All Posts

Find Answers
Ask questions. Get answers. Find technical product solutions from passionate members of the Splunk community.

All Posts

Hi everyone I got a question regarding the configuration of the app Microsoft Teams Add-on for Splunk. When I configure a Webhook, a TeamsSubscription, and a CallRecord according to this guide, M... See more...
Hi everyone I got a question regarding the configuration of the app Microsoft Teams Add-on for Splunk. When I configure a Webhook, a TeamsSubscription, and a CallRecord according to this guide, MS Teams data flow into my Splunk instance. Just like the guide suggests, I use ngrok since the server my Splunk instance is running on is not accessible via HTTPS. Ngrok is fine for testing, but I want to switch it out for my actual proxy server. I tried several different settings, but there is no more data coming in. Given that data came in for as long as I used ngrok, all settings related to Azure (Tenant ID, Client ID, Client Secret) must be correct. The issue lies somewhere in the proxy server settings. Can anyone share some insights on how to configure the MS Teams Add-on as well as proxy server settings? Here is my current setup. Webhook - Name: Webhook - Interval: 30 - Index: ms_teams - Port: 4444 Subscription - Name: Subscription - Interval: 86400 - Index: ms_teams - Global Account: MSAzure - Tenant ID: mytenantidfromazure - Environment: Public - Webhook URL: myproxy.server.com <------- splunkinstanceserver.com:4444 or myproxy.server.com? - Endpoint: v1.0 CallRecord - Name: CallRecord - Interval: 30 - Index: ms_teams - Global Account: MSAzure - Tenant ID: mytenantidfromazure - Environment: Public - Endpoint: v1.0 - Max Batch Site: 5000 Proxy - Enable: checked - Host: myproxyserver.com - Port: 4444  <--------- Is this meant to be the port of my webhook or where my proxy takes https requests? - Username: userformyproxyserver - PW: userpwformyproxyserver splunkd.log ***Paths are shortened for readability. .../TA_MS_Teams/bin/TA_MS_Teams_rh_settings.py persistent}: WARNING:root:Run function: get_password failed: Traceback (most recent call last): .../TA_MS_Teams/bin/TA_MS_Teams_rh_settings.py persistent}: File ".../TA_MS_Teams/bin/ta_ms_teams/aob_py3/solnlib/utils.py", line 148, in wrapper .../TA_MS_Teams/bin/TA_MS_Teams_rh_settings.py persistent}: return func(*args, **kwargs) .../TA_MS_Teams/bin/TA_MS_Teams_rh_settings.py persistent}: File ".../TA_MS_Teams/bin/ta_ms_teams/aob_py3/solnlib/credentials.py", line 128, in get_password .../TA_MS_Teams/bin/TA_MS_Teams_rh_settings.py persistent}: "Failed to get password of realm=%s, user=%s." % (self._realm, user) .../TA_MS_Teams/bin/TA_MS_Teams_rh_settings.py persistent}: solnlib.credentials.CredentialNotExistException: Failed to get password of realm=__REST_CREDENTIAL__#TA_MS_Teams#configs/conf-ta_ms_teams_settings, user=proxy.
Hi, I'm trying to set a specific color to each one of 4 my dynamic labels of my 3 trellis pie charts. I already added series color option :  <option name="charting.seriesColors">[#CFD6EA,#C45AB3,#7... See more...
Hi, I'm trying to set a specific color to each one of 4 my dynamic labels of my 3 trellis pie charts. I already added series color option :  <option name="charting.seriesColors">[#CFD6EA,#C45AB3,#735CDD,#8fba38]</option> My issue is that my labels are "dynamic" and also  I don't  have a constant  number of categories ( it changes in each chart between 0-4 according to the data i receive). So my color plate sequence not aligned with the number of categories. For example, I want to set the flowing: type_A - Red type_B- Blue type_C- Green The problem is that  sometimes category "type_A" is missing from one or more of my charts and the category type_B is getting its color (Red) instead of Blue. here is my query: <---Search--> | stats dc(sessions) as Number_of_Sessions by type | sort type | eval type = type." - ".Number_of_Sessions I will very a appreciate any help i get get :-0) 10Q
| eval zip=mvzip(Cluster, mvzip(Current, Max)) | mvexpand zip | eval zip=split(zip, ","), Cluster=mvindex(zip, 0), Current=mvindex(zip, 1), Max=mvindex(zip,2) | eval threshold = Current / Max | whe... See more...
| eval zip=mvzip(Cluster, mvzip(Current, Max)) | mvexpand zip | eval zip=split(zip, ","), Cluster=mvindex(zip, 0), Current=mvindex(zip, 1), Max=mvindex(zip,2) | eval threshold = Current / Max | where threshold > 0.85
Hi @aditsss , what's the name of the first column? if it's "EBNCStatus", put the condition EBNCStatus=* at the end of the search. Ciao. Giuseppe
I forgotten a pipe before stats I need to cross the event_file field of the index (called NewProcessName) with the event_file field of the lookup
Hi @danroberts, please try this: | rex max_match=0 "(?<filename>OU_\w*\.\w*" Ciao. Giuseppe
