About dfurtaw

dfurtaw · ‎04-19-2022

Good day all, I come to seek guidance from the experts 🙂 My team and I have been tasked with creating an alert that will capture hosts that start a Windows AV scan (EventCode=1000) on a Friday and don't complete by Monday. These long running scans are causing issues in the environment and we are hoping to tackle them before the start of business on Monday. The hosts log EventCode=1001 OR EventCode=1002 when they have stopped their scan. We have attempted to put together a couple queries, one using a subsearch that grabs all hosts who have logged EventCode=1000 that is piped into an outer search that does a NOT EventCode=1001 OR EventCode=1002 and the second using the transaction command with the following syntax: <base search> | transaction maxspan=3d startswith=EventCode="1000" endswith=(EventCode="1001" OR EventCode="1002") keeporphans=true | where _txn_orphan=1 | stats count by ComputerName but get no results. I do know that the transaction command is a hog and is generally recommended against. I wanted to ask the collective any thoughts or ideas on this to see the best practice for this type of search. I have read a couple posts using streamstats but I'm not sure if this is the best route for this specific example here As always, it is greatly appreciated.

dfurtaw · ‎02-23-2021

Hi guys, I have done my due diligence scouring internet forums and docs but can't seem to figure out how to tailor this sedcmd I'm using in this query to remove everything after host. This log is from a mainframe system and is broken in a funky manner. I am wanting to keep the host entry that is bolded but remove everything after this. Can I get someone to assist me with the sedcmd and explain how to apply this "wildcard" to everything in the log not just the line in question? Log: Feb 23 11:45:51.469604 host-qa log {start 1614098751.47494} {addr xx,xx.xx.194} {port 85488} {method GET} {url /statictest.html} {bytes 399} {status 200} {end 1614098751.461997} {host 88.10.30.7} Feb 23 11:45:51.469604 nstop-qa CommonLog: Feb 23 11:45:51.469604 nstop-qa 10.13.80.7 - - [23/Feb/2021:11:45:51 -0500] "GET /statictest.html HTTP/1.0" 200 399 Feb 23 11:45:51.470248 host-qa ' Feb 23 11:45:51.470248 host-qa Query: basesearch | rex mode=sed field=_raw "s/{host.*//g" Results after I run this query Feb 23 11:45:51.469604 host-qa log {start 1614098751.47494} {addr xx,xx.xx.194} {port 85488} {method GET} {url /statictest.html} {bytes 399} {status 200} {end 1614098751.461997} Feb 23 11:45:51.469604 nstop-qa CommonLog: Feb 23 11:45:51.469604 nstop-qa 10.13.80.7 - - [23/Feb/2021:11:45:51 -0500] "GET /statictest.html HTTP/1.0" 200 399 Feb 23 11:45:51.470248 host-qa ' Feb 23 11:45:51.470248 host-qa

dfurtaw · ‎12-10-2020

Hey guys, I had a quick question that I am unable to get an answer for by googling/doc'ing. If I am wanting to tag a server by using /etc/system/local/inputs.conf, am I able to apply this _meta field to various sources as opposed to only sourcetypes? For example, we are needing to give specific tags to each respective log file location on a server. One location, will have _meta = altci::examplea and the other will have _meta = altci::exampleb. It would look like this: [default] hostname = $decideOnStartUp [F:\logFiles\inetpub\*.log] _meta = altci:examplea [C:\logFiles\inetpub\*.log] _meta = altci:exampleb Reason being is a few of our servers are legacy and host numerous sites/apps. Blah. I know it sucks, but it's a few old servers that are pretty important! Thanks!!

dfurtaw · ‎10-14-2020

Hi All, In our environment we are wanting to cut down on some windows event logs. There are quite a few logs that have specific message patterns and script names that we are wanting to discard. After researching and scouring the internet for ways to perform regex on a blacklist, I'm having trouble finding an example similar to mine. In our Windows Event Logs, we are seeing events still come through, even though we are attempting to blacklist them. Here is an example where the ScriptName is C:\WINDOWS\system32\WindowsPowerShell\v1.\powershell.EXE and is not being dropped, I have a feeling this is due to the regex in place and the .* not wanting to pick up whatever is after the initial C:\WINDOWS\ If anyone could shed any light on this, that would be much appreciated!! Message=Pipeline execution details for command line: $Col = new-object Data.DataColumn . Context Information: DetailSequence=1 DetailTotal=1 SequenceNumber=21 UserId=domain\AccountName$ HostName=ConsoleHost HostVersion=46545HostId=xxx-xxx-xx-xxxxHostApplication=C:\WINDOWS\system32\WindowsPowerShell\v1.0\powershell.EXE -command C:\WINDOWS\Script\debug-process.ps1 \EngineVersion=RunspaceId=-5e81---PipelineId=1 ScriptName=C:\WINDOWS\Script\debug-process.ps1 CommandLine= $Col = new-object Data.DataColumn Details: CommandInvocation(New-Object): "New-Object" ParameterBinding(New-Object): name="TypeName"; value="Data.DataColumn" 1 blacklist8 = EventCode="800" Message="domain\\AccountName" ScriptName=".+(?:C:\\WINDOWS\\Script\\.*)"

