Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About AbelCruz
AbelCruz
Path Finder
Member since:
02-08-2018
01-03-2021
Community Statistics
| Posts | 24 |
| Solutions | 1 |
| Karma Given | 1 |
| Karma Received | 0 |
| Member Since | 02-08-2018 |
Activity Feed
- Posted Re: Reduce Event Code 4663 volume on Getting Data In. 01-03-2021 05:02 AM
- Posted Re: Reduce Event Code 4663 volume on Getting Data In. 01-03-2021 04:34 AM
- Posted Reduce Event Code 4663 volume on Getting Data In. 01-02-2021 06:59 PM
- Karma Re: Cannot get to Splunk Web interface for neelamssantosh. 06-05-2020 12:45 AM
- Posted SQLAUDIT logs files from folder on All Apps and Add-ons. 09-30-2019 01:22 PM
- Tagged SQLAUDIT logs files from folder on All Apps and Add-ons. 09-30-2019 01:22 PM
- Tagged SQLAUDIT logs files from folder on All Apps and Add-ons. 09-30-2019 01:22 PM
- Posted Re: How do I remove a dash (-) from the Account_Name field? on Alerting. 12-17-2018 09:22 AM
- Posted How do I remove a dash (-) from the Account_Name field? on Alerting. 12-17-2018 07:57 AM
- Tagged How do I remove a dash (-) from the Account_Name field? on Alerting. 12-17-2018 07:57 AM
- Posted Optiv Threat Intel not generating any data on the dashboards on Dashboards & Visualizations. 07-13-2018 05:56 AM
- Tagged Optiv Threat Intel not generating any data on the dashboards on Dashboards & Visualizations. 07-13-2018 05:56 AM
- Tagged Optiv Threat Intel not generating any data on the dashboards on Dashboards & Visualizations. 07-13-2018 05:56 AM
- Posted Re: Which firewall ports are required for the Splunk Add-on for Microsoft Cloud Services? on All Apps and Add-ons. 04-03-2018 01:05 PM
- Posted Re: Which firewall ports are required for the Splunk Add-on for Microsoft Cloud Services? on All Apps and Add-ons. 03-30-2018 12:28 PM
- Posted Re: Which firewall ports are required for the Splunk Add-on for Microsoft Cloud Services? on All Apps and Add-ons. 03-28-2018 01:26 PM
- Posted Which firewall ports are required for the Splunk Add-on for Microsoft Cloud Services? on All Apps and Add-ons. 03-26-2018 07:56 AM
- Tagged Which firewall ports are required for the Splunk Add-on for Microsoft Cloud Services? on All Apps and Add-ons. 03-26-2018 07:56 AM
- Tagged Which firewall ports are required for the Splunk Add-on for Microsoft Cloud Services? on All Apps and Add-ons. 03-26-2018 07:56 AM
- Tagged Which firewall ports are required for the Splunk Add-on for Microsoft Cloud Services? on All Apps and Add-ons. 03-26-2018 07:56 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
01-03-2021
05:02 AM
HF is not an option for us at this moment. Doing this at the indexer level still count against the daily license?
... View more
01-03-2021
04:34 AM
Thank you for your reply. Can this be done at the UF level through a blacklist regex?
... View more
01-02-2021
06:59 PM
Hello. Thank you for reading this Due to license constrictions, we need to eliminate the Event Code 4663 based on the Message field that includes Accesses: ReadData (or ListDirectory). while retaining the other values from the Accesses field. We are using the Splunk_TA_windows and configuring blacklist in its inputs.conf file. We have tried tried several regex but so far they either blacklist the entire Event Code 4663 or it doesn't Here is an example of the Message field: n attempt was made to access an object. Subject: Security ID: ACA\ACA_SQL_Service Account Name: ACA_SQL_Service Account Domain: ACA Logon ID: 0x1347AFBE1 Object: Object Server: Security Object Type: File Object Name: G:\Program Files (x86)\Microsoft SQL Server\110\Tools\Binn Handle ID: 0x55c Resource Attributes: Process Information: Process ID: 0x55cc8 Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Access Request Information: Accesses: ReadData (or ListDirectory) Access Mask: 0x1
... View more
Labels
- Labels:
-
inputs.conf
09-30-2019
01:22 PM
Hello
We have several DB servers that are sending logs to a single folder.
How can I collect those logs into Splunk?
Do I need to create a new sourcetype or can they be indexed into an app?
