All Posts

Find Answers
Ask questions. Get answers. Find technical product solutions from passionate members of the Splunk community.

All Posts

thanks its working is it also possible to set it like that so when object is selected it will remove the "ALL" automatically ?
Hi @sarit_s6 , yes, you can use the IN operator and comma as separator. Ciao. Giuseppe
@Alan_Chan - Are you sure your Splunk port is 8443??  
@vader13 - You did not included the reference which mention supported and not supported. Also, I'm not sure what you are referring to with HTTPOUT.  
Yes you can do that. @sarit_s6    You can make use of  <delimiter> text   A string that will be placed between each selected value. Typically, you specify " OR " or " AND " using upper case ... See more...
Yes you can do that. @sarit_s6    You can make use of  <delimiter> text   A string that will be placed between each selected value. Typically, you specify " OR " or " AND " using upper case – do not specify the quote marks, but specify a space character before and after the text. <valuePrefix> text   String prefixed to the value of the input element. Can be a regular expression. <valueSuffix> text   String appended to the value of the input element. Can be a regular expression.   delimiter -> AND valuePrefix -> key=" valueSuffix -> "   This will prepare something like -> key="A" AND key="B" ....   I hope this helps!!!!
@tommasoscarpa1 - I prefer to put the logs in a custom log files always. Which will come into custom sourcetype as well on Splunk. Inside _internal index of Splunk so no Splunk license will be used ... See more...
@tommasoscarpa1 - I prefer to put the logs in a custom log files always. Which will come into custom sourcetype as well on Splunk. Inside _internal index of Splunk so no Splunk license will be used for that as well.   Here is the reference code for some other App's custom command. * https://github.com/CrossRealms/Splunk-App-Auto-Update-MaxMind-Database/blob/master/bin/maxmind_db_update_command.py (Custom search command) * https://github.com/CrossRealms/Splunk-App-Auto-Update-MaxMind-Database/blob/master/bin/logger_manager.py (Custom logger manager file) * https://github.com/CrossRealms/Splunk-App-Auto-Update-MaxMind-Database/blob/master/default/props.conf (For assigning the custom sourcetype)   You can search the data in the index=_internal sourcetype=<sourcetype-you-asssign-in-props.conf> Also, just FYI, you can use the same the same code for custom rest-endpoints, python modular inputs, or anything else.   I hope this helps!!! Kindly upload the answer if you like the solution.
Hello is it possible to use multiselect input in classic dashboard so the selected objects there will be  key=value AND key=value1 ? if im using IN its acts like OR   Thanks
I can't see editing menu on lookup editor app , please guide me. Karn
Hey @Karthikeya, What @ITWhisperer mentioned is correct. I have currently modified that source code of the dashboard to open the same search in a new tab based on the clicked selection. Paste the fo... See more...
Hey @Karthikeya, What @ITWhisperer mentioned is correct. I have currently modified that source code of the dashboard to open the same search in a new tab based on the clicked selection. Paste the following code in your dashboard and it should work as per your requirement.  <form version="1.1" theme="light"> <label>Akamai WAF Dashboard</label> <search id="base_search"> <query>index="waf_app_*" sourcetype=akamai_waf |fields * |search attackData.configId=$configid$ source=$source$ </query> <earliest>$time.earliest$</earliest> <latest>$time.latest$</latest> </search> <description></description> <fieldset submitButton="false" autoRun="true"> <input type="dropdown" token="configid" searchWhenChanged="true"> <label>Security Configuration ID</label> <choice value="*">All</choice> <fieldForLabel>attackData.configId</fieldForLabel> <fieldForValue>attackData.configId</fieldForValue> <search> <query>index="waf_app_*" sourcetype=akamai_waf source=$source$ | stats count by attackData.configId</query> <earliest>-5m</earliest> <latest>now</latest> </search> <default>*</default> <initialValue>*</initialValue> </input> <input type="dropdown" token="source" searchWhenChanged="true"> <label>Service Name</label> <choice value="*">All</choice> <fieldForLabel>source</fieldForLabel> <fieldForValue>source</fieldForValue> <search> <query>index="waf_app_*" sourcetype=akamai_waf attackData.configId=$configid$ |stats count by source</query> <earliest>-5m@m</earliest> <latest>now</latest> </search> <default>*</default> <initialValue>*</initialValue> </input> <input type="time" token="time"> <label>Select Time Range</label> <default> <earliest>-5m</earliest> <latest>now</latest> </default> </input> </fieldset> <row> <panel> <title>Top 10 Attack Rule IDs</title> <chart> <search base="base_search"> <query> | top limit=10 attackData.rules{}.id | rename attackData.rules{}.id as "Rule ID"</query> </search> <option name="charting.chart">bar</option> <option name="charting.chart.stackMode">default</option> <option