Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
All Posts
Find Answers
Ask questions. Get answers. Find technical product solutions from passionate members of the Splunk community.
×
Are you a member of the Splunk Community?
Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- Find Answers
- :
- All Posts
All Posts
11-14-2023
10:29 AM
Is the only advantage that append is not limited as the join? Thank you
11-14-2023
10:19 AM
1 Karma
| rex field=field_id max_match=0 "/(?<key>[^/]+)/(?<value>[^/]+)"
| eval row=mvrange(0,mvcount(key))
| streamstats count as _row
| mvexpand row
| eval name="field_".mvindex(key,row)
| eval {name}=mvi...
See more...
| rex field=field_id max_match=0 "/(?<key>[^/]+)/(?<value>[^/]+)"
| eval row=mvrange(0,mvcount(key))
| streamstats count as _row
| mvexpand row
| eval name="field_".mvindex(key,row)
| eval {name}=mvindex(value,row)
| fields - key value name row
| stats values(*) as * by _row
11-14-2023
10:17 AM
Thank you! The max = 0 flag is what i had missing indeed. The data i provided is the result of the search that is why it's epoch. The logs i am managing are not that big but i will keep that in mind ...
See more...
Thank you! The max = 0 flag is what i had missing indeed. The data i provided is the result of the search that is why it's epoch. The logs i am managing are not that big but i will keep that in mind for the future! Have a nice day!
11-14-2023
10:15 AM
The difficulty is that click.name2 is the group by in the query, which is dynamically determined by the eval in the query (the AppName). That AppName is for making the chart human readable, but the ...
See more...
The difficulty is that click.name2 is the group by in the query, which is dynamically determined by the eval in the query (the AppName). That AppName is for making the chart human readable, but the drill down need to "convert" the AppName back into the search terms used for the clicked on AppName. e.g., the app named GVMSAuth is really the search terms (SourceName="KmsService" AND Message="*GVMSAuth(Ver:*"), as far as seeing the event logs. Does that make sense?
11-14-2023
10:11 AM
I am using splunk 8.2.12 and am trying to generate a pdf via an existing alert action using splunk api calls. The action was originally developed for automated ticketing within another app when a spl...
See more...
I am using splunk 8.2.12 and am trying to generate a pdf via an existing alert action using splunk api calls. The action was originally developed for automated ticketing within another app when a splunk alert is triggered. The end goal is to be able to upload the pdf of search results based on the alert to the ticket in an automated way. below is the current state of the code: def create_pdf_for_ticket(payload, output_file):
# Extract relevant information from the payload
ticket_id = payload.get('sid')
index = payload.get('result', {}).get('index')
sourcetype = payload.get('result', {}).get('sourcetype')
# Construct the search query based on the extracted information
search_query = f'search index={index} sourcetype={sourcetype} sid={ticket_id}'
# Make the API request to execute the search and get the results
search_payload = {
'search': search_query,
'output_mode': 'json',
}
search_response = requests.get('http://localhost:8089/services/search/jobs/export', params=search_payload, headers=post_headers)
# Check if the search request was successful
if search_response.status_code == 200:
# Save the search results to a file
with open(output_file, 'wb') as pdf_file:
pdf_file.write(search_response.content)
print(f"PDF created successfully at: {output_file}")
else:
print(f"Error creating PDF: {search_response.status_code} - {search_response.text}")
def main():
*****
# Create PDF for the ticket
output_file = os.environ['SPLUNK_HOME'] + '/etc/apps/Splunk_Ivanti/local/ticket.pdf'
create_pdf_for_ticket(payload, output_file)
*****
11-14-2023
10:10 AM
Without seeing the events, it is difficult to know what to suggest. Hopefully, previous answers will at least give you some ideas.
11-14-2023
10:08 AM
Try something like this <drilldown>
<eval token="start_time">if(isnull($row._time$),$field1.earliest$,$row._time$)</eval>
<eval token="end_time">if(isnull($row._time$),$f...
See more...