Thank you in advance
... View more
- Tags:
- splunk-enterprise
- sql
12-17-2018
09:22 AM
Thank you for the suggestion but I need to find the way to fix the filed at indexing so it won't be split in two values and the dash excluded. Excluding/masking it during search will require for me to be always available when a user wants to do a search
... View more
12-17-2018
07:57 AM
The Account_Name and other fields show a dash (-) as a value in addition to the actual Account_Name. I can't filter it out since it does exclude the actual value. How can the field value be rectified to show only the proper value?
... View more
- Tags:
- splunk-enterprise
07-13-2018
05:56 AM
Good morning
We deployed the Optiv Threat intel and the TA in our prem environment.
We use Splunk Enterprise on this configuration:
1 Search Head
2 Indexers
1 Heavy Forwarder
The Optiv Threat Intel is in the Search Head, The Optiv TA is in the Heavy Forwarder.
We use RHEL and the install path is /opt/splunk
We created the optiv index in both indexers(index name: it_optiv)
We ran the starter script without any errors.
We still have no data in the Optiv Dashboards after 24 hours.
The Heavy forwarder does communicate with the indexers as we do have other data sources using it successfully.
Anything else that we are missing or misconstruing?
We do appreciate any help.
... View more
04-03-2018
01:05 PM
2018-03-27 18:25:27,745 +0000 log_level=INFO, pid=2014, tid=MainThread, file=o365_refresh_token.py, func_name=set_up_env, code_line_no=120 | No account is available for refreshing
host = ABCDEF01 source = /opt/splunk/var/log/splunk/splunk_ta_microsoft-cloudservices_account_monitoring.log sourcetype = ms:o365:jobinsight:account
Continuos events:
3/27/18
2:25:59.090 PM
2018-03-27 18:25:59,090 +0000 log_level=INFO, pid=5259, tid=MainThread, file=ta_mod_input.py, func_name=main, code_line_no=200 | End Microsoft Cloudservices Azure Audit task
host = ABCDEF01 source = /opt/splunk/var/log/splunk/splunk_ta_microsoft-cloudservices_azure_audit.log sourcetype = mscs:azure:audit:log
3/27/18
2:25:59.089 PM
2018-03-27 18:25:59,089 +0000 log_level=INFO, pid=5259, tid=MainThread, file=ta_config.py, func_name=_generate_task_configs, code_line_no=89 | Totally generated 0 task configs
host = ABCDEF01 source = /opt/splunk/var/log/splunk/splunk_ta_microsoft-cloudservices_azure_audit.log sourcetype = mscs:azure:audit:log
When I look at the inputs (settings/data inputs) they show none for the app. When try to add one it shows this error:
Encountered the following error while trying to save: Splunkd daemon is not responding: ("Error connecting to /servicesNS/admin/Splunk_TA_microsoft-cloudservices/data/inputs/ms_o365_management: ('The read operation timed out',)",)
... View more
03-30-2018
12:28 PM
Where in the folders would the logs be? This is what we have so far:
alert_logevent
appsbrowser
gettingstarted
launcher
legacy
search
SplunkForwarder
splunk_instrumentation
splunk_monitoring_console
user-prefs
alert_webhook
framework
introspection_generator_addon
learned
sample_app
splunk_archiver
splunk_httpinput
SplunkLightForwarder
Splunk_TA_microsoft-cloudservices
... View more
03-28-2018
01:26 PM
Thank you so much for your response. Yes we are using the O365 Management API through the Splunk Add-On for Microsoft Cloud Services. We follow all the configuration steps. Currently have no errors in the Add-on's o365 Troubleshooting tab and Auditing is enabled in the SharePoint management console. We are not receiving any traffic from SharePoint. Any suggestions? Any steps that we might be missing?
... View more
03-26-2018
07:56 AM
In a Splunk prem environment, which ports do we need to open in the firewall to allow the SharePoint logs to be collected by an internal Heavy Forwarder?
