Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About BrandonKeep
BrandonKeep
Explorer
Member since:
03-01-2018
01-19-2022
Community Statistics
| Posts | 8 |
| Solutions | 1 |
| Karma Given | 3 |
| Karma Received | 1 |
| Member Since | 03-01-2018 |
Activity Feed
- Got Karma for Re: indexes not passing data alerts. 09-04-2021 02:00 AM
- Posted Re: indexes not passing data alerts on Getting Data In. 09-03-2021 11:15 AM
- Karma Re: indexes not passing data alerts for gcusello. 09-03-2021 11:09 AM
- Karma Re: Why am I getting an error about No spec file on the deployment server when deploying Splunk_TA_nix? for xpac. 06-05-2020 12:49 AM
- Karma Re: Why am I getting duplicate values for all fields from JSON events? for wegscd. 06-05-2020 12:48 AM
- Posted Re: Validate an existing sslPassword hash given a plaintext input on Deployment Architecture. 05-25-2018 12:16 AM
- Posted Validate an existing sslPassword hash given a plaintext input on Deployment Architecture. 05-17-2018 12:26 PM
- Tagged Validate an existing sslPassword hash given a plaintext input on Deployment Architecture. 05-17-2018 12:26 PM
- Tagged Validate an existing sslPassword hash given a plaintext input on Deployment Architecture. 05-17-2018 12:26 PM
- Posted Re: Why am I getting an error about No spec file on the deployment server when deploying Splunk_TA_nix? on All Apps and Add-ons. 05-10-2018 04:40 PM
- Posted Why am I getting an error about No spec file on the deployment server when deploying Splunk_TA_nix? on All Apps and Add-ons. 05-09-2018 10:25 PM
- Tagged Why am I getting an error about No spec file on the deployment server when deploying Splunk_TA_nix? on All Apps and Add-ons. 05-09-2018 10:25 PM
- Tagged Why am I getting an error about No spec file on the deployment server when deploying Splunk_TA_nix? on All Apps and Add-ons. 05-09-2018 10:25 PM
- Tagged Why am I getting an error about No spec file on the deployment server when deploying Splunk_TA_nix? on All Apps and Add-ons. 05-09-2018 10:25 PM
- Tagged Why am I getting an error about No spec file on the deployment server when deploying Splunk_TA_nix? on All Apps and Add-ons. 05-09-2018 10:25 PM
- Tagged Why am I getting an error about No spec file on the deployment server when deploying Splunk_TA_nix? on All Apps and Add-ons. 05-09-2018 10:25 PM
- Posted Re: Optimize join for audit logs on Splunk Search. 04-22-2018 09:57 AM
- Posted Re: Optimize join for audit logs on Splunk Search. 04-22-2018 09:35 AM
- Posted Optimize join for audit logs on Splunk Search. 04-21-2018 05:04 PM
- Tagged Optimize join for audit logs on Splunk Search. 04-21-2018 05:04 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 |
09-03-2021
11:15 AM
1 Karma
I know this is a bit of an old thread but your search helped me come up with something similar. I've been looking for what seems like days to find a solution. I ended up going with tstats and using the date for when the last log was found within the lookback window. | tstats latest(_time) as lastTime where index=* by index
| append [
| rest /services/data/indexes
| dedup title
| rename title as index
| eval lastTime=0
| fields index lastTime
]
| search NOT index IN ("_*", test)
| convert ctime("lastTime")
| stats max(lastTime) as lastTime by index I used | rest /services/data/indexes but one can easily swap that with a lookup like you have in your example. It will list out all the indexes and provides a date stamp of the last known log entry. The caveat is that the the last known log, is only known if there is an event that falls within the lookback period. However, this is still good because we can see all the indexes except those omitted as part of the filter. Hopefully this is also helpful to someone.
... View more
05-25-2018
12:16 AM
I ended up taking a slightly different route for anyone who is interested. Ansible has a hash filter | hash('sha256') , which I used to write the hashed value as a comment in the file. I then check for it's existence on subsequent runs and skip it if the values match. All things considered, it seems to work pretty well as a temporary solution. I may add some obfuscation to my technique but with a strong enough password and keeping strict permissions on the server.conf file, I'm okay with it for now.
Regards,
... View more
05-17-2018
12:26 PM
I am looking for a way to validate an existing sslPassword hash given a plaintext input.
I am working on an ansible deployment script and I would like to make it more idempotent. Right now, I can just reset those values on each run but it would be nice to do a check based off the correct hash. If it matches, skip the task, otherwise, replace the hashed value with a new plaintext or hashed value.
There is a utility hash-passwd where you can run splunk hash-passwd password and it will return a hashed value. However, it doesn't return the same type of hash used for pass4SymmKey or sslPassword
Is there anything like that for sslPassword?
Regards,
Brandon
... View more
05-10-2018
04:40 PM
Thanks for the clear answer.
... View more
05-09-2018
10:25 PM
I downloaded the latest version of the Splunk addon for linux and when deploying, I see this error in the web UI "No spec file for: /opt/splunk/etc/master-apps/Splunk_TA_nix/default/eventgen.conf"
The app was deployed and exists on the indexers. Just curious why I am seeing this on a fresh install.
What can I do to resolve this?
Regards,
Brandon
... View more
04-22-2018
09:57 AM
Thanks for the reply. I have added some sample log data and a screenshot of the expected output. Can you clarify your example a bit as it isn't clear to me how to get my expected output.
Regards,
... View more
04-22-2018
09:35 AM
While this is a cool command that I didn't know existed, it doesn't give me the results that I need. I end up with over a million results. My posted search gives me two results. I will update the initial question with some sample data and expected results.
Thanks for the attempt.
Regards
... View more
04-21-2018
05:04 PM
I have a search that returns correct results. However, the join subsearch portion is constantly hitting the max 50000 results limit. I'd like to run this against a larger timerange so I can produce a weekly report. Right now, I have to keep the timerange small to get any results.
index=os sourcetype=linux_audit type=SYSCALL key=pci
| join msg [search index=os sourcetype=linux_audit type=CWD]
| table _time, host, exe, comm, success, auid, cwd
The field I want to use within the join is the msg field. Is there a way to pass the msg value in the join to speed up the search?
Some sample data from the log messages:
type=SYSCALL msg=audit(1524096248.939:201277): success=yes pid=6561 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=33671 comm="rm" exe="/bin/rm" key="pci"
type=CWD msg=audit(1524096248.939:201277): cwd="/home/user"
type=SYSCALL msg=audit(1524096249.335:201280): success=yes pid=6561 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=33671 comm="rm" exe="/bin/rm" key="pci"
type=CWD msg=audit(152409649.335:201280): cwd="/home/user"
The expected results match based on the contents of the msg field
None of the provided answers seems to be what I need. Anyone else able to answer this?
... View more