Try something like this <drilldown>
<eval token="start_time">if(isnull($row._time$),$field1.earliest$,$row._time$)</eval>
<eval token="end_time">if(isnull($row._time$),$field1.latest$,($row._time$ + $row._span$))</eval>
<link target="_blank">search?q=(index%3Divss%20OR%20index%3Dhec_18399_na_prod)%0D%0ANOT%20%22*ivss-test*%22%0D%0ANOT%20(SourceName%3DMicrosoft-Windows-CAPI2)%0D%0ANOT%20(SourceName%3DMicrosoft-Windows-DistributedCOM)%0D%0ANOT%20(SourceName%3D%22Microsoft%20WSE%203.0%22)%0D%0ANOT%20(SourceName%3DMicrosoft-Windows-GroupPolicy)%0D%0ANOT%20(SourceName%3DMicrosoft-Windows-Eventlog)%0D%0ANOT%20(SourceName%3DLogging)%0D%0ANOT%20(SourceName%3DADFSAuth)%0D%0ANOT%20(SourceName%3DSchannel)%0D%0ANOT%20%22*PackageExtractor.exe*%22%0D%0ANOT%20%22*w3wp.exe*%22%0D%0ANOT%20%22*openssl.exe*%22%0D%0A(Type%3D%22Error%22%20OR%20Level%3D%22Error%22)%0D%0A%7C%20eval%20AppName%20%3D%20case(%0D%0A(SourceName%3D%22KmsService%22%20AND%20Message%3D%22*Mailer(*%22)%2C%20%22Mailer%22%2C%20%0D%0A(SourceName%3D%22KmsService%22%20AND%20Message%3D%22*SPackager(*%22)%2C%20%22SPackager%22%2C%20%0D%0A(SourceName%3D%22KmsService%22%20AND%20Message%3D%22*Hancock(Ver%3A*%22)%2C%20%22Hancock%22%2C%20%0D%0A(SourceName%3D%22KmsService%22%20AND%20Message%3D%22*GVMSAuth(Ver%3A*%22)%2C%20%22GVMSAuth%22%2C%20%0D%0A(source%3D%22Cloud.SecurePnC%22)%2C%20%22Cloud_SecurePnC%22%2C%0D%0A(source%3D%22ivssspd%22)%2C%20%22SecurePackageDelivery%22%2C%0D%0A(sourcetype%3D%22WinEventLog%3ASystem%22%20AND%20EventCode%3D5074)%2C%20%22AppPool_Restarts%22%2C%0D%0A(source%3D%22ivsscs%22%20AND%20'Properties.Service'%3D%22SecureConnect%22)%2C%20%22Cloud_SecureConnect%22%2C%0D%0A(source%3D%22ivsscs%22%20AND%20'Properties.Service'%3D%22SecureMessage%22)%2C%20%22Cloud_SecureMessage%22%2C%0D%0A(source%3D%22ivsscs%22%20AND%20'Properties.Service'%3D%22FPackager%22)%2C%20%22Cloud_FPackager%22%2C%0D%0A(SourceName%3D%22IVSSCS%22%20AND%20match(_raw%2C%20%22.*Service%20%3D%20SecureMessage.*%22))%2C%20%22SecureMessage%22%2C%0D%0A(SourceName%3D%22IVSSCS%22%20AND%20match(_raw%2C%20%22.*Service%20%3D%20SecureConnect.*%22))%2C%20%22SecureConnect%22%2C%0D%0A(SourceName%3D%22KmsService%22)%2C%20%22KmsService%22%2C%0D%0A(SourceName%3D%22AutoSigner%22)%2C%20%22AutoSigner%22%2C%0D%0A(SourceName%3D%22DebugToken%22)%2C%20%22DebugToken%22%2C%0D%0A(SourceName%3D%22FlashbackCache%22)%2C%20%22FlashbackCache%22%2C%0D%0A(SourceName%3D%22KeyBundler%22)%2C%20%22KeyBundler%22%2C%0D%0A(SourceName%3D%22SecureModuleCore%22)%2C%20%22SecureModuleCore%22%2C%0D%0A(SourceName%3D%22SecureOTACore%22)%2C%20%22SecureOTACore%22%2C%0D%0A(SourceName%3D%22SecurePaaK%22)%2C%20%22SecurePaaK%22%2C%0D%0A(SourceName%3D%22SecurePayloadCore%22)%2C%20%22SecurePayloadCore%22%2C%0D%0A(SourceName%3D%22SecurePnCCore%22)%2C%20%22SecurePnCCore%22%2C%0D%0A(SourceName%3D%22SecureRekey%22)%2C%20%22SecureRekey%22%2C%0D%0A(SourceName%3D%22SecureSigner%22)%2C%20%22SecureSigner%22%2C%0D%0A(SourceName%3D%22SupplierFeed%22)%2C%20%22SupplierFeed%22%2C%0D%0A(SourceName%3D%22TRON%22)%2C%20%22TRON%22%2C%0D%0A(SourceName%3D%22WSLAgent5%22)%2C%20%22WSLAgent5%22%2C%0D%0A(SourceName%3D%22MMU%22)%2C%20%22MMU%22%2C%0D%0A1%3D%3D1%2C%20%22Other%22)%0D%0A%7C%20where%20AppName%3D"$click.name2$"&earliest=$start_time$&latest=$end_time$</link>