... View more
02-16-2018
08:48 AM
How can I limit the results to only users that have more than 3 EventCode=4625? I am trying to show only users that have more than 3 login failures within 5 minutes
EventCode=4625 user="*" | dedup user | timechart count
... View more
- Tags:
- splunk-enterprise
02-14-2018
11:44 AM
Hi there
Thank you for all your help
Finally got it to work by using this code:
<table>
<title>Detected Malware</title>
<search>
<query>sourcetype=McAfee_Virus_Threat_xml EPOEvents_ThreatName="*" | rename "EPOEvents_ThreatName" AS "Threat Name" | stats count by "Threat Name"</query>
<earliest>-6mon</earliest>
<latest>now</latest>
</search>
<drilldown>
<set token="EPOEvents_ThreatNam_tok">$click.value$</set>
</drilldown>
<option name="wrap">true</option>
<option name="rowNumbers">false</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">cell</option>
<option name="count">10</option>
</table>
<chart depends="$EPOEvents_ThreatNam_tok$">
<title>Impacted Hosts</title>
<search>
<query>sourcetype=McAfee_Virus_Threat_xml EPOEvents_ThreatName="$EPOEvents_ThreatNam_tok$" | rename "EPOEvents_ThreatName" AS "Threat Name", "EPOEvents_TargetHostName" AS "Host Name" | timechart count by "Host Name" limit=0</query>
<earliest>-6mon</earliest>
<latest>now</latest>
</search>
<option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
<option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
<option name="charting.axisTitleX.visibility">visible</option>
<option name="charting.axisTitleY.visibility">visible</option>
<option name="charting.axisTitleY2.visibility">visible</option>
<option name="charting.axisX.scale">linear</option>
<option name="charting.axisY.scale">linear</option>
<option name="charting.axisY2.enabled">0</option>
<option name="charting.axisY2.scale">inherit</option>
<option name="charting.chart">column</option>
<option name="charting.chart.bubbleMaximumSize">50</option>
<option name="charting.chart.bubbleMinimumSize">10</option>
<option name="charting.chart.bubbleSizeBy">area</option>
<option name="charting.chart.nullValueMode">gaps</option>
<option name="charting.chart.showDataLabels">none</option>
<option name="charting.chart.sliceCollapsingThreshold">0.01</option>
<option name="charting.chart.stackMode">stacked</option>
<option name="charting.chart.style">shiny</option>
<option name="charting.drilldown">all</option>
<option name="charting.layout.splitSeries">0</option>
<option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
<option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
<option name="charting.legend.placement">bottom</option>
</chart>
Again thank you for taking the time to help me out.
... View more
02-14-2018
09:04 AM
This is the xml code for the destination form. Does it matter that the EPOEvents_ThreatName is set to "*"?
sourcetype=McAfee_Virus_Threat_xml EPOEvents_ThreatName="*" | timechart count by EPOEvents_TargetHostName limit=0
McAfee test
<panel>
<chart>
<title>Infected Host by Threat</title>
<search>
<query>sourcetype=McAfee_Virus_Threat_xml EPOEvents_ThreatName="*" | timechart count by EPOEvents_TargetHostName limit=0</query>
<earliest>0</earliest>
</search>
<option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
<option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
<option name="charting.axisTitleX.visibility">visible</option>
<option name="charting.axisTitleY.visibility">visible</option>
<option name="charting.axisTitleY2.visibility">visible</option>
<option name="charting.axisX.scale">linear</option>
<option name="charting.axisY.scale">linear</option>
<option name="charting.axisY2.enabled">0</option>
<option name="charting.axisY2.scale">inherit</option>
<option name="charting.chart">column</option>
<option name="charting.chart.bubbleMaximumSize">50</option>
<option name="charting.chart.bubbleMinimumSize">10</option>
<option name="charting.chart.bubbleSizeBy">area</option>
<option name="charting.chart.nullValueMode">gaps</option>
<option name="charting.chart.showDataLabels">none</option>
<option name="charting.chart.sliceCollapsingThreshold">0.01</option>
<option name="charting.chart.stackMode">default</option>
<option name="charting.chart.style">shiny</option>
<option name="charting.drilldown">all</option>
<option name="charting.layout.splitSeries">0</option>
<option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
<option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
<option name="charting.legend.placement">right</option>
<option name="wrap">true</option>
<option name="rowNumbers">false</option>
<option name="dataOverlayMode">none</option>
<option name="count">10</option>
</chart>
</panel>
... View more
02-14-2018
09:01 AM
This brings up a table with all the threats and hosts by time. It doesn't group the hosts by the previously selected threat name
... View more
02-14-2018
08:45 AM
Yes it does in a line underneath the Threat table. How can I pass it to the target form?
... View more
02-14-2018
08:38 AM
It does shows the right clicked value underneath the Threat_name table
... View more
02-14-2018
07:30 AM
When I click on the threat name it shows all the hosts for all the threats not just for the specific threat that was clicked on
This is what I have on the receiving form (maybe this is where the error is?
