All Posts

Find Answers
Ask questions. Get answers. Find technical product solutions from passionate members of the Splunk community.

All Posts

I would like to extract the Message, Timestamp, and serial fields Then I would like to plot the target: Temp(315600), state: Temp(315600), cavity: 178900  Each on individual plots based on the time... See more...
I would like to extract the Message, Timestamp, and serial fields Then I would like to plot the target: Temp(315600), state: Temp(315600), cavity: 178900  Each on individual plots based on the time series I take it I will have to use a rex command to extract the bolded values from the message field. How would I go about this? {"bootcount":10,"device_id":"71ff6686fa5347828e3668e59249d0be","environment":"prod_walker", "event_source":"appliance","event_type":"GENERIC","location": {"city":"","country":"XXX","latitude":XXX,"longitude":XXX,"state":""}, "log_level":"info","message":"hardware_controller: TestState { target: Temp(315600), state: Temp(315600), cavity: 178900, fuel: None, shutdown: None, errors: test() }", "model_number":"XXXX","sequence":1411,"serial":"XXXX","software_version":"2.2.2.7641","ticks":158236,"timestamp":1717972790}  
Hello, I hope all is well. Need your help to monitor the F5 Interface utilization throughput (performance Monitor). Any Idea! @community  #performanceMonitor
Hello, as questions. I'd like to ask if it is possible to convert Elasticsearch machine learning anomaly detector model to Splunk machine learning toolkit model?
Hi, I am runnig Splunk 9.0.9 with Splunk Add-on for Sysmon 4.0.1 and Sysmon Security Monitoring App for Splunk 4.0.13. I configured the alerts to be sent by email and I am receiving many of them (f... See more...
Hi, I am runnig Splunk 9.0.9 with Splunk Add-on for Sysmon 4.0.1 and Sysmon Security Monitoring App for Splunk 4.0.13. I configured the alerts to be sent by email and I am receiving many of them (false positives thanks god). At this point I have two issues: - The field "Body" is always empty.   Reviewing the macros included in the app, they seem to be created for the non-XML sysmon events. I changed the inputs.conf from the TA-Windows-Sysmon addon without success. The events continue flowing in in XML format.     [WinEventLog://Microsoft-Windows-Sysmon/Operational] disabled = false renderXml = 0 source = WinEventLog:Microsoft-Windows-Sysmon/Operational     Did anyone face the same issue? how did you solve it? - I also would like to add an exception list of processes to reduce the amount of alerts, whitelisting some well known windows executables or tools. have anyone done that? could you tell me the approach you took? thanks a lot. I am checking other alternatives like Cyences https://splunkbase.splunk.com/app/5351. any opinion?
where the last 4 digits contain any number from 0 to 9
Thanks for the reply. I actually need a 7 digit format like " 555-XXXX". 
Hi @Scott.Lucier, I spoke with a PMM on my team and this is what they shared with me.  In my opinion, the better way is to create an action suppression. You would need three: one for 5 PM to midn... See more...
Hi @Scott.Lucier, I spoke with a PMM on my team and this is what they shared with me.  In my opinion, the better way is to create an action suppression. You would need three: one for 5 PM to midnight M-F, one from 21:00 AM to 6 AM M-F, and a third for all day Sat-Sunday. Action suppression is a feature that is meant for this purpose, and can be used globally for an application or environment, for all HRs, so you do not have to re-create each HR.
The random function only returns an integer and there is no way to force it to include hyphens in the output. Since the function may return an integer too small for a phone number, I suggest using m... See more...
The random function only returns an integer and there is no way to force it to include hyphens in the output. Since the function may return an integer too small for a phone number, I suggest using multiple calls to build it.  Here's an example using the North American Numbering Plan.     | eval PhoneNumber = (random() % 1000)."-".(random() % 1000)."-".(random() % 10000)     Additional massaging may be needed if you want more realistic phone numbers (no "001" for an area code, for example).
We are already ingesting Salesforce data via the Salesforce for Splunk Add on. I have a requirement to monitor when an admin permission set has been assigned to a user and what changes that user mak... See more...
We are already ingesting Salesforce data via the Salesforce for Splunk Add on. I have a requirement to monitor when an admin permission set has been assigned to a user and what changes that user makes. Has anyone fulfilled a similar requirement? So far i have found a list of the following objects that could provide the information i need to see when a permission set is assigned to a user (https://developer.salesforce.com/docs/atlas.en-us.object_reference.meta/object_reference/sforce_api_objects_permissionsetassignment.htm) but not sure how to track what changes that admin user makes.   Can you help?
