Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
All Posts
Find Answers
Ask questions. Get answers. Find technical product solutions from passionate members of the Splunk community.
×
Are you a member of the Splunk Community?
Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- Find Answers
- :
- All Posts
All Posts
03-21-2024
06:10 AM
I'm a bit stumped as to why I cannot tokenize $result.<field>$ from a dynamic search that generates dropdown values in an input. Below is an example dashboard I was testing this on. Of note, I cannot...
See more...
I'm a bit stumped as to why I cannot tokenize $result.<field>$ from a dynamic search that generates dropdown values in an input. Below is an example dashboard I was testing this on. Of note, I cannot wildcard "*" the All and use the wildcard in the token because the underlying search narrowly limits the data returned and a wildcard would expand the follow-on search beyond the results of the dynamic input search. I've validated the conditionals work in the test dash with the static_tok, which changes with each selection. I am attempting to use the dynamic search to create a result that creates OR statements between each value. it would look something like this if "All" dropdown option was selected. Any other dropdown selection should set that value in the token (ie dropdown_tok=buttercup, which works). test="buttercup" OR test="dash" OR test="fleetfoot" OR test="mcintosh" OR test="mistmane" OR test="rarity" OR test="tenderhoof" This is a dashboard that tests this method: <form version="1.1" theme="light">
<label>test</label>
<fieldset submitButton="false">
<input type="time" token="timerange1">
<label></label>
<default>
<earliest>-24h@h</earliest>
<latest>now</latest>
</default>
</input>
</fieldset>
<row>
<panel>
<input type="dropdown" token="dropdown_tok" searchWhenChanged="true">
<label>dropdown test</label>
<choice value="all">All</choice>
<fieldForLabel>test</fieldForLabel>
<fieldForValue>test</fieldForValue>
<search>
<query>| makeresults
| eval test="buttercup rarity tenderhoof dash mcintosh fleetfoot mistmane"
| makemv delim=" " test
| mvexpand test
| eventstats values(test) as mv_test
| eval all_test="test=\"".mvjoin(mv_test, "\" OR test=\"")."\""
| table test,mv_test,all_test
</query>
<earliest>$timerange1.earliest$</earliest>
<latest>$timerange1.latest$</latest>
</search>
<change>
<condition match="$dropdown_tok$ == "all"">
<set token="dropdown_tok">$result.all_test$</set>
<set token="all_test">$result.all_test$</set>
<set token="static_tok">"all_condition"</set>
</condition>
<condition match="$dropdown_tok$!="all"">
<set token="dropdown_tok">$dropdown_tok|s$</set>
<set token="static_tok">"not_all_condition"</set>
</condition>
</change>
<default>all</default>
<initialValue>all</initialValue>
</input>
</panel>
</row>
<row>
<panel>
<html>
<p>dropdown_tok: $dropdown_tok$</p>
<p>all_test: $all_test$</p>
<p>static_tok: $static_tok$</p>
</html>
</panel>
<panel>
<table>
<search>
<query>| makeresults
| eval dropdown_tok=$dropdown_tok$
| eval static_tok=$static_tok$
| table dropdown_tok,static_tok</query>
<earliest>$timerange1.earliest$</earliest>
<latest>$timerange1.latest$</latest>
</search>
<option name="drilldown">none</option>
<option name="refresh.display">progressbar</option>
</table>
</panel>
</row>
</form>
Labels
- Labels:
-
token
03-21-2024
06:05 AM
You are correct in saying that Splunk no longer automatically extracts the fields with a new custom source type > Do you know if there is a way to activate this option ?
03-21-2024
06:00 AM
Check your local.meta file at the following path: /opt/splunk/etc/apps/Splunk_TA_cisco-asa/metadata and look for this stanza
[lookups]
access = read : [ power, sc_admin ],
write : [ ess_...
See more...
