All Topics

cyber_Maddy · ‎10-07-2021

I want to change the default page to an alerting page after login.

palkar · ‎10-07-2021

1. My network security device (F5 WAF) sending syslog/events logs to siem tool(splunk) then what kind of forwarder will my network security device? 2. Can we purse payload on splunk receiving events...

1. My network security device (F5 WAF) sending syslog/events logs to siem tool(splunk) then what kind of forwarder will my network security device? 2. Can we purse payload on splunk receiving events get from WAF and how?

Bleepie · ‎10-07-2021

Dear Splunk Community, I have the following search: index=websphere 200 OK POST And I have different platforms that I find like this: index=websphere 200 OK POST LINUX index=websphere 2...

Dear Splunk Community, I have the following search: index=websphere 200 OK POST And I have different platforms that I find like this: index=websphere 200 OK POST LINUX index=websphere 200 OK POST Windows index=websphere 200 OK POST zLinux I am currently using the following query to count all 200 OK POST events per platform: index=websphere 200 OK POST LINUX | stats count | rename count AS "Linux" | append [search index=websphere 200 OK POST WINDOWS | stats count | rename count AS "Windows"] | append [search index=websphere 200 OK POST ZLINUX | stats count | rename count AS "zLinux"] This is just an example, I have way more platforms that I search like in the query above. I have two issues: Its slow It counts per platform and generates table headers horizontally that I don't want I would like to change the above so that I get the following output: Platform | Count Linux | 24 Windows | 50 zLinux | 0 Also, using append search seems a bit devious. There must be a simpler, faster and better way to do this, but how? Thanks in advance EDIT: Please note that the results are all shown in _raw , there are no platform fields or anything generated

robertlynch2020 · ‎10-07-2021

Hi I am trying to send data into a cluster with 1 SH, 1MN and 3 indexers. I am unsure if I A: Send data to the search head then use the output groups to send the data to the indexers B: Send th...

Hi I am trying to send data into a cluster with 1 SH, 1MN and 3 indexers. I am unsure if I A: Send data to the search head then use the output groups to send the data to the indexers B: Send the data directly to the indexers (However I don't have a way to load balance this data) Regards Robert

sjringo · ‎10-07-2021

Trying to figure out how to loop in Splunk. I have the below query and my end result is to map/chart into a timechart by the percentage over _time. index=anIndex sourcetype=aSource StringA earliest...

Trying to figure out how to loop in Splunk. I have the below query and my end result is to map/chart into a timechart by the percentage over _time. index=anIndex sourcetype=aSource StringA earliest=-480m latest=-240m | stats count as A | appendcols [search index=anIndex sourcetype=aSouce StringB earliest=-480m latest=-240m | stats count as B ] | eval _time = relative_time(now(), "-240m@m") | eval percentage = round(( A / B) * 100) | fields + _time, percentage Variables that need to change with each loop. Lets assume I want to show percentage starting from 4 hour in the past to the current time by 30 minute increments. 1) Index: the earliest and latest need to increment by +30 minutes starting at (latest=-480, earliest = -240) till I get to 0 2) _time will need to be relative to when I start (beginning @ time now(), -240) and be adjusted on each loop by + 30 mins till I get to 0 I have looked at many examples but do not understand how to apply it to my requirements...

hammad_yasir · ‎10-07-2021

HI, guys, I want to get logs from splunk to me socket.io Server but i receive BAD MESSAGE REQUEST error on socket.io server side. I can receive data from splunk to simple socket but i need to use so...

HI, guys, I want to get logs from splunk to me socket.io Server but i receive BAD MESSAGE REQUEST error on socket.io server side. I can receive data from splunk to simple socket but i need to use socket.io with websocket and i am facing this issue can you guys help me to receive data from splunk to socket.io Server?

TheEggi98 · ‎10-07-2021

I wonder whats the best practice when working with JS in Dashboards. Im on Splunk Enterprise 8.2.1 Windows single Instance for learning. When i use a JS for just setting tokens its enough to <h...

I wonder whats the best practice when working with JS in Dashboards. Im on Splunk Enterprise 8.2.1 Windows single Instance for learning. When i use a JS for just setting tokens its enough to <host>:<port>/<language>/_bump after changes But when i require a second JS inside my JS (separated JS for customview) i have to rename the second JS and restart splunkd service and then _bump. _bump alone is not working neither /debug/refresh here What is the best practice there? How does splunk behave on different Systems? Our productive Splunk for example ist clustered on Linux servers.

robertlynch2020 · ‎10-07-2021

Hi - We have been using OT to send data into a single Splunk install and it is working very well. I am now looking to move this to production and send the data for my Cluster. 3 indexers, but I ...