name="charting.drilldown">all</option> <option name="refresh.display">progressbar</option> </chart> </panel> <panel> <title>Top 10 Attack Rule Tags</title> <chart> <search base="base_search"> <query> |stats count by attackData.rules{}.tag |sort - count |head 10</query> </search> <option name="charting.chart">pie</option> <option name="charting.chart.stackMode">default</option> <option name="charting.drilldown">all</option> <option name="refresh.display">progressbar</option> </chart> </panel> </row> <row> <panel> <title>Rule Messages</title> <table> <search base="base_search"> <query>| stats count by attackData.rules{}.message |sort - count |head 10</query> </search> <option name="dataOverlayMode">heatmap</option> <option name="drilldown">cell</option> <option name="refresh.display">progressbar</option> <option name="rowNumbers">false</option> <option name="wrap">true</option> </table> </panel> <panel> <title>Rule Action by Count</title> <chart> <search base="base_search"> <query> | stats count by attackData.rules{}.action |sort - count</query> </search> <option name="charting.chart">column</option> <option name="charting.chart.showDataLabels">minmax</option> <option name="charting.chart.sliceCollapsingThreshold">0.05</option> <option name="charting.chart.stackMode">stacked</option> <option name="charting.drilldown">all</option> <option name="charting.layout.splitSeries">0</option> <option name="refresh.display">progressbar</option> <drilldown> <set token="clicked_value">$click.value2$</set> <link target="_blank">search?q=index%3D%22waf_app_*%22%20sourcetype%3Dakamai_waf%20%7Cfields%20*%20|search%20attackData.configId%3D$configid$%20source%3D$source$%20%7C%20stats%20count%20by%20attackData.rules%7B%7D.action%20|sort%20-%20count%0A%7C%20search%20attackData.rules%7B%7D.action%3D%22$clicked_value$%22&amp;earliest=$time.earliest$&amp;latest=$time.latest$</link> </drilldown> </chart> </panel> </row> <row> <panel> <title>Rule IDs Trend (5 min)</title> <chart> <search base="base_search"> <query> | timechart count(attackData.rules{}.id) span=5min</query> </search> <option name="charting.chart">line</option> <option name="charting.drilldown">all</option> <option name="refresh.display">progressbar</option> </chart> </panel> </row> <row> <panel> <title>Status Code Trend</title> <chart> <search base="base_search"> <query> | stats count by httpMessage.status</query> </search> <option name="charting.chart">pie</option> <option name="charting.chart.showDataLabels">none</option> <option name="charting.chart.sliceCollapsingThreshold">0</option> <option name="charting.chart.stackMode">stacked</option> <option name="charting.drilldown">all</option> <option name="charting.layout.splitSeries">0</option> <option name="refresh.display">progressbar</option> </chart> </panel> <panel> <title>Top 10 IP Addresses</title> <chart> <search base="base_search"> <query> | stats count by attackData.clientIP |sort - count |head 10</query> </search> <option name="charting.chart">bar</option> <option name="charting.chart.stackMode">stacked</option> <option name="charting.drilldown">all</option> <option name="charting.layout.splitSeries">0</option> <option name="refresh.display">progressbar</option> </chart> </panel> </row> <row> <panel> <title>Top 10 HTTP Path Details</title> <chart> <search base="base_search"> <query> | stats count by httpMessage.path |sort - count |head 10</query> </search> <option name="charting.chart">bar</option> <option name="charting.chart.showDataLabels">all</option> <option name="charting.chart.stackMode">default</option> <option name="charting.drilldown">all</option> <option name="refresh.display">progressbar</option> </chart> </panel> <panel> <title>HTTP Method Count</title> <chart> <search base="base_search"> <query> | stats count by httpMessage.method |sort - count </query> </search> <option name="charting.chart">column</option> <option name="charting.chart.showDataLabels">all</option> <option name="charting.chart.sliceCollapsingThreshold">0</option> <option name="charting.chart.stackMode">default</option> <option name="charting.drilldown">all</option> </chart> </panel> </row> </form>   Thanks, Tejas.   --- If the above solution helps, an upvote is appreciated..!!
You don't have any specific drilldown action configured which means you will just get a basic search. If you want something more tailored, you should define a panel or other dashboard with the search... See more...
You don't have any specific drilldown action configured which means you will just get a basic search. If you want something more tailored, you should define a panel or other dashboard with the search that you want executed when the drilldown is triggered, and then configure the drilldown to activate this panel.
Hi @meng , I never experienced this issue, opena a case to Splunk Support, for your case and also for the other Splunk Customer. Ciao. Giuseppe
Hi @karn , you could add a columns to a lookup using the Lookup Editor app, but remember to modify also the Lookup Definition. With a csv lookup, you don't need to modify the Lookup Definition, but... See more...
