All Posts

prakashsbk · ‎10-09-2023

Hi All We are trying to get the incidents which are in open state (ie AlertStatus only equal to CREATE) . Table Out is below : Here IncidentID 1414821 has both AlertStatus = CLEAR and CREA...

Hi All We are trying to get the incidents which are in open state (ie AlertStatus only equal to CREATE) . Table Out is below : Here IncidentID 1414821 has both AlertStatus = CLEAR and CREATE , this Incident ID should not get displayed . We need IncidentID only with Alertstaus = CREATE. we ran with | eval IncidentID=case(AlertStatus="CREATE" AND AlertStatus!="CLEAR",IncidentID) | table IncidentID AlertStatus When we run an Query it should only Display IncidentID value 1437718 Thanks and Regards

vijreddy30 · ‎10-09-2023

Hi All, Created test user and assign the viwer roles and provided read only access, the above screen not the test user not able to see the under the knowledge objects, how yo remove the knowledge obj...

Hi All, Created test user and assign the viwer roles and provided read only access, the above screen not the test user not able to see the under the knowledge objects, how yo remove the knowledge objects? Please help me the process? I need to remove tags,eventypes,lookups,userinterface..................

PickleRick · ‎10-09-2023

OK, for the clarification. In my case (I have no idea if yours is the same but seems so). The RSTs were not sent as a response to the initial SYN - signalling a closed port. No, they were sent by the...

OK, for the clarification. In my case (I have no idea if yours is the same but seems so). The RSTs were not sent as a response to the initial SYN - signalling a closed port. No, they were sent by the receiving end some time after the connection had been already established and some data was already sent through it. Just for no apparent reason the receiver decided that it wouldn't talk to the sender no more and would abruptly close the connection.

noobSpl888 · ‎10-09-2023

Hi, the outputs.conf is the same as in our linux hosts (which are working fine). anyway i shall check with my network team on the firewall level. and also raise a support case. thanks for the inp...

Hi, the outputs.conf is the same as in our linux hosts (which are working fine). anyway i shall check with my network team on the firewall level. and also raise a support case. thanks for the inputs. Cheers

VatsalJagani · ‎10-09-2023

@vijreddy30 - There is no concept of "Read access" in Splunk. In Splunk terms, you have to assign role which consist of capabilities. This document describes all the capabilities - https://docs.s...

@vijreddy30 - There is no concept of "Read access" in Splunk. In Splunk terms, you have to assign role which consist of capabilities. This document describes all the capabilities - https://docs.splunk.com/Documentation/Splunk/9.1.1/Security/Rolesandcapabilities BTW, I don't think you can create a role/user that has only read access based on available capabilities. But you try updating capabilities to that role to see if any combination capabilities. See if any combination works for you. I hope this helps!!!

splunkuser320 · ‎10-09-2023

I am trying to setup the drop down value from one dashboard to another dashboard. On the first dashboard I setup the interactions to set the token value. Do I need to setup anything on the second das...

I am trying to setup the drop down value from one dashboard to another dashboard. On the first dashboard I setup the interactions to set the token value. Do I need to setup anything on the second dashboard?

chris997 · ‎10-09-2023

Hello! I'm working on setting up the integration between Splunk SOAR and Splunk using the Splunk App for SOAR Export. I was able to configure my SOAR server in the app and verify connectivity, but I...

Hello! I'm working on setting up the integration between Splunk SOAR and Splunk using the Splunk App for SOAR Export. I was able to configure my SOAR server in the app and verify connectivity, but I'm running into errors when trying to use the alert action associated with the app. When using the "Send to SOAR" alert action, I receive "Alert script returned error code 5" in the logs. I wasn't able to find any information regarding this error code so I'm not sure what could be causing it. Any help would be appreciated, thank you!

richgalloway · ‎10-09-2023

If you have a support entitlement, you can submit a ticket with Splunk Support.

richgalloway · ‎10-09-2023

Onboarding of data is completely under your control even in Splunk Cloud. To send the data to an events index, change the index name in inputs.conf to one that is for events. Note that there are tw...

Onboarding of data is completely under your control even in Splunk Cloud. To send the data to an events index, change the index name in inputs.conf to one that is for events. Note that there are two types of indexes: event indexes and metrics indexes. Events indexes are the traditional type and can hold any text data. Metrics indexes are relatively new and are designed to hold metrics data in a specific format for faster processing. A metrics index cannot store events nor can it store data that is not properly formatted. Changing the format of the data depends on the source of that data. You may have to work with the data engineer to get the data formatted such that it can be stored in a metrics index.

PickleRick · ‎10-09-2023

BIG-IP uses syslog-ng so the easiest approach would probably be to reconfigure it to send events to a remote destination. Then receive and ingest as you'd do with any other syslog source (with rsyslo...

BIG-IP uses syslog-ng so the easiest approach would probably be to reconfigure it to send events to a remote destination. Then receive and ingest as you'd do with any other syslog source (with rsyslog/plain syslog-ng/SC4S... I wouldn't advise using built-in network port input) See for example https://my.f5.com/manage/s/article/K13080

fishmong3r0 · ‎10-09-2023

Hey Community, We have 2 BIG-IP load balancer VMs and need to have the OS logs (like audit.d) forwarded to Splunk. So, this is not about the F5 application logs themselves, but the OS logs from the ...