Hi - We have been using OT to send data into a single Splunk install and it is working very well. I am now looking to move this to production and send the data for my Cluster. 3 indexers, but I am unsure how to tell the exporter to do this? In a forwarder I would give it the host and post of the 3 indexers, but how do I do this in an exporter? Configure the exportor exporters: otlp/aggregation: # push to the aggregator endpoint: ${AGGREGATOR_HOST}:${AGGREGATOR_PORT} insecure: true splunk_hec: # pushed to splunk token: "a04daf32-68b9-48b2-88a0-6ac53b3ec002" endpoint: "https://mx33456vm:8088/services/collector" source: "mx" sourcetype: "otel" index: "metrics_test" insecure_skip_verify: true Thanks for you help in advance

aditsss · ‎10-07-2021

Hi Team, Can someone guide me how can I extract the logs from the below raw data: 1)Need to Extract the id 5d302144-3cab-387d-8e8c-2532a32b78fe 2) Need to Extract the Starting Time and the Sto...

Hi Team, Can someone guide me how can I extract the logs from the below raw data: 1)Need to Extract the id 5d302144-3cab-387d-8e8c-2532a32b78fe 2) Need to Extract the Starting Time and the Stopping Time 2021-09-01 22:08:48,329 INFO [main] o.a.n.controller.StandardProcessorNode Starting SalesforceBulkAPIJobStatusProcessorV1[id=5d302144-3cab-387d-8e8c-2532a32b78fe] 2021-08-20 12:53:23,476 INFO [main] o.a.n.controller.StandardProcessorNode Stopping processor: SalesforceBatchJobStatusProcessor[id=11c59e11-4bc5-3bbb-9fea-3c12407f3aa2] Can someone please guide me on this

luckyman80 · ‎10-07-2021

Hi Experts! , Wondered if there was a way of doing this. I have a need to compare a timestamp of a log to an EPOCH time also on the same log line and show the Diff Example 20...

Hi Experts! , Wondered if there was a way of doing this. I have a need to compare a timestamp of a log to an EPOCH time also on the same log line and show the Diff Example 2021-10-05 04:49:10.138 [pool-1-thread-1] INFO order - [Pool]Book={inst=example,1=[],2=[feed-|time=1633427347600000000} Manually looking the difference is 2021-10-05 04:49:10.138 -(Standard time) 2021-10-05 04:49:07.600 -(EPOCH time) Difference 2.54 seconds Thanks in advance

rayar · ‎10-07-2021

Installing a new HF and getting the UiHttpListener - Web UI disabled in web.conf [settings]; not starting message /opt/splunk/etc/system/local [splunk@ilissplfwd10 local]$ cat web.conf [settings...

Installing a new HF and getting the UiHttpListener - Web UI disabled in web.conf [settings]; not starting message /opt/splunk/etc/system/local [splunk@ilissplfwd10 local]$ cat web.conf [settings] splunkdConnectionTimeout = 300 #privKeyPath =/opt/splunk/etc/auth/amd_certificates/ilissplfwd05.key #serverCert = /opt/splunk/etc/auth/amd_certificates/ilissplfwd05.pem #privKeyPath = etc/auth/splunkweb/ilissplfwd05.key #serverCert = etc/auth/splunkweb/ilissplfwd05.pem # # enableSplunkWebSSL = true httpport = 8000 [splunk@ilissplfwd10 local]$ cat server.conf [general] serverName = ilissplfwd10 pass4SymmKey = $7$Byj9tE1Bz0uc/sXtMDIlSnuR96UpkmVZHEuj7i0giRrtt5r1zNk= [sslConfig] sslPassword = $7$SMjaRC7EGQjvqnX8xl9tkV+VzYcXdQ2rt0Ui0WCC8UzO3IJLqsJd8Q== [lmpool:auto_generated_pool_forwarder] description = auto_generated_pool_forwarder quota = MAX slaves = * stack_id = forwarder [lmpool:auto_generated_pool_free] description = auto_generated_pool_free quota = MAX slaves = * stack_id = free [splunk@ilissplfwd10 local]$

schimpy · ‎10-07-2021

Hello folks, Has anyone of you made it work that you somehow update the sighting of an attribute in connected MISP instance? I have my MISP integrated to Splunk, IoC are being downloaded to TI fr...

Hello folks, Has anyone of you made it work that you somehow update the sighting of an attribute in connected MISP instance? I have my MISP integrated to Splunk, IoC are being downloaded to TI framework. Based on this some correlation searches that are scheduled, TI-based notables triggers I am looking for a way how to get the feedback about TP/FP back to MISP. I am using MISP42Splunk app, which has an adaptive response action "Alert for sighting MISP attribute(s)" but I cannot make it work. I was also trying to do it via some in-build MISP command without any success. Do you guy have implemented this feature of do you know some way to do it? Thanks!

rolyrolex · ‎10-07-2021

Hello !! I am new to using splunk and would like to know if it is possible to edit a lookup file via Splunk REST API or lookup editor API ? Thank y'all

sarvesh_11 · ‎10-07-2021

Hello Splunkers, I have a HTML button on my splunk dashboard, i want a pop-up when i click that button. That Pop-up will have a splunk Query Output. Please find my below code: Button: <html> <bu...