McAfee test
<panel>
<chart>
<title>Hosts</title>
<search>
<query>sourcetype=McAfee_Virus_Threat_xml EPOEvents_ThreatName="*" | timechart count by EPOEvents_TargetHostName limit=0</query>
<earliest>1501560000</earliest>
<latest>now</latest>
</search>
<option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
<option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
<option name="charting.axisTitleX.visibility">collapsed</option>
<option name="charting.axisTitleY.visibility">collapsed</option>
<option name="charting.axisTitleY2.visibility">visible</option>
<option name="charting.axisX.scale">linear</option>
<option name="charting.axisY.scale">linear</option>
<option name="charting.axisY2.enabled">0</option>
<option name="charting.axisY2.scale">inherit</option>
<option name="charting.chart">column</option>
<option name="charting.chart.bubbleMaximumSize">50</option>
<option name="charting.chart.bubbleMinimumSize">10</option>
<option name="charting.chart.bubbleSizeBy">area</option>
<option name="charting.chart.nullValueMode">gaps</option>
<option name="charting.chart.showDataLabels">all</option>
<option name="charting.chart.sliceCollapsingThreshold">0.01</option>
<option name="charting.chart.stackMode">stacked</option>
<option name="charting.chart.style">shiny</option>
<option name="charting.drilldown">all</option>
<option name="charting.layout.splitSeries">0</option>
<option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
<option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
<option name="charting.legend.placement">bottom</option>
</chart>
</panel>
... View more
02-14-2018
06:38 AM
Thank you for your help.
It does brings the values now but it does all of them. What I am trying to do is to click on a threat name and have Splunk to show in a new form all the affected host by that specific threat. Any suggestions ?
... View more
02-14-2018
06:09 AM
Good morning
I am trying to drilldown from a table into another table based on the click value.
The new form does open but the value is not carried over from the previous table
"
McAfee
<panel>
<table>
<title>Host Threat correlation</title>
<search>
<query>sourcetype=McAfee_Virus_Threat_xml | rename "EPOEvents_TargetHostName" AS "Host Name" | dedup EPOEvents_ThreatName | rename "EPOEvents_ThreatName" AS "Threat Name" | rename "EPOEvents.ThreatType" AS "Threat Type" | rename "EPO_Events_ThreatHandled" AS "Action Taken" | replace "true" with "Contained" in "Action Taken" | table "Threat Name" "Threat Type" "Action Taken" | sort by - "Threat Type"</query>
<earliest>-30d@d</earliest>
<latest>now</latest>
</search>
<option name="wrap">true</option>
<option name="rowNumbers">true</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">row</option>
<option name="count">10</option>
<drilldown>
<link>
/app/search/mcafee_test?
search sourcetype=McAfee_Virus_Threat_xml EPOEvents_ThreatName=$click_value$ | stats count by EPOEvents_TargetHostName
</link>
</drilldown>
</table>
</panel>
"
... View more
02-08-2018
06:56 AM
No worries. This gets me back to just opening the website but it doesn't carry any clicked value from the table.
The table columns' order is: IP, _time, and user.
Am I using the wrong token or do I need to create one?
I do apologize for the questions. I am new to Splunk.
... View more
02-08-2018
06:44 AM
Good morning
Thank you for your response
After using your suggestion now I get this on the website. Still does lookup my current IP address though.
Error: Invalid input address: [ip address]/?q=68.189.154.2
<link>
https://www.iplocation.net/?query=[ip address]/?q=$click.value$
</link>
</drilldown>
</table>
... View more
02-08-2018
06:16 AM
I am trying to drilldown an IP address value from a table into the IP Lookup box of https://www.iplocation.net to obtain the IP address' details. I can click on the value and open the right website on a new tab but it doesn't carry over the selected IP value from the table. I am using Splunk predefined token but still doesn't wok. Any suggestions on what I am missing?
<table>
<title>IP lookup test</title>
<search>
<query>sourcetype="cisco:asa" Cisco_ASA_vendor_action="authentication Rejected"| dedup user | table IP _time user</query>
<earliest>-7d@h</earliest>
<latest>now</latest>
</search>
<option name="wrap">true</option>
<option name="rowNumbers">true</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">cell</option>
<option name="count">10</option>
<drilldown target="https://www.iplocation.net/">
<link>
https://www.iplocation.net/?q=$click.value2$
</link>
</drilldown>
</table>
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
01-03-2021
07:30 PM
|
