Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About rossikwan
rossikwan
Path Finder
Member since:
09-17-2010
11-26-2020
Community Statistics
| Posts | 22 |
| Solutions | 2 |
| Karma Given | 18 |
| Karma Received | 7 |
| Member Since | 09-17-2010 |
Activity Feed
- Got Karma for Re: What variables can you use in email subject?. 01-30-2023 04:40 AM
- Karma Re: Configure Ldap role mapping showing only 999 iteams for gooza. 06-05-2020 12:46 AM
- Karma Re: Question on heavy forwarder for lguinn2. 06-05-2020 12:46 AM
- Karma Re: Why are the default values of max_searches_per_cpu and base_max_searches in limits.conf lowered in 5.x? for mchang_splunk. 06-05-2020 12:46 AM
- Karma Re: variables indicating the time range of the interactive search selection ? for Ayn. 06-05-2020 12:46 AM
- Karma Re: Events recevie date & time for Ayn. 06-05-2020 12:46 AM
- Karma Re: Events recevie date & time for datasearchninja. 06-05-2020 12:46 AM
- Karma Re: Splunk User is Created automatically when i done a splunk installation ?? for lcrielaa. 06-05-2020 12:46 AM
- Karma Re: Subsearch results display in different columns with same field by differenet timerange for imrago. 06-05-2020 12:46 AM
- Karma Re: Splunk shows vulnerable to CVE-2012-4929 in my Nessus vulnerability scan, what is going on? for jbsplunk. 06-05-2020 12:46 AM
- Karma Splunk shows vulnerable to CVE-2012-4929 in my Nessus vulnerability scan, what is going on? for ahattrell_splun. 06-05-2020 12:46 AM
- Karma Re: query when the field might not exist for Ayn. 06-05-2020 12:46 AM
- Karma Re: Best method for pulling Microsoft DNS logs with Splunk for _d_. 06-05-2020 12:46 AM
- Got Karma for Re: Scheduled PDF Email displays charts that are still "loading". 06-05-2020 12:46 AM
- Karma LDAP on AD not returning all groups - even with filtering for FunPolice. 06-05-2020 12:45 AM
- Karma Re: LDAP on AD not returning all groups - even with filtering for gkanapathy. 06-05-2020 12:45 AM
- Karma Re: What variables can you use in email subject? for bmunson_splunk. 06-05-2020 12:45 AM
- Karma Re: SplunkWeb fails to start - timeout when binding to port for Paolo_Prigione. 06-05-2020 12:45 AM
- Karma Re: width adjustable table for bwooden. 06-05-2020 12:45 AM
- Karma Routing to nullQueue based on extracted field for Paolo_Prigione. 06-05-2020 12:45 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
10-02-2019
01:23 AM
Hi,
Configured the proxy for retrieving threat intelligence in Enterprise Security and its succesfully retrieved those feed.
As the local Splunk server DNS query will be stopped for external Internet name query soon, I am in doubt that the retrival of the threat intelligence will be failed as the Enterprise Security can't have the DNS query results from the proxy server.
Will it need to keep the local Splunk server have the external DNS query in order to have the retrieving threat intelligence succesful?
... View more
03-03-2015
01:27 AM
As the Splunk Universal Forwarder installed 3 yrs ago (1,094 days) & it doesn't upgraded.
The SSL certificate used in 8089 management port will be expired & be changelled by auditors.
According to the nrpeter's comment in below URL, the server.pem (used for the SSL certification) located in /opt/splunkforwarder/etc/auth will be recreated while it's missing when Splunkd start.
http://answers.splunk.com/answers/33308/splunk-fowarder-ssl-error-error-tcpoutputproc.html
As a result, except to upgrade the Splunk Universal Forwarder to latest version, we could remove the server.pem and restart the Splunk UF.
And we could use below command to check the renewed certification information. Hope this help.
command:
/usr/bin/openssl s_client -connect localhost:8089
OR
/usr/bin/openssl s_client -connect 127.0.0.1:8089
And the results could be checked by below online services.
Decode SSL certificate Online
https://www.trustico.com/ssltools/decode/certificate-pem/decode-certificate.php
... View more
01-23-2014
01:50 AM
try using the openssl located in /usr/bin or type the absolute path as below
/usr/bin/openssl genrsa -des3 -out mySplunkWebPrivateKey.key 2048
... View more
01-23-2014
01:47 AM
Got this problem too and try to use absolute path for the /usr/bin/openssl as below
/usr/bin/openssl genrsa -des3 -out mySplunkWebPrivateKey.key 2048
It's because the path "/opt/splunk/bin" in environment variable $PATH$ is located before the "/usr/bin"
... View more
12-08-2013
08:21 PM
tried this props.conf, but didn't work 😞
Any hints?
props.conf
TIME_PREFIX = "\d*"\s"
MAX_TIMESTAMP_LOOKAHEAD = 21
TIME_FORMAT = %d%b%Y" "%H:%M:%S
... View more
12-05-2013
01:41 AM
For below list of data stored in a files, the first line is the fields name and exact data is started on 2nd line.
