All Posts

Find Answers
Ask questions. Get answers. Find technical product solutions from passionate members of the Splunk community.

All Posts

Hi there, the same story is true for me. Actually after updating ESCU to 4330. Not only for custom correlation search rules but for cloned rules. before that everything was ok! when u clone a bui... See more...
Hi there, the same story is true for me. Actually after updating ESCU to 4330. Not only for custom correlation search rules but for cloned rules. before that everything was ok! when u clone a built-in rule e.g "Excessive Failed Logins" to something like "Excessive Failed Logins- Custom", in Security Posture's Top Notable Events dashboard pane it appears like "Access - Excessive Failed Logins- Custom - Rule" and when u click on it to open in incident review, it doesn't filter out this as selected source but all incidents are listed as if no filter is selected.
This was really bothering me ... and I isolated the cause to browser-local storage managed by SplunkWeb. Keys beginning with splunk-appnav cache nav menus, e.g.: splunk-appnav:localized_nav:admin:en... See more...
This was really bothering me ... and I isolated the cause to browser-local storage managed by SplunkWeb. Keys beginning with splunk-appnav cache nav menus, e.g.: splunk-appnav:localized_nav:admin:en-US { "nav": [ { "label": "Localized Nav Dashboard", "uri": "/en-US/app/localized_nav/localized_nav_dashboard", "viewName": "localized_nav_dashboard", "isDefault": true }, { "label": "More...", "submenu": [ { "label": "Search", "uri": "/en-US/app/localized_nav/search", "viewName": "search" }, { "label": "Analytics", "uri": "/en-US/app/localized_nav/analytics_workspace", "viewName": "analytics_workspace" }, { "label": "Datasets", "uri": "/en-US/app/localized_nav/datasets", "viewName": "datasets" }, { "label": "Reports", "uri": "/en-US/app/localized_nav/reports", "viewName": "reports" }, { "label": "Alerts", "uri": "/en-US/app/localized_nav/alerts", "viewName": "alerts" }, { "label": "Dashboards", "uri": "/en-US/app/localized_nav/dashboards", "viewName": "dashboards" } ] } ], "color": "#ff0000", "label": "Localized Nav", "searchView": "search", "lastModified": 1725807491341 } Switching locales generates a new cached menu under a new key: splunk-appnav:localized_nav:admin:it-IT If you're having issues with nav menus, you may be able to resolve them with one of the following: Clear browser cache Clear site cookies/storage (linked in Chromium-based browsers) Clear local storage entries in browser dev tools
Thank you for the kind reply! Where can I find SplunkCloud rootCA ?
That a whole different ball game! Are you using Studio or Classic Simple XML dashboards?
Hi, I would like to extract a field from a JSON logs which is in a prettier format already. I would like to extract a field named "clientTransactionId" from below sample data. { [-]    @timestamp:... See more...
Hi, I would like to extract a field from a JSON logs which is in a prettier format already. I would like to extract a field named "clientTransactionId" from below sample data. { [-]    @timestamp: 2024-09-05T10:59:34.826855417+10:00    appName: TestApp    environment: UAT    ivUser: Ashish    level: INFO    logger: com.app.login    message: New user state created - state_id: XXXX-YYYYYY, key_id: twoFactorAuth, key_value: {"tamSessionIndex":"1d1ad722-XXXX-11ef-8a2b-005056b70cf5","devicePrint":"DDDDDDDDDDD","createdAt":"2099-09-05T00:59:34.734404799Z","updatedAt":"2099-09-05T00:59:34.734404799Z","clientSessionId":"ppppppppppppp","sessionId":"WWWWWWWWW","clientTransactionId":"8fd2353d-d609-XXXX-52i6-2e1dc12359m4","transactionId":"9285-:f18c10db191:XXXXXXXX_TRX","twoFaResult":"CHALLENGE","newDevice":true,"newLocation":false,"overseas":true} with TTL: 46825    parentId:    spanId: 14223cXXXX6d63d5    tamSessionIndex: 1d1ad722-6b22-11ef-8a2b-XXXXXXX    thread: https-jsse-nio-XXXX-exec-6    traceId: 66d90275ecc565aa61XXXXXXXX02f5815 }
Thank you. On that note how can I highlight in red or something that specific timestamp that was used to fill down the rest of the rows below etc. i.e a way to differentiate it from the rest which wa... See more...