It depends on the format of phone number that you want and any range constraints on the number. Essentially, random() returns a "random" potentially large integer. This is usually reduced in range b... See more...
It depends on the format of phone number that you want and any range constraints on the number. Essentially, random() returns a "random" potentially large integer. This is usually reduced in range by using a modulus operation. e.g.  | eval number=random() % 1000000 This will give you an integer below a million. Alternatively, you could randomise parts of the number e.g. | eval number = "1-".printf("%0.3d", random() % 1000)."-".printf("%04d", random() %10000)
In fully managed Splunk Cloud context, we don't have access to the file system, so we can't readily edit the custom.dat file.  This is a plea to the developers:  Could you please update this app to a... See more...
In fully managed Splunk Cloud context, we don't have access to the file system, so we can't readily edit the custom.dat file.  This is a plea to the developers:  Could you please update this app to address this need?  Thanks!
How do I format a returned int into a phone number with the hyphen using the eval random function.    What I have so far:  | eval PhoneNumber = (random() )
Guys thanks for valuables hints and posts. This time I managed to do it by myself.  here is my new, working query: index="odp" OR index="oap" txt2="ibum_p" | eval c_e = mvindex(split(c_e,","... See more...
Guys thanks for valuables hints and posts. This time I managed to do it by myself.  here is my new, working query: index="odp" OR index="oap" txt2="ibum_p" | eval c_e = mvindex(split(c_e,","),0) | eval c_e=coalesce(c_e,e) | stats values(*) by c_e So critical in my case was renaming field.  Instead of rename I use coalesce and it helped.  Stats now returns values from both indexes. K.    
Any details on adding the use of AWS IAM Roles Anywhere with the Splunk addon for AWS
Apologies, but would really appreciate a more detailed set of instructions - can`t get my head round how adding a checkbox helps with the encryption and how to actually achieve this ? Many thanks!
Thanks for the response -  I expect about 5 results for each reference result -> so I set maxsearches=5.  However, nothing I have tried produces any results.  Boss?  You mean team SME?  Don't actuall... See more...
Thanks for the response -  I expect about 5 results for each reference result -> so I set maxsearches=5.  However, nothing I have tried produces any results.  Boss?  You mean team SME?  Don't actually have one of those, we are in a help yourself environment. Everything I've done with the above query results an a msg that says "unable to run query",  specifying the query after the map.
You are parsing HdtIn and HdtOut twice with strptime using different formats. Only one of the formats is working. Use that to parse the times into epoch format and find the difference between these t... See more...
You are parsing HdtIn and HdtOut twice with strptime using different formats. Only one of the formats is working. Use that to parse the times into epoch format and find the difference between these times.
Not able to extract the difference.  Query:  (index="events_prod_gmh_gateway_esa") SPNLDSCR* | spath Y_CONV | search Y_CONV=CACAFORM| spath ID_FAMILLE | search ID_FAMILLE=CAFORM |eval Time_in = ... See more...
Not able to extract the difference.  Query:  (index="events_prod_gmh_gateway_esa") SPNLDSCR* | spath Y_CONV | search Y_CONV=CACAFORM| spath ID_FAMILLE | search ID_FAMILLE=CAFORM |eval Time_in = "20" + substr(sRefInt , 9 , 15) |eval Processing_Start_Time = strptime(HdtIn,"%Y%m%d%H%M%S.%q") , Processing_End_Time = strptime(HdtOut,"%Y%m%d%H%M%S.%q") , Reception_Time = strptime(Time_in,"%Y%m%d%H%M%S.%q") |eval Processing_Start_Time_1 = strptime(HdtIn,"%m/%d/%Y %H:%M:%S.%6N") , Processing_End_Time_1 = strptime(HdtOut,"%m/%d/%Y %H:%M:%S.%6N") , Reception_Time_1 = strptime(Time_in,"%Y%m%d%H%M%S.%q"), diff = Processing_End_Time_1 - Reception_Time_1 |convert ctime(Processing_Start_Time) , ctime(Processing_End_Time) , ctime(Reception_Time) | table _time , ID_FAMILLE , MSG_TYP_CONV , MSG_TYP_ORIG , sRefInt , Reception_Time , Processing_Start_Time , Processing_End_Time , Processing_Start_Time_1 , Processing_End_Time_1 , Reception_Time_1 , diff    
Hi All, I'm working on a project to create some dashboards that display a lot of information and one of the questions that I'm facing is how to know if Nessus scans are credential, I looked at some ... See more...
Hi All, I'm working on a project to create some dashboards that display a lot of information and one of the questions that I'm facing is how to know if Nessus scans are credential, I looked at some events, and it indicates the check type: local. Is this means it is credential ?  Thanks in advance for any information may help.
Have you tried | fields *Read*  ?