All Topics

TamishaJ · ‎09-13-2022

I am working with ES and the DVC_city filed is not populating which is derived from a lookup table file. We have: checked the file, ensured the .csv format is correct etc, removed the fields for th...

I am working with ES and the DVC_city filed is not populating which is derived from a lookup table file. We have: checked the file, ensured the .csv format is correct etc, removed the fields for that particular data set and readded. We added the data via the Lookup_editor. Upon troubleshooting, we received errors when we ran the following search: index=_internal (sourcetype=lookup_editor_rest_handler OR sourcetype=lookup_backups_rest_handler) INFO OR WARNING OR ERROR OR CRITICAL | rex field=_raw "(?<severity>(DEBUG)|(ERROR)|(WARNING)|(INFO)|(CRITICAL)) (?<message>.*)" | fillnull severity value="UNDEFINED" | search severity=ERROR ERROR Unable to force replication of the lookup file, user= <user's_name> , namespace=SplunkEnterpriseSecuritySuite, lookup_file=lookup_file.csv Traceback (most recent call last): File "/opt/splunk/etc/apps/lookup_editor/bin/lookup_editor/__init__.py", line 415, in update self.force_lookup_replication(namespace, lookup_file, session_key) File "/opt/splunk/etc/apps/lookup_editor/bin/lookup_editor/__init__.py", line 292, in force_lookup_replication if 'No local ConfRepo registered' in content: TypeError: a bytes-like object is required, not 'str' Please note the following: 1. We periodically add data to this lookup file and this is the first time recieving this error 2. We are on the Splunk Cloud Platform 3. As a result, we are not recieving any enrichments for any new data added to that particular lookup file. Previous data is populating as normal with the dvc fields as expected. 4. Asset lookup was added in ES and the new lookup data is shown in exported file 5. Inputlookup search is generating the new data added with the "city" field which maps to dvc_city 6. The global setting is configured for the correct city/ip mapping in ES Let me know if any other information is required.

donelliot · ‎09-13-2022

I am on splunk cloud and have been using this functionality which is pretty useful to determine what timezone our users are in. It just seems to have stopped since last Tuesday we just got our enviro...

I am on splunk cloud and have been using this functionality which is pretty useful to determine what timezone our users are in. It just seems to have stopped since last Tuesday we just got our environment upgraded to Version:8.2.2203.4 it is returning the fields for timezone and metro but no data Any ideas ? (where x.x.x.x = ip address) | makeresults 1 | eval src_ip = "x.x.x.x" | iplocation src_ip allfields=true | transpose gives column row 1 City Houston Continent North America Country United States MetroCode Region Texas Timezone _time 1663100176 lat 29.7604 lon -95.3698 src_ip x.x.x.x I've raised a case but interested if anyone else has experienced this

ChrisMalt · ‎09-13-2022

Hello, We have Splunk in my new company and I am trying to understand Splunk and the environment. So, they have firewall logs (from one product) in 3 different indexes, one for traffic, one for thr...

Hello, We have Splunk in my new company and I am trying to understand Splunk and the environment. So, they have firewall logs (from one product) in 3 different indexes, one for traffic, one for threats and for other firewall logs. Is this normal? Seems a bit inefficient especially with regards to organization of logs and when searching. They also have combined 2 different firewall products into one of the indexes. I thought each product should have its own index? The person who did the deployment said that this was done for efficiency but this somehow seems to be counterproductive. Am I missing something when I have to search 3 different indexes to get complete results for a certain IP? Any advise is appreciated, Thank you, CM

melarnell · ‎09-13-2022

Hello everyone, I was curious if someone could help me finding an app for splunk that will provide syslogs of my cisco network gear? (IE if someone changes a vlan or shuts a port) I can look up...

Hello everyone, I was curious if someone could help me finding an app for splunk that will provide syslogs of my cisco network gear? (IE if someone changes a vlan or shuts a port) I can look up their user name or switch name, and it will provide me the time stamp, command that was ran and who did it I used this a a prior employer and want to get this implements where I am employed now. This was good when there were outages and no one spoke up, accountability and training.

DG3bran · ‎09-13-2022

Hello team !! Im working whit CDR of SMS and I have to find a way to visualize that two fields are repeated more than 10 times in a minute Could you help me find a way to do it? This is a part of...

