We’re rewarding the question askers & reputations are being recalculated! Read more.

Questions tagged [splunk]

For questions about Splunk, a software product used for searching, monitoring, and analyzing machine-generated data.

Filter by
Sorted by
Tagged with
0
votes
0answers
18 views

*nix firewall failure logs - Splunk Alert

I need a Splunk alert to detect firewall failures. I figured out windows firewall failures from the relevant event codes like 5025, 5027...etc. I'm not able to find any way to detect *nix firewall ...
0
votes
0answers
11 views

Use Splunk to create an alert to Glip

The process has been to set up an alert to look back 1 minute with a snap to the start and end of the minute. This process would not trigger on all log entries. The process was changed to a 5 minute ...
0
votes
1answer
29 views

Dedup is not working on Splunk

Please see picture below. I inserted dedup for job_duration, but it was not showing in the search result. I only need one result to do visualisation.
0
votes
0answers
113 views

bases search with tstats in Splunk

I've built a dashboard that has functions   tstats and search ID It uses The problem here is that it does not show the output in the sub-queries For example, the main search is as follows search id = ...
0
votes
0answers
21 views

Splunk is not triggering action

Our system has Splunk installed and indexing a directory for log files. A search string of "uploaded file" is set at All time (real-time). The search is saved as an alert. When creating the alert real-...
0
votes
0answers
27 views

How to reduce my nmon_data as it's using most of my license?

I tried changing the nmon.conf and I changed: # Default is longperiod_high #mode="longperiod_high" mode="longperiod_low" # Refresh interval in seconds, Nmon will use this value to refresh data each ...
0
votes
0answers
172 views

Splunk alert manager app - No alerts indexed

I have installed alert manager app and followed documentation for installation. I have Splunk 7.2.4 on a single instance server and Alert manager 2.2.0 add-on. I also installed Python for scientific ...
0
votes
1answer
39 views

How can I monitor a process being or arguments of a specific utility in my network?

Adversaries may use InstallUtil to proxy execution of code through a trusted Windows utility. It can also be used to bypass process whitelisting through use of attributes within the binary that ...
0
votes
0answers
46 views

Is it possible to add blank lines in between results when using Spunk CLI search?

I'm using RHEL 6.10 and using the Splunk CLI to find "transactions" (groups of results together). It is searching for rtvscand log lines. /opt/splunk/bin/splunk search \ 'syslog_source=rtvscand | ...