About sahr

sahr · ‎03-13-2018

1) Create a user on a HEAVY FORWARDER. The universal forwarder cannot send HTTP POST. This user is the one that will authenticate through Splunk and it's credentials will be used by the FireEye appliance to send the data. So....here is an example below... user=fireEyE_API password= RiP$RickY (Try to have a complex password that must be under 17 characters--some people have had issues with 16 they say so 8-14 I think is safe) 2) Follow the steps on the FireEye docs about configuring the FireEye Appliance-- Fire_Eye Docs *Basically you need to have a similar configuration(below) in your FireEye appliance** https://:8089/services/receivers/simple?host=&source=fe_ alert&sourcetype=fe_ json&index=fireEye_index Troubleshooting index=_internal <<> If you get a 400 code=bad request If you get a 401 code=bad password probably If you get 200 code = Take the rest of the day off.... Any other codes = Google If 200 code and you still don't see your data...try index=* sourcetype=what_you_used source=what_you_used In the example above, we use fe_alert as the source as and fe_json as the sourcetype Hope this helps. I will ad more troubleshooting tips and onboarding issues I canvas through answers as I find them.

sahr · ‎03-13-2018

Creating this post to make a dummy proof post on how to get FireEye JSON data in via http POST . This is also in the FireEye docs. https://www.fireeye.com/content/dam/fireeye-www/global/en/partners/pdfs/config-guide-fireeye-app-for-splunk-enterprise.pdf

sahr · ‎03-12-2018

bo-bo-bo-bo-bo-bo Love this answer...

sahr · ‎03-10-2018

This blog was really useful for me when attempting to understand streamstats and eventstats. Thanks @tmartin

sahr · ‎12-28-2017

Here is something else I use that usually helps me out | rex field=updated (?\d{4}-\d{2}-\d+)T(?\d+:\d+:\d+.\d+) | eval timestamp= timestampA + timestampB | eval timestamp = strptime(timestamp, "%Y-%m-%d%H:%M:%S.%3N") | eval timestamp=strftime(timestamp, "%c") |fields - timestampA timestampB

sahr · ‎10-19-2017

Thanks a lot @lloydknight. I was able to figure it out using the same concept. I just missed a couple of steps. Thanks, Sahr

sahr · ‎10-19-2017

So I was able to solve it with the help of a good friend. I used |makeresults command to just test it. | makeresults | eval numbers=random() | eval numbers2=random() | eval numbers3=random() | fillnull value="" numbers numbers2 numbers3 | eval test=numbers.".".numbers2.".".numbers3 | eval testing=split(test,".") I used the random() function to just generate some random numbers So imagine numbers 1=123 So imagine numbers 2=456 So imagine numbers 3=789 fillnull fills in the values from the fields we are using we eval to basically combine the fields then finally we split by the delimiter/separator(in this case ".") we used in our previous eval I hope I explained this well.

sahr · ‎10-19-2017

I have the following problem I would like to solve Numbers1 Numbers 2 1 6 2 7 3 8 4 9 5 10 I want to concatenate so it will be like this Number_combined 1 2 3 4 5 6 7 8 9 10 I have tried field aliases, mvjoin, coalescence, eval with the (.) but still can't seem to figure it out. Help please. Thanks,

sahr · ‎09-07-2017

Hello, I am trying to use and eval and if statement to calculate a percentage and I am not sure if I am doing something wrong or possible using the wrong spl or functions for this calculation. Basically I have multiple agencies that have a total number of Splunk servers... AGENCY ------- COUNT OF SPLUNK_SERVERS Agency A -------- 30 Agency B --------- 20 Agency C -------- 15 Agency D -------- 12 I am using a rest spl to get the active Servers and want to divide by the absolute numbers above, so I was trying something like this base search yields X number per Agency===we will say it's called the "count" field |eval "Percentage of Available Servers"=if(Agency=Agency A, count/30)*100 As I researched, I know I was not doing the right thing and I know there are probably multiple ways that would be much easier so I thought I would ask for help. I have created a lookup* but not quite sure how to make it work with what I want to do* Thanks in Advance.

sahr · ‎08-26-2017

Having this same issue now. Did you ever figure this out?

sahr · ‎07-12-2017

I am super super late but thought I'd add an easy fix for me. I basically just changed the retention policy on the Cluster Master and then pushed out. Checked the indexes shortly after and wa-la..all clean. [onboarding] homePath = volume:primary/onboarding/db coldPath = volume:primary/onboarding/colddb thawedPath = $SPLUNK_DB/onboarding/thaweddb repFactor = auto maxDataSize = auto_high_volume maxHotSpanSecs = 86401 frozenTimePeriodInSecs = 10 rotatePeriodInSecs = 10 maxHotIdleSecs = 180 Hope this helps someone. Happy Splunking.

sahr · ‎06-27-2017

Just to add a different scenario towards the answer. And a different way of achieving the same thing. 1) Select the Apps drop down(next to the Splunk logo on top left) 2) Select Manage Apps 3) Locate the app's default view you want to edit and select "view objects" 4) Select "default" 5) This is what my screen looked like. And notice search is my default view. 6) Change to the default dashboard/view you want. I wanted it to change to an app called system_events. Trick: If you are unsure of the exact name. Keep a second tab open with the dashboard or view you want to use. Then copy the end of the URI to what you want. (ex..below) https://10.100.200.250:8443/en-US/app/exec_test/System_Events?form.time_range.earliest=%40w0&form.time_range.latest=now Use just System_events inside the quotes next to the "default=true". Do not include the other stuff otherwise your page won't render. Hope this helps someone.

Posts	13
Solutions	2
Karma Given	59
Karma Received	14
Member Since	‎06-20-2017

Online Status	Offline
Date Last Visited	‎06-05-2020 02:03 AM

How do you get FireEye Data in via RestfulAPI?

Combining unique field values

Eval with an If Statement

Re: How do you get FireEye Data in via RestfulAPI?

How do you get FireEye Data in via RestfulAPI?

Re: How do bundles work?

Re: eventstats

Re: How to edit my search to remove "T" and "Z" ch...

Re: Combining unique field values

Re: Combining unique field values

Combining unique field values

Eval with an If Statement

Re: Files not reindexing even after deleting the f...

Re: How do I clean a clustered index?

Re: Change start screen for app