Hi @karn , you could add a columns to a lookup using the Lookup Editor app, but remember to modify also the Lookup Definition. With a csv lookup, you don't need to modify the Lookup Definition, but it's required for KV-Store lookups. Ciao. Giuseppe
Have you tried to use the API to add the field? KV store endpoint descriptions - Splunk Documentation
<form version="1.1" theme="light"> <label>Akamai WAF Dashboard</label> <search id="base_search"> <query>index="waf_app_*" sourcetype=akamai_waf |fields * |search attackData.configId=$configid... See more...
<form version="1.1" theme="light"> <label>Akamai WAF Dashboard</label> <search id="base_search"> <query>index="waf_app_*" sourcetype=akamai_waf |fields * |search attackData.configId=$configid$ source=$source$ </query> <earliest>$time.earliest$</earliest> <latest>$time.latest$</latest> </search> <description></description> <fieldset submitButton="false" autoRun="true"> <input type="dropdown" token="configid" searchWhenChanged="true"> <label>Security Configuration ID</label> <choice value="*">All</choice> <fieldForLabel>attackData.configId</fieldForLabel> <fieldForValue>attackData.configId</fieldForValue> <search> <query>index="waf_app_*" sourcetype=akamai_waf source=$source$ | stats count by attackData.configId</query> <earliest>-5m</earliest> <latest>now</latest> </search> <default>*</default> <initialValue>*</initialValue> </input> <input type="dropdown" token="source" searchWhenChanged="true"> <label>Service Name</label> <choice value="*">All</choice> <fieldForLabel>source</fieldForLabel> <fieldForValue>source</fieldForValue> <search> <query>index="waf_app_*" sourcetype=akamai_waf attackData.configId=$configid$ |stats count by source</query> <earliest>-5m@m</earliest> <latest>now</latest> </search> <default>*</default> <initialValue>*</initialValue> </input> <input type="time" token="time"> <label>Select Time Range</label> <default> <earliest>-5m</earliest> <latest>now</latest> </default> </input> </fieldset> <row> <panel> <title>Top 10 Attack Rule IDs</title> <chart> <search base="base_search"> <query> | top limit=10 attackData.rules{}.id | rename attackData.rules{}.id as "Rule ID"</query> </search> <option name="charting.chart">bar</option> <option name="charting.chart.stackMode">default</option> <option name="charting.drilldown">all</option> <option name="refresh.display">progressbar</option> </chart> </panel> <panel> <title>Top 10 Attack Rule Tags</title> <chart> <search base="base_search"> <query> |stats count by attackData.rules{}.tag |sort - count |head 10</query> </search> <option name="charting.chart">pie</option> <option name="charting.chart.stackMode">default</option> <option name="charting.drilldown">all</option> <option name="refresh.display">progressbar</option> </chart> </panel> </row> <row> <panel> <title>Rule Messages</title> <table> <search base="base_search"> <query>| stats count by attackData.rules{}.message |sort - count |head 10</query> </search> <option name="dataOverlayMode">heatmap</option> <option name="drilldown">cell</option> <option name="refresh.display">progressbar</option> <option name="rowNumbers">false</option> <option name="wrap">true</option> </table> </panel> <panel> <title>Rule Action by Count</title> <chart> <search base="base_search"> <query> | stats count by attackData.rules{}.action |sort - count</query> </search> <option name="charting.chart">column</option> <option name="charting.chart.showDataLabels">minmax</option> <option name="charting.chart.sliceCollapsingThreshold">0.05</option> <option name="charting.chart.stackMode">stacked</option> <option name="charting.drilldown">all</option> <option name="charting.layout.splitSeries">0</option> <option name="refresh.display">progressbar</option> </chart> </panel> </row> <row> <panel> <title>Rule IDs Trend (5 min)</title> <chart> <search base="base_search"> <query> | timechart count(attackData.rules{}.id) span=5min</query> </search> <option name="charting.chart">line</option> <option name="charting.drilldown">all</option> <option name="refresh.display">progressbar</option> </chart> </panel> </row> <row> <panel> <title>Status Code Trend</title> <chart> <search base="base_search"> <query> | stats count by httpMessage.status</query> </search> <option name="charting.chart">pie</option> <option name="charting.chart.showDataLabels">none</option> <option name="charting.chart.sliceCollapsingThreshold">0</option> <option name="charting.chart.stackMode">stacked</option> <option name="charting.drilldown">all</option> <option name="charting.layout.splitSeries">0</option> <option name="refresh.display">progressbar</option> </chart> </panel> <panel> <title>Top 10 IP Addresses</title> <chart> <search base="base_search"> <query> | stats count by attackData.clientIP |sort - count |head 10</query> </search> <option name="charting.chart">bar</option> <option name="charting.chart.stackMode">stacked</option> <option name="charting.drilldown">all</option> <option name="charting.layout.splitSeries">0</option> <option name="refresh.display">progressbar</option> </chart> </panel> </row> <row> <panel> <title>Top 10 HTTP Path Details</title> <chart> <search base="base_search"> <query> | stats count by httpMessage.path |sort - count |head 10</query> </search> <option name="charting.chart">bar</option> <option name="charting.chart.showDataLabels">all</option> <option name="charting.chart.stackMode">default</option> <option name="charting.drilldown">all</option> <option name="refresh.display">progressbar</option> </chart> </panel> <panel> <title>HTTP Method Count</title> <chart> <search base="base_search"> <query> | stats count by httpMessage.method |sort - count </query> </search> <option name="charting.chart">column</option> <option name="charting.chart.showDataLabels">all</option> <option name="charting.chart.sliceCollapsingThreshold">0</option> <option name="charting.chart.stackMode">default</option> <option name="charting.drilldown">all</option> </chart> </panel> </row> </form>
Hey @Karthikeya, The other data is coming because of improper drilldown configuration. Can you share the dashboard source code here? Make sure to share it in code block for better visibility.  Than... See more...
