About Splunk77

Splunk77 · ‎02-13-2024

Anyone know how and what path to query on splunkcloud instance to pull existing SAML configuration details and certificate? I can view the information by browsing to settings -> authentication method -> SAML -> SAML configuration. I want to be able to export that information if it is captured in a file as a backup prior to migrating to different authentication method. Thanks in advance.

Splunk77 · ‎12-01-2023

I am working on upgrading an instance of heavy forwarder that is running an out of support version of 7.3.3. In order to upgrade this to 9.0.1, is there another version level this must be upgraded to prior to bringing it to version 9.0.1? I searched for upgrade path and no luck. Thanks.

Splunk77 · ‎09-28-2023

What is the fastest way to run a query to get an event count on a timechart per host? This is for windows events and I want to get a list of how many events each device is logging per month so that I can identify the increase/decrease. They are all ingested in one index. A query like this will take a while to run if run for about a year. Is there a faster way to get this data? index=<index_name> | timechart count by Computer span=1mon Thanks.

Splunk77 · ‎05-09-2023

Running this query and not quite getting the desired results. I have test events generated within a 2 minute window. Expanded maxspan to 5 minutes to capture a larger window.

Splunk77 · ‎05-09-2023

I am working on a query to report on events generated within 2 minutes of the first event for the same host. In the following example, I need a query to look for any occurrence of EventType 4697 within two minutes of EventType 4624 for the same ComputerName ComputerName=x (This is a unique field) EventType=4624 EventType=4697 Thanks.

Splunk77 · ‎03-08-2023

I am working on a query to report on host/s that have triggered two different event types. For example windows event IDs 4697 and 4698, if triggered by the same host, rule must alert. EventType =4697 EventType =4698 HostName=What is the best way to imply host name being unique to the eventtypes. To further clarify, if the same host triggers 4697 and 4698 in a 5 minute window, I want to report on that. Thanks in advance.

Splunk77 · ‎02-09-2023

What I am looking for might be something even simpler. If I can get the total log volume per day and set up a threshold for alerting that will work. I was thinking log volume for most indexes (log sources) do tend to drop on the weekends. Perhaps there is a threshold that can be set up based on the day of the week. Weekends vs week days. Any such way to accomplish this?

Splunk77 · ‎02-09-2023

I am trying to monitor drop in events per index. What is the best way to get a baseline and detect deviation to the volume? I am more interesting in drop in events and not increase.

Splunk77 · ‎02-03-2023

I am writing a query to correlate across two different indexes. One index has userID field. I want the query to match a field in the second index and output additional fields from the second index. index 'idx1' has field name usr. For the sake of this example, there is a user called 'jdoe' index 'idx2' has a field name called user, which contains 'jdoe' along with another field called account ID, which has the name spelled out 'John Doe'. I want the query to use the usr field content from idx1 and use that info to pull the contents of 'account ID' field in index. What's the best way to accomplish this?

Splunk77 · ‎01-10-2023

I have a look up table with two columns. They are for source IP and destination IP addresses. I want to be able to search for firewall traffic logs and filter out any source IP and destination IP combination from the results. The following query allows for excluding source_ip from the lookup table. How would I be able to exclude source_ip and destination_ip combination? index=firewall sourcetype=<source_type> NOT [ | inputlookup test.csv table source_ip] | table _time, source_ip, destination_ip, action, protocol Thanks.

Posts	10
Solutions	0
Karma Given	0
Karma Received	0
Member Since	‎01-10-2023

Online Status	Offline
Date Last Visited	a week ago

Curl request tp admin config service

Heavy forwarder upgrade

What is the fastest way to run a query to get an e...

How to write events within 2 minutes of the first ...

How to create a query for alerting two different e...

How to monitor deviation to log volume?

How do I correlate across two log sources?

How would I be able to exclude source_ip and desti...