All Posts

Find Answers
Ask questions. Get answers. Find technical product solutions from passionate members of the Splunk community.

All Posts

OK. Fully honestly, I don't see the point in doing so. You're adding some synthetic zeros and then count something which will easily be divisible by 4 (because when you're preparing your bitstring he... See more...
OK. Fully honestly, I don't see the point in doing so. You're adding some synthetic zeros and then count something which will easily be divisible by 4 (because when you're preparing your bitstring he ones must be separated by multiplies of 4). You're doing some strange bit swapping (and it's completely inconsistent - your original example had something that resembled a 16-bits little-endian integer which you "converted" to 32-bit value and from my single bit 0x63 value you also built a 32-bit value but obviously in a different way). So, to be absolutely frank, it doesn't make much sense. A completely separate thing is why would you want to do it in splunk? (actually the easiest solution could be to implement an external lookup using a python script).
Best work around I've come to, and its not half bad considering that I don't have to deal with these long field names very often, is to right click>open in inspector (this is in Edge by the way) and ... See more...
Best work around I've come to, and its not half bad considering that I don't have to deal with these long field names very often, is to right click>open in inspector (this is in Edge by the way) and then drag the field name from the inspector to the editor of choice.
Hello @PickleRick ,    Sorry for the mistake!    I have edited in the post, Considering 0*63 is 01100011 Seperating the byte as with 2positions byte 0 - 01 -> 0000 0001 byte 1 - 10 -> 0... See more...
Hello @PickleRick ,    Sorry for the mistake!    I have edited in the post, Considering 0*63 is 01100011 Seperating the byte as with 2positions byte 0 - 01 -> 0000 0001 byte 1 - 10 -> 0001 0000 byte 2 - 00 -> 0000 0000 byte 3 - 11 -> 0001 0001 Combining it byte 3 byte 2 byte 1 byte 0 - 0001 0001 0000 0000 0001 0000 0000 0001 Counting the non zero postions  - 0, 12, 24, 28 These were the answers. please let me know if there are anything. Thanks in advance!
Hi @dural_yyz ,    Thanks for your reply! please look at this example as well, also we are having hex_code as a single field value, from that field we are seperating bit 1 and bit 2,  bit po... See more...
Hi @dural_yyz ,    Thanks for your reply! please look at this example as well, also we are having hex_code as a single field value, from that field we are seperating bit 1 and bit 2,  bit position of the least significant bit Another example Hex code - 00200100 Seperate 2 bytes each  00/20/01/00 4 Byte bitmask Byte 0: HEX = 00 -  0000 0000 Byte 1: HEX = 20 - 0010 0000 Byte 2: HEX = 01 - 0000 0001 Byte 3: HEX = 00 - 0000 0000 Byte 3 Byte 2 Byte1 Byte 0 - 0000 0000 0000 0001 0010 0000 0000 0000 calculate the non zero th position values from right side Byte combination  - 0000 0000 0000 0001 0010 0000 0000 0000 Position -                                                               16       13        ...9 8765  4321 At position 14 and 17, we got 1 while counting from right side. so the bit value is 13 and 16. thanks!
Hi @ITWhisperer , Thanks for your time! Here is an another example Another example Hex code - 00200100 Seperate 2 bytes each  00/20/01/00 4 Byte bitmask Byte 0: HEX = 00 -  0000 ... See more...
Hi @ITWhisperer , Thanks for your time! Here is an another example Another example Hex code - 00200100 Seperate 2 bytes each  00/20/01/00 4 Byte bitmask Byte 0: HEX = 00 -  0000 0000 Byte 1: HEX = 20 - 0010 0000 Byte 2: HEX = 01 - 0000 0001 Byte 3: HEX = 00 - 0000 0000 Byte 3 Byte 2 Byte1 Byte 0 - 0000 0000 0000 0001 0010 0000 0000 0000 calculate the non zero th position values from right side Byte combination  - 0000 0000 0000 0001 0010 0000 0000 0000 Position -                                                               16       13        ...9 8765  4321 At position 14 and 17, we got 1 while counting from right side. so the bit value is 13 and 16. yes,  bit position of the least significant bit is needed.., Thanks in Advance!