Hello team !! Im working whit CDR of SMS and I have to find a way to visualize that two fields are repeated more than 10 times in a minute Could you help me find a way to do it? This is a part of my CDR 14:00:06.495844|2022-09-13 14:00:06.495847|2022-09-13 14:00:06|MT|3385251555|56271948588 origin:3385251555 dest:56271948588 I want to see when it repeats the same origin and the same destination more than 10 times in 1 minute Thank you very much for your help and time

_joe · ‎09-13-2022

Has anyone setup CIM parsing for the Akamai SIEM TA? I am assuming these events should be going to the Alerts data model, but there is almost no parsing in the app. https://splunkbase.splunk.com/a...

Has anyone setup CIM parsing for the Akamai SIEM TA? I am assuming these events should be going to the Alerts data model, but there is almost no parsing in the app. https://splunkbase.splunk.com/app/4310/

nbowman · ‎09-13-2022

I'm looking to setup a multisite indexer cluster. And due to GDPR, I'd like to have a non-replicated index on one of the sites. Is this possible?

skeer007 · ‎09-13-2022

Hey all, So I found a question here about using multiple inputs.conf files.. how it's possible with multiple apps but not just one. My question is, would this work if you copied the single app you ha...

Hey all, So I found a question here about using multiple inputs.conf files.. how it's possible with multiple apps but not just one. My question is, would this work if you copied the single app you have to a new directory? Say you have App 1, you copy it to App 2. Since the contents are the same.. as long as you did not try to monitor the same log files.. would this work and be considered two apps?

udaraglobalwave · ‎09-13-2022

Invalid key in stanza [webhook] in /opt/splunkforwarder/etc/system/default/alert_actions.conf, line 229: enable_allowlist (value: false). How to solve this error? Please help me.

mikerennie · ‎09-13-2022

Hi MC team, One of our current requirements for a Security Incident Management solution is to be able to provide quick context around an asset. One of the most time consuming tasks that an incide...

Hi MC team, One of our current requirements for a Security Incident Management solution is to be able to provide quick context around an asset. One of the most time consuming tasks that an incident responder faces is to track down what the device being alerted on does, what its criticality is and who is the owner. The most effective way to do this is to integrate with an Asset Management /CMDB solution. Is this something that Mission Control can or is looking to do? Thank you kindly, Mike

genesiusj · ‎09-13-2022

Hello, Need to perform a search using a list of values and I do not know the field names. In Splunk, this works. index=employees AND (123456789 OR SMITH OR "1 MAIN STREET") | ta...

Hello, Need to perform a search using a list of values and I do not know the field names. In Splunk, this works. index=employees AND (123456789 OR SMITH OR "1 MAIN STREET") | table * In SQL I can do this. Note: These are not my table or field names. This is an example from the Internet. DECLARE @ColName varchar(126) = 'col_name' DECLARE @ColVal varchar(64) = 'col_val' DECLARE @SQL AS nvarchar(MAX) SET @SQL = '' SELECT @SQL = @SQL + 'SELECT * FROM ' + IST.TABLE_SCHEMA + '.' + IST.TABLE_NAME +' where '+ @ColName +' = '''+ @ColVal +''' ' + CHAR(13) FROM INFORMATION_SCHEMA.TABLES IST INNER JOIN INFORMATION_SCHEMA.COLUMNS ISC ON IST.TABLE_NAME = ISC.TABLE_NAME WHERE ISC.COLUMN_NAME = @ColName EXEC (@SQL) Is it possible to write the above for DBConnect? Thanks and God bless, Genesius

cdp_fap · ‎09-13-2022

I want to enable client authentication. so I midify $SPLUNK_HOME/etc/apps/splunk_httpinput/local/inputs.conf [http] disabled = 0 enableSSL = 1 port = 56606 serverCert = /opt/splunk/cert/service...

I want to enable client authentication. so I midify $SPLUNK_HOME/etc/apps/splunk_httpinput/local/inputs.conf [http] disabled = 0 enableSSL = 1 port = 56606 serverCert = /opt/splunk/cert/service.pem requireClientCert = true I have copy the certificate of my application (myapp.cert) into splunk server. How can I enable myapp.cert into splunk HEC

Jay9 · ‎09-13-2022

I want to create a Maintenance window in ITSI using cron schedule . How I can do this one ?