</drilldown>
11-14-2023
09:49 AM
1 Karma
It looks correct. The events are timestamped in UTC, but the props.conf says to convert times to Americas/Chicago, which is 6 hours behind UTC. I recommend changing the props to extract the time zo...
See more...
It looks correct. The events are timestamped in UTC, but the props.conf says to convert times to Americas/Chicago, which is 6 hours behind UTC. I recommend changing the props to extract the time zone from the timestamp. [app_log]
CHARSET=UTF-8
LINE_BREAKER=([\r\n]+)\d+\-\d+\-\d+\s\d+\:\d+\:\d+\w
NO_BINARY_CHECK=true
SHOULD_LINEMERGE=false
disabled=false
TIME_FORMAT=%Y-%m-%d %H:%M:%S%Z
TIME_PREFIX=^
11-14-2023
09:46 AM
I'm trying to corral a string into new field and value and having trouble. I've used eval / split / mvexpand.... The string looks like this. Its actually a field in an event: field_id=/key1/value1/...
See more...
I'm trying to corral a string into new field and value and having trouble. I've used eval / split / mvexpand.... The string looks like this. Its actually a field in an event: field_id=/key1/value1/key2/value2/key3/value3/key4/value4 The end goal is to have new fields. Like: field_key1=value1 filed_key2=value2 So i can now search, for example, if field_key1='the value of something"
Labels
- Labels:
-
data
-
field extraction
11-14-2023
09:43 AM
1 Karma
Looks good to me. Of course, change "mysourcetype" to the actual sourcetype name.
11-14-2023
09:39 AM
1 Karma
For a better and easy, you can use below SPL and replace your index name for any duplicates in Splunk. index=* | stats count by _raw, index, sourcetype, source, host | where count>1
11-14-2023
09:38 AM
great - I removed the "|u" from the token in the link, in case that might not escape the double quotes, but the search window went back to jsut showing the token name, not value. I put the "|u" back...
See more...
great - I removed the "|u" from the token in the link, in case that might not escape the double quotes, but the search window went back to jsut showing the token name, not value. I put the "|u" back, but the search window is now persisting showing the token name, not value. it's almost like the splunk xml parser is behaving inconsistently.
11-14-2023
09:35 AM
I have this props.conf TIME is almost 6hrs off from the event time. Below is my props. [app_log] CHARSET=UTF-8 LINE_BREAKER=([\r\n]+)\d+\-\d+\-\d+\s\d+\:\d+\:\d+\w NO_BINARY_CHECK=true SHOULD_LI...
See more...