Thank you. On that note how can I highlight in red or something that specific timestamp that was used to fill down the rest of the rows below etc. i.e a way to differentiate it from the rest which was filled using filldown?
could you help me with examples please ? cuz i tried to find an app for Trellix hx end-point security but i can't find it    THANKS
It looks like you may be using a default extract which takes name=value and the value is being terminated at the next space. You will probably have to do some field specific extractions to override t... See more...
It looks like you may be using a default extract which takes name=value and the value is being terminated at the next space. You will probably have to do some field specific extractions to override these defaults.
Line 3 creates a string in t2 so line 4 should be parsing the string strptime not strftime
Hello members   i'm facing problems regarding parsing the event details on splunk i have forwarded the events from HF to indexers and now it's able to search but i'm facing issues with field extrac... See more...
Hello members   i'm facing problems regarding parsing the event details on splunk i have forwarded the events from HF to indexers and now it's able to search but i'm facing issues with field extractions and event details because the messages are truncated for example    if i have something like this sample event    CEF:0|fireeye|HX|4.8.0|IOC Hit Found|IOC Hit Found|10|rt=Jul 23 2019 16:54:24 UTC dvchost=fireeye.mps.test categoryDeviceGroup=/IDS categoryDeviceType=Forensic Investigation categoryObject=/Host   the categoryDeviceType parameter is truncated in field extraction so it display only forensic and other string is truncated   so can any one please help on this matter   my props.conf is   [trellix] category = Custom pulldown_type = 1 TIME_FORMAT = ^<\d+> EVAL-_time = strftime(_time, "%Y %b %d %H:%M:%S") TIME_PREFIX = %b %d %H:%M:%S
That doesn't always work. I cant seem to find a good solution for this type of problem either. I can't convert this timestamp for subtraction purposes for example (see how t3 column is empty?):
is there another options for parsing like editing props.conf since i don't want to add new app    is there any possibility for this type of events to just edit props.conf?   my props.conf [trell... See more...
is there another options for parsing like editing props.conf since i don't want to add new app    is there any possibility for this type of events to just edit props.conf?   my props.conf [trellix] category = Custom pulldown_type = 1 TIME_FORMAT = ^<\d+> EVAL-_time = strftime(_time, "%Y %b %d %H:%M:%S") TIME_PREFIX = %b %d %H:%M:%S
Hi @jmartens , Very sorry for the inconvenience. Engineering is aware of this (reference: SPL-258019). They have come up with a fix, which excludes the 2 internal users, 'nobody' and 'splunk-system... See more...
Hi @jmartens , Very sorry for the inconvenience. Engineering is aware of this (reference: SPL-258019). They have come up with a fix, which excludes the 2 internal users, 'nobody' and 'splunk-system', from the warning message. The fix will most likely be added to the next 9.1.x version after 9.1.6 and the next 9.2.x version after 9.2.3, respectively. 
Your description is insufficient for others to help.  You need to make some mockup data scenarios and corresponding desired outcomes for us to understand what "multiple" token for each column means. ... See more...
Your description is insufficient for others to help.  You need to make some mockup data scenarios and corresponding desired outcomes for us to understand what "multiple" token for each column means. If you mean whether clicking on different cells in the same row can set different tokens, the answer is no.  You can set multiple tokens by one click.  But each row can only result in one set of values.
A simple test in a barebones app worked for me. After working though the app name bug (see above), I customized default.xml, and the menu is rendered in both en-US and it-IT locales. My browser local... See more...
A simple test in a barebones app worked for me. After working though the app name bug (see above), I customized default.xml, and the menu is rendered in both en-US and it-IT locales. My browser locale remains US English, however, so I'm probably not sufficiently emulating your environment.