dfurtaw · ‎10-06-2020

Hi All, I am in an interesting predicament in the environment I work with where our traditional method of tagging devops hosts via UF (in props/transforms) will no longer suffice as the team is moving to kubernetes and using Splunk Connect to forward to the HEC on our SH. A few of our Splunk end-users are questioning our ability to dynamically create tags, which they rely heavily on when creating custom reports and dashboards. Long story short, I am curious if there is the ability to assign a field value (i.e, altci) to a tag when a log is sent to the HEC. I believe there may be the ability to do this on the indexer level as data is being sent through the indexing pipeline but I do not have any experience and I can't find any documentation that states this. I would appreciate any type of guidance on this matter. Thank you! Dan Ideally, it would be something like: If log has a field named altci, turn the field value into a tag=altcivalue.

dfurtaw · ‎08-04-2020

Hey Splunk world, After learning that the nullQueue option for eliminating unneeded data is required to be installed on an indexer as a props/transforms combo vs. placing it on a UF. I had one more question regarding this as I come into this roadblock quite a few times in our Splunk Cloud environment. Since we are on Splunk Cloud v 7.2, we run into rolling restarts on sourcetype additions and app installs. The way the folks in the admin realm have done things in the past is to add a props/transforms on a custom app, install it on the SH + Indexers and then allow those settings to globally apply across the environment on the specific sourcetype. Is there a different way of implementing the below props/transforms combo into our environment without causing the rolling restart via app install? I usually add extractions via the GUI and this allows me to not cause a rollin restart, but with the format required for this data manipulation, I'm not sure if I'm able to use the GUI. Mainly wanting to save time and not wait until our Saturday maintenance window to make a change. Splunk Cloud does not allow access to the server CLI per SH or indexer. PROPS [linux_audit] TRANSFORMS-null= setnull TRANSFORMS [setnull] REGEX = type=CWD | key=\"delete\" DEST_KEY = queue FORMAT = nullQueue Thank you!

dfurtaw · ‎07-22-2020

A little late on my reply, but it worked. Thanks Rich! I guess in some cases, we can SED on the UF.

dfurtaw · ‎07-22-2020

Hi Splunk Answer guys/gals, I have a question regarding DBConnect and I was curious if anyone had any insight on it. After reading the documentation, I'm still a bit unsure on how to use the DB Output feature that is included in dbconnect. I have dbconnect installed on one of our HF's but in order for the output command to work, I'll need to search the data that is in our Splunk Cloud instance. The HF is currently configured to send data to the indexers, but I'm stuck on figuring out how I'll be able to perform a query on the HF that will allow me to then send the data I return to a DB. Currently, I'm unable to pull any data on the HF. Thank you! DFurtaw

dfurtaw · ‎06-24-2020

Awesome. Thanks! Yes, it was on the UF of our Syslog relay farm. It was a SEDCMD that obfuscated some sensitive data. Host -> Syslog -> Splunk Cloud

dfurtaw · ‎06-24-2020

Thanks for the reply Rich! I recall in the past (6 or so months ago), I was able to place a SEDCMD in the props on a UF and saw the stripping of data. Did this change recently? By placing it in a props on the indexers, will this allow the data to be stripped BEFORE it enters the licensing phase? We are hoping to remove this large amount of unnecessary data before it hits this stage to limit ingestion.