Another example Hex code - 00200100 Seperate 2 bytes each  00/20/01/00 4 Byte bitmask Byte 0: HEX = 00 -  0000 0000 Byte 1: HEX = 20 - 0010 0000 Byte 2: HEX = 01 - 0000 0001 Byte 3: HEX ... See more...
Another example Hex code - 00200100 Seperate 2 bytes each  00/20/01/00 4 Byte bitmask Byte 0: HEX = 00 -  0000 0000 Byte 1: HEX = 20 - 0010 0000 Byte 2: HEX = 01 - 0000 0001 Byte 3: HEX = 00 - 0000 0000 Byte 3 Byte 2 Byte1 Byte 0 - 0000 0000 0000 0001 0010 0000 0000 0000 calculate the non zero th position values from right side Byte combination  - 0000 0000 0000 0001 0010 0000 0000 0000 Position -                                                               16       13        ...9 8765  4321 At position 14 and 17, we got 1 while counting from right side. so the bit value is 13 and 16.
I did fix the restart issue But in the $HOME/attack_range/terraform/ansible/roles/splunk_server_post/tasks/install_enterprise_security.yml, the following stanza fails: - name: Run es post-instal... See more...
I did fix the restart issue But in the $HOME/attack_range/terraform/ansible/roles/splunk_server_post/tasks/install_enterprise_security.yml, the following stanza fails: - name: Run es post-install setup command: "/opt/splunk/bin/splunk search '| essinstall --ssl_enablement auto' -auth admin:{{ general.attack_range_password }}" become: yes async: 600 poll: 60   It seems that the OWNERSHIP OF THE splunk install path is either root or the uid/gid (10777) of the person that built the tar ball. How can I get the path ownership to be owned by my user (aradmin) ? Is this done with the "become:true" flag? Where do I need to update the scripts?
There was issue with key department for older version, after correcting that using eval, both solutions worked. thanks a lot guys.
That reason is new to me.  The app is supported by the developer.  Their contact info is on the splunkbase page.
these searches are showing the reason as "Relation '' is unknown. (2)" . Here I'm unsure what action that i need to perform here.
https://www.splunk.com/en_us/blog/platform/splunking-your-conf-files-how-to-audit-configuration-changes-like-a-boss.html?locale=en_us This will show you how to track conf file changes.  Earlier ques... See more...
https://www.splunk.com/en_us/blog/platform/splunking-your-conf-files-how-to-audit-configuration-changes-like-a-boss.html?locale=en_us This will show you how to track conf file changes.  Earlier questions wanted to change control on dashboards which are xml files so it wont work for those.
Usually, a search is skipped because of external factors (no resources), but a search will be skipped if it contains an error or if it's already/still running.  The Monitoring Console or CMC will tel... See more...
Usually, a search is skipped because of external factors (no resources), but a search will be skipped if it contains an error or if it's already/still running.  The Monitoring Console or CMC will tell the reason for the skips in the Scheduler Activity dashboard.  Fix the reason and the skips should stop.
This workaround does work for us: %SPLUNK_HOME%\etc\apps\introspection_generator_addon\local\server.conf [introspection:generator:resource_usage] disabled = true acquireExtra_i_data = false
Hi Team, We're getting skipped search alerts for all 3  Lookup Gen searches. How we can resolve this? Even though after disabling those searches we are still getting error for these searches. Your... See more...
Hi Team, We're getting skipped search alerts for all 3  Lookup Gen searches. How we can resolve this? Even though after disabling those searches we are still getting error for these searches. Your assistance is greatly appreciated. Lookup Gen - bh_sourcetype_cache broken_hosts Relation '' is unknown. (2) none 2 Lookup Gen - bh_host_cache broken_hosts Relation '' is unknown. (2) none 2 Lookup Gen - bh_index_cache broken_hosts Relation '' is unknown. (2) none
OK. This is confusing. You have four hexadecimal digits but they're little-endian so the resulting bit order (not byte, mind you; you're happily using the same word for both bits and bytes). But what... See more...
OK. This is confusing. You have four hexadecimal digits but they're little-endian so the resulting bit order (not byte, mind you; you're happily using the same word for both bits and bytes). But what the calculation should be based on? What do you want to achieve? You showed only one example which is a power of 2 so it gives you just one set bit in your whole 16-bit sequence. But what if you had 0x63 0x3A? 0x63 is 01100011, 0x3A is 00111010 As this is little-endian, the resulting bit-stream would be 00111010 01100011 And what now? You want the position of first non-zero bit from the right? And what does it have to do with "lookup"?
