All Posts

bowesmana · ‎04-02-2024

You will either have to show the pie chart as a trellis chart so it shows one chart for each country or create a composite field containing both country and error message, as the pie chart can only s...

You will either have to show the pie chart as a trellis chart so it shows one chart for each country or create a composite field containing both country and error message, as the pie chart can only show one dimension, i.e. index=test | iplocation Properties.ip | dedup Properties.ip | eval composite=country.":".'event.Properties.errMessage' | stats count by composite Then the composite will be Australia:OK and so on.

ITWhisperer · ‎04-02-2024

| where event.Properties.errMessage != "OK"

ITWhisperer · ‎04-02-2024

Create a composite field with the two labels concatenated and count by that

bowesmana · ‎04-02-2024

It appears to be related to the size of the visualisation. I changed f to be 100003138 and still I see all 6 slices but if I simply change the size of the visualisation area of the pie chart I w...

It appears to be related to the size of the visualisation. I changed f to be 100003138 and still I see all 6 slices but if I simply change the size of the visualisation area of the pie chart I will see this

jaibalaraman · ‎04-02-2024

Hi Team Can anyone help me with Splunk search query to split the successful login from invalid? Ex - I want to exclude OK from the search, want to see only the locket out, invalid, invalid paramet...

Hi Team Can anyone help me with Splunk search query to split the successful login from invalid? Ex - I want to exclude OK from the search, want to see only the locket out, invalid, invalid parameter Thanks

jaibalaraman · ‎04-02-2024

Hi Can anyone help me with below query I have created a pie chart based on the error message, however i am not sure how to add country along index=test | iplocation Properties.ip | dedup Prop...

Hi Can anyone help me with below query I have created a pie chart based on the error message, however i am not sure how to add country along index=test | iplocation Properties.ip | dedup Properties.ip | stats count by event.Properties.errMessage

ITWhisperer · ‎04-02-2024

Double wild-carded strings are not very efficient. Could you perhaps extract the "proc" values into a field and then use a where command to exclude to events with the undesired values?

ITWhisperer · ‎04-02-2024

I don't know the decrypt command so this might be completely irrelevant, but, is the output (emitted) field a multi value field and if so do you need to use mvexpand to separate out the strings that ...

I don't know the decrypt command so this might be completely irrelevant, but, is the output (emitted) field a multi value field and if so do you need to use mvexpand to separate out the strings that you want to filter on? Another possibility is perhaps the regex command | regex process_decoded!="SELECT"

ITWhisperer · ‎04-02-2024

Try something like this index=compare sourcetype="accountA" OR sourcetype="accountB" | rename nameB as nameA, addressB as addressA, cellB as cellA | eventstats count by accid nameA addressA cellA | ...

Try something like this index=compare sourcetype="accountA" OR sourcetype="accountB" | rename nameB as nameA, addressB as addressA, cellB as cellA | eventstats count by accid nameA addressA cellA | where count==1

ITWhisperer · ‎04-02-2024

Probably - the token you could try to use in the drilldown is $trellis.value$

SplunkDash · ‎04-02-2024

Hello, How do I compare 2 source types within the same index and find the Gap. For Example: index=compare sourcetype=accountA and sourcetype=accountB; we have some account info in accountA but not i...

Hello, How do I compare 2 source types within the same index and find the Gap. For Example: index=compare sourcetype=accountA and sourcetype=accountB; we have some account info in accountA but not in accountB and objective is to find that gap. sourcetypeA accid nameA addressA cellA 002 test1 tadd1 1234 003 test2 tadd2 1256 003 test2 tadd2 5674 004 test3 tadd3 2345 005 test4 tadd4 4567 006 test5 tadd5 7800 006 test5 tadd5 9900 sourcetypeB accid nameB addressB cellB 002 test1 tadd1 1234 003 test2 tadd2 5674 004 test3 tadd3 2345 005 test4 tadd3 4567 006 test5 tadd5 9900 Output will be: 003 test2 tadd2 1256 006 test5 tadd5 7800 Any Recommendation will be highly appreciated.

abhi04 · ‎04-02-2024

Hi, I have setup the Object and event input configuration in the salesforce TA, I am able to see the object logs but unable to see the event logs in splunk cloud. Any directions of triaging the ...

Hi, I have setup the Object and event input configuration in the salesforce TA, I am able to see the object logs but unable to see the event logs in splunk cloud. Any directions of triaging the issue? Appropriate permissions are provided for the salesforce user.

marnall · ‎04-02-2024

You might be wanting to configure Splunk to start at boot time. /opt/splunk/bin/splunk enable boot-start ref: https://docs.splunk.com/Documentation/Splunk/latest/Admin/ConfigureSplunktostartatboott...

You might be wanting to configure Splunk to start at boot time. /opt/splunk/bin/splunk enable boot-start ref: https://docs.splunk.com/Documentation/Splunk/latest/Admin/ConfigureSplunktostartatboottime

jwhughes58 · ‎04-02-2024

Thanks. I hadn't thought of that. Since I posted the question, NetSkope came back with a solution. I was sent this conf_file_stanzas = conf_file_object.get_all() replace the above line with ...