Hey @Karthikeya, The other data is coming because of improper drilldown configuration. Can you share the dashboard source code here? Make sure to share it in code block for better visibility.  Thanks, Tejas. 
raw data
  Dashboard panel looks in this way. But when they click on any value (eg alert), below is the data coming -  But Ideally they want to see only alert related log but remaining 2 are also coming... See more...
  Dashboard panel looks in this way. But when they click on any value (eg alert), below is the data coming -  But Ideally they want to see only alert related log but remaining 2 are also coming in log.
Hello @Karthikeya, Can you share a screenshot of how the dashboard looks right now and how it should look ideally? I believe you can use spath command to separate out each rules from the attackData ... See more...
Hello @Karthikeya, Can you share a screenshot of how the dashboard looks right now and how it should look ideally? I believe you can use spath command to separate out each rules from the attackData and use mvexpand. But to provide more context, I'll need some more information. Thanks, Tejas. 
raw data -  "attackData":{"rules":[{"data":"SCANTL=10","action":"alert","selector":"","tag":"REPUTATION","id":"REP_6021037","message":"Scanning Tools (High Threat) - Shared IPs","version":""},{"data... See more...
raw data -  "attackData":{"rules":[{"data":"SCANTL=10","action":"alert","selector":"","tag":"REPUTATION","id":"REP_6021037","message":"Scanning Tools (High Threat) - Shared IPs","version":""},{"data":"SCANTL=10","action":"alert","selector":"","tag":"REPUTATION","id":"REP_6021039","message":"Scanning Tools (Low Threat) - Shared IPs","version":""},{"data":"WEBATCK=10","action":"alert","selector":"","tag":"REPUTATION","id":"REP_6021041","message":"Web Attackers (High Threat) - Shared IPs","version":""},{"data":"WEBATCK=10","action":"alert","selector":"","tag":"REPUTATION","id":"REP_6021043","message":"Web Attackers (Low Threat) - Shared IPs","version":""}], converted to Json and here is the result -  attackData: { [-] rules: [ [-]        {  action: alert          data: SCANTL=10          id: REP_6021037          message: Scanning Tools (High Threat) - Shared IPs          selector:          tag: REPUTATION          version:        }        { [-] action: alert          data: SCANTL=10          id: REP_6021039          message: Scanning Tools (Low Threat) - Shared IPs          selector:          tag: REPUTATION          version:        }        { [-] action: alert data:WEBATCK=10 id:REP_6021041 message:Web Attackers (High Threat) - Shared IPs selector: tag:REPUTATION version:        }        { [-] action: alert          data: WEBATCK=10          id: REP_6021043          message: Web Attackers (Low Threat) - Shared IPs          selector:          tag: REPUTATION        }      ]    } Here the issue is whenever we are creating an alert or dashboard with single message called Scanning Tools (High Threat) - Shared IPs we are getting correct values but along with that rest all rules are also coming in event which client is not accepting. I know that will be there bcoz thats how the log is. Can we do anything for this to get only given message or value not all. This is happening for all events.  
Hi fsoengn, Thanks for the reply. Mine is AppDynamics SaaS. So the requirement is when we are sharing a dashboard & if there are any maintenance activities there, we need to add a message/banner/sc... See more...
Hi fsoengn, Thanks for the reply. Mine is AppDynamics SaaS. So the requirement is when we are sharing a dashboard & if there are any maintenance activities there, we need to add a message/banner/scroll @ the top so that they will know the application is down due to maintenance. I didn't find any option currently, but I do remember older versions having something similar. Thanks.