All tokens in a search must have a non-null value before the search will run. Try setting the null tokens to empty strings ("") before the search.
Yup, classic FireEye CEF. There was an add-on for FireEye on Splunkbase but it's archived already (last version was released 7 years ago so no wonder) - https://splunkbase.splunk.com/app/1904 As far ... See more...
Yup, classic FireEye CEF. There was an add-on for FireEye on Splunkbase but it's archived already (last version was released 7 years ago so no wonder) - https://splunkbase.splunk.com/app/1904 As far as I remember it also had some issues with proper parsing. If you want to use CEF, you might try this add-on https://splunkbase.splunk.com/app/487 but I wouldn't count on it being CIM-compliant.
Hi, I have a requirement to perform end to search for troubleshooting in a dashboard. I am using multiple tokens inside the dashboard. Some tokens have a condition to be set or unset depending ... See more...
Hi, I have a requirement to perform end to search for troubleshooting in a dashboard. I am using multiple tokens inside the dashboard. Some tokens have a condition to be set or unset depending upon null values. However, if any of the tokens are not null, then I should concatenate the tokens and pass the combined token to the other sub searches. Note: There is always a token which is not null I tried but the other panels always say 'search is waiting for the input' Below is a sample snippet from the xml dashboard. <search><query>index=foo</query></search> <drilldown> <eval "combined">$token1$. .$token2$. .$token3$. .$token4$. $token5$</eval> <set "combined_token">$combined$</set> </drilldown> <panel> <search><query>index=abc $combined_token$</query></search> </panel>
it's like this  <149>Jul 23 18:54:24 fireeye.mps.test cef[5159]: CEF:0|fireeye|HX|4.8.0|IOC Hit Found|IOC Hit Found|10|rt=Jul 23 2019 16:54:24 UTC dvchost=fireeye.mps.test categoryDeviceGroup=/IDS... See more...
it's like this  <149>Jul 23 18:54:24 fireeye.mps.test cef[5159]: CEF:0|fireeye|HX|4.8.0|IOC Hit Found|IOC Hit Found|10|rt=Jul 23 2019 16:54:24 UTC dvchost=fireeye.mps.test categoryDeviceGroup=/IDS categoryDeviceType=Forensic Investigation categoryObject=/Host cs1Label=Host Agent Cert Hash cs1=fwvqcmXUHVcbm4AFK01cim dst=192.168.1.172 dmac=00-00-5e-00-53-00 dhost=test-host1 dntdom=test deviceCustomDate1Label=Agent Last Audit deviceCustomDate1=Jul 23 2019 16:54:22 UTC cs2Label=FireEye Agent Version cs2=29.7.0 cs5Label=Target GMT Offset cs5=+PT2H cs6Label=Target OS cs6=Windows 10 Pro 17134 externalId=17688554 start=Jul 23 2019 16:53:18 UTC categoryOutcome=/Success categorySignificance=/Compromise categoryBehavior=/Found cs7Label=Resolution cs7=ALERT cs8Label=Alert Types cs8=exc act=Detection IOC Hit msg=Host test-host1 IOC compromise alert categoryTupleDescription=A Detection IOC found a compromise indication. cs4Label=IOC Name cs4=SVCHOST SUSPICIOUS PARENT PROCESS   this as a raw data but when i try to expand the details of event i see it's truncated . i will provide you with the config i did inside HF this morning.   Thx
My custom default.xml isn't displayed at all in 9.3.0. I know it's being read because I changed the default view, and that's the view that loads when the app loads. ??? EDIT: I had named my test app... See more...
My custom default.xml isn't displayed at all in 9.3.0. I know it's being read because I changed the default view, and that's the view that loads when the app loads. ??? EDIT: I had named my test app localized_menu, and for reasons unknown to me right now, this broke menu customization. Variations on this app name worked fine: lauz_localized_menu leaz_localized_menu localzzz localized_nav localized_xxx localizedxxx mlocalized_menu This appears to be a bug specific to apps named localized_menu or similar enough permutations, but I don't have a personal support account. For now, though, I can test localization in a sanely named localized_nav app.