Check your local.meta file at the following path: /opt/splunk/etc/apps/Splunk_TA_cisco-asa/metadata and look for this stanza
[lookups]
access = read : [ power, sc_admin ],
write : [ ess_analyst, power, sc_admin ]
export = system
version = 9.1.2308.201
modtime = 1710775209.916764000
then add the role to the access like so:
access = read : [ user ,power, sc_admin ]
If this answer helped, let me know.
03-21-2024
05:49 AM
Hello, I have a dashboard with the following inputs: <fieldset submitButton="true" autoRun="false">
<input type="dropdown" token="tok1" searchWhenChanged="false">
<label>Tok1</label>
<c...
See more...
Hello, I have a dashboard with the following inputs: <fieldset submitButton="true" autoRun="false">
<input type="dropdown" token="tok1" searchWhenChanged="false">
<label>Tok1</label>
<choice value="All">*</choice>
<choice value="Active">Y</choice>
<choice value="Inactive">N</choice>
<prefix>Status="</prefix>
<suffix>"</suffix>
<default>*</default>
<change>
<condition value="All">
<set token="tok1"></set>
</condition>
<condition>
<eval token="tok1">"\" AND upper(STATUS)=upper(\'" + $value$ + "\')\""</eval>
</condition>
</change>
</input>
<input type="text" token="tok2" searchWhenChanged="false">
<label>UserID</label>
<default></default>
<change>
<condition>
<eval token="tok2">if(match($value$,"\\w")," AND UserID=\"*" + upper($value$) + "*\"", "")</eval>
</condition>
</change>
</input>
</fieldset> These two example tokens are user in a panel where the query is just | search * $tok1$ $tok2$ because it refers to another search as base query. The problem is the following: I have a submit button, so I expect that every change in the fields do not trigger the search until I press the Submit button. What happens instead is that, if I change the value of tok1,the search starts, if I change the value of tok2 and then click outside of the text box, the search starts. In both cases, the submit button is bypassed. If I remove tok1 and tok2 manipulations in the <change> tag, everything works as expected, so I guess that the issue is caused by this tag, but I cannot understand the flow that Splunk goes through to decide to bypass the submit button. Thank you very much to anyone who can help me. Have a nice day!
Labels
- Labels:
-
Classic dashboard
-
token
03-21-2024
05:14 AM
Hi! I am faced with the following problem. I need to filter the logs that I receive from the source. I get the logs via Heavy-Forwarder, using the following config: inputs.conf [udp://4514]
ind...
See more...
Hi! I am faced with the following problem. I need to filter the logs that I receive from the source. I get the logs via Heavy-Forwarder, using the following config: inputs.conf [udp://4514]
index=mylogs
sourcetype = mylogs:leef Before writing regex I tried the following configuration: props.conf [mylogs:leef]
TRANSFORMS-null= setnull_mylogs transoforms.conf [setnull_mylogs]
REGEX= .
DEST_KEY=queue
FORMAT=nullQueue But it is not working, I still receiving all events in indexes. This conf files store in <heavy_folder>/etc/apps/<app_name>/local. May be I need to use another stanza name in props, but I tried [source::udp://4514] and it is not working. Any ideas? My goal than to write a few regex and receive only useful logs from this source. Thank you.
Labels
- Labels:
-
heavy forwarder
03-21-2024
05:09 AM
Hi, We are getting below error on the machines running with Network Toolkit app. It's affecting the Data forwarding to Splunk cloud. Please help. 0000 ERROR ExecProcessor [5441 ExecProcessorSc...
See more...
Hi, We are getting below error on the machines running with Network Toolkit app. It's affecting the Data forwarding to Splunk cloud. Please help. 0000 ERROR ExecProcessor [5441 ExecProcessorSchedulerThread] - message from "/opt/splunk/bin/python3.7 /opt/splunk/etc/apps/network_tools/bin/ping.py" self.logger.warn("Thread limit has been reached and thus this execution will be skipped for stanza=%s, thread_count=%i", stanza, len(self.threads)) Thanks!
