Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About jb1982
jb1982
Path Finder
Member since:
08-29-2017
09-07-2023
Community Statistics
| Posts | 15 |
| Solutions | 2 |
| Karma Given | 1 |
| Karma Received | 0 |
| Member Since | 08-29-2017 |
Activity Feed
- Karma Re: Unforseen Error during upgrade from enterprise 8.2.9 to 9.0.4.1? for ThiloMüller. 09-07-2023 07:11 AM
- Posted Re: Issue with Pantag in Palo Alto Networks app on All Apps and Add-ons. 01-11-2018 12:47 PM
- Posted Issue with Pantag in Palo Alto Networks app on All Apps and Add-ons. 01-11-2018 11:51 AM
- Tagged Issue with Pantag in Palo Alto Networks app on All Apps and Add-ons. 01-11-2018 11:51 AM
- Tagged Issue with Pantag in Palo Alto Networks app on All Apps and Add-ons. 01-11-2018 11:51 AM
- Posted Re: Why isnt't our firewall showing events? We're sending syslogs to a UDP port on Getting Data In. 10-24-2017 10:53 AM
- Posted Re: Why isnt't our firewall showing events? We're sending syslogs to a UDP port on Getting Data In. 10-24-2017 10:52 AM
- Posted Re: Why isnt't our firewall showing events? We're sending syslogs to a UDP port on Getting Data In. 10-12-2017 07:24 AM
- Posted Re: Why isnt't our firewall showing events? We're sending syslogs to a UDP port on Getting Data In. 10-12-2017 07:22 AM
- Posted Re: Why isnt't our firewall showing events? We're sending syslogs to a UDP port on Getting Data In. 10-12-2017 06:24 AM
- Posted Re: Why isnt't our firewall showing events? We're sending syslogs to a UDP port on Getting Data In. 10-12-2017 06:05 AM
- Posted Re: Why isnt't our firewall showing events? We're sending syslogs to a UDP port on Getting Data In. 10-10-2017 01:28 PM
- Posted Re: Why isnt't our firewall showing events? We're sending syslogs to a UDP port on Getting Data In. 10-10-2017 01:28 PM
- Posted Re: Why isnt't our firewall showing events? We're sending syslogs to a UDP port on Getting Data In. 10-10-2017 01:17 PM
- Posted Re: Why isnt't our firewall showing events? We're sending syslogs to a UDP port on Getting Data In. 10-10-2017 01:10 PM
- Posted Re: Why isnt't our firewall showing events? We're sending syslogs to a UDP port on Getting Data In. 10-10-2017 01:01 PM
- Posted Why isnt't our firewall showing events? We're sending syslogs to a UDP port on Getting Data In. 10-10-2017 09:14 AM
- Tagged Why isnt't our firewall showing events? We're sending syslogs to a UDP port on Getting Data In. 10-10-2017 09:14 AM
- Tagged Why isnt't our firewall showing events? We're sending syslogs to a UDP port on Getting Data In. 10-10-2017 09:14 AM
- Tagged Why isnt't our firewall showing events? We're sending syslogs to a UDP port on Getting Data In. 10-10-2017 09:14 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 |
01-11-2018
12:47 PM
So, i think i figured this out. I was trying to test this without the dynamic group being in a committed policy, because i didn't want to break anything. Doesn't work that way. The tags will only apply without a commit if the dynamic group is referenced in a policy that is committed to the running config. I hope this helps anyone who is having the same issue!
... View more
01-11-2018
11:51 AM
Good afternoon, and thanks in advance for any suggestions
We are trying to pantag search results in an alert to a dynamic address group. The addresses are not showing up into the dynamic group until someone runs a commit. The same holds true when we pantag to remove tags. I'm beating my head against the wall here, any suggestions are welcome!
Thank you!
... View more
10-24-2017
10:53 AM
Going into inputs.conf for search app and adding no_appending_timestamp = true for the stanza of the input fixed this issue.
... View more
10-24-2017
10:52 AM
Finally fixed! Went into inputs.conf and added no_appending_timestamp = true and viola.
Thank you again everyone for your help and input!
... View more
10-12-2017
07:24 AM
The time format that splunk is stamping on it or the time from the actual events in the logs?
... View more
10-12-2017
07:22 AM
The time appears in the log entries in several places
Oct 12 10:16:46
2017/10/12 10:16:46
Oct 12 10:16:46
2017/10/12 10:16:46
They format of the logs across the 3 firewalls are identical
... View more
10-12-2017
06:24 AM
I am going to shy away from posting the actual log entries, but I can say they are from 3 different palo alto firewalls running the same exact version of PAN OS, time is synced with NTP, (checked time anyways) checked all syslog settings and they are identical.
... View more
10-12-2017
06:05 AM
Still stuck on this. Didn't see anything in props.conf that jumped out at me as being wrong. The 3 firewalls are the same make and model, running similar firmware. I do not know why the third would be timestamped incorrectly...
... View more
10-10-2017
01:28 PM
To add to that, the log entries themselves show the correct date and time.
... View more
10-10-2017
01:28 PM
Already did, timezone is the same across all 3. Time is the same as they are all synced using NTP. Funny, I found my events! Splunk is dating them as being 2 years prior! But I am positive the date on the firewalls are all the same.
... View more
10-10-2017
01:17 PM
I see it in the first two, but not the last. There seems to be a disparity though between last time and recent time..... Much more so than anything else.
... View more
10-10-2017
01:10 PM
Returns a count of zero, other two fields are blank, so I am guessing that it is not even being indexed?
... View more
10-10-2017
01:01 PM
Thank you both for your input! The source is mentioned in metrics.log. ssievert, I see no mention of timestamp parsing 😞
... View more
10-10-2017
09:14 AM
Good afternoon,
We have 3 firewalls that are sending their syslogs to a udp port. 2 are showing events, one is not. It's like the events aren't being indexed. I tried sending the 1 firewall we aren't seeing data for to a different port mapped to the same source type to no avail. I do see splunkd listening on that port, and tcpdump shows data from that ip coming in on that port. What further steps may I take to diagnose this?
Thank you in advance!!!
... View more
08-29-2017
09:19 AM
Hey everyone,
Trying to write a search to find Firewall allows by Previous Drops
I am very new to Splunk (love it so far) and am trying to write a search with a subsearch. Basically I want to find IP addresses that were denied at our firewall and then check if they were subsequently allowed at some point. So far I have:
tag=network action=allow [search tag=network NOT action=allow | dedup src_ip | table src_ip] | top src_ip by dest_ip
I think this should be correct but before I mess with it I wanted to see if there was a better way to do this.
Thank you, and sorry for the noobish question!
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
09-07-2023
12:23 PM
|
