All Posts

spodda01da · ‎10-30-2023

Hi all, I am using Splunk Enterprise Security and having trouble converting the indexes to CIM compliance. One of them is Cloudflare. The JSON data is being ingested via an AWS S3 bucket, and the v...

Hi all, I am using Splunk Enterprise Security and having trouble converting the indexes to CIM compliance. One of them is Cloudflare. The JSON data is being ingested via an AWS S3 bucket, and the visualization works fine on the Cloudflare App. However, the CIM Validator doesn't recognize the events and is unable to be used in Splunk ES. Has anyone been able to successfully convert these events to be CIM compliant? Thanks,

Splunkie1 · ‎10-30-2023

Thank you but, I get position_select dynamically from a search with up to 1000 results. working through each position individually would be impractical. Is there another way?

LearningGuy · ‎10-30-2023

Hi @gcusello , Sorry if I wasn't clear. If you refer to the drawing I posted previously. The issue is actually the opposite. After I moved the **commands/searches** into summary index, the ...

Hi @gcusello , Sorry if I wasn't clear. If you refer to the drawing I posted previously. The issue is actually the opposite. After I moved the **commands/searches** into summary index, the data was merged into one row, so the values command did not give me unique values I expected to get "companyA", but it gave me "companyA companyA" because of the Carriage Return ("\n") Values command did not work company ip companyA companyA 1.1.1.1 companyB companyB companyB 1.1.1.2 values command worked company ip companyA companyA 1.1.1.1 companyB companyB companyB 1.1.1.2 I also have a different post specifically discussed about why summary index caused this merge behavious https://community.splunk.com/t5/Reporting/summary-index-merges-multiple-line-values-into-one-row/m-p/666673#M12266 1) Why values command does not work if the data gets merged into one line? 2) Why does summary index cause merging into one row in the first place? Thank you so much for your help

avi7326 · ‎10-30-2023

Is there any way to merge query A and Query B , Both these two queries are different . Query A |stats count as total result = 5 Query B |stats count as error result=3 Now I want a dif...

Is there any way to merge query A and Query B , Both these two queries are different . Query A |stats count as total result = 5 Query B |stats count as error result=3 Now I want a difference 5-3 =2 as success count

bennett_riegel · ‎10-30-2023

I'm in the install app from file section, and I've downloaded the security essentials, but I don't see a file to put in there. What is the exact name of it because I feel like I've tried all of them?...

I'm in the install app from file section, and I've downloaded the security essentials, but I don't see a file to put in there. What is the exact name of it because I feel like I've tried all of them?

gcusello · ‎10-30-2023

Hi @LearningGuy , to have all the values in the same row, you have to add the nomv command (https://docs.splunk.com/Documentation/Splunk/9.1.1/SearchReference/Nomv) after the stats command: index=r...

Hi @LearningGuy , to have all the values in the same row, you have to add the nomv command (https://docs.splunk.com/Documentation/Splunk/9.1.1/SearchReference/Nomv) after the stats command: index=regular_index | stats values(company) AS company BY ip | nomv company | table company ip Ciao. Giuseppe

LearningGuy · ‎10-30-2023

Hi @gcusello Yes, this answered my question, but I have other doubt. Values command does not work if the data got merged into one row after "summary index". Please see below example and pictur...

Hi @gcusello Yes, this answered my question, but I have other doubt. Values command does not work if the data got merged into one row after "summary index". Please see below example and picture. Please suggest. Thanks company ip companyA companyA 1.1.1.1 companyB companyB companyB 1.1.1.2

ITWhisperer · ‎10-30-2023

Set up your selection so that the value of the selection includes the where command, except in the case of * <input type="dropdown" token="position_select" searchWhenChanged="true"> <label...

Set up your selection so that the value of the selection includes the where command, except in the case of * <input type="dropdown" token="position_select" searchWhenChanged="true"> <label>Floored $position_select$</label> <choice value="">*</choice> <choice value="| where position=1">1.2</choice> <choice value="| where position=2">2.4</choice> </input> Then just use the token in your search index = index1 $position_select$

ITWhisperer · ‎10-30-2023

Since you are using count by Entity, you will get multiple counts, one for each unique Entity. Similarly, since you are using count by title, you will get multiple counts, one for each unique title. ...

Since you are using count by Entity, you will get multiple counts, one for each unique Entity. Similarly, since you are using count by title, you will get multiple counts, one for each unique title. Which Entity count do you want to compare with which title count?

jotne · ‎10-30-2023

You can use the command addtotals totals for rows. | makeresults | eval mon=10, tue=23, wen=12, thu=2, fri=15 | addtotals You get a new field with name Total with value 62

djjung_chung · ‎10-30-2023

Hello I understand that you access the monitoring web through the launch controller button on the account page. I received the license today and proceeded with the installation, but two errors oc...

Hello I understand that you access the monitoring web through the launch controller button on the account page. I received the license today and proceeded with the installation, but two errors occur as follows. 1. <h1>500 Internal Server Error</h1><br/>Exception <br/> 2. : HttpErrorResponse <html><body><h1>500 Internal Server Error</h1><br/>Exception <br/></body></html> Http failure response for https://chaplinappdynamics.com/controller/restui/containerApp/mainNavConfig: 500 Internal Server Error I didn't click "Use local login", I clicked "Next". Can you tell me what the problem is? Thank you.

gcusello · ‎10-30-2023

Hi @mukhan1, have you an API to extract the content of this file? If yes, you could develop a script that periodically extract the logs and writes them in a text file readable from Splunk or direct...

