Erik Horton

IT aficionado / hobbyist

Read this first

Splunk - Diff examples and One-Way diff

Splunk’s ‘set’ command will allow you to ‘diff’ two result sets. What this means is that say you have two sets:

Set A: “event1 event2 event3”
Set B: “event2 event3 event4”

Splunk will tell you all the differences that occur between these two sets. When you run the following command, the output will be “event1 event4” because they are not common in both sets.

| set diff [set A] [set B]

A full splunk search search to generate the following example might look like:

| set diff
[| makeresults | eval events=“event1 event2 event3” | makemv events | mvexpand events | table events]
[| makeresults | eval events=“event2 event3 event4” | makemv events | mvexpand events | table events]

This would be considered a two-way diff. It can be very useful for determining that there are events from both sets (search results) that can’t be found in the opposite set.

To break down the commands

Continue reading →


Synthesia on Windows 10 (VirtualMIDISynth)

Problem: On Windows 10, when trying to use VirtualMIDISynth + Synthesia for lag-less piano playing, VirtualMIDISynth does not appear as an option for output.

Use Case: You followed the following, with no luck. https://www.synthesiagame.com/support/faq#better_synth

Solution: Under the following two registry keys, create a new string (REG_SZ) key/value pair, called “midi3”. Make the value: C:\Windows\System32\VirtualMIDISynth\VirtualMIDISynth.dll

  • HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32
  • HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Drivers32

Continue reading →


Dell XPS 9550 Mouse Lag only over Windows Desktop

Problem: Mouse lags when going over just the Windows desktop
Hardware: Dell XPS 9550
Software: Windows 10

Solution: Task Manager -> Startup tab -> Disable Nvidia Capture Server Proxy; Restart your computer.

Edit: More recently, I also had to uninstall Nvidia GeForce Experience

Note: This mouse lag occurs when programs that use hardware acceleration are open. For me, programs that would cause this issue included Google Chrome and Lync (Skype for Business). You can disable hardware acceleration in Google Chrome settings which would resolve the issue. Lync does not have this feature. By disabling Nvidia Capture Server Proxy, I no longer receive mouse lag on the windows desktop / wallpaper.

Continue reading →


Ansible - Splunk Forwarder Deployment - Pt.1

This post will help you get up and running with Ansible with the end goal of deploying Splunk universal forwarders to both Windows and Linux.

 Inspiration

https://github.com/divious1

.conf 2015 talk - Splunk Configuration Management and Deployment with Ansible - Jose Hernandez / Sean Delaney

 Prerequisites

Ansible

Follow installation guidelines here:

http://docs.ansible.com/ansible/intro_installation.html

Install dependencies for connecting to windows hosts

http://docs.ansible.com/ansible/intro_windows.html

Linux Specific

  • User who can ssh
  • User who can sudo

Windows Specific

  • Domain account who can access server via winrm, and install software
  • A share location that your servers can pull down files from (using your domain account)
  • HTTP/AllowUnencrypted=True

    winrm set winrm/config/service ‘@{AllowUnencrypted=“true”}’

or

  • HTTPS/AllowUnencrypted=False

 Install

Continue reading →


Splunk: Automatically update GeoIP database across environment

Information for this post was inspired by this post.

Edit: Also see George Starcher’s implementation.

On every Splunk upgrade, they also push out a GeoIP database found here. Instead of waiting, I wanted to automate the pull on search heads. The following is how you can set up the same in your environment.

Create app structure on Deployment Server

/opt/splunk/etc/deployment-apps/Splunk_geoip/
    bin
        get_maxmind_db.sh
    default
        inputs.conf
        limits.conf

get_maxmind_db.sh

This will download and extract the database, as well as set the correct permissions on it.

#!/bin/bash

 # Author: Andrew Wurster
 # Date: 13 Jan 2015

cd /opt/splunk/etc/apps/Splunk_geoip/bin

wget -O GeoLite2-City-Latest.mmdb.gz http://geolite.maxmind.com/download/geoip/database/GeoLite2-City.mmdb.gz || { echo 'Could not download MaxMind GeoIP DB, exiting.' ; exit 1; }
gunzip -f

Continue reading →


Splunk Deployment Server: Grab all deployment clients

There are times when you need to know what’s out there. If you’re like me, you have thousands of deployment clients in the environment, and browsing to the GUI interface to see your forwarders just doesn’t cut it.

