The dojo of Splunk. Learn, share, teach, mentor.
Videos
Latest Activity
Michael Wilde replied to Nikita's discussion Count failures and success via transaction"How are these transactions linked together... by a field called "ID"? If so.. just build them with the field ID, and then use one of the MV commands to extract a field with success or failure in it. Paste some samples and…"
bizza's Discussions
WinEventLog:Security filter
Hi all,i have some problems to filter logs from windows forwarders (not light forwarder).Example:LogName=SecuritySourceName=SecurityEventCode=540EventType=8Type=Success…Continue
Started Feb 3, 2010
bizza's Page
Gifts Received
bizza has not received any gifts yet
Latest Activity
"hi,
which distros are you using?
Rhel (and sles) has it own tool to deploy software and/or configurations.
Or you can install splunk using a script and ssh (with key auth) to automate the process.
An other solution is deploy software using…"
WinEventLog:Security filter
Hi all,i have some problems to filter logs from windows forwarders (not light forwarder).Example:LogName=SecuritySourceName=SecurityEventCode=540EventType=8Type=Success AuditComputerName=ISAPROXYUser=userxxxSid=S-1-5-21-127xxxxx01-97xxxxx52-4263xxxxx-xxxxSidType=1Category=2CategoryString=Logon/LogoffRecordNumber=3991297Message=Successful Network Logon: User Name: myuser Domain: XXXIT Logon ID: (0x0,0x4D7D2B66) Logon Type: 3 Logon…See More
Profile Information
- Are you an existing splunk user?
- Licensed
- What do you do for your day job?
- Track security events
- Web / Blog Address
- http://www.rm-rf.eu
Comment Wall
- No comments yet!
© 2012 Created by Michael Wilde.