dfurtaw · ‎06-24-2020

Hi All, I'm banging my head against a wall attempting to figure out why a SEDCMD inside of a props.conf on a UF isn't wanting to strip out the value I tell it to. We are wanting to strip out a hashed value from a log that is inside of a bracket (example below), as well as the brackets, with the SEDCMD. I am able to successfully test this command inside of the searchhead, but when I place it inside of the props.conf on the UF, I don't see it successfully implemented. I'm sure I'm missing something pretty simple. I've tried quite a few variations of this and no luck. Could anyone help me or possibly give me a hint as to what I could be doing wrong? Thank you all. | rex mode=sed field=_raw "s/\[ecid: .+?\]//g" [log4j] SEDCMD-random=s/\[ecid: .+?\]//g Sourcetype: log4j [2020-06-24T10:02:08.590-04:00] [Server] [NOTIFICATION] [] [] [tid: 394025] [userId: <anonymous>] [ecid: 3956b675-4930-42d5-9e7d-94ca9013d2ea-0037ac42,0:26:74:38:2010:52:52:71:38] [APP: oraclediagent2] [partition-name: DOMAIN] [tenant-name: GLOBAL] [oracle.odi.runtime.MrepExtId: 38392028449]

dfurtaw · ‎05-04-2020

Hi All, I'm a new Splunk admin working inside of a pretty large Splunk Cloud environment. Historically, the folks on the admin/engineering team have defined custom sourcetypes inside of a custom application that is installed on our SH's and indexers. They have created the sourcetype by adding a stanza in the props.conf and configuring the flags within the stanza. I'm all for best practices and I wanted to see if the Splunk community could weigh in and point me in the right direction of how I should be creating new custom sourcetypes. Would the best way be to create the sourcetype in the GUI? If so, which app should I be saving the sourcetype in? I could continue using the current process, although this process requires a rolling restart of our indexers and SH, which causes an outage during each update to the custom app. If there is any other information I should be including, please let me know. Thank you 🙂

dfurtaw · ‎02-23-2020

Got it. Thanks Rich.

dfurtaw · ‎02-23-2020

Hi guys, I'm working on studying for the Power user certification and I'm putting together a study guide for myself. I've been studying the PDF as well as a few flashcard study helpers online and I've come across a few questions that I'm a bit unsure of and I wanted to see if I could get a better explanation on them. I've scoured through every bit of the study material and I just can't get a definite answer. Wanted to see if any Splunkers could weigh in and help me out 🙂 I understand that when a search returns statistical values, it can be viewed as a chart (i.e, timechart, chart, stats, etc). One question that I'm unable to find a solid answer to in my PDF and notes is, "When a search returns _________, it can be viewed as a list. The options it gives are A. A list of events B. transactions, C. statistical values. My gut would say transactions, but it looks like the majority of study guides are saying that it is statistical values. This is confusing to me as I would assume that statistical values would imply a chart, and transactions (events grouped based on a field, etc) would return in a list, grouped by the transaction term. Could I get some extra insight into this? This has been on my mind for quite some time now! Another question I had that seemed a bit ambiguous was a question I saw was regarding the gauge command. I understand the gauge visualization is chosen when you are picking the type of visual on your panel, the gauge command itself, from my understanding is used to set values based on number ranges. A question I came across while scouring the internet mentions the command and asks it's purpose. The answers you can choose from are that it creates a single-value visualization, creates a radial gauge visualization or allows you to set colored ranges for a single-value visualization. I would go with the last answer because I believe that is actually what the command is used for. Could I get an extra opinion on this? Thank you guys so much. Again - I believe I have done my due dilligence, but these are a couple questions that I'm still a bit on the unsure side with. -DF

dfurtaw · ‎02-23-2020

Thank you! Along with the regex, the rtrim idea does what is needed!

dfurtaw · ‎02-23-2020

Thank you Rich. This extraction worked 🙂

dfurtaw · ‎02-21-2020

Inconsistency with file names coming from Microsoft AV hashes is causing alerts to populate null results when firing off after a file has been quarantined. Currently, we are matching the hashes based on a lookup that is generated by a saved search. We are having problems with our regex expression because the file names within the WinEvent Log message are not consistent. We are trying to extract the file name. Most of the time, our regex is successful in pulling out the file name for the field. However, there are times when the file name is not extracted properly due to the format of the log being different (returning values that append (GZIP) or other characters). The main problem is that we are seeing it showing the entire zip location and not just the actual file itself. Any suggestions to this would be awesome. The query being used to look at these events and extraction, then outputting to a lookup is: This report runs every 5 minutes and scans for new files and hashes. index=wineventlog (sourcetype="WinEventLog:System" OR sourcetype="WinEventLog:Microsoft-Windows-Windows Defender/Operational") EventCode=1120 (SourceName="Microsoft Antimalware" OR SourceName="Microsoft-Windows-Windows Defender") earliest=-5m@m latest=@m | rex field=Threat_resource_path "(?[^\\]$)" | stats count BY file_name ComputerName Hashes | fields - count | inputlookup append=t .csv | dedup ComputerName Hashes | outputlookup .csv Example of a log that has trouble with extraction: 02/20/2020 02:20:44 AM LogName=Microsoft-Windows-Windows Defender/Operational SourceName=Microsoft-Windows-Windows Defender EventCode=1120 EventType=4 Type=Information ComputerName= User=NOT_TRANSLATED Sid= SidType=0 TaskCategory=None OpCode=Info RecordNumber=33310 Keywords=None Message=Windows Defender Antivirus has deduced the hashes for a threat resource. Current Platform Version: 4.18.1911.3 Threat resource path: C:\Users\usergoeshere\AppData\Local\Google\Chrome\User Data\Default\Cache\f_019fa8->(GZip) Hashes: SHA1:5b803dc7f6c6ahashgoesheree0efadfbf6c5ba834; The file_name extraction wants to pull the entire f_019fa8->(GZip) as opposed to just f_019fa8. 😞

