Category Archives: splunk

Splunk SAML integration with AAD

Posted on March 17, 2020 by xli14

Here is the article for reference. https://www.splunk.com/en_us/blog/cloud/configuring-microsoft-s-azure-security-assertion-markup-language-saml-single-sign-on-sso-with-splunk-cloud-azure-portal.html For object ID referenced herein, this is the connection between Azure AD and splunk. When do the saml authentication, ID Service (Splunk) will get all groups of a users through group claims, if … Continue reading →

Posted in saml, splunk | Leave a comment

splunk cmdlet

Posted on January 9, 2020 by xli14

Check Splunk Env: /opt/splunk/bin/splunk cmd python -c “import os; print(os.environ)” Reload Splunk App: /opt/splunk/bin/splunk _internal call /services/apps/local/splunk_app_db_connect/_reload list users and roles:  | rest /services/authentication/users | table title realname roles type email List current logon users: | rest /services/authentication/current-context | table … Continue reading →

Posted in splunk, Uncategorized | Tagged | Leave a comment

Splunk filter AD computer authentication events

Posted on March 6, 2019 by xli14

We have a local splunk environment almost reaching our license threshold. One option is to filter unnecessary event. Previous we have filtered some windows EventID ( backlist ), but now windows Events still is one of the big volume, among … Continue reading →

Posted in splunk | Tagged | Leave a comment

Ingest Azure NSG flow into splunk

Posted on March 6, 2019 by xli14

Recently for troubleshooting purpose, I need to import the NSG flow logs to splunk for easy search and troubleshoot, though azure network watcher is a traffic analytic tool, I still don’t know much how to use it, for example, to … Continue reading →

Posted in splunk, Uncategorized | Leave a comment

No Log on Splunk

Posted on July 30, 2018 by xli14

This happened at least twice. Normally you data indexed in splunk server, all of a sudden, some log is missing and splunk alert comes “No data from some host for last 1 hour”. Nothing changed for the environment. One time, … Continue reading →

Posted in splunk | Leave a comment

Splunk – Summary index

Posted on July 13, 2018 by xli14

Enable summary index for the search ( index=”index” | stats count by dest_hostname | collect   index=summary_index_test         )  every hour. The effect is huge: no sumary search takes about 1 minute for last 4 hours statistics summary index … Continue reading →

Posted in splunk | Leave a comment

Splunk – bucket lexicons and segmentation – save storage

Posted on July 3, 2018 by xli14

Splunk – bucket lexicons and segmentation About Segmentation Event segmentation is an operation key to how Splunk processes your data as it is being both indexed and searched.  At index time, the segmentation configuration determines what rules Splunk uses to extract … Continue reading →

Posted in splunk | Tagged , , , | Leave a comment

splunk cmd walklex

Posted on July 3, 2018 by xli14

splunk cmd walklex some_tsindx_file.tsidx “” # ll rawdata/ total 110384 -rw——- 1 splunk splunk 85337 Jun 21 15:38 1179739938 -rw——- 1 splunk splunk 112649873 Jun 21 15:38 journal.gz -rw——- 1 splunk splunk 285066 Jun 21 15:38 slicesv2.dat # pwd /opt/splunk/var/lib/splunk/fortinet/db/hot_v1_8685 … Continue reading →

Posted in splunk | Tagged | Leave a comment

splunk tstats –> much faster than stats on indexed fields

Posted on July 3, 2018 by xli14

http://docs.splunk.com/Documentation/Splunk/7.1.1/SearchReference/Tstats tstats Description Use the tstats command to perform statistical queries on indexed fields in tsidx files. The indexed fields can be from normal index data, tscollect data, or accelerated data models. Syntax | tstats [prestats=<bool>] [local=<bool>] [append=<bool>] [summariesonly=<bool>] [allow_old_summaries=<bool>] [chunk_size=<unsigned int>] <stats-func>… [FROM … Continue reading →

Posted in splunk | Tagged | Leave a comment

Splunk Event Segmentation

Posted on July 3, 2018 by xli14

  Segmentation breaks events up into searchable segments at index time, and again at search time. Segments can be classified as MAJOR or MINOR. Minor segments are breaks within Major segments. For example, IP address “192.1.2.3” is a major segment, … Continue reading →

Posted in splunk | Leave a comment