Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About sun1000
sun1000
Path Finder
Member since:
01-24-2019
11-03-2021
Community Statistics
| Posts | 13 |
| Solutions | 1 |
| Karma Given | 1 |
| Karma Received | 0 |
| Member Since | 01-24-2019 |
Activity Feed
- Posted Parsing AWS Managed Active Directory logs on All Apps and Add-ons. 08-17-2021 09:42 PM
- Tagged Parsing AWS Managed Active Directory logs on All Apps and Add-ons. 08-17-2021 09:42 PM
- Tagged Parsing AWS Managed Active Directory logs on All Apps and Add-ons. 08-17-2021 09:42 PM
- Tagged Parsing AWS Managed Active Directory logs on All Apps and Add-ons. 08-17-2021 09:42 PM
- Tagged Parsing AWS Managed Active Directory logs on All Apps and Add-ons. 08-17-2021 09:42 PM
- Posted Re: Sending HEC data to Nullqueue on Getting Data In. 05-24-2021 09:43 PM
- Tagged How to blacklist EventCode 5145 with Wineventlog? on Getting Data In. 04-15-2021 10:03 PM
- Posted How to blacklist EventCode 5145 with Wineventlog? on Getting Data In. 04-15-2021 10:02 PM
- Tagged How to blacklist EventCode 5145 with Wineventlog? on Getting Data In. 04-15-2021 10:02 PM
- Tagged How to blacklist EventCode 5145 with Wineventlog? on Getting Data In. 04-15-2021 10:02 PM
- Karma Re: How to Reset the Admin password? for cbreshears_splu. 06-05-2020 12:45 AM
- Posted Re: Sending HEC data to Nullqueue on Getting Data In. 05-04-2020 08:57 PM
- Posted Re: Sending HEC data to Nullqueue on Getting Data In. 04-30-2020 01:30 PM
- Posted Re: Sending HEC data to Nullqueue on Getting Data In. 04-30-2020 09:22 AM
- Posted Sending HEC data to Nullqueue on Getting Data In. 04-29-2020 08:13 PM
- Tagged Sending HEC data to Nullqueue on Getting Data In. 04-29-2020 08:13 PM
- Tagged Sending HEC data to Nullqueue on Getting Data In. 04-29-2020 08:13 PM
- Tagged Sending HEC data to Nullqueue on Getting Data In. 04-29-2020 08:13 PM
- Tagged Sending HEC data to Nullqueue on Getting Data In. 04-29-2020 08:13 PM
- Tagged Sending HEC data to Nullqueue on Getting Data In. 04-29-2020 08:13 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
08-17-2021
09:42 PM
Hi Team, Need help in parsing AWS Managed Active Directory AD Team is writing logs to cloudwatch, and we have Splunk Addon for AWS which consumes these logs through Kinesis stream. I have props config to convert the logs to xmlwineventlog sourcetype after which data is parsed but not all the fields. I want the addon to parse using the source [xmlwineventlog:security] but that is not happening, Here is my props config [source://*securitylogs] Transforms-Index=override_st_props,override_source_props And transforms as below [override_st_props] REGEX=. FORMAT = sourcetype::xmlwineventlog DEST_KEY = MetaData:Sourcetype [override_source_props] REGEX = . FORMAT = source::xmlwineventlog:security DEST_KEY = MetaData:Source It is getting changed on sourcetype and source, but parsing is happening based on sourcetype as per windows addon and not on source Hope i made it clear, please help
... View more
Labels
- Labels:
-
troubleshooting
05-24-2021
09:43 PM
@robert_miller Yes, i was able to get around this In props.conf., I added setnull3 at the end [props.conf] TRANSFORMS-override = override_st_journald,override_host_journald,setnull3 And in transforms.conf, I add the below for setnull3 [setnull3] SOURCE_KEY = _raw REGEX = \"SYSTEMD_UNIT\":(\"elasticsearch.service\"|\"rsyslog.service\") DEST_KEY = queue FORMAT = nullQueue Please accept my answer if this solved your problem
... View more
04-15-2021
10:02 PM
I am trying to blacklist EventCode 5145 with specific message and it is not working. Example Event:
LogName=Security SourceName=Microsoft-Windows-Security-Auditing EventCode=5145 EventType=4 Type=Success Audit ComputerName=xxxx Category=11111 CategoryString=none RecordNumber=xxxx Message=A network share object was checked to see whether client can be granted desired access. Subject: Security ID: Account Name: Account Domain: Logon ID:
Network Information: Object Type: File Source Address: Source Port: Share Information: Share Name: Share Path: \ Relative Target Name: x.dxmdg.com\Policies\{123456789456456456454654464546464558655}\Machine\Preferences\Registry\Registry.xml
Access Request Information: Access Mask: Accesses: Access Check Results:
With below blacklist and it is not working blacklist4 = EventCode="5145" Message="Relative Target Name:\s.+Registry.xml"
Please provide some suggestions
... View more
Labels
- Labels:
-
other
04-30-2020
01:30 PM
I tried that one as well - Is there some limitation with HEC input ?
