Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About cnoulin
cnoulin
Explorer
Member since:
11-30-2017
08-11-2021
Community Statistics
| Posts | 15 |
| Solutions | 0 |
| Karma Given | 0 |
| Karma Received | 1 |
| Member Since | 11-30-2017 |
Activity Feed
- Got Karma for Re: Strange search behavior with "transaction". 06-05-2020 12:49 AM
- Posted Re: Identifying Users that connect from different ip simultaneously on same device on Alerting. 12-11-2019 07:05 AM
- Posted Re: Identifying Users that connect from different ip simultaneously on same device on Alerting. 12-11-2019 05:08 AM
- Posted Identifying Users that connect from different ip simultaneously on same device on Alerting. 12-11-2019 01:30 AM
- Tagged Identifying Users that connect from different ip simultaneously on same device on Alerting. 12-11-2019 01:30 AM
- Posted Re: Alert triggering on an entry not in inputlookup file on Splunk Enterprise Security. 02-27-2019 02:51 AM
- Posted Re: Alert triggering on an entry not in inputlookup file on Splunk Enterprise Security. 02-22-2019 02:44 AM
- Posted Re: Alert triggering on an entry not in inputlookup file on Splunk Enterprise Security. 02-22-2019 02:33 AM
- Posted Re: Alert triggering on an entry not in inputlookup file on Splunk Enterprise Security. 02-22-2019 02:18 AM
- Posted Re: Alert triggering on an entry not in inputlookup file on Splunk Enterprise Security. 02-22-2019 02:14 AM
- Posted Alert triggering on an entry not in inputlookup file on Splunk Enterprise Security. 02-22-2019 01:40 AM
- Tagged Alert triggering on an entry not in inputlookup file on Splunk Enterprise Security. 02-22-2019 01:40 AM
- Posted Re: Strange search behavior with "transaction" on Splunk Search. 08-17-2018 02:17 AM
- Posted Re: Strange search behavior with "transaction" on Splunk Search. 08-17-2018 12:06 AM
- Posted Re: Strange search behavior with "transaction" on Splunk Search. 08-17-2018 12:02 AM
- Posted Strange search behavior with "transaction" on Splunk Search. 08-16-2018 06:34 AM
- Tagged Strange search behavior with "transaction" on Splunk Search. 08-16-2018 06:34 AM
- Tagged Strange search behavior with "transaction" on Splunk Search. 08-16-2018 06:34 AM
- Posted Re: Cisco Networks Add-on for Splunk Enterprise: How can I Use a nonstandard sourcetype to parse Cisco IOS logs? on All Apps and Add-ons. 12-01-2017 06:56 AM
- Posted Cisco Networks Add-on for Splunk Enterprise: How can I Use a nonstandard sourcetype to parse Cisco IOS logs? on All Apps and Add-ons. 11-30-2017 07:31 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
12-11-2019
07:05 AM
@gcusello not really in my case, because the source is a firewall and i want to identify external users that use same login from different ip and access the site via the firewall
... View more
12-11-2019
05:08 AM
@gcusello , thanks for your answer.
Actually my source is my device.
when i add the device ip as device_id, there is no result.
Actually the request work but send me result when the same user as different ip in different moment of the day (that is "normal"), but i want only same user_id with different IP simultaneously.
... View more
12-11-2019
01:30 AM
Hello, i want to make an alert that trigger when on a specific device, a user connect simultaneously from different IP.
My search is as follow :
source="My Source" | stats dc(src_ip) as count,values(src_ip) as src_ip by user | where count > 1
Thanks in advance
... View more
- Tags:
- splunk-enterprise
02-27-2019
02:51 AM
the file is as follow
query
...
DnsAdmins
DnsUpdateProxy
Domain Admins
Domain Admins Restriction
Domain Computers
Domain Controllers
COMPUTER1 Admins
...
thanks for your help
... View more
02-22-2019
02:44 AM
and my index=windows
... View more
02-22-2019
02:33 AM
4728 is my event_code , i thing you mean Group_Name=one_of_the_group_in_the_query_field ?
My real alert is
if a group_name in my file in the "query" field correspond in group_name in my log AND with EventCode=4728
My source log is WinEventLog:ForwardedEvents
... View more
02-22-2019
02:18 AM
just a question.
with my alert i want to say :
if a group_name in my file in the "query" field correspond in group_name in my log it will fire
Is it ok ?
sorry for my english
... View more
02-22-2019
02:14 AM
thank you for your answer, i'll do the modification.
you think it could be the cause of the behavior ?
... View more
02-22-2019
01:40 AM
Hello, i have made an alert as follow :
[|inputlookup admin_groups.csv | table "query" as Group_Name ] | search EventCode=4728
she work well but i have strange behavior.
Sometime she trigge with a Group_Name that is not in the list..
How explain that ?
Thanks in advance
... View more
08-17-2018
02:17 AM
1 Karma
it work, perfect !
Thanks
... View more
08-17-2018
12:06 AM
another thing.
The goal is to have a "unique" log entry when i visualize in splunk.
Actually ESA send me one line by log and the complete mail transaction is very difficult to analyse.
Mayube there is another solution to aggregate during indexing instead of during visualization ?
... View more
08-17-2018
12:02 AM
thank you for your answer.
I'm a splunk noob and try some differents syntax with the stat command but no one work...
Coulmd you help me and give me the syntax ?
I try different functions but no one work.
... View more
08-16-2018
06:34 AM
Hello,
Could someone explain me the following strange behavior with search
With this type of search :
sourcetype="cisco:esa:textmail" | transaction internal_message_id | search "My_email_address@address.com"
When i make a search on last 15 minutes, last hour or last 4 hours, my search work and return me answers .
If i use a specified period time it work too.
As soon as i use 24hours or more, the search give me no answer.
How to explain this ?
Sorry for my english and thanks in advance
... View more
- Tags:
- search
- transactions
12-01-2017
06:56 AM
thank you fir your answer.
With your help i have now a working app.
i have changed in props.conf of the TA-cisco_ios following line :
[cisco:ios]
[(?::){0}network:cisco_*]
...
nothing in the transforms.conf
and in the cisco_ios i have created a local/eventtypes.conf with theses lines :
[cisco_ios]
search = (sourcetype=network:cisco_switch OR sourcetype=network:cisco_wlc OR sourcetype=network:cisco_coeur_reseau)
Thanks again
... View more
11-30-2017
07:31 AM
Hello,
I try to use the cisco ios ta to parsing my ios logs.
I have created non standard sourcetype for my logs as follow :
[udp://XXX.XX.XX:514]
source = My-switch-name
sourcetype = network:cisco_switch
disabled = false
index = Network
and
[udp://XXX.XXX.XXX.XXX:514]
source = My-wlc-ap
sourcetype = network:cisco_wlc
disabled = false
index = Network
in the app, i have changed my eventtypes.conf as follow
[cisco_ios]
search = sourcetype=cisco:ios
search = sourcetype=network:*
but the logs are not parsed.
I'm new to Splunk and I have maybe forgotten something ?
Thanks for you help and sorry for my English 😄
... View more
