About gjhaaland

gjhaaland · ‎11-15-2023

Thanks

gjhaaland · ‎11-15-2023

Hi, The code is like index=main host=server10 (EventCode=4624 OR EventCode=4634) Logon_Type=3 NOT user="*$" NOT user "ANONYMOUS LOGON" | dedup user | where NOT MsgID==AUT22673 | eval LoginTime=_time | table user LoginTime The output will list active RDP user. No idea how to fix the rest of it, either 1: If number of user == 0, then print "No Remote desktop user" 2: Or put number of user into a Single Value, Radial Gauge (not username) Sounds so easy but I cannot figure out how to fix it. Too little Splunk experience. Rgds Geir

gjhaaland · ‎11-13-2023

Thanks, Does not work. Also know following. If src_sg_info does not exist then we know that it's no active VPN user. Does not know how to test src_sg_info existance. Thnaks again. Rgds Geir

gjhaaland · ‎11-09-2023

Hi, Code is following index=asa host=1.2.3.4 src_sg_info=* | timechart span=10m dc(src_sg_info) by src_sg_info | rename user1 as "David E" | rename user2 as "Mary E" | rename user3 as "Lucy E" If number of user is 0, then we know theres is no VPN user at all. Plan is to print it out together with active VPN user in timechart if possible. Try to explain how it looks below. user2 user3 No Vpn user No VPN user time .....................................................................................................................................................................................................................................

gjhaaland · ‎11-09-2023

Thanks, is it possible to if field src_sg_info does not exist then "No active VPN user" in the same timechart.

gjhaaland · ‎11-09-2023

Hi, Not sure how to fix it. Hope someone can give me a hint. The code looks like index=asa host=1.2.3.4 src_sg_info=* | timchart span=10m dc(src_sg_info) by src_sg_info | rename user1 as "David E" This splunk code will give a list with active/logged on VPN user. So far so good. So my question is following: howto include empty src_sg_info into the same timechart and mark it as "No active VPN user"

gjhaaland · ‎11-09-2023

Thanks

gjhaaland · ‎11-08-2023

Hi, Thanks. I have installed the image but it looks some difficult to use it. Is it possible to get manual or description how to use it? Rgds Geir

gjhaaland · ‎11-07-2023

Hi, I have created a Cluster Map that show number of counts based on number of ASA blocked actions. The circle size is based on number of hits. A bigger circle represent more counts than a small circle. So far so good. It looks ok, but would be even better if I could change color based on number of counts/hits. Is it also possible change color based on destination portnumber (80,23,22++) Thanks Geir

gjhaaland · ‎11-02-2023

Thanks 🙂

gjhaaland · ‎11-02-2023

Hi, Not sure why it's so difficult to convert timeformat from AM/PM to 24 hours format using timechart. Our command is timechart span=10m dc(src_sg_info) by src_sg_info X-axes use 12-hours format. I have google a lot without finding any answer on it. Hope someone can give me some hints on it. Thanks Geir

gjhaaland · ‎10-27-2023

Thanks 🙂 yes the search looks strange, but it's the only way out of my problems. If dest_interface=outside the cable to outside interface is connected. Not sure why, but it's perfect. I have also tried to use appendcols to combine both graphs without success. I think I must do more investigation to find out why. Geir

gjhaaland · ‎10-27-2023

Hi, I have create two different timechart like: Timechart1(cable connection on/off): index=cisco_asa dest_interface=outside | timechart span=10m dc(count) by count Timechart2(login user listed): host=10.1.1.1 src_sg_info=* | timechart span=10m dc(src_sg_info) by src_sg_info Individually the display is perfect, but it would be even better if we could combined into one graph with common timestamps. I search through splunk documents, also tried different setup without success. Hope someone could help me with it 🙂

gjhaaland · ‎10-25-2023

Thanks, but I also think it should be possible to mark everyting between login and logout in a timechart. Maybe it's not possible. If not I will investigae the apps

gjhaaland · ‎10-25-2023

Hi, Not sure how to fix continius bar between login and logout. As you can see on picture it's marked as login, lot of spaces and then logout. The best would be everything is color marked from login until logout. Though it could be done throug format, but not this time. Hope someone can help me with it Rgds

