Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About jdhunter
jdhunter
Path Finder
Member since:
07-19-2018
Monday
Community Statistics
| Posts | 30 |
| Solutions | 5 |
| Karma Given | 2 |
| Karma Received | 5 |
| Member Since | 07-19-2018 |
Activity Feed
- Posted Re: Filter Windows EventCode 0 on Getting Data In. 02-28-2022 01:47 PM
- Posted Re: Search Factor and Replication factory not met. Frozen=1 on Splunk Enterprise. 05-10-2021 09:54 AM
- Got Karma for Re: Splunk shcluster configuration on master not updating config. 06-05-2020 12:50 AM
- Got Karma for Re: How to run exe files when deployed apps.. 06-05-2020 12:50 AM
- Got Karma for Re: Custom App icons not showing. 06-05-2020 12:50 AM
- Got Karma for Re: Custom App icons not showing. 06-05-2020 12:50 AM
- Got Karma for Re: Sysmon deploy.bat and update.bat files thowing errors. 06-05-2020 12:49 AM
- Karma Re: useother=f in a pie chart for lycollicott. 06-05-2020 12:46 AM
- Karma Re: How to display the count in piechart as labels for abhijitsaoji. 06-05-2020 12:46 AM
- Posted Re: Splunk Enterprise Security: How to ingest firewall ,waf ,ssandbox ,email gateway, endpoints logs to datamodels on Splunk Enterprise Security. 10-28-2019 08:02 AM
- Posted Re: Splunk Enterprise Security: How to ingest firewall ,waf ,ssandbox ,email gateway, endpoints logs to datamodels on Splunk Enterprise Security. 10-16-2019 12:25 PM
- Posted Re: Need to limit iis logs to 4xx and 5xx statuses in universal forwarder on Getting Data In. 10-15-2019 02:21 PM
- Posted Re: Rename Columns not Fields on Dashboards & Visualizations. 10-15-2019 02:03 PM
- Posted Re: Splunk Enterprise Security: How to ingest firewall ,waf ,ssandbox ,email gateway, endpoints logs to datamodels on Splunk Enterprise Security. 10-14-2019 07:42 AM
- Posted Re: Splunk Enterprise Security: How to ingest firewall ,waf ,ssandbox ,email gateway, endpoints logs to datamodels on Splunk Enterprise Security. 10-11-2019 10:28 AM
- Posted Re: How to run exe files when deployed apps. on Deployment Architecture. 10-11-2019 10:07 AM
- Posted Re: splunk SPL on Splunk Search. 10-08-2019 02:58 PM
- Posted Re: Custom App icons not showing on Dashboards & Visualizations. 10-02-2019 01:40 PM
- Posted Re: Splunk shcluster configuration on master not updating config on Deployment Architecture. 10-02-2019 01:10 PM
- Posted Re: How to set up Indexes on Indexers on Getting Data In. 10-01-2019 12:30 PM
Topics I've Started
No posts to display.
02-28-2022
01:47 PM
We were able to filter it out from the UF using the following in our inputs.conf: [WinEventLog://Application] disabled = 0 index = windows_index blacklist1 = EventCode="0"
... View more
05-10-2021
09:54 AM
I'm seeing these messages as well now that I have upgraded to 8.1.3 (from 7.3.3)
... View more
10-28-2019
08:02 AM
When you search your trend micro data, does this data have a tag field? You will see this on the left hand side when searching your data as Selected fields or Interesting fields. If you are having issues with your Splunk server, I would recommend calling support and asking for assistance in making changes to your datamodels as this can impact the performance of your Splunk environment.
... View more
10-16-2019
12:25 PM
If you are having issues with the stability of your environment, I would open a Support case.
... View more
10-15-2019
02:21 PM
Props and transforms will not parse the data on Universal Forwarders. See - https://answers.splunk.com/answers/27373/universal-forwarder-and-props-conf-and-transforms-conf.html
You might be able to use whitelist in inputs.conf. I have used this method for Windows event codes, but haven't done it on IIS logs.
https://docs.splunk.com/Documentation/Splunk/latest/Admin/Inputsconf
... View more
10-15-2019
02:03 PM
See past answers submission below, he recommends using the rename command.
https://answers.splunk.com/answers/59171/changing-table-column-header-names.html
... View more
10-14-2019
07:42 AM
Search the data in question to make sure fields, for the datamodel they need to be a part, exist. Also check the for the field tag. The data needs to be tagged appropriately for that data model as well (tag=network and communicate). So your firewall data should follow the Network traffic data model. If the firewall has an IPS/IDS and that data is sent to Splunk, it will need to follow the datamodel Intrusion Detection field names and tags=ids and attack.