However, after indexed, it merged to a single events instead of multiple events.
How could the events break down into multiple events? Thanks.
"Number" "Date" "Time" "Interface" "Origin" "Type" "Action" "Service" "Source Port" "Source" "Destination" "Protocol" "Rule" "Rule Name" "Current Rule Number" "User" "Information" "Product" "Source Machine Name" "Source User Name"
"2495" "5Nov2013" "0:00:10" "Internal" "uabcabc" "Log" "Drop" "microsoft-ds" "1164" "123.123.123.123" "www.abcabc.com" "tcp" "52" "" "" "" "" "VPN-1 Power/UTM" "" ""
"2523" "5Nov2013" "0:00:13" "Internal" "uabcabc" "Log" "Drop" "http" "50895" "123.123.123.123" "www.abcabc.com" "tcp" "14" "" "" "" "" "IPS Software Blade" "" ""
"2524" "5Nov2013" "0:00:13" "Internal" "uabcabc" "Log" "Drop" "http" "50898" "123.123.123.123" "www.abcabc.com" "tcp" "14" "" "" "" "" "IPS Software Blade" "" ""
... View more
07-31-2013
01:18 AM
Ref:
http://docs.splunk.com/Documentation/Splunk/5.0.3/SearchReference/Fillnull
... View more
03-15-2013
03:16 AM
Thanks and could there a method to show when did that event indexed in Splunk?
... View more
03-14-2013
06:34 PM
After the events received, how to identify the events receiving date & time?
... View more
08-08-2012
11:47 PM
Hi all,
I have below Splunk setup for the various kind of servers events,
Main indexer: Linux Redhat installed with Splunk indexer, search head, (for UNIX UF, Linux UF, syslog, etc)
Domain joined Windows server with Splunk UF installed (for WMI pull events, shared files, etc)
Since I would like to monitor the missing status of the UNIX & Linux UF, the "missing forwarders search" in Splunk Deployment Monitor app is working fine for those hosts received from UF. It does a really great job at all.
But, since most of the Windows WMI events is pulled from the Windows Server (with UF), and that's mean the "missing forwarder search" isn't represent for the WMI host missing status.
Could anyone help that any hints to check the missing Windows host in this WMI inputs?
P.S. I am thinking that use "diff" to compare the list of hosts for WMI events in 2 period of time, and I think there should have a faster & elegant way for this. Thanks in advance.
... View more
06-13-2012
03:20 AM
6 Karma
Except the $name$, is there any useful example in that xml?
I found some of it & listed below (not tested), is it fine to add $xxx$ in the email subject?
$search$
$description$
$timerange$
$alert.severity$
... View more
01-19-2012
12:42 AM
Works like a Charm, thanks 🙂
... View more
12-22-2011
07:59 PM
This is a slow way to list
"* | top sourcetypes by host"
host, sourcetype, count, percent
hostA, AAA, XXX, YY
... View more
12-22-2011
07:40 PM
sourcetype=xxx earliest=-1d@d latest=-0d@d | stats count by host | append [search earliest=-2d@d latest=-1d@d | stats count by host] | sort -count -host
The results displayed as below:
host count
hostA 6080
hostA 6182
hostB 3023
hostB 3238
...
...
And I would like the results displayed as below:
host p1d_count p2d_count
hostA 6080 6182
hostB 3023 3238
...
...
Is there a simple way to make the results for easily read & presentable?
Thanks.
Rossi
... View more
11-20-2011
11:14 PM
in UNIX app, there has script to retrieve the last from various OS include IBM AIX, SUN Solaris, Linux different distribution... Thanks.
... View more
11-14-2011
10:50 PM
Let's check how these apps could be help in this items. Get back here after check, thanks
... View more
11-14-2011
10:49 PM
Yes, other kind of data are already sent to Splunk instance and could be searched & reporting.
And I tried to use "script input" which using "last" command is not success, due to formatting as below stated.
http://splunk-base.splunk.com/answers/5844/can-i-splunk-my-wtmp-files
"This can be more elaborate since "last" doesn't have tailing or time span selection capabilities, but advanced shell scripting and cron can be used to set this up."
[Script Input]
"/usr/bin/last -f /opt/logs/acctlog/wtmpx.20111114"
where wtmpx.$DATE$ is the last date "/var/adm/wtmpx" truncated.
... View more
11-13-2011
09:33 PM
Hi all,
My UNIX (Solaris) host installed Splunk universal forwarder in which some kind of monitor in inputs.conf is successful indexed.
But I would like to retrieve daily login information for the UNIX servers without luck to retrieve the events from last command.
Could anyone here help for the UNIX login info. to br indexed to Splunk?
Thanks
Rossi
... View more
08-31-2011
03:28 AM
1 Karma
Yep, some of my scheduled pdf not show all of the results even it could be seem in the views. And it's seems that no solution right now.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
11-26-2020
02:52 AM
|
Karma from
