About hettervik_new

hettervik_new · ‎05-15-2023

There is a search endpoint on Splunk for running searches remotely via the REST API and stream back the search results as they become available (search/v2/jobs/export). There also is a rest command in Splunk. One would think that it is possible to use the rest command to run searches on the endpoint "search/v2/jobs/export", for example like this. | rest /services/search/v2/jobs/export splunk_server=local search="123" However, I get the error message "Method Not Allowed" when I'm trying to do this. Suspect this is because the enpoint is expecting a HTTP POST, not HTTP GET. Has anyone managed to do a search on this API endpoint like this using the rest search command, or have any idea on how to do it?

hettervik_new · ‎12-14-2022

I have a correlation search in Splunk ES that does some statistics, and return a table with the events; "src_ip", "dest_ip", "count", "latest", "action", "app", "src", "dest", and "dest_port". The search looks something like the following. | tstats count latest(_time) as latest values(All_Traffic.action) as action values(All_Traffic.app) as app values(All_Traffic.src) as src values(All_Traffic.dest) as dest values(All_Traffic.dest_port) as dest_port from datamodel=Network_Traffic where All_Traffic.dest_ip=1.2.3.4 by All_Traffic.src_ip All_Traffic.dest_ip | rename All_Traffic.* as * When this correlation search triggers it writes an event to the notable index, and that notable event contains the fields that are outputed from the search, except src_ip and dest_ip. Note that I'm talking about the notable index here, not the incidents showing in the Incident Review. I've looked in the documentation for an explanation of this behaviour, but can't find anything. Can someone explain to me how Splunk picks which fields are to be written to the notable index events, and if possible, how one can force Splunk to write all fields from the search to the notable index?

hettervik_new · ‎12-14-2022

Hi. There are a defined list of field names that will show up in Incident Review in Splunk ES. To get a new field added to that list, i.e. "unique_count", you must add it in the list "Incident Review - Event Attributes" under Configure > Incident Management > Incident Review Settings.

hettervik_new · ‎11-23-2022

Yes, I know, but say someone indeed does run the delete command on all data, it could still create some a fair amount of downtime before the Splunk admins are able to figure out what's wrong and restore all the data. If somebody deletes data say before a weekend or a holiday, the downtime would be even greater. Also, I'm aware that normally the admin rights are needed to access the delete command, but in my Splunk environment the delete command is basically never needed, so it adds no benefit, but adds a risk. I'm guessing this is the case for a lot of other customers as well. Thus, removing the option completely from the search head would be the best and most secure solution.

hettervik_new · ‎11-17-2022

My proposed answer is stated in the post. Just wanted to share. Also, if you think this solution should be a default part of Splunk, feel free to give my idea a thumb up: https://ideas.splunk.com/ideas/EID-I-1667

hettervik_new · ‎11-17-2022

As of today data models, like the Network Traffic data model, have fields for src, src_ip, dest and dest_ip, but not src_dns and dest_dns. The way I understand it, DNS names should then be used in the src and dest fields, and IPs in the fields src_ip and dest_ip. Some logs don't have DNS names available in the log itself. However, if you have Splunk ES with a populated asset framework, it will automatically add the field src_dns and dest_dns to the events if the fields src and dest are already available. If I want the fields src_dns and dest_dns from the events to be added to the src and dest fields in the data model, I would normally solve this by adding a coalesce for src in props.conf for the source type, but since lookups are applied after evals in the search time parsing, this is not possible when src_dns and dest_dns comes from a lookup, as in the case with Splunk ES. Therefore I propose the following change to the data models themselves, for all datamodels that are using the src and dest fields: Change the eval for src from if(isnull(src) OR src="","unknown",src) to case((isnull(src_dns) OR src_dns="") AND (isnull(src) OR src=""),"unknown",NOT (isnull(src_dns) OR src_dns=""),src_dns,true(),dest) and likewise change the eval for dest from if(isnull(dest) OR dest="","unknown",dest) to case((isnull(dest_dns) OR dest_dns="") AND (isnull(dest) OR dest=""),"unknown",NOT (isnull(dest_dns) OR dest_dns=""),dest_dns,true(),dest)

hettervik_new · ‎11-17-2022

Okay, update on this. I've been looking into federated search, and realize that one can use this to guarantee that the users cannot delete data on the Splunk indexers, and more. Let me explain. If you have a Splunk deployment with a search head, let's call it "main SH", then you can set up an extra search head, let's call it "external SH". You could then give access to users, all or only the "risky" ones, on the external SH, and set up a federated search option from the external SH to the main SH. Then, even if a user on the external SH gets full admin rights, and even if they are able to get root on the external SH server, they still would not be able to elevate their privileges on the main SH. This is kind of an extreme solution, that adds a lot of complexity to your Splunk deployment. Preferably, if there was a way to disable the "can_delete" capability on the SH without being able to re-add it through the Splunk web, that would have been easier, but as of now this seems to be the only way. If someone agrees that there should be an option to safely remove the "can_delete" capability, feel free to give my post in Splunk Ideas a thumb up: https://ideas.splunk.com/ideas/EID-I-1687

hettervik_new · ‎11-11-2022

Hi, One thing that doesn't seem to be documentet, is how Splunk handles Linux file permissions when files from the deployer is pushed to the search head cluster. Docs: https://docs.splunk.com/Documentation/Splunk/9.0.2/DistSearch/PropagateSHCconfigurationchanges For example, I have an app "/opt/splunk/etc/shcluster/apps/my app". This app has a script under "/opt/splunk/etc/shcluster/apps/my app/bin/helloworld.sh". This script has the permission "-rwxr-x---" on the deployer, but if I push the script to the search head cluster it gets the permission "-rw-rw-r--" on the search head cluster members. Note that the executable permission is removed, making the script not usable. I'm using Splunk version 9.0.2 on both the deployer and the search head cluster members. Also, a colleague of mine is having the same problem, so I don't think is something wrong with my Splunk environment in particular. Is anyone else experiencing this problem, and is there a workaround?

hettervik_new · ‎11-08-2022

I know that I can get the current size of an accelerated data model using REST or just using the web GUI under settings "Data models", but how can I see the historical (disk) size of the accelerated data model over time?

Posts	9
Solutions	1
Karma Given	5
Karma Received	0
Member Since	‎10-05-2022

Online Status	Offline
Date Last Visited	‎05-16-2023 10:41 AM

Is it possible to run a Splunk search via the REST...

Why are my correlation search fields missing from ...

How to change src and dest field in data models to...

How to retain Linux file permission when files are...

Is there a way to see the size of an accelerated d...

Is it possible to run a Splunk search via the REST...

Why are my correlation search fields missing from ...

Re: Notable Event Custom Fields

Re: Is there any way to securely disable the delet...

Re: How to change src and dest field in data model...

How to change src and dest field in data models to...

Re: Is there any way to securely disable the delet...

How to retain Linux file permission when files are...

Is there a way to see the size of an accelerated d...