dfurtaw · ‎01-08-2020

Hey Rich - went ahead and updated the question with a query.

dfurtaw · ‎01-08-2020

A scheduled report runs once every sunday and does not return all of the data that we need. I fear that it is hitting a quota or limit but I'm unable to find any noteworthy information after inspecting the job. This report takes 00:57:10 to run. More context: The report shows a stats table and list events by chronological order for the previous week, it looks like most of the results returned were the most recent, it doesn't want to return the older events (longer than 2 days into the report). If I run an ad hoc search on results for a smaller time range, I return results that I should be seeing in the report. Error I'm seeing in the search.log (although I see this in reports that complete) 01-05-2020 08:20:44.434 INFO PipelineComponent - Process delayed by 3429.056 seconds, perhaps system was suspended? Any suggestions on troubleshooting techniques? Events: 15,891,316 5.01 MB Query: (index=wineventlog sourcetype=wineventlog:security EventCode=numberofcode [| inputlookup nameofcsv.csv | fields Account_Name]) OR (index=linux sourcetype=linux_secure [| inputlookup nameofcsv.csv | rename Account_Name as user | fields user]) OR (index=indexname sourcetype=sourcetypename authentication_category=login [| inputlookup nameofcsv.csv | rename Account_Name as src_user | fields src_user]) OR (index=mssql sourcetype=mssql:audit [| inputlookup nameofcsv.csv | rename Account_Name as server_principal_name | fields server_principal_name]) OR (index=indexname sourcetype=sourcetypename [| inputlookup nameofcsv.csv | rename Account_Name as user | fields user]) | rename Account_Name as tmp_user user as tmp_user src_user as tmp_user server_principal_name as tmp_user | mvexpand tmp_user | search [| inputlookup nameofcsv.csv | rename Account_Name as tmp_user | fields tmp_user] | eval var_user=lower(tmp_user) | stats max(_time) AS Last_Login by var_user | convert ctime("Last_Login") | lookup nameoflookup Account_Name as var_user OUTPUTNEW dn

Posts	19
Solutions	0
Karma Given	8
Karma Received	2
Member Since	‎01-08-2020

Online Status	Offline
Date Last Visited	‎04-20-2022 11:39 AM

Quick SPL help with Windows Logs!

Help with SEDCMD

Question regarding _meta on multi-tenant hosts

Question on Regex for Windows Event Blacklist

Field Values to Tags?

Best Practice for Adding a Transforms on Indexers

How to perform a query on the HF that will allow m...

Help with SEDCMD in Props.conf

Best Practice for Creating New Sourcetype - Splunk...

Help With Fundamentals 1 and 2 Questions

Quick SPL help with Windows Logs!

Help with SEDCMD

Question regarding _meta on multi-tenant hosts

Question on Regex for Windows Event Blacklist

Field Values to Tags?

Best Practice for Adding a Transforms on Indexers

Re: Help with SEDCMD in Props.conf

How to perform a query on the HF that will allow m...

Re: Help with SEDCMD in Props.conf

Re: Help with SEDCMD in Props.conf

Help with SEDCMD in Props.conf

Best Practice for Creating New Sourcetype - Splunk...

Re: Help With Fundamentals 1 and 2 Questions

Help With Fundamentals 1 and 2 Questions

Re: Help With Extractions Involving Microsoft AV H...

Re: Help With Extractions Involving Microsoft AV H...

Help With Extractions Involving Microsoft AV Hashe...

Re: Scheduled report returning incomplete results

Scheduled report returning incomplete results