Hello Splunkers, I have a HTML button on my splunk dashboard, i want a pop-up when i click that button. That Pop-up will have a splunk Query Output. Please find my below code: Button: <html> <button class="btn btn-primary button2" style="margin-left: 950px; margin-top: -75px; position: absolute;" token="button">Report Of Killed Processes</button> </html> Button.js require([ 'splunkjs/mvc/searchmanager', 'splunkjs/mvc/tableview', 'underscore', 'splunkjs/mvc', '/static/app/abcd/Modal.js', "splunkjs/mvc/simplexml/ready!" ], function(SearchManager, TableView, _, mvc, Modal) { $(".button2").on("click", function (e){ e.preventDefault() console.log(e) var myModal = new Modal("mod1", { title: "Movie Details", backdrop: true, keyboard: false, destroyOnHide: true, type: 'wide' }); myModal.body .append($('<p>Please find the movie details below</p><div id="modal_dtl_tabl"></div>')); $(myModal.$el).on("show", function() { setTimeout(function() { var epoch = (new Date).getTime() var modal_movie_dtl_srch = new SearchManager({ id: "modal_tbl_srch" + epoch, earliest_time: "@d", latest_time: "now", preview: true, cache: false, search: "|inputlookup kill_log.csv |table *" }); var myCustomtable = new TableView({ id: "modal_example-table" + epoch, managerid: "modal_tbl_srch" + epoch, pageSize: "10", el: $("#modal_dtl_tabl") }).render(); }, 300) }); myModal.show(); }) }); Also i am using Modal.js from Splunk Dev For All, placed it in my app ABCD. Now when i click the button, nothing happens.

sarit_s · ‎10-07-2021

Hello I have logs that contains some string that i want to replace with *** i want to to be permanent and not only in search time. is it possible ? p.s - i don't have the log files anymore so i ...

Hello I have logs that contains some string that i want to replace with *** i want to to be permanent and not only in search time. is it possible ? p.s - i don't have the log files anymore so i cannot delete and index again thanks

EdgeSync · ‎10-07-2021

Hey there, I am looking to Configure the Crowdstrike OAuth API app inside my SOAR instance. To connect to Crowdstrike it will require an account on the Crowdstrike Falcon instance. I cannot find ...

Hey there, I am looking to Configure the Crowdstrike OAuth API app inside my SOAR instance. To connect to Crowdstrike it will require an account on the Crowdstrike Falcon instance. I cannot find anywhere in the Documentation which states what permissions are needed for this account. Crowdstrike details the permissions on it's website but nothing specific for the API actions which are part of the SOAR app. Any ideas?

Morrel · ‎10-07-2021

Hallo. can anyone please help me. i want search sourcetype for this IP 10.2.123.123 OR 22.222.222.22 OR 33.333.333.33 | stats count by sourcetype the result will be join result as a 3 IP above....

NightShark · ‎10-07-2021

Currently working on a project where instead of dedicating only a single instance of Splunk only for ES they actually have ES installed on every Search Head. From my experience in tinkering with "htt...

Currently working on a project where instead of dedicating only a single instance of Splunk only for ES they actually have ES installed on every Search Head. From my experience in tinkering with "https://splunk-sizing.appspot.com/" any time I would pick ES for Search Heads, the automatic amount required for Indexer nodes gets trippled. I was just wondering maybe if this would help ease the critical pressure that is going on in the indexers at the moment. Thanks,

saravana22 · ‎10-06-2021

https://answers.splunk.com/answers/562629/how-to-configure-pie-chart-to-display-count-within.html same as above post, would like to have a pie chart with its count, so followed the post and its work...

https://answers.splunk.com/answers/562629/how-to-configure-pie-chart-to-display-count-within.html same as above post, would like to have a pie chart with its count, so followed the post and its work, it can show the Count in Pie Chart ... |stats count by sc_status |eval status_slice =sc_status+" - count:"+count Beside, we still have a token to Pass the sc_status as 404/500/304... to customised search string in drilldown unfortunately, it's now passing sc_status as 304 - count:21088 instead of passing 304 to dilldown to search we click on it, which cause the search not working. <drilldown> <eval token="test">replace('click.value',"(\?<=\d\d\d)(\?s)(.*\$)","")</eval> </drilldown> in drill down its not replacing the value as expexted would like to seek any way can fulfill both requirements ( Show Count in Pie Chart + Pass the correct Value to customised search)

MdSahirKhan · ‎10-06-2021

Hello, I'm Sahir Khan I need a Helm chart for Splunk operator Deployment.

All Topics

All Topics

The default page needs to be changed after login.

Queries on splunk

Looking for a faster search query: Count different platforms from somewhat same events

What are the steps to set up HEC on a cluster

Looping in Splunk...

can't receive logs from splunk to socket.io server

Usage of JS in Dashboards

Open Telemetry Exporter to a Cluster

How to Extract the field from the raw logs

Compare usual time to Epoch time

UiHttpListener - Web UI disabled in web.conf [settings]; not starting

Splunk MISP42 sighting: How to update the sighting of an attribute in connected MISP instance?

Edit a lookup file through the REST API

Modal pop-up to show splunk query output not working on html button click?

replace string in log

Crowdstrike App in SOAR - Permissions?

create search input as a part of a result

Would Multiple Enterprise Security Splunk Instances Affect Indexing?

Pie Chart with count+ DrillDown with click.value and replace

Splunk operator Deployment

All Topics

Are you a member of the Splunk Community?

All Topics