All Posts

yuvaraj_m91 · ‎12-12-2023

I have two different logs where the error is capturing in different fields in each log message...(error_message and error_response) I have to capture the error_message and error_response without d...

I have two different logs where the error is capturing in different fields in each log message...(error_message and error_response) I have to capture the error_message and error_response without dropping the other logs.? Log 1 : message:"Lambda execution: exit with failure", message_type:"ERROR", error_message:"error reason update" Log 2 : message:"Lambda execution: exit with failure", message_type:"ERROR", error_response:"updated error reason" Expected Output : Error count 1. error reason update 1 2. updated error reason 1

Abhineet · ‎12-12-2023

Hi I want to execute different SPL query in Dashboard studio panel on the basis of dropdown value. Drop down have two item only, if we select "Item1" in dropdown then in particular panel of Dashboa...

Hi I want to execute different SPL query in Dashboard studio panel on the basis of dropdown value. Drop down have two item only, if we select "Item1" in dropdown then in particular panel of Dashboard should execute "Query1" if selected "item2" in dropdown then in same panel of Dashboard studio should execute "Query2" item1 = "Aruba NetWorks" Item2 = "Cisco" Query1 = index=dot1x_index sourcetype=cisco_failed_src OR sourcetype=aruba_failed_src| | eval node= if(isnotnull(node_vendor),"Cisco","Aruba NetWorks")| search node = $<dropdown token>$ | table node_dns node_ip region Query2 = index=dot1x_index sourcetype=cisco_failed_src OR sourcetype=aruba_failed_src| eval node= if(isnotnull(node_vendor),"Cisco","Aruba NetWorks")| search node = $<dropdown token>$ | table Name Kindly Guide. Thanks Abhineet Kumar

julianpmcaf · ‎12-12-2023

When i'm in the dashboard panel I can't seem to find a download button anywhere so I'm not sure if i can download the results

ITWhisperer · ‎12-12-2023

Rather than exporting the dashboard, can you download the results from the panel?

julianpmcaf · ‎12-12-2023

I have a dashboard with the event feeds of these browser tests but when I try to export the dashboard it exports as a json file and I need it as a csv or another file that shows the results of the te...

I have a dashboard with the event feeds of these browser tests but when I try to export the dashboard it exports as a json file and I need it as a csv or another file that shows the results of the test.

ITWhisperer · ‎12-12-2023

| mvexpand latest | eval diff=now - latest

ITWhisperer · ‎12-12-2023

Do you have a dashboard or report with these results in?

ITWhisperer · ‎12-12-2023

You can't use the time range filter on loadjob savedsearch for this purpose. The time range filter on the loadjob command applies to when the saved search was executed (and its results saved). It is ...

You can't use the time range filter on loadjob savedsearch for this purpose. The time range filter on the loadjob command applies to when the saved search was executed (and its results saved). It is not applied to the results themselves. For this you would have to use a where command (as you already have), and for time ranges, you should parse your timestamp field into and epoch time (using the strptime() function) so that it can be compared with other epoch time values e.g. the start and end of your desired time range.

SplunkingKnight · ‎12-12-2023

Hi @FlorianScho, as a workaround, we have added the IP addresses of our Splunk instances in the TLS certificates as SAN and also included them in the server.conf in the sslAltNameToCheck parameter. ...

Hi @FlorianScho, as a workaround, we have added the IP addresses of our Splunk instances in the TLS certificates as SAN and also included them in the server.conf in the sslAltNameToCheck parameter. Best regards

maayan · ‎12-12-2023

Hi, I'm using: loadjob savedsearch because my query is big and it takes time to load. I have some multi-select filters and i want to add input time range filter. (| loadjob savedsearch="mp:search:...

Hi, I'm using: loadjob savedsearch because my query is big and it takes time to load. I have some multi-select filters and i want to add input time range filter. (| loadjob savedsearch="mp:search:queryName" | where $pc$ AND $Version$ ) I'm not sure how to do that because i need to use a field called: Timestamp (i get it in my query, this is the time the event is written to the json file ) and not the _time field. In addition, I don't know how to use loadjob savedsearch with time range filter Can you help me, please? Thank, Maayan

akarivaratharaj · ‎12-12-2023

I have gone through a few questions which are related to lookup file changes. I tried to use the same query to get the internal logs regarding my lookup file changes but I am unable to fetch any logs...