I've successfully uploaded and installed a private app to Cloud. The app simply contains a few javascript-based utilities which are located in, e.g.: common_ui_util/appserver/static/js/close_div.js ... See more...
I've successfully uploaded and installed a private app to Cloud. The app simply contains a few javascript-based utilities which are located in, e.g.: common_ui_util/appserver/static/js/close_div.js I'm hoping to use these in the same way that I'm able to from an enterprise install where, from any other app context, I'm able to include the javascript in the simple XML, e.g.:  <form version="1.1" script="common_ui_util:/js/close_div.js"> However, this isn't working for me in Cloud, and the console shows the script as 404. The console shows the path as: https://<subdomain>.splunkcloud.com/en-US/static/@<id>/app/common_ui_util//js/close_div.js   I've verified that the app is installed and that I have set permissions to read for everyone, and exported globally. Common UI Utilities common_ui_util 1.0.0 No No Global | Permissions Enabled | Disable Uninstall | Edit properties | View objects   What am I missing here?
Hi Team is there any information of when Compliance Essentials will be updated to support CMMC version 2.0, from my understanding it continues to only support 1.0 and this is impacting customers from... See more...
Hi Team is there any information of when Compliance Essentials will be updated to support CMMC version 2.0, from my understanding it continues to only support 1.0 and this is impacting customers from considering Splunk platform for their environment as there are specific needs around using Splunk platform to address CMMC compliance.     
    | makeresults format=csv data="bit1,bit2 0000,0002 000f,0088 00af,00de 00bd,003c" | fields bit1 bit2 | eval bit1ASnumber=tonumber(bit1,16), bit2ASnumber=tonumber(bit2,16) | eval bit1ASbinary=to... See more...
    | makeresults format=csv data="bit1,bit2 0000,0002 000f,0088 00af,00de 00bd,003c" | fields bit1 bit2 | eval bit1ASnumber=tonumber(bit1,16), bit2ASnumber=tonumber(bit2,16) | eval bit1ASbinary=tostring(bit1ASnumber,"binary"), bit2ASbinary=tostring(bit2ASnumber,"binary") | table bit1 bit2 bit*ASnum* bit*ASbin*     bit1 bit2 bit1ASnumber bit2ASnumber bit1ASbinary bit2ASbinary 0000 0002 0 2 0 10 000f 0088 15 136 1111 10001000 00af 00de 175 222 10101111 11011110 00bd 003c 189 60 10111101 111100 Ok I can get you as far as converting to binary but the results of the binary do not include leading 0's to always make an 8 character string/number.  Since your example had 4 characters for the hex code those values are treated as string so first convert to a number before converting to binary as attempting to go straight will fail when your source as a mix of alphanumeric characters. Obviously without the leading zeros when you concatenate the two values as strings you will lose some positions you need to count.  Also I didn't bother with sorting out the count how many zero's right of the last occurring 1 but essentially that's what comes after inserting your leading zero's
Yes, Studio is not a good choice for anything vaguely sophisticated!
When using dashboard studio currently there is no option for this. dataValuesDisplay ("off" | "all" | "minmax") off Specify whether chart should display no labels, all labels, or only the min ... See more...
When using dashboard studio currently there is no option for this. dataValuesDisplay ("off" | "all" | "minmax") off Specify whether chart should display no labels, all labels, or only the min and max labels. https://docs.splunk.com/Documentation/SplunkCloud/9.2.2406/DashStudio/chartsBar I have even tried putting the overlay into the y2 axis and the dataValuesDisplay is a higher level option so impacts all axis. {     "type": "splunk.column",     "dataSources": {         "primary": "ds_TNxdC2O9"     },     "containerOptions": {},     "showProgressBar": false,     "showLastUpdated": false,     "title": "Column Chart",     "description": "Overlay Test",     "options": {         "y": "> primary | frameBySeriesNames('regular','_span')",         "y2": "> primary | frameBySeriesNames('overlay','_span')",         "overlayFields": [             "overlay"         ],         "dataValuesDisplay": "all"     },     "context": {} }