The following can be run as a search on your deployment server to pull all of your deployment clients.

    | rest /services/deployment/server/clients splunk_server=local | table hostname dns clientName utsname

You can then pipe this out to outputcsv to better use the data.

If for some reason you cannot do it this way, you can always pull information on the command line. To get all the IP addresses of your clients, run the following:

    /opt/splunk/bin/splunk list deploy-clients | grep -Po 'ip:\s+\K([0-9]{1,3}\.){3}[0-9]{1,3}'

Continue reading →


How to use Regex in Splunk searches

 Regex to extract fields

| rex field=_raw "port (?<port>.+)\."

_raw

The source to apply the regular expression to.

left side of ()

The left side of what you want stored as a variable. Anything here will not be captured and stored into the variable. Everything here is still a regular expression.

right side of ()

The right side of what you want stored as a variable. Anything here will not be captured and stored into the variable. Everything here is still a regular expression. Because “.” is outside of the parentheses to the right, it denotes the period ends the expression, and should not be included in the variable.

?<port>

Store captured regex in variable “port”.

.+

Regex to capture and save in the variable. In this case, an unlimited amount of characters until the end of the line.

 Putting it all together

Say you have _raw data equal to the following

Jun 24 14:03:43

Continue reading →


Splunk Cisco_IPS app no longer pulls from IPS

 Problem

After an upgrade to Splunk 6, the Cisco_IPS app fails to download IPS logs.

 Troubleshooting

  1. Navigate to /var/log/splunk/sdee_get.log
  2. Events like the following show up

    Exception thrown in sdee.get(): URLError: <urlopen error [Errno 1] _ssl.c:521 error:1407741A:SSL routines:SSL23_GET_SERVER_HELLO:tlsv1 alert decode error>
    

 Fix

Note: Upgrade to the latest version and you shouldn’t experience the problem anymore. App Link

Info for the fix was pulled from: This Splunk forum

  1. Navigate to /etc/apps/Splunk_CiscoIPS/bin/pysdee/
  2. Edit: pySDEE.py
  3. Directly after the default import statements, paste the following.

    # The section below is to override the default socket connection
    # which will fail with these devices. The newer version of openssl
    # in Python does not support the ciphers these devices would like to use
    import httplib
    from httplib import HTTPConnection, HTTPS_PORT

Continue reading →


Getting Ubuntu 12.04 LTS, Django, and Heroku to all play nicely together

Personally, I used VMWare Workstation 8 to host my Ubuntu machine, so I will include some instructions for that as well.

 Part 1: Setup

Open: C:\ProgramData\VMware\VMware Workstation\config.ini (Windows 7)

Add the following:

prefvmx.minVmMemPct = "100" 
mainMem.useNamedFile = "FALSE" 
mainMem.partialLazySave = "FALSE" 
mainMem.partialLazyRestore = "FALSE"

Note: This will prevent a long shutdown process for your vm.

  1. Install ubuntu 12.04 LTS

  2. After boot, login (command line), and enter the following:

sudo mv /etc/issue.backup /etc/issue

sudo mv /etc/rc.local.backup /etc/rc.local

sudo mv /opt/vmware-tools-installer/lightdm.conf /etc/init

Note: This gets you past the issues with VMWare Tools Easy Install

sudo shutdown -h 0

  1. Make sure settings of vm set cd / floppy to physical

  2. Install vmware tools & reboot (optional)

  3. Update Ubuntu

sudo apt-get update && sudo apt-get

Continue reading →


Python Game Development - Pygame vs. Pyglet: Part 2

Here in part 2, you’ll find intermediate level snippet comparisons between Pygame and Pyglet

If you missed it, check out Part 1.

 Display an image and text on the screen

 Pygame

import pygame, sys, os

running = True
pygame.init()
screen = pygame.display.set_mode((800,600))
clock = pygame.time.Clock()

#calculate current path + location of player image. Image must be on same level as this file
mypath = os.path.dirname( os.path.realpath( __file__) )
p_path = os.path.join(mypath, 'player.png')

#create player image, move to 400,300
player_image = pygame.sprite.Sprite()
player_image.image = pygame.image.load(p_path).convert()
player_image.rect = player_image.image.get_rect().move(400,300)

#create text label
font = pygame.font.Font(None, 24)
font_color = (255,255,255)
font_background = (0,0,0)
t = font.render("Hello World", True, font_color, font_background)
t_rect = t.get_rect()

Continue reading →