... View more
04-30-2020
09:22 AM
Regex is correct, I validated with regex101 and also ran search | regex _raw to validate it is correct
Even without source_key it is still a problem
Not sure why it is not working - Tried plenty of options
Please provide more details
... View more
04-29-2020
08:13 PM
We are using HEC collector endpoint to consume logs from FluentD, we recently identified filtering opportunity and trying to apply props/transforms to send data to null queue which is not working.
Source field is sent by Fluentd, so we are using that field to create sourcetype as below
props.conf
[source::*.journald]
TRANSFORMS-override = override_st_journald,override_host_journald
SHOULD_LINEMERGE = false
TIME_PREFIX = SOURCE_REALTIME_TIMESTAMP\":\"
TIME_FORMAT = %s%6Q
transforms.conf
[override_st_journald]
SOURCE_KEY = _raw
REGEX = SYSTEMD_UNIT\":\"([^.\s\"0-9]+)
FORMAT = sourcetype::$1
DEST_KEY = MetaData:Sourcetype
[override_host_journald]
SOURCE_KEY = _raw
REGEX = instance_id\":\"([^\"]+)
FORMAT = host::$1
DEST_KEY = MetaData:Host
Now I want to send partial of data for this source to null queue which is not working
my configuration in props.conf
[source::.journald]
**TRANSFORMS-null= setnullsourcetype*
TRANSFORMS-override = override_st_journald,override_host_journald
SHOULD_LINEMERGE = false
TIME_PREFIX = SOURCE_REALTIME_TIMESTAMP\":\"
TIME_FORMAT = %s%6Q
transforms.conf
[setnullsourcetype]
SOURCE_KEY = _raw
REGEX = \"SYSTEMD_UNIT\":\"rsyslog.service\"
DEST_KEY = queue
FORMAT = nullQueue
Can you please help me understand why it is not working. Please help me to identify how can I fix this
... View more
12-23-2019
05:16 AM
@splunkaddonworkday - I am also looking for same feature having multiple tenants. When is this getting enabled in Workday addon ?
... View more
12-04-2019
09:51 AM
@ejenson Are you able to get a solution for this ? i am experiencing same problem
... View more
09-16-2019
11:24 AM
Hi, I am also getting the same problem. Is this issue resolved ?
... View more
04-14-2019
09:33 PM
We are monitoring docker container logs in base linux OS using universal forwarder, whenever docker containers gets restarted the old files will get deleted and new files/folders will get created. When that happens Splunk UF (7.2.3) stops reading new files. I think it is still looking for old file, how to handle this situation ?
... View more
03-13-2019
09:40 AM
I also have the same question, is there any answer for this one ?
... View more
01-24-2019
09:03 PM
I am looking for options to automate the upgrade of Add-on in Clustered environment
Say for example, I have this add-on Splunk_TA_nix in SHCluster (which we have one deployer and 3 search head members)
Now I want to upgrade this add-on without breaking any custom configuration through automation (Instead of taking backup of folder, placing the new version of app and restoring the custom configuration to new version)
Please help to identify the best and automated way to upgrade Add-on
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
11-03-2021
12:47 AM
|