I have this props.conf TIME is almost 6hrs off from the event time. Below is my props. [app_log] CHARSET=UTF-8 LINE_BREAKER=([\r\n]+)\d+\-\d+\-\d+\s\d+\:\d+\:\d+\w NO_BINARY_CHECK=true SHOULD_LINEMERGE=false disabled=false TIME_FORMAT=%Y-%m-%d %H:%M:%S TIME_PREFIX=^ TZ=US/Central Sample log:- This is event time which is ingesting fine "2023-11-14 10:59:58Z" 2023-11-14 10:59:58Z stevelog Closed Successfully 2023-11-14 10:59:58Z stevelog_close 2023-11-14 10:59:58Z Resetting CWD back from C:\WINDOWS\SysWOW64\inetsrv 2023-11-14 10:59:58Z Resetting CWD complete, back too C:\WINDOWS\SysWOW64\inetsrv 2023-11-14 10:59:58Z steveEngineMain Thread ====================> END The actual TIME is 6hrs how than event time. Please find the attached screen and request you to let me know what the time difference.
11-14-2023
09:31 AM
I tried removing all my custom xml & use the drilldown ui to generate the evals. then I went to the xml to add the link back in. interestingly, the value for the token app_query is getting passed t...
See more...
I tried removing all my custom xml & use the drilldown ui to generate the evals. then I went to the xml to add the link back in. interestingly, the value for the token app_query is getting passed to the new search window, but it is url escaped, so the query returns no results.
11-14-2023
09:10 AM
just tried, same result <form version="1.1" theme="dark">
<label>Error Overview</label>
<description>These charts only show apps having errors in the selected time frame</description>
<fie...
See more...
just tried, same result <form version="1.1" theme="dark">
<label>Error Overview</label>
<description>These charts only show apps having errors in the selected time frame</description>
<fieldset submitButton="false">
<input type="time" token="field1">
<label></label>
<default>
<earliest>-24h@h</earliest>
<latest>now</latest>
</default>
</input>
</fieldset>
<row>
<panel>
<title>Across Time</title>
<chart>
<search>
<query>(index=ivss OR index=hec_18399_na_prod)
NOT "*ivss-test*"
NOT (SourceName=Microsoft-Windows-CAPI2)
NOT (SourceName=Microsoft-Windows-DistributedCOM)
NOT (SourceName="Microsoft WSE 3.0")
NOT (SourceName=Microsoft-Windows-GroupPolicy)
NOT (SourceName=Microsoft-Windows-Eventlog)
NOT (SourceName=Logging)
NOT (SourceName=ADFSAuth)
NOT (SourceName=Schannel)
NOT "*PackageExtractor.exe*"
NOT "*w3wp.exe*"
NOT "*openssl.exe*"
(Type="Error" OR Level="Error")
| eval AppName = case(
(SourceName="KmsService" AND Message="*Mailer(*"), "Mailer",
(SourceName="KmsService" AND Message="*SPackager(*"), "SPackager",
(SourceName="KmsService" AND Message="*Hancock(Ver:*"), "Hancock",
(SourceName="KmsService" AND Message="*GVMSAuth(Ver:*"), "GVMSAuth",
(source="Cloud.SecurePnC"), "Cloud_SecurePnC",
(source="ivssspd"), "SecurePackageDelivery",
(sourcetype="WinEventLog:System" AND EventCode=5074), "AppPool_Restarts",
(source="ivsscs" AND 'Properties.Service'="SecureConnect"), "Cloud_SecureConnect",
(source="ivsscs" AND 'Properties.Service'="SecureMessage"), "Cloud_SecureMessage",
(source="ivsscs" AND 'Properties.Service'="FPackager"), "Cloud_FPackager",
(SourceName="IVSSCS" AND match(_raw, ".*Service = SecureMessage.*")), "SecureMessage",
(SourceName="IVSSCS" AND match(_raw, ".*Service = SecureConnect.*")), "SecureConnect",
(SourceName="KmsService"), "KmsService",