gjhaaland · ‎10-13-2023

No problems with permissions, diskusage ++. I think it's a global problems. I know that for some days ago I tried to setup pkcs12 certificate (estreamer) on splunk server. But can't remember where I did these settings. Out form commands: $ source /home/splunk/bin/setSplunkEnv && df -H $SPLUNK_HOME $splunk_db Tab-completion of "splunk <verb> <object>" is available. Filesystem Size Used Avail Use% Mounted on /dev/mapper/centos-home 886G 587G 300G 67% /home $ $sudo /home/splunk/bin/splunk btool indexes list volume |egrep '(\[|path)' [volume:_splunk_summaries] path = $SPLUNK_DB $df Filesystem 1K-blocks Used Available Use% Mounted on /dev/mapper/centos-root 52403200 11477568 40925632 22% / devtmpfs 16312676 0 16312676 0% /dev tmpfs 16329816 0 16329816 0% /dev/shm tmpfs 16329816 10560 16319256 1% /run tmpfs 16329816 0 16329816 0% /sys/fs/cgroup /dev/sda3 1038336 173348 864988 17% /boot /dev/mapper/centos-home 865131800 558906488 306225312 65% /home tmpfs 3265964 12 3265952 1% /run/user/42 tmpfs 3265964 0 3265964 0% /run/user/1001 $

gjhaaland · ‎10-13-2023

Thanks. No problems with persmissions. It could be something wrong with with some confiles. But since the proplems involves all indexfiles it must be something global settings, or some services/program not running. Do you thinks it's best to backup $SPLUNK/etc, run installation/upgrade and next copy etc files into new installation. Geir

gjhaaland · ‎10-13-2023

Thanks for the answer. Everyting seems to be ok. disk not full, licenses ok, rebooted several times, restarted splunk several times. But still we don't receive data into indexes. To save time, I wondered if it's possible to backup some files $SPLUNK_HOME/etc, and then reinstall splunk sw + copy files into new installation. Do you think it will work? Rgds Geir

gjhaaland · ‎10-12-2023

Hi, For some reason we cannot receive data to _interal or other indexes(all of them). Old indexes are still available through database. It looks like a generic problem, not related to any specific index. All I can see is _audit. Maybe it's ok to backup $SPLUNK_HOME/etc, and then reinstall splunk sw? or if possible restart some processes, or modify config file. input, output.conf Rgds Geir

gjhaaland · ‎09-21-2023

Hi, After some days the Splunk server stop receiving input. The forwarders are not changed, but I did some changes on splunk server (can't remember what I did). Also know that the firewall does not cause of the problem. On server Splunk server we have also configured Splunk Uniiversal forwarder. So same server include both Splunk Enterprise + Splunk Universal forwarder. Not sure, but I think it's some trouble with indexer since they cannot receive inputs. Have also verified that environment variables is ok. Also changed file permission on all filres/directories below Splunk_HOME. So it should be fine On Splunk Universal clients (on clients), splunkd.log says that TcpOutProc is connected to Splunk Server. It also says that the Splunk server LISTEN to *:9997. > ss -tnlup tcp LISTEN 0 128 *:9997 *:* users(("splunkd",pid=170257,fd=41)) Assume telemytry data is sent to Splunkserver, but they are not indexed. One more information: On Splunk server: Settings - Data - Indexes I can see that _audit SplunkLighForwarder $SPLUNK_DB/audit/db status says disabled _internal SplunkLighForwarder $SPLUNK_DB/_internal/db status says disabled _introspection SplunkLighForwarder $SPLUNK_DB/_introspection/db status says disabled _telemetry SplunkLighForwarder SPLUNK_DB/_telemetry/db status says disabled history SplunkLighForwarder SPLUNK_DB/history/db status says disabled main SplunkLighForwarder PLUNK_DB/history /default/db status says disabled Assume it has something to do with wrong settings on Splunk server. Hope soemone out there can give me some usefull tips/hints. So we can use splunk again as normal. Rgds Geir J. H

gjhaaland · ‎09-19-2023

Forgot to mention When I open Data Summary it says "Waiting for results" but it never get/receive any data. Only Waiting for Results without ending. Rgds Geir

gjhaaland · ‎09-19-2023

Giuseppe, Thanks again, Yes, If I run search command and/or old reports we get no answer at all. The splunk gui is running, but we don't get any answer if we run search - index=*. Normally we will see a long listing with output. I have not deleted any files. All I have done is some settings regarding field extraction. After a while I discovered that we did not receive any data at all. So I must be some connection between fields (enable/disable) and fields extraction. Rgds Geir