AntoineDRN · ‎09-13-2022

Hello Splunkers, We had some trouble with notable events. Long story short, by wanting edit one notable, something like 15,000 events has been updated instead. Is there any way to rollbac...

Hello Splunkers, We had some trouble with notable events. Long story short, by wanting edit one notable, something like 15,000 events has been updated instead. Is there any way to rollback, and suppress the update done on the edited notable events? Thanks in advance for your answer, Best Regards

gcusello · ‎09-13-2022

Hi at all, I'm working with an Enterprise Security installation on Splunk Cloud. I have to ingest data from AWS and Azure, so I'm trying to use Data Manager, but this App isn't present in the Splun...

Hi at all, I'm working with an Enterprise Security installation on Splunk Cloud. I have to ingest data from AWS and Azure, so I'm trying to use Data Manager, but this App isn't present in the Splunk Cloud installation. Is it an error to notice to the Splunk Support or is it normal having ES and I cannot use this App? Thanks to all. Ciao. Giuseppe

mohanp_splunk · ‎09-13-2022

When I'm extracting 1 hr data, I'm able to get the results, but If I go more then 1 hr, it's getting timed out, my requirement to display 24 hrs data on dashboard, Is there any way I can optimize bel...

When I'm extracting 1 hr data, I'm able to get the results, but If I go more then 1 hr, it's getting timed out, my requirement to display 24 hrs data on dashboard, Is there any way I can optimize below query? index=idx2 sourcetype=demographic | rex "\|Country_Code~(?<Country_Code>.*?)\|" | search Country_Code="*" | rex "Service~(?<Service>\w+)\|" | rex "Service_version~(?<Version>\d\.\d)\|" | rex"Response_Status~(?<Status>\w+)\|" | rex "Elapsed_Time~(?<response_time>\d+)\|" | rex "Consumer_Name~(?<Consumer_Name>\w+)\|" | rex "Response_Status_Code~(?<Response_Code>\d+)\|" | eval countSuccess=if(Response_Code==200 OR Response_Code==206 OR Response_Code==404 OR Response_Code==424 OR Response_Code==403 OR Response_Code==501,1,0) | eval countFailure=if(Response_Code==500 OR Response_Code==400,1,0) | eval CountTimeout=if(Response_Code==504,1,0) | stats values(Version) as Version count as Volume sum(countSuccess) as SuccessPerc sum(countFailure) as FailurePerc sum(CountTimeout) as TimieOutPerc avg(response_time) as AvgResp exactperc90(response_time) as "90% Resp (ms)" exactperc99(response_time) as "99% Resp (ms)" min(response_time) as "Min Resp (ms)" max(response_time) as "Max Resp (ms)" by Consumer_Name Service Country_Code | sort - Volume | eval AvgResp=round(AvgResp,2) | eval SuccessPerc=round((SuccessPerc/Volume)*100,2)."%" | eval FailurePerc=round((FailurePerc/Volume)*100,2)."%" | eval TimieOutPerc=round((TimieOutPerc/Volume)*100,2)."%" | rename AvgResp as "Avg Resp (ms)" SuccessPerc as "Success %" FailurePerc as "Failure %" TimieOutPerc as "Timeout %" | eval Volume=toString(Volume,"commas")

mark_cet · ‎09-13-2022

I am a fairly new to Splunk, and I am having a lot of trouble using the table lookups. I have a lookup CSV table (team_info) that looks like this: team_id,active,group team_a,1,team a ops t...

I am a fairly new to Splunk, and I am having a lot of trouble using the table lookups. I have a lookup CSV table (team_info) that looks like this: team_id,active,group team_a,1,team a ops team_b,0,team b marketing team_c,1,team c netops My search is extracting field using regex: index="sys_alerts" | rex field="Message" "...<teamID>..." | eval app="Application A" | lookup team_info team_id as teamID OUTPUT active as active, group as group When I run the search the teamID is being extracted successfully but I do not see the active or group fields in the events. What am I doing wrong or missing? Thanks in advance.

aakwah · ‎09-13-2022

Hi, I'd like to change Notable Event row color or the color of any field in incident review dashboard to easily identify certain events. I played with "Advanced Edit" by setting display.visualiza...