... View more
10-11-2019
10:28 AM
First you need to make sure your data is CIM (Common Information Model) compliant. This is to normalize the data so you are using the same field values for the datamodel. You will want to look at each data model for the Common names and then check your data that corresponds to that datamodel. https://docs.splunk.com/Documentation/CIM/4.13.0/User/Overview
Example for Network Datamodel: https://docs.splunk.com/Documentation/CIM/4.13.0/User/NetworkTraffic
The data also needs to be tagged properly. Network traffic has the tag of network and communication. This is typically done through the app but you will need to check this as well.
This is is where I would start and move through each datamodel and data source you are having issues with.
... View more
10-11-2019
10:07 AM
1 Karma
I call a BAT script to install Sysmon and execute the Sysmon.exe. You could do something similiar:
inputs.conf
[script://.\bin\deploy.bat]
disabled = false
Run Once on Startup
interval = -1
index = your_Index_you_want_to_store_your_script_data
BAT and EXE file exist within the bin directory - App is on a Windows client machine. You will need to change your slashes depending on your environment.
... View more
10-08-2019
02:58 PM
Try this:
your search
|bin _time span=1d
| stats count(eval(like(Code, "3011648"))) as Incorrect_Login by _time
I would avoid real time searches
... View more
10-02-2019
01:40 PM
2 Karma
You need to create the folder/directory static in your app.
etc/app/your_app/static
Then I copied my png file into this directory and renamed it appIcon.png.
This is the default name the app uses when you create one
http://dev.splunk.com/view/webframework-developapps/SP-CAAAE86
I would restart Splunk, sometimes you can get away with issuing a debug/refresh when updating certain content in your app
... View more
10-02-2019
01:10 PM
From my clustering class notes, there is no CLI support for enabling the deployer. You have to edit the server.conf file and then restart splunk:
[shclustering]
pass4SymmKey =
Secret needs to be the same on deployer and SHC members
... View more
10-01-2019
12:30 PM
Clients will check in periodically and compare the app on the DS to their app. If there is a change, the client will download.
https://docs.splunk.com/Documentation/Splunk/7.3.1/Updating/Howdeploymentupdateshappen
Process for setting up the DS:
https://docs.splunk.com/Documentation/Splunk/7.3.1/Updating/Planadeployment
... View more
10-01-2019
09:07 AM
Excellent point Rich! Since he isn't running a clustered environment, he could use a Deployment Server to deliver his custom app to the indexers and avoid having to move it to each.
... View more
10-01-2019
07:44 AM
Since your environment is not clustered, you will want to create the index on each indexer. You can do this via the UI or from the CLI. Look at the Wiki below:
Splunk Web:
In Splunk Web, navigate to Settings > Indexes and click New.
To create a new index, enter:
A name for the index. User-defined index names must consist of only numbers, lowercase letters, underscores, and hyphens. They cannot begin with an underscore or hyphen, or contain the word "kvstore".
The index data type. For event data, click Events. This is the default data type.
The path locations for index data storage:
Home path. Leave blank for default $SPLUNK_DB/ /db
Cold path. Leave blank for default $SPLUNK_DB/ /colddb
Thawed path. Leave blank for default $SPLUNK_DB/ /thaweddb
Enable/disable data integrity check.
The maximum size of the entire index. Defaults to 500000MB.
The maximum size of each index bucket. When setting the maximum size, use auto_high_volume for high volume indexes (such as the main index); otherwise, use auto.
The frozen archive path. Set this field if you want to archive frozen buckets. For information on bucket archiving, see Archive indexed data.
The app in which the index resides.
The tsidx retention policy. See Reduce tsidx usage.
For more information on index settings, see Configure index storage.
Click Save.
CLI:
Edit indexes.conf
To add a new index, add a stanza to indexes.conf in $SPLUNK_HOME/etc/system/local, identified by the name of the new index. For example:
[newindex]
homePath=
coldPath=
thawedPath=
...
For information on index settings, see Configure index storage and the indexes.conf spec file.
Note: User-defined index names must consist of only numbers, lowercase letters, underscores, and hyphens. They cannot begin with an underscore or hyphen, or contain the word "kvstore".
You must restart the indexer after editing indexes.conf.
https://docs.splunk.com/Documentation/Splunk/7.3.1/Indexer/Setupmultipleindexes
... View more
09-30-2019
02:07 PM
1 Karma
Do you have a License installed on this server? I would setup a License Master and point all of your Splunk instances to it.
