Questions tagged [splunk]

For questions about Splunk, a software product used for searching, monitoring, and analyzing machine-generated data.

Filter by
Sorted by
Tagged with
1 vote
0 answers
261 views

net.core.netdev_max_backlog - what's the impact when set too HIGH?

I'm working on optimizing and right-sizing my EC2 syslog-ng servers and have some carryover settings in our ansible playbook for kernel settings that were used on "in-house" data center ...
jasonr's user avatar
  • 11
0 votes
1 answer
361 views

splunk and ansi escape sequences?

Is there any way to have ANSI color output on my logs and also consume them in splunk? either having splunk show the color (ideal but highly unlikely) or apply a filter on splunk to remove the escape ...
gabriel's user avatar
  • 23
0 votes
1 answer
8k views

how do I fix this? Ip contains set host bits?

I am setting up a ubuntu server (ver 22.04) so I can place a universal forwarder for Splunk on it and redirect FortiGate traffic to the SIEM (Splunk). In total there are 6 virtual machines that i am ...
harryb1912's user avatar
1 vote
1 answer
454 views

One capture group value becomes the field name for the next capture group

I'm using PCRE2 (PHP >=7.3) in Splunk. I have data that is major delimited by carriage returns/new lines and minor delimited by commas as key/value pairs. key1="value1",key2="value2&...
Tensore's user avatar
  • 73
0 votes
0 answers
67 views

How can I merge multiple individual worksheets in an Excel workbook that are in the same format (but different lengths)?

I have an inherited (and sometimes still-updated) workbook with many worksheets (currently 50+). Each of these tabs has a table in the format of: segment_name | subsegment | subnet | ipaddress ^^...
warren's user avatar
  • 10.1k
1 vote
1 answer
611 views

WinEventLog for monitoring BitLocker

I am a Newbie to Splunk and working on monitoring the BitLocker process. I wondered if I could leverage any Windows Security logs to check whether the BitLocker was enabled by someone to encrypt files ...
Marklov's user avatar
  • 11
0 votes
0 answers
146 views

How to prevent malicious use of BitLocker

I was wondering if anyone has thought about a scenario in which BitLocker can be used as ransomware. For example, if the hacker was granted access to the system, and used BitLocker to encrypt the disk....
Marklov's user avatar
  • 11
2 votes
2 answers
1k views

How to query events that happened in a specific order?

Say I have the following events in Splunk (ordered chronologically): operator=zeroPointModule id=123 action=start operator=foobar id=123 action=start operator=zeroPointModule id=123 action=stop ...
pyb's user avatar
  • 172
0 votes
1 answer
2k views

Can't access Splunk Enterprise from Web GUI

I installed Splunk Enterprise 8 splunk-8.0.0-1357bef0a7f6-linux-2.6-x86_64.rpm but due to low space, I attach new HDD 50GB and created a partition and mounted it on /opt. Then I moved all the data ...
OmiPenguin's user avatar
0 votes
2 answers
1k views

Dedup is not working on Splunk

Please see picture below. I inserted dedup for job_duration, but it was not showing in the search result. I only need one result to do visualisation.
Jeng Chong's user avatar
0 votes
1 answer
58 views

How can I monitor a process being or arguments of a specific utility in my network?

Adversaries may use InstallUtil to proxy execution of code through a trusted Windows utility. It can also be used to bypass process whitelisting through use of attributes within the binary that ...
Daniyal Naeem's user avatar
1 vote
0 answers
108 views

Is it possible to add blank lines in between results when using Spunk CLI search?

I'm using RHEL 6.10 and using the Splunk CLI to find "transactions" (groups of results together). It is searching for rtvscand log lines. /opt/splunk/bin/splunk search \ 'syslog_source=rtvscand | ...
hymie's user avatar
  • 1,266