gjhaaland · ‎09-19-2023

Hi gcusello Thanks for the answer. No answer at all, even if I run “Usage Reporting Dashboard” the answer is empty. Since it work perfect yesterday I thinks/assume that some files are blocking stopping normal behavior . If I restart splunkd I got following messages 1: Invalid key in stanza [admin_external:configure]in /home/splunk/etc/apps/TA-eStreamer/default/restmap.conf, line 7: python.version 2: your indexes and inputs configurations are not internally consistent. For more info run splunk btool -check –debug 3: Validating installed files against hashes from /home/splunk/splunk/7.1……..-x86_64manifest’ Problems were found, please review your files and more customization to local Starting splunk aerver deamon (splunkd) Done [OK} Rgds Geir If I run splunk btool -check –debug I got following error (cut/paste errors) No spec file for: /home/splunk/etc/apps/Splunk_CiscoSecuritySuite/local/css_views.co No spec file for: /home/splunk/etc/apps/TA-eStreamer/local/encore.conf No spec file for: /home/splunk/etc/apps/eStreamer/local/estreamer.conf No spec file for: /home/splunk/etc/apps/Splunk_CiscoSecuritySuite/default/css_views.conf No spec file for: /home/splunk/etc/apps/Splunk_CiscoSecuritySuite/default/eventgen.conf No spec file for: /home/splunk/etc/apps/TA-eStreamer/default/encore.conf Invalid key in stanza [admin_external:configure] in /home/splunk/etc/apps/TA-eStreamer/default/restmap.conf, line 7: python.version (value: python3). No spec file for: /home/splunk/etc/apps/eStreamer/default/estreamer.conf No spec file for: /home/splunk/etc/apps/firepower_dashboard/default/appsetup.conf No spec file for: /home/splunk/etc/apps/firepower_dashboard/default/umbrella.conf No spec file for: /home/splunk/etc/system/default/conf.conf No spec file for: /home/splunk/etc/system/local/migration.conf

gjhaaland · ‎09-19-2023

Hi, Splunk has been working for a long period without any trouble. When I changed settings yesterday (can't remember what I did) the search command dos not work as before (no answer). If I go to settings - indexing _audit, _internal , _introspection, _telemtry, _history + main area all of them is disabled. I also google, and it says that it perhaps has something to do identical id under db directory. We have same id on some files with .sentinel example: db_123_345_12 db_123_345_12.rbsentinel If I run following command: run netsat -an | grep 9997 we have many tcp session establised . Have of course rebooted, restarted splunk server several times. It does not help much. Thanks in advance. Hope someone can give me a hint. Rgds Geir

gjhaaland · ‎11-05-2019

Hi, For some reason I cannot access Splunk home page when login. I have Googled to find answer on it, but so far without any success. I could of cource be a missing file/folder or wrong file permisssion/owner. So I Wonder following: Is it possible to run an Upgrade from 7.1 to 8.0. Hopefully the missing home page will be restored. Or do someone seen it before. and can give me some hints

Posts	25
Solutions	0
Karma Given	3
Karma Received	0
Member Since	‎08-28-2019

Online Status	Offline
Date Last Visited	‎11-15-2023 04:38 PM

Remote desktop user

Timechart

Conditional timechart condiftion

Cluster map

Timechart

Combine two chart

Timechart presentation

Cannot getting data into indexes

SplunkEnterprise

How to get an answer from search command in Splunk...

Re: Remote desktop user

Remote desktop user

Re: Conditional timechart condiftion

Timechart

Re: Conditional timechart condiftion

Conditional timechart condiftion

Re: Cluster map

Re: Cluster map

Cluster map

Re: Timechart

Timechart

Re: Combine two chart

Combine two chart

Re: Timechart presentation

Timechart presentation

Re: Cannot getting data into indexes

Re: Cannot getting data into indexes

Re: Cannot getting data into indexes

Cannot getting data into indexes

SplunkEnterprise

Re: For some reason we cannot get answer from sear...

Re: For some reason we cannot get answer from sear...

Re: For some reason we cannot get answer from sear...

How to get an answer from search command in Splunk...

Ooops Page not found when I login