Michel Oosterhof on @micheloosterhof

Splunk Segmenter config for ISO8601 dates

Wed, 31 Oct 2018 00:00:00 +0000

Recently I read an excellent article by Duane Waddle on splunk bucket lexicons and segmentation.

This inspired to put a small app on SplunkBase that improves the default settings to ignore ISO8601 date and time stamps in the searchable lexicon in Splunk.

Practically this means Splunk will stop indexing parts of the timestamp, and you can no longer search for terms like 2018. Because this significantly reduces the index, this should save you a good amount of disk space.

Cowrie Honeypot

Tue, 30 Oct 2018 00:00:00 +0000

Articles on the Cowrie Honeypot are now live at www.cowrie.org.

The official Github repository has also moved and is now at www.github.com/cowrie/cowrie/.

If you want to know more, join us on the Cowrie Slack.

Cookie Policy

Mon, 01 Jan 0001 00:00:00 +0000

Cookies Link to heading

A cookie is a small text file which is automatically saved on your computer when you visit our website and is used to help track activity across a website. micheloosterhof.com uses cookies on our website for the following purposes:

Google Analytics Link to heading

We use Google Analytics to help provide anonymous web analytics for our website.

Thanks!

Mon, 01 Jan 0001 00:00:00 +0000

Thanks!