Labels
- Labels:
-
administration
03-21-2024
05:05 AM
Hi all, I recently updated the NetSkope Add-on For Splunk (TA-NetSkopeAppForSplunk) from version 3.1.2 to version 3.6.0 in my Splunk Cloud environment (version 9.1.2308.203). I followed the steps o...
See more...
Hi all, I recently updated the NetSkope Add-on For Splunk (TA-NetSkopeAppForSplunk) from version 3.1.2 to version 3.6.0 in my Splunk Cloud environment (version 9.1.2308.203). I followed the steps outlined in the Splunkbase upgrade guide, but I’m experiencing issues in getting my data into Splunk for Web Transactions V2. I got the V2 token set up by the Netskope Administrator, with the proper permissions, then I get the following error when setting up the data input: Error occurred while validating Token V2 parameter: 'status''. Did anyone have the same issue? Thanks in advance.
Labels
03-21-2024
05:04 AM
Hello, thanks for the clarification. Your solution is about to send all the events that match (?ms)EventCode=(4624|4634|4625)\s+.*\.adm in a specific index, but what about if I want to send the not...
See more...
Hello, thanks for the clarification. Your solution is about to send all the events that match (?ms)EventCode=(4624|4634|4625)\s+.*\.adm in a specific index, but what about if I want to send the not matched events to another index?
03-21-2024
04:58 AM
It looks like you have an eval for ProcessMsg, immediately followed by a stats command which overwrites the same field - is this your issue?
03-21-2024
04:54 AM
@Prathyusha891 - FYI splunklib doesn't come built in with Splunk. In your App you need to put the Splunklib explicitly, mostly in the bin folder of your App. pip install splunk-sdk --target ./bin ...
See more...
@Prathyusha891 - FYI splunklib doesn't come built in with Splunk. In your App you need to put the Splunklib explicitly, mostly in the bin folder of your App. pip install splunk-sdk --target ./bin I hope this helps!!! Kindly upvote if it does!!!
03-21-2024
04:52 AM
Change your time-picker to be the time period you want
03-21-2024
04:52 AM
1 Karma
This can be accomplished with props and transforms. On your indexer machines, make the following files with stanzas: (whether through cluster bundle pushes or direct editing) props.conf # put this ...
See more...
This can be accomplished with props and transforms. On your indexer machines, make the following files with stanzas: (whether through cluster bundle pushes or direct editing) props.conf # put this stanza in props.conf. Here your source field for the logs is assumed to be "WinEventLog://Security"
[source::WinEventLog://Security]
TRANSFORMS-anynamegoeshere=yourtransformname
# If you would like to apply the filter to a sourcetype, you can also do this:
[<yoursourcetype>]
TRANSFORMS-anynamegoeshere=yourtransformname transforms.conf # Put this in transforms.conf
[yourtransformname]
REGEX = (?ms)EventCode=(4624|4634|4625)\s+.*\.adm
FORMAT = index2
DEST_KEY = _MetaData:Index
03-21-2024
04:50 AM
Hi Guys, I am trying fetch details using stats.In this query I am trying get status from the below conditions and when i am populating in the table.The ProccesMsg has some values but in failure con...
See more...
Hi Guys, I am trying fetch details using stats.In this query I am trying get status from the below conditions and when i am populating in the table.The ProccesMsg has some values but in failure conditions i will add message in the result so i used coalesec to map both the result and need to populate in the table.But i cant able to populate the result.What mistake i did here. index="mulesoft" applicationName="ext" environment=DEV
(*End of GL-import flow*) OR (message="GLImport Job Already Running, Please wait for the job to complete*") OR (message="process - No files found for import to ISG") |rename content.File.fstatus as Status|eval Status=case( like('Status' ,"%SUCCESS%"),"SUCCESS",like('Status',"%ERROR%"),"ERROR",like('message',"%process - No files found for import to ISG%"), "ERROR",like('message',"GLImport Job Already Running, Please wait for the job to complete"), "WARN")
| eval ProcessMsg= coalesce(ProcessMsg,message)
|stats values(content.File.fid) as "TransferBatch/OnDemand" values(content.File.fname) as "BatchName/FileName" values(content.File.fprocess_message) as ProcessMsg
values(Status) as Status values(content.File.isg_file_batch_id) as OracleBatchID values(content.File.total_rec_count) as "Total Record Count" by correlationId
|table Status Start_Time "TransferBatch/OnDemand" "BatchName/FileName" ProcessMsg OracleBatchID "Total Record Count" ElapsedTimeInSecs "Total Elapsed Time" correlationId
Labels
- Labels:
-
fields
03-21-2024
04:48 AM
@kidderjc - I'm no Java expert based on my past experience with log4j to Splunk HEC. If Splunk fails for some reason your solution will encounter a memory issue and may crash. My Recommendation: Sto...