(SourceName="AutoSigner"), "AutoSigner",
(SourceName="DebugToken"), "DebugToken",
(SourceName="FlashbackCache"), "FlashbackCache",
(SourceName="KeyBundler"), "KeyBundler",
(SourceName="SecureModuleCore"), "SecureModuleCore",
(SourceName="SecureOTACore"), "SecureOTACore",
(SourceName="SecurePaaK"), "SecurePaaK",
(SourceName="SecurePayloadCore"), "SecurePayloadCore",
(SourceName="SecurePnCCore"), "SecurePnCCore",
(SourceName="SecureRekey"), "SecureRekey",
(SourceName="SecureSigner"), "SecureSigner",
(SourceName="SupplierFeed"), "SupplierFeed",
(SourceName="TRON"), "TRON",
(SourceName="WSLAgent5"), "WSLAgent5",
(SourceName="MMU"), "MMU",
1==1, "Other")
| timechart usenull=f useother=f limit=0 span=1h count by AppName</query>
<earliest>$field1.earliest$</earliest>
<latest>$field1.latest$</latest>
</search>
<option name="charting.axisTitleX.visibility">collapsed</option>
<option name="charting.chart">line</option>
<option name="charting.drilldown">all</option>
<option name="height">500</option>
<option name="refresh.display">progressbar</option>
<drilldown target="_blank">
<eval token="app_query">case($click.name2$=="Mailer", "(SourceName="KmsService" AND Message="*Mailer(*")",$click.name2$=="SPackager", "(SourceName="KmsService" AND Message="*SPackager(*")",$click.name2$=="Hancock", "(SourceName="KmsService" AND Message="*Hancock(Ver:*")",$click.name2$=="GVMSAuth", "(SourceName="KmsService" AND Message="*GVMSAuth(Ver:*")",$click.name2$=="Cloud_SecurePnC", "(source="Cloud.SecurePnC")",$click.name2$=="SecurePackageDelivery", "(source="ivssspd")",$click.name2$=="AppPool_Restarts", "(sourcetype="WinEventLog:System" AND EventCode=5074)",$click.name2$=="Cloud_SecureConnect", "(source="ivsscs" AND Properties.Service="SecureConnect")",$click.name2$=="Cloud_SecureMessage", "(source="ivsscs" AND Properties.Service="SecureMessage")",$click.name2$=="Cloud_FPackager", "(source="ivsscs" AND Properties.Service="FPackager")",$click.name2$=="SecureMessage", "(SourceName="IVSSCS" AND "*Service = SecureMessage*")",$click.name2$=="SecureConnect", "(SourceName="IVSSCS" AND "*Service = SecureConnect*")",$click.name2$=="KmsService", "(SourceName="KmsService")",$click.name2$=="AutoSigner", "(SourceName="AutoSigner")",$click.name2$=="DebugToken", "(SourceName="DebugToken")",$click.name2$=="FlashbackCache", "(SourceName="FlashbackCache")",$click.name2$=="KeyBundler", "(SourceName="KeyBundler")",$click.name2$=="SecureModuleCore", "(SourceName="SecureModuleCore")",$click.name2$=="SecureOTACore", "(SourceName="SecureOTACore")",$click.name2$=="SecurePaaK", "(SourceName="SecurePaaK")",$click.name2$=="SecurePayloadCore", "(SourceName="SecurePayloadCore")",$click.name2$=="SecurePnCCore", "(SourceName="SecurePnCCore")",$click.name2$=="SecureRekey", "(SourceName="SecureRekey")",$click.name2$=="SecureSigner", "(SourceName="SecureSigner")",$click.name2$=="SupplierFeed", "(SourceName="SupplierFeed")",$click.name2$=="TRON", "(SourceName="TRON")",$click.name2$=="WSLAgent5", "(SourceName="WSLAgent5")",$click.name2$=="MMU", "(SourceName="MMU")")</eval>
<eval token="start_time">if(isnull($row._time$),$field1.earliest$,$row._time$)</eval>
<eval token="end_time">if(isnull($row._time$),$field1.latest$,($row._time$ + $row._span$))</eval>