I have gone through a few questions which are related to lookup file changes. I tried to use the same query to get the internal logs regarding my lookup file changes but I am unable to fetch any logs. I would like to know where can I find the information about the changes made to my lookup file. The information is more related to the user who modified and the respective time. I tried to search in _audit index, but I am unable to find the exact logs (may be the way of my searching is wrong) Could anyone please help me in finding the history of modification/changes made to any lookup file?

parthiban · ‎12-12-2023

Hi @gcusello | rename "response_details.response_payload.entities{}.onlineStatus" as status | stats count BY status | append [ | makeresults | eval name=xxxx, count=0 | fields name ] | stats sum...

Hi @gcusello | rename "response_details.response_payload.entities{}.onlineStatus" as status | stats count BY status | append [ | makeresults | eval name=xxxx, count=0 | fields name ] | stats sum(count) AS total BY status | eval status=if(total=0,"OFFLINE",status) | search status="ONLINE" OR status="OFFLINE" | table status I getting result is "ONLINE" How it will works on the alert ? How can I set in the alert? Can you please guide me

1ueshkil · ‎12-12-2023

@inventsekar Could you please suggest on this. We have already integrated linux, palo alto,SAP log sources. Just looking to create Linux, Palo alto, SAP use cases which is based on MITRE framework o...

@inventsekar Could you please suggest on this. We have already integrated linux, palo alto,SAP log sources. Just looking to create Linux, Palo alto, SAP use cases which is based on MITRE framework or any attack pattern use cases, as we don't have that much knowledge to create SPL use cases.

julianpmcaf · ‎12-12-2023

Hi, I want to export browser test results in some sort of csv or any file where I can see the performance of a browser test for the past year or month. How can this be possible?

gcusello · ‎12-12-2023

parthiban · ‎12-12-2023

Hi @gcusello This is on premises device and managed by cloud. If device went offline cloud will send log. Which condition I need to add ?

nehamvinchankar · ‎12-12-2023

How to get difference of lastest value with now i have multiple values in latest column and only one value in now column i want output as difference latest now 1701973800.000000 170145...

How to get difference of lastest value with now i have multiple values in latest column and only one value in now column i want output as difference latest now 1701973800.000000 1701455400.000000 1701455400.000000 1700418600.000000 1700418600.000000 1702372339 1701973800.000000- 1702372339 = 1701455400.000000- 1702372339= like this

gcusello · ‎12-12-2023

Hi @nehamvinchankar, does the regex extract only one value or doesn't it extract any value? if only one value, plese try this: | rex max_match=0 "(?ms)\"API_NAME\": \"(?<API_NAME>[^\"]+)\",\n\"DEP...

Hi @nehamvinchankar, does the regex extract only one value or doesn't it extract any value? if only one value, plese try this: | rex max_match=0 "(?ms)\"API_NAME\": \"(?<API_NAME>[^\"]+)\",\n\"DEP_DATE\": \"(?<DEP_DATE>[^\"]+)\"" if no values, please check the source, because using the source you shared the regex extracts all the values, as you can test in regex101 Ciao. Giuseppe

nehamvinchankar · ‎12-12-2023

not working fields are not getting extracted

gcusello · ‎12-12-2023

Hi @parthiban, ok, but how can the device send a status if it's offline? if it continue to send logs even if it's offline, you can add this condition to the search, but, as I suppose, it doesnt sen...

Hi @parthiban, ok, but how can the device send a status if it's offline? if it continue to send logs even if it's offline, you can add this condition to the search, but, as I suppose, it doesnt sends logs when offline, you can use my search. Ciao. Giuseppe

All Posts

All Posts

Splunk Search

Different query execution in Dashboard studio panel on the basis of drop down value.

Re: Export Browser Tests Data

Re: Export Browser Tests Data

Re: Export Browser Tests Data

Re: mulitvalue and single value difference

Re: Export Browser Tests Data

Re: Add time range filter based on specific column when using loadjob savedsearch query

Re: TLS validation fails in connection from searchhead to indexpeers in cluster scenarios?

Add time range filter based on specific column when using loadjob savedsearch query

How to get the history of modifications made to a lookup file?

Re: Creating alert for if device went offline and recovery status.

Re: MITRE usecases

Export Browser Tests Data

Re: Creating alert for if device went offline and recovery status.

Re: Creating alert for if device went offline and recovery status.

mulitvalue and single value difference

Re: Field extraction from one multivalued event

Re: Field extraction from one multivalued event

Re: Creating alert for if device went offline and recovery status.

All Posts

Are you a member of the Splunk Community?

All Posts