Once you have a license master configured, you can run this command on all your Splunk servers.
Setting License Master Slave
splunk edit licenser-localslave -master_uri 'https://license_master_uri:8089'
https://docs.splunk.com/Documentation/Splunk/7.3.1/Admin/Configurealicensemaster
https://docs.splunk.com/Documentation/Splunk/7.3.1/Admin/LicenserCLIcommands
Next, I would setup the Cluster Master and the Cluster Peers
Cluster Master
splunk edit cluster-config -mode master -replication_factor # -search_factor # -secret your_key -cluster_label cluster1
Cluster Peer (Your Indexers)
splunk edit cluster-config -mode slave -master_uri https://cluster_master:8089 -replication_port 9887 -secret your_key
https://docs.splunk.com/Documentation/Splunk/7.3.1/Indexer/Enablethemasternode
https://docs.splunk.com/Documentation/Splunk/7.3.1/Indexer/ConfiguremasterwithCLI
https://docs.splunk.com/Documentation/Splunk/7.3.1/Indexer/ConfigurepeerswithCLI
Finally, there are multiple steps in setting up a Search Head Cluster to Deploy the cluster:
These are the key steps in deploying clusters:
Identify your requirements.
Set up the deployer.
Install the Splunk Enterprise instances.
Initialize cluster members.
Bring up the cluster captain.
Perform post-deployment set-up.
https://docs.splunk.com/Documentation/Splunk/7.3.1/DistSearch/SHCdeploymentoverview
System Requirements for installing Cluster Master and SHC Deployer on the same machine
https://docs.splunk.com/Documentation/Splunk/7.3.1/Indexer/Systemrequirements
... View more
09-27-2019
02:00 PM
Is Splunk running as a Domain Account and have access to read the directory? If not, It will not be able to read any network drives, shares, etc.
... View more
08-23-2018
08:54 AM
Have you looked at Route and Filtering techniques?
http://docs.splunk.com/Documentation/Splunk/7.1.2/Forwarding/Routeandfilterdatad
... View more
08-23-2018
08:01 AM
Is your issue getting advanced IIS logs into Splunk? Or you need to send them to two locations?
... View more
08-08-2018
05:17 PM
I would read more about the Splunk Add on for Microsoft IIS.
https://docs.splunk.com/Documentation/AddOns/released/MSIIS/About
Verify where your IIS logs are writing to:
Standard logs default directory: %SystemDrive%\inetpub\logs\LogFiles
Advanced logs default directory: %SystemDrive%\inetpub\logs\AdvancedLogs
You should be able to configure your inputs.conf to accept both standard logs and advanced
Example inputs.conf:
[monitor://C:\inetpub\logs\AdvancedLogs]
disabled = false
sourcetype = ms:iis:auto
[monitor://C:\inetpub\logs\LogFiles]
disabled = false
sourcetype = ms:iis:auto
They also mention this article to enable Advanced Logging on your IIS server
https://docs.microsoft.com/en-us/iis/extensions/advanced-logging-module/advanced-logging-for-iis-custom-logging
... View more
08-07-2018
04:03 PM
What type of logs are you bringing into Splunk?
For Windows Security Logs, you would want to look for EventCode 4624 (Successful log on) & EventCode 4625 (failed login) for the user in question. If you don't care about attempts, you can leave out 4625.
If you have VPN solution, you should check those logs as well.
Create your search and then schedule an alert. Trigger on anything greater than 0
... View more
08-06-2018
09:35 AM
Type that in your search as is, you just need to know what index the firewall data is being written to and update the portion after index=
Once you get the syntax correct, you can create a report by clicking Save As > Report and schedule it to run daily, weekly, etc.
... View more
08-06-2018
07:59 AM
http://docs.splunk.com/Documentation/Splunk/7.1.2/SearchReference/Metadata
| metadata type=hosts index=your_firewall_index
... View more
07-30-2018
01:49 PM
With + between the $ signs, it will match between 1 or more
Try testing this:
whitelist = EventCode=%^4624$% Message=%Account\sName:\s+\$\$.*%
... View more
07-24-2018
07:19 AM
inputs.conf - http://docs.splunk.com/Documentation/Splunk/latest/Admin/Inputsconf
Look at the Windows Event Log Monitor Section
Example from inputs.conf documentation:
whitelist = EventCode=%^200$% User=%jrodman%
Include events only if they have EventCode 200 and relate to User jrodman
Follow this pattern for your EventCode and Account Name
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
Monday
|