Hey Community, We have 2 BIG-IP load balancer VMs and need to have the OS logs (like audit.d) forwarded to Splunk. So, this is not about the F5 application logs themselves, but the OS logs from the underlying system. Is there a way to do this? Much appreciate your support.

AL3Z · ‎10-09-2023

@richgalloway I'm working on Splunk cloud how we can correct the event format or send the data to an events index ?

toonspintue · ‎10-09-2023

Hi @richgalloway, At the moment, a few days later, 3 out of 4 CloudFront IPs are still serving an expired certificate. Leaving aside for the moment that I feel it's a bad look for a security platfo...

Hi @richgalloway, At the moment, a few days later, 3 out of 4 CloudFront IPs are still serving an expired certificate. Leaving aside for the moment that I feel it's a bad look for a security platform to let its TLS certificate expire, whom can I contact about this without resorting to speaking to a sales person? There seems to be no tech support page on splunk.com that doesn't link to sales. Kind regards, Toon

rikinet · ‎10-09-2023

I have time series data like this: _time digital_value: can be either 0.1 or 1 (see Note) analog_value: can be 0, 100, 500, 1000, 5000, 10000 Note) It's actually 0 or 1, but 0 doesn't show in a...

I have time series data like this: _time digital_value: can be either 0.1 or 1 (see Note) analog_value: can be 0, 100, 500, 1000, 5000, 10000 Note) It's actually 0 or 1, but 0 doesn't show in a bar graph. I want to plot this data in a diagram like this: X axis = _time digital_value=0.1 as a red bar digital_value=1 as a green bar analog_value as an overlaid line graph, with log scale Y axis To colorize digital_value, I understand I must split it into two series, like this: | digital_value_red = if(digital_value=0.1, 0.1, null()) | digital_value_green = if(digital_value=1, 1, null()) | fields -digital_value However, this creates two bars per data point, where only the non-null one is shown and the other one leaves a gap. That way, I don't have equally spaced bars along the X axis any more. See this example: So, stacked bars? Yes, but that doesn't work with log scale Y axis for the overlaid line graph. So, calculate log(analog_value) and plot that a linear Y axis? While that produces a proper visual, you can't read the value of analog_value any more (only it's log). Any ideas how I can achieve a colorized bar graph + log scale overlay?

richgalloway · ‎10-09-2023

The error message seems plain enough. There is data going into a metrics index that is not formatted properly for that index type. Either correct the event format or send the data to an events index.

ITWhisperer · ‎10-09-2023

You can add the token name and value to the url you define in your drilldown for the charts, then use this token in the dashboard. When you use tokens, you will notice that the URL address in your b...

You can add the token name and value to the url you define in your drilldown for the charts, then use this token in the dashboard. When you use tokens, you will notice that the URL address in your browser will change to include any tokens which have been defined - you can use this as a guide to the format you need for your drilldown URL

emilep · ‎10-09-2023

Hi @ITWhisperer , Here it seems that transpose was not the good approach. Your solution is working as expected. Many thanks, Emile

smanojkumar · ‎10-09-2023

Hi Splunkers, I'm having a drodown for index_value with console, standard and aws as options, also having separate pie charts for standard, console and aws, when we click the pie chart in any one...

Hi Splunkers, I'm having a drodown for index_value with console, standard and aws as options, also having separate pie charts for standard, console and aws, when we click the pie chart in any one of these 3, it will take to another dashboard, over there i need to mark the value of index_valrue of drilldown as standard if we select the standard pie chart in the drilldown of new dashboard that is same for all other two selections. Thanks in Advance, Manoj Kumar S

phanTom · ‎10-09-2023

@Arty yes but it depends how you want to send. E.g. The SSH App does have the ability to send files. I suspect there are other apps that can too but you would need to check the actions list on sp...

@Arty yes but it depends how you want to send. E.g. The SSH App does have the ability to send files. I suspect there are other apps that can too but you would need to check the actions list on splunkbase, or if you have access to a SOAR platform you can type the action name in the top-left search field, such as "put file" and then select `apps` and it will show you apps with the action. I saw SSH/HTTP/Windows when i checked so there should be plenty of options.

lladi · ‎10-09-2023

Try to get error failures from live integration and create Splunk alert for every continuous 5 Alerts

All Posts

All Posts

Splunk Query to check two Conditions

Knowledge objects remove

Re: Splunk UF cant forward data to HF

Re: Splunk UF cant forward data to HF

Re: Splunk Manage app

Dashboard Studio | Drilldown to Second dashboard

Splunk App for SOAR Export: Error code 5

Re: Privacy Error

Re: metric event is not properly structured issue in my SH !

Re: Splunk UF on F5 BIG-IP for OS logs

Splunk UF on F5 BIG-IP for OS logs

Re: metric event is not properly structured issue in my SH !

Re: Privacy Error

Colorized bar graph with log scale overlay

Re: metric event is not properly structured issue in my SH !

Re: Token

Re: Transpose question

Token in drilldown

Re: Send files from SOAR to Server

query to write to get the failures from every exception

All Posts

Are you a member of the Splunk Community?

All Posts