Hi @mukhan1, have you an API to extract the content of this file? If yes, you could develop a script that periodically extract the logs and writes them in a text file readable from Splunk or directly in Splunk. Splunk developed a connector (e.g. for wineventlog) to extract not text files. Ciao. Giuseppe Ciao. Giuseppe

Rajaion · ‎10-30-2023

Oh yes, I had forgotten the use of sum, in fact, it works perfectly. Thank you very much for your help. Best regards, Rajaion

Splunkie1 · ‎10-30-2023

I have a field called position that contains integers and a token called position_select that is either a floating point number or a * (=all positions). Now i want to search all positions that match...

I have a field called position that contains integers and a token called position_select that is either a floating point number or a * (=all positions). Now i want to search all positions that match position_select. So i tried something like that: index = index1 | eval position_search = floor($position_select$) | where position = position_search The problem is that you of course can't use * in floor. Another problem is that | where position = * is impossible too. However i cant use | search because | search position = position_search does not work. So the question is, is there any way to use something like floor() on position_select?

Falko · ‎10-30-2023

Thanks! This sounds like what I'm looking for. I might give this a try. The indexes in question already have several years of retention period configured. That should be taken care off. It's really j...

Thanks! This sounds like what I'm looking for. I might give this a try. The indexes in question already have several years of retention period configured. That should be taken care off. It's really just summary indexes that we want to persist for "sentimental reasons"

avi7326 · ‎10-30-2023

From the query using stats count by entity getting A and then using stats count by title getting B then I want a difference A-B count then what should I use.

ITWhisperer · ‎10-30-2023

Your requirement is unclear - if you have a count by "Entity A" for example, which total count do you want to use to find the difference, "Total X", "Total Y" or "Total Z", and vice versa

capilarity · ‎10-30-2023

Hi, We receive daily emails with lists of IOC's for malware and phishing alerts, each email may contain multiple ip address, domains and email addresses and we are trying to extract these to run se...

Hi, We receive daily emails with lists of IOC's for malware and phishing alerts, each email may contain multiple ip address, domains and email addresses and we are trying to extract these to run searches against out web and email logs. I have the regex working for extraction but it will only extract the first match. I've tried multiple ways of achieving this without success, the current config is: Props.conf EXTRACT-IOCURL = (?P<IOCURL>[a-zA-Z0-9][a-zA-Z0-9-]+[a-zA-Z0-9][\[][\.|@][\]][^\s]{2,}|[a-zA-Z0-9][a-zA-Z0-9-]+[a-zA-Z0-9][\[][\.|@][\]][^\s]{2,}|[a-zA-Z0-9]+[\[][\.|@][\]][^\s]{2,}|[a-zA-Z0-9]+[\[][\.|@][\]][^\s]{2,}) EXTRACT-IOCIP = (?P<IOCIP>\d{1,3}\[\.\]\d{1,3}\[\.\]\d{1,3}\[\.\]\d{1,3}+) The indexed email looks like this.... .... Domains comprised[.]site badsite[.]studio malware[.]live IP addresses 192[.]254[.]71[.]78 192[.]71[.]27[.]202 193[.]182[.]144[.]67 .... but the current config will only extract the first record for each: IOCURL - comprised[.]site and IOCIP - 192[.]254[.]71[.]78. Any ideas how to extract all the domains and IP addresses? Thanks

ITWhisperer · ‎10-30-2023

Try it like this (for pre-Splunk 9) index=* Initialised xxxxxxxxxxxx xxxxxx|rex "\{consumerName\=\'(MY REGEX)"|chart count AS Connections by name | append [| makeresults | eval name="Container ...

Try it like this (for pre-Splunk 9) index=* Initialised xxxxxxxxxxxx xxxxxx|rex "\{consumerName\=\'(MY REGEX)"|chart count AS Connections by name | append [| makeresults | eval name="Container A,Container B,Container C,Container D" | eval name=split(name,",")] | stats count by name | where count < 2

mukhan1 · ‎10-30-2023

@gcusello yes you're correct splunk can integrate any text file but my issue is that i have .log file namely as "F.JBASE.JED.AUDIT.LOG" this is the file name this file is not a text file

All Posts

All Posts

Cloudflare CIM-Complaint issue for Splunk ES

Re: use * in floor

Re: Does stats values command combine unique values?

Re: How to find the difference of two stats count

Re: Splunk Security Essentials

Re: Does stats values command combine unique values?

Re: Does stats values command combine unique values?

Re: use * in floor

Re: How to find the difference of two stats count

Re: How do you calculate the totals of each table row and display those values as new fields?

500 Internal Server Error

Re: Splunk integartion with Flat file

Re: Add a value "0" and make it visible on a graph

use * in floor

Re: How to hibernate a whole Splunk Cluster?

Re: How to find the difference of two stats count

Re: How to find the difference of two stats count

Extraction of Multiple events (URLS and IP addresses) from text files

Re: Pass values in splunk search and compare it with results

Re: Splunk integartion with Flat file

All Posts

Are you a member of the Splunk Community?

All Posts