Hi, I'd like to change Notable Event row color or the color of any field in incident review dashboard to easily identify certain events. I played with "Advanced Edit" by setting display.visualizations.charting.fieldColors with no success as per the attached screen shot. Ahmed

ajayabburi508 · ‎09-13-2022

Hi Every one , I am able to add check boxes to the each row of the table using https://splunkbase.splunk.com/app/4362/. but here when i am browsing between two pages ,it is not working. example...

Hi Every one , I am able to add check boxes to the each row of the table using https://splunkbase.splunk.com/app/4362/. but here when i am browsing between two pages ,it is not working. example : i selected 3 rows in first page in second page i selected 2 rows then from here i go back to first page . in first page i am not able to see selected 3 rows. can someone help me here?

jip31 · ‎09-13-2022

hello In a first dashboard, i use 2 dropdown list the first dropdown list concerns a relative time choice and the second dropdown list concern a site choice I need to retrieve in a second dashb...

hello In a first dashboard, i use 2 dropdown list the first dropdown list concerns a relative time choice and the second dropdown list concern a site choice I need to retrieve in a second dashboard (there is also the same dropdown list in this dash) the choice done from these 2 dropdown list by executing html link <form> <label>TEST</label> <fieldset submitButton="false"> <input type="dropdown" token="period"> <label>Période</label> <choice value="1654466400.0">Lundi 6 Juin 2022</choice> <choice value="1655071200.0">Lundi 13 Juin 2022</choice> <choice value="1655676000.0">Lundi 20 Juin 2022</choice> <choice value="1656280800.0">Lundi 27 Juin 2022</choice> <change> <eval token="debut">period</eval> <eval token="fin">debut+432000</eval> <eval token="debut_4w">relative_time(debut,"-4w")</eval> <eval token="fin_4w">relative_time(debut,"-0w")</eval> </change> <default>1655071200.0</default> <initialValue>1655071200.0</initialValue> </input> <input type="dropdown" token="site" searchWhenChanged="true"> <label>Espace </label> <fieldForLabel>site</fieldForLabel> <fieldForValue>site</fieldForValue> <search> <query>`index_mes` | dedup site | table site | sort + site</query> <earliest>-7d@h</earliest> <latest>now</latest> </search> <choice value="*">*</choice> <default>*</default> <initialValue>*</initialValue> </input> </fieldset> <row> <panel> <html> <a href="/app/spl_pub/bpe?form.site=$form.site|u$&form.period.earliest=$form.period$&form.period.latest=$form.period$" target="_blank">Cliquez ici</a> </html> </panel> </row> it works for the site by adding | search site="$form.site$" in the second dashboard for every search but it doesnt works for the time so what is wrong in the html link and how to take into account the time choice done in the first dashboard in the second dashboard? thanks

All Topics

All Topics

Why are dvc fields (e.g dvc_city) not populating/ possible error with Lookup_Editor app/ lookup file?

Why has iplocation /all just stopped working - was returning timezone?

One Application in 3 indexes?

Could someone help me find an app for Splunk that will provide syslogs of my Cisco network gear?

How to FILTER same events whit two or more fields in a time interval?

Has anyone set up CIM parsing for Akamai SIEM TA?

Is it possible to have a standalone index on one site of a multisite cluster?

Multiple inputs files, with 1 app?

Splunk Forwarder installation using Linux- How do I solve this error?

Asset context and/or integration with asset management/CMDB- Is this something Mission Control can or is looking to do?

How do I search for unknown columns using DB Connect?

Can Splunk HEC enable client authentication?

How do I create a Maintenance window using cron schedule In splunk ITSI?

Tried to edit one notable and 15,000 events got updated instead- Is there a way to rollback?

Data manager in ES installation

How can I optimize search which is getting timed out?

Lookups with extracted fields not working- Why can't I see the active or group fields in events?

How to change notable event row color or the color of any field in incident review dashboard?

How to add check boxes to each row in CustomViz Multiselect Table?

Help to use token drilldown with an html link

All Topics

Are you a member of the Splunk Community?

All Topics