As stated in my response, a saved search will have a non-empty value in the savedsearch_name field (keyword).  If savedsearch_name="" then the search is ad-hoc.
You can't use subsearches in this way. What are you trying to achieve?
Remember that subsearches run first and their results become text that replace the subsearch in the query.  So, if the subsearch returns "foo.exe" (the value of file_name) then the query becomes ind... See more...
Remember that subsearches run first and their results become text that replace the subsearch in the query.  So, if the subsearch returns "foo.exe" (the value of file_name) then the query becomes index=toto event_id=4688 | eval file_name=if(event_id==4688, replace(NewProcessName, "^*\\\\([^\\\\]+)$","\\1"),null) foo.exe stats values(file_name) as file_name..... See the problem?  "foo.exe" and the following stats command are considered part of the eval command because there is no intervening |. The fix depends on what you want the query to do.
This is not working at all, We will get all the searches running in splunk. because there is no keyword to identify whether search is savedsearch or Ad-hoc search or Reports. 
I use the Splunk Machine Learning command: | fit LinearRegression blah, blah into ModelName I can generate a ModelName file. Using the command  | summary ModelName I can generate a result s... See more...
I use the Splunk Machine Learning command: | fit LinearRegression blah, blah into ModelName I can generate a ModelName file. Using the command  | summary ModelName I can generate a result set that has feature and coefficient fields. How can I "extract" the numerical coefficients so that I can create a regression equation for future use? Example: I'm trying to create the equation y = c0 + c1 * Term1 + c2 * Term2 for a future modeling activity?  
It is not working since mvzip will process only X and Y fields. It worked with the below. eval zip= mvzip(mvzip(Cluster,Current),Max)|mvexpand zip|eval zip=split(zip, ","), Cluster=mvindex(zip, 0), ... See more...
It is not working since mvzip will process only X and Y fields. It worked with the below. eval zip= mvzip(mvzip(Cluster,Current),Max)|mvexpand zip|eval zip=split(zip, ","), Cluster=mvindex(zip, 0), Current=mvindex(zip, 1),Max=mvindex(zip, 2) I am left with threshold, if the current is above 85% than Max, it should trigger an alert.  
Hi When I run the command below, it works fine   index=toto event_id=4688 | eval file_name=if(event_id==4688, replace(NewProcessName, "^*\\\\([^\\\\]+)$","\\1"),null)   Now I need to combine th... See more...
Hi When I run the command below, it works fine   index=toto event_id=4688 | eval file_name=if(event_id==4688, replace(NewProcessName, "^*\\\\([^\\\\]+)$","\\1"),null)   Now I need to combine this search with a subearch   index=toto event_id=4688 | eval file_name=if(event_id==4688, replace(NewProcessName, "^*\\\\([^\\\\]+)$","\\1"),null) [| inputlookup test where software=pm | table pm |rename pm as file_name | format] | stats values(file_name) as file_name.....   But i have the message "Error in "EvalCommand": The expression is malformed What is wrong please?
Please read the my previous response fully...I have tried in both ways Anyways thanks for your response. I found a solution   
This is what you asked for
Thanks for the rely, this has worked.  Would this also work in a props.conf file ?  I'm utilising a universal forwarder with a bat script to pull the data from the directory. 
Thanks for the reply, unfortunately this just pulls out one of the OU file names. 
@gcusello  Apologies the query is working but I am getting one additional row . My query: search index="abc" sourcetype =$Regions$ source="/amex/app/gfp-settlement-raw/logs/gfp-settlement-raw.log"... See more...
@gcusello  Apologies the query is working but I am getting one additional row . My query: search index="abc" sourcetype =$Regions$ source="/amex/app/gfp-settlement-raw/logs/gfp-settlement-raw.log" "ReadFileImpl - ebnc event balanced successfully" | eval True=if(searchmatch("ebnc event balanced successfully"),"✔","") | eval EBNCStatus="ebnc event balanced successfully",Day=strftime(_time,"%Y-%m-%d")| dedup EBNCStatus Day | table EBNCStatus True Day      
@gcusello  yes but with that I am only getting two message  I have selected last 7 days and I am getting only two. I want if I select last 7 it should show 7 message  when I select yesterday it s... See more...
@gcusello  yes but with that I am only getting two message  I have selected last 7 days and I am getting only two. I want if I select last 7 it should show 7 message  when I select yesterday it should show 1 message.
Hi @aditsss, did you try my last answer? Ciao. Giuseppe