<link target="_blank">search?q=(index%3Divss%20OR%20index%3Dhec_18399_na_prod)%0ANOT%20%22*ivss-test*%22%0ANOT%20(SourceName%3DMicrosoft-Windows-CAPI2)%0ANOT%20(SourceName%3DMicrosoft-Windows-DistributedCOM)%0ANOT%20(SourceName%3D%22Microsoft%20WSE%203.0%22)%0ANOT%20(SourceName%3DMicrosoft-Windows-GroupPolicy)%0ANOT%20(SourceName%3DMicrosoft-Windows-Eventlog)%0ANOT%20(SourceName%3DLogging)%0ANOT%20(SourceName%3DADFSAuth)%0ANOT%20(SourceName%3DSchannel)%0ANOT%20%22*PackageExtractor.exe*%22%0ANOT%20%22*w3wp.exe*%22%0ANOT%20%22*openssl.exe*%22%0A(Type%3D%22Error%22%20OR%20Level%3D%22Error%22)%0A$app_query|u$&earliest=$start_time$&latest=$end_time$</link>
</drilldown>
</chart>
</panel>
</row>
</form>
11-14-2023
09:07 AM
I'm creating an alert to notify oracle database administrators when a db_connect connection has failed. I have created the query to return the name of the failed connection using the splunk _intern...
See more...
I'm creating an alert to notify oracle database administrators when a db_connect connection has failed. I have created the query to return the name of the failed connection using the splunk _internal logs. However, I would like to include the hostname and default database that are defined in the connection. I have not been able to locate logs with the connection host and default database using the connection name as the search criteria. Is there a REST or CURL command available that retrieves the host and default database (using the connection name as input) that I can use to join with my completed query that retrieves failed connections? Thanks In Advance.
Labels
- Labels:
-
search
11-14-2023
09:00 AM
Hi @richgalloway , my final tranforms.conf and props.conf looks like this correct if format is not valid [key_value_pair] REGEX = (\w+)=(.*?)(?=\s\w+=|$) FORMAT = $1::$2 props.conf [mysourc...
See more...
Hi @richgalloway , my final tranforms.conf and props.conf looks like this correct if format is not valid [key_value_pair] REGEX = (\w+)=(.*?)(?=\s\w+=|$) FORMAT = $1::$2 props.conf [mysourcetype] category = Custom description = Secret Server EXTRACT-event_id_name = \|Secret Server\|[^\|]*\|(?<event_id>[^\|]*)\|(?<event_name>[^\|]*)\| #REPORT-key_value_pair = key_value_pair KV_MODE = auto SEDCMD-rm_cs2 = s/(cs2=.*?(cs|\s*$))/\2/ SEDCMD-rm_cs2Label = s/(cs2Label=.*?(cs|\s*$))/\2/ EVAL-group = if(match(cs2, "^Secret Server"), cs2, null()) EVAL-user = if(match(cs2, "^Secret Server"), null(), cs2) Thanks Thanks
11-14-2023
08:51 AM
Is the app (Cisco Secure eStreamer Client Add-On[https://splunkbase.splunk.com/app/3662]) even usable on splunkcloud? I can install it from the "browse more apps" page in the cloud app management are...
See more...
Is the app (Cisco Secure eStreamer Client Add-On[https://splunkbase.splunk.com/app/3662]) even usable on splunkcloud? I can install it from the "browse more apps" page in the cloud app management area, but it seems i will not be able to set it up or use it, as 1) it requires you to edit a config file on disk; 2) it writes the data it retreives from Cisco to a local disk; 3) it is not possible to create a disk monitor in splunkcloud. Only real option seems to be to use a heavy forwarder. Any suggestions?
Labels
- Labels:
-
using Splunk Cloud
11-14-2023
08:47 AM
OK so that's not the actual event. So, going by what you have shared, try this | where matching="[mobileNumber, countryCode]"
