About jawahir007

jawahir007 · ‎01-13-2023

Both will be having the same effect, because props and transforms are part of the parsing activity only, data passes through the license after the parsing. If you are filtering the data inputs (inputs.conf) using a whitelist or any other way at the time of reading it, you can save some network bandwidth by reducing the amount of data sent toward the Heavy Forwarder/Indexer. And also you can reduce the effort of the parser by reducing the amount of data to be parsed. Both the case's licenses will be calculated based on the data which the parser outputs.

jawahir007 · ‎01-13-2023

In Monitoring Console you can see the forwarder status. There is an in built dashboard available for it. Refer for more info about the built in alert/reports: Configure forwarder monitoring for the Monitoring Console

jawahir007 · ‎06-10-2020

Edit the simple XML code and add an "id" attribute to the <row> element (<row id="p1"). and inside panel specify your CSS style in a <style> tag (<html><style> #id{ your css style here...}</style></html>) repeat the procedure for the second panel too. i think this is what you asking for....... eg:- <row id="p1"> <panel> <title>panel1</title> <single> <search> <query>index=_internal|stats count</query> <earliest>-24h@h</earliest> <latest>now</latest> <sampleRatio>1</sampleRatio> </search> <option name="drilldown">none</option> </single> <html> <style> #p1{ border-color: #92a8d1; border-width: thick; border-style: solid; } </style> </html> </panel> </row>

jawahir007 · ‎06-10-2020

Edit the simple XML code and add an "id" attribute to the <row> element (<row id="p1"). and inside panel specify your CSS style in a <style> tag (<html><style> #id{ your css style here...}</style></html>) repeat the procedure for the second panel too. i think this is what you asking for....... eg:- <row id="p1"> <panel> <title>panel1</title> <single> <search> <query>index=_internal|stats count</query> <earliest>-24h@h</earliest> <latest>now</latest> <sampleRatio>1</sampleRatio> </search> <option name="drilldown">none</option> </single> <html> <style> #p1{ border-color: #92a8d1; border-width: thick; border-style: solid; } </style> </html> </panel> </row>

jawahir007 · ‎04-22-2020

Try this: - |rex "Class:(?<Class>[^:\n]*)\s*Host:.*\s*External\s*ID"|rex "Open\s*:\s*(?<Open>.*)\n"|rex "Host:(?<Host>.*)\s*External\s*ID"|rex "Impact:\s*\d*\-?(?<Impact>.*)\n"|rex "Urgency:\s*\d*\-?(?<Urgency>.*)<\/Notes"|rex "Incident_Number>\s*(?<Incident_Number>.*)<\/Incident_Number"|rex "Summary>AlertID:\s*(?<AlertID>\d*)"|rex "USER:\s*(?<USER>[^\s>]*)"|table Class,Open,Host,Impact,Urgency,Incident_Number,AlertID,USER

jawahir007 · ‎04-22-2020

Try this : - SEDCMD-mask=s/(.*?\(userPassword,\s*{).*(}\)\])/\1####\2/g

jawahir007 · ‎01-27-2020

Refer this link: https://www.tecmint.com/manage-linux-system-logs-using-rsyslogd-and-logrotate/

jawahir007 · ‎11-14-2019

is it possible to sort multi-value field by word length...if yes then how to.

jawahir007 · ‎10-22-2019

try this : | rex field=Version "\\x22(?<version>.*)\\x22"

jawahir007 · ‎10-22-2019

you can try like : | metadata type=hosts index=* |search host="DNS-DC-01" you car refer this link for more information about metadata command: https://docs.splunk.com/Documentation/Splunk/7.3.2/SearchReference/Metadata

jawahir007 · ‎02-16-2019

How can I forward "windows security events" to a third party Syslog server without indexing it to the Splunk.

Posts	12
Solutions	0
Karma Given	0
Karma Received	4
Member Since	‎10-03-2018

Online Status	Offline
Date Last Visited	‎02-13-2024 12:15 PM

Is it possible to sort multi value field by word l...

Syslog Forward without indexing

Re: quick clarification, difference between a inpu...

Re: UF status was not connected dashboard

Re: How can we give two different styling for two ...

Re: How can we give two different styling for two ...

Re: RegEx Help

Re: Props.conf: Why isn't my mask working?

Re: Rsyslog Log Rotation

Is it possible to sort multi value field by word l...

Re: Help with some basic REGEX please?

Re: Need Particular Host "DNS-DC-01" data from met...

Syslog Forward without indexing