See more...
@kidderjc - I'm no Java expert based on my past experience with log4j to Splunk HEC. If Splunk fails for some reason your solution will encounter a memory issue and may crash. My Recommendation: Store logs to log files on the server and use Splunk UF to forward the logs to Splunk indexers. I hope this helps!!!
03-21-2024
04:45 AM
You are correct in saying that Splunk no longer automatically extracts the fields with a new custom source type. Splunk does attempt to make field extractions if there are <key>=<value> patterns in t...
See more...
You are correct in saying that Splunk no longer automatically extracts the fields with a new custom source type. Splunk does attempt to make field extractions if there are <key>=<value> patterns in the data, but that does not seem to be the case in these logs. You could try using sed-cmd to change the logs to be formatted like apache http logs and then set the sourcetype to the standard apache http log sourcetype, then it should work. I recommend also getting the Apache Web Server app as it has knowledge objects for apache http logs. https://splunkbase.splunk.com/app/3186
03-21-2024
04:40 AM
I recommend setting SHOULD_LINEMERGE to false so that Splunk does not try to re-combine your events together.
03-21-2024
04:27 AM
tcp start and end are not suppose to be mapped to Network Sessions Datamodel (CIM) according to Splunk: https://docs.splunk.com/Documentation/CIM/5.3.1/User/NetworkSessions: "The fields in the Ne...
See more...
tcp start and end are not suppose to be mapped to Network Sessions Datamodel (CIM) according to Splunk: https://docs.splunk.com/Documentation/CIM/5.3.1/User/NetworkSessions: "The fields in the Network Sessions data model describe Dynamic Host Configuration Protocol (DHCP) and Virtual Private Network (VPN) traffic, whether server:server or client:server, and network infrastructure inventory and topology." Globalprotect logs should be the ones mapped to Network Sessions - VPN
03-21-2024
04:14 AM
Sorry, no I did not find a solution, the requirement changed, and we shifted gears.
03-21-2024
04:11 AM
How to write a query to get data like this Branch 1 🟢 🟢 Branch 2 🟢🟢🟢 Branch 3 🟢 🟢 Branch 4 🟢🟢🟢 . . . . . . Here branch is the actual branch and green represe...
See more...
How to write a query to get data like this Branch 1 🟢 🟢 Branch 2 🟢🟢🟢 Branch 3 🟢 🟢 Branch 4 🟢🟢🟢 . . . . . . Here branch is the actual branch and green represent success build ,red will be the failure build and black will be the aborted build status. (Recent 5 build status)
Labels
- Labels:
-
Classic dashboard
03-21-2024
03:59 AM
We have multiple firewalls and different locations and each location we have syslog collector server and its forward the logs to splunk indexer. Pan: traffic count 27,644,629 83% Pan:threat count ...
See more...
We have multiple firewalls and different locations and each location we have syslog collector server and its forward the logs to splunk indexer. Pan: traffic count 27,644,629 83% Pan:threat count 3,224,543 9.77% Pan:firewall_cloud 2,034,183 6.18% last one hour data. it looks like over utilization, so we want to validate receiving logs are legitimate or not? Planning to reduce consumption of firewall logs. Please guide me how can i validate firewall logs we are reciving correct logs or any excessive or not needed?