Thanks. I hadn't thought of that. Since I posted the question, NetSkope came back with a solution. I was sent this conf_file_stanzas = conf_file_object.get_all() replace the above line with following: conf_file_stanzas = conf_file_object.get_all(only_current_app=True) With that the issue was resolved. The code was trying to get information from another TA.

marnall · ‎04-02-2024

Assuming you are on a linux machine, you could try piping the session_key value to that first command. echo "sessionkeyhere" | splunk cmd python -m pdb netskope_email_notification.py (Note that if ...

Assuming you are on a linux machine, you could try piping the session_key value to that first command. echo "sessionkeyhere" | splunk cmd python -m pdb netskope_email_notification.py (Note that if you enter the key in explicitly, it may be saved in your command history which may be undesired. You can also read the key from a source using the "cat" command) I couldn't tell you about the session_key... perhaps the Netskope docs could tell you where to get one. It could be a session with an email provider if this python script is intended to send email.

marnall · ‎04-02-2024

I don't fully understand what you mean... would it be possible to include screenshots demonstrating the timechart you would like (using the All-time search) versus what you get? Also a full query (wi...

I don't fully understand what you mean... would it be possible to include screenshots demonstrating the timechart you would like (using the All-time search) versus what you get? Also a full query (without private information) would be very helpful. E.g. something like this?

marnall · ‎04-02-2024

Indeed, "latest" should be on 9.2.1, but it seems to be on 9.0.9 . Perhaps we can ping the resolver of that post @amayor_splunk and humbly ask for assistance.

marnall · ‎04-02-2024

At search time, you could use spath to navigate past the "event:" part of the log: <yoursearch> | spath path=event output=_raw However you may want a solution that does not require spath on every s...

At search time, you could use spath to navigate past the "event:" part of the log: <yoursearch> | spath path=event output=_raw However you may want a solution that does not require spath on every search. You can configure your indexing tier to remove the "event:" part of the log, so that it directly shows you the useful fields without needing to be expanded. On the indexing tier, make a props.conf file in an app e.g. /opt/splunk/etc/apps/yourappname/local/props.conf Make this stanza: [cisco:amp:event] SEDCMD-RemoveEventKey = s/{"event":\s*// SEDCMD-RemoveLastBracket = s/}$// (and more stanzas for other sourcetypes you would like this change to apply to)

vnarahari · ‎04-02-2024

I have been working on decoding a base64 encoded command using the decrypt2 app. I have successfully decoded the string but facing difficulty excluding or searching and also running stats of decoded ...

I have been working on decoding a base64 encoded command using the decrypt2 app. I have successfully decoded the string but facing difficulty excluding or searching and also running stats of decoded field which gives a "p" thing as a result. Examples of | Search NOT: Example of Stats resulted "p": | rex field="process" ".*-(e|E)(n|N)[codemanCODEMAN]{0,12}\ (?<process_enc>[A-Za-z\d+/=]*)?" | decrypt field=process_enc b64 emit('process_decoded') | stats count by process_decoded Could someone please provide guidance on the correct syntax to exclude or search the decoded field using search not or using a lookup and help clarify the "P" thing from stats command? DECRYPT2

kmccullagh · ‎04-02-2024

We have installed and configured the MS Teams app Splunk>VictorOps version 1.1.0. It is successfully posting alerts to channels that are Public or Standard channels in a private team. However there i...

We have installed and configured the MS Teams app Splunk>VictorOps version 1.1.0. It is successfully posting alerts to channels that are Public or Standard channels in a private team. However there is no option to select posting alerts to a shared channel. The channel just does not appear in the list. Is this a known limitation of the app? On the integration guide here https://help.victorops.com/knowledge-base/microsoft-teams-integration-guide/ it states that "Note that installing into any channel in a team will make Splunk>VictorOps available for all channels in that team." Has the app been set up to allow integration with Shared channels in MS Teams? References: https://learn.microsoft.com/en-us/microsoftteams/shared-channels https://learn.microsoft.com/en-us/microsoftteams/platform/concepts/build-and-test/shared-channels

All Posts

All Posts

Re: How to include the country in the PIE chart

Re: How to seperate succefully login attempt from invlaid Login id

Re: How to include the country in the PIE chart

Re: Why is field missing in piechart?

How to seperate succefully login attempt from invlaid Login id

How to include the country in the PIE chart

Re: Searching a Field with Large Number of Selectors - NOT

Re: Issue with excluding a decoded base64 command

Re: Compare 2 source types within the same index and find the Gap

Re: Auto scale up/down of visualization panel in splunk dashboard

Compare 2 source types within the same index and find the Gap

Issue with salesforce event logs ingestion

Re: Splunkd not running after EC2 instance stopped and starts

Re: Debugging python from the command line that needs a session key

Re: Debugging python from the command line that needs a session key

Re: Single with timechart display issue

Re: Why is docker latest not on the most recent version (March 2024 edition)

Re: Splunk not formatting AMP logs

Issue with excluding a decoded base64 command

MS Teams app with Shared or Private channels

All Posts

Are you a member of the Splunk Community?

All Posts