging group membership changes. References: http://docs.splunk.com/Documentation/Splunk/7.1.1/Data/MonitorWindowseventlogdata https://www.ultimatewindowssecurity.com/securitylog/book/page.aspx?spid=chapter2 That second link is probably one of the better introductions I've seen to Windows Audit Policy to include covering both the traditional audit policy and the advanced audit policy. If you're new to the Windows auditing and the security log, I would take a little time looking at that second link.

danielransell · ‎06-06-2018

Your text is going down two different paths I believe. AD monitoring ingests the AD infrastructure - but not Windows Security Events. With AD monitoring, you can search against your domain objects - for example, show me all useres who are members of Domain Admins. When you want to view Event ID 4728, you need to get that from the Windows Security Log on the system that processed the action. So in your instance, you need the security log from the domain controller(s). Generally, the best way to accomplish this is to install a Universal Forwarder on the system and send those logs to your indexer. If your Splunk instance is not installed on your domain controller, I'm not sure that AD monitoring is pulling in any events.

danielransell · ‎06-05-2018

It appears Splunk should allow you to whitelist based on Type, which is the field/key where the level is sent. I would start with: whitelist = Type="^[1|2]" references: http://docs.splunk.com/Documentation/Splunk/7.1.1/Data/MonitorWindowseventlogdata#Create_advanced_filters_with_.27whitelist.27_and_.27blacklist.27 https://msdn.microsoft.com/en-us/library/aa394226(v=vs.85).aspx

danielransell · ‎06-02-2018

I think you want to look at whitelisting for this. I have blacklisted certain event codes when ingesting security logs - I believe you can also perform whitelisting, that is on ingest events that meet a particular criteria.

danielransell · ‎06-01-2018

I accomplished this same task using file monitoring on Splunk Enterprise installed on a Windows Server 2012. I created an index for the year. Put all the logs for that year into a single directory on the same server and then created a new monitoring input - you should be able to accomplish this through the web interface if you so choose. Start small, with a single evtx or two, and then grow from there. If your Splunk Enterprise instance is loaded on a Linux system, your mileage may very.

danielransell · ‎01-01-2018

You may not have permissions to monitor files on another system. If your splunk instantiation is installed with the default setup on a Windows machine, it is running with that computer’s ‘local system’ account. This account has full privileges on that system, but would have no privileges on the remote system - and therefore would be unable to monitor it.

danielransell · ‎04-27-2017

Thanks - My intentions are to include the results in a recurring report, so I guess my next step is to figure out Windows Security Log time extraction from the native event. I appreciate the review and feedback.

danielransell · ‎04-27-2017

Can someone help me identify whether I have a time zone issue or a search implementation issue? I have a props.conf under SPLUNKHOME\etc\system\local with the following: [host::CA*] TZ = US/Pacific I am in the Eastern time zone and some of the computers I am collecting events for are in the Pacific time zone (named CA01, CA02, etc). I am searching through Windows Security logs for after hour user activity where the hour is greater than 18 or less than 6. My events for lax computers include events occurring at 3PM Pacific or later. If I run a search, for all events with the applicable host name and pipe those results to a table with _time and _raw, there is a three hour difference between the _time value and the timestamp in the _raw event. Using *./splunk cmd btool props list --debug *, I confirmed that my [host::CA] and TZ = US/Pacific were in the active props configuration. My searches for events where the hour is greater than 18 rely on the following: search string | eval hour = strftime(_time, "%H") | where (hour<=5 OR hour >=18) Any suggestions?

Posts	21
Solutions	2
Karma Given	1
Karma Received	4
Member Since	‎04-26-2017

Online Status	Offline
Date Last Visited	‎06-29-2020 02:09 PM

How to make a custom heat map (choropleth like set...

Help charting or displaying multiple fields

How do I identify user activity outside normal hou...

Re: How to make a custom heat map (choropleth like...

Re: How to make a custom heat map (choropleth like...

Re: How to make a custom heat map (choropleth like...

Re: How to make a custom heat map (choropleth like...

Re: How to make a custom heat map (choropleth like...

How to make a custom heat map (choropleth like set...

Re: How to include counts with 0 events?

Re: Help charting or displaying multiple fields

Re: Help charting or displaying multiple fields

Re: Help charting or displaying multiple fields

Re: Help charting or displaying multiple fields

Help charting or displaying multiple fields

Re: How do I create a search which detects passwor...

Re: admon and alerting

Re: admon and alerting

Re: How to monitor [WinEventLog://System] event l...

Re: How to monitor [WinEventLog://System] event l...

Re: How to ingest old evt and evtx files?

Re: inputs.conf monitor stanza for a remote Window...

Re: How do I identify user activity outside normal...

How do I identify user activity outside normal hou...