Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About stwong
stwong
Communicator
Member since:
05-02-2012
12-30-2022
Community Statistics
| Posts | 130 |
| Solutions | 0 |
| Karma Given | 24 |
| Karma Received | 7 |
| Member Since | 05-02-2012 |
Activity Feed
- Posted Splunk Add-on for Microsoft Office 365 - failed to parse URL for IPv6 on Building for the Splunk Platform. 12-29-2022 08:01 PM
- Posted Re: JSON timestamp parsing- When events are being fed from UF, the timestamp can't be extracted? on Getting Data In. 12-20-2022 08:03 PM
- Karma Re: JSON timestamp parsing- When events are being fed from UF, the timestamp can't be extracted? for richgalloway. 12-20-2022 05:46 PM
- Karma Re: Pls help: JSON timestamp parsing for wmazur-splunk. 12-20-2022 05:46 PM
- Posted JSON timestamp parsing- When events are being fed from UF, the timestamp can't be extracted? on Getting Data In. 12-20-2022 01:40 AM
- Posted Re: Macro definition = () on Splunk Enterprise Security. 09-09-2021 11:29 PM
- Karma Re: Macro definition = () for isoutamo. 09-09-2021 11:28 PM
- Karma Re: Macro definition = () for PickleRick. 09-09-2021 11:28 PM
- Posted Re: Macro definition = () on Splunk Enterprise Security. 09-09-2021 02:27 AM
- Karma Re: Macro definition = () for PickleRick. 09-09-2021 02:23 AM
- Posted Macro definition = () on Splunk Enterprise Security. 09-09-2021 12:39 AM
- Posted Tell setup wizard to use python2.7 on Splunk 8.1.1 ? on All Apps and Add-ons. 01-04-2021 10:39 PM
- Posted Re: Join by time range on Splunk Search. 10-28-2020 08:10 PM
- Posted Join by time range on Splunk Search. 10-28-2020 04:15 AM
- Posted Re: Display time in panel on Dashboards & Visualizations. 07-30-2020 03:04 AM
- Karma Re: Display time in panel for isoutamo. 07-30-2020 03:03 AM
- Posted Re: Display time in panel on Dashboards & Visualizations. 07-29-2020 06:17 PM
- Posted How to display time in panel? on Dashboards & Visualizations. 07-29-2020 03:58 AM
- Posted Re: Using base search in drop down list on Dashboards & Visualizations. 07-08-2020 07:52 PM
- Karma Re: Using base search in drop down list for bowesmana. 07-08-2020 06:17 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
01-21-2019
06:17 PM
Thanks. I have similar error on other add-on, which was fixed by adding following to /etc/hosts on corresponding Splunk instance host:
::1 localhost localhost.localdomain localhost6 localhost6.localdomain6
Maybe this case can also be fixed similarly.
Anyway, we switched to test the new add-on https://splunkbase.splunk.com/app/4055/ instead per support's advice.
Thanks for all responded.
... View more
12-20-2018
09:44 AM
Thanks. Found that it's done by a transform in the CIM add-on $SPLUNKE_HOME/etc/apps/Splunk_SA_CIM/default/props.conf.
Thanks a lot.
... View more
12-20-2018
09:40 AM
Thanks and agree. But when expanding the event fields on web interfrace, we can see that the "action" attribute is set to "success", not "login attempt".
... View more
12-20-2018
02:23 AM
Hi, thanks for your help.
I'm just interest to know which configuration makes Splunk changed value of "action" into something different to that stated in the events...
... View more
12-20-2018
12:31 AM
Hi,
We're looking for web GUI log in attempts from index=_audit. Note that for event like following:
Audit: [timestamp=12-20-2018 12:15:38.921, user=user123, action=login attempt, info=succeeded, src=12.34.56.78][n/a]
the "action" field is set to "success" instead of "login attempt".
Was it set somewhere? Sorry for the newbie question.
Thanks a lot.
Regards
EDIT: removed the ip address
... View more
11-04-2018
07:40 PM
Hi all,
We have a simple dashboard containing 3 panels with some charts and tables.
When we use the PDF schedule, the labels in the x-axis of the charts are overlapped. We tried to change the paper size to A3 and the paper layout to Landscape, but it didn't help — the chart doesn't aware of change its paper size/orientation.
We're using Splunk v7.0.
Would anyone please help?
Thanks and rgds
/st wong
... View more
- Tags:
- splunk-enterprise
10-23-2018
10:44 PM
Hi, not yet. We're waiting for updated version of the add-on... Thanks.
... View more
07-23-2018
08:14 PM
1 Karma
Thanks for the suggestions, that match with what we need. Will give them a try.
Thanks a lot.
... View more
07-17-2018
09:08 PM
Hi thanks. We also use this method for Splunk instance with few apps installed, but looking for ways to hide apps menu on per user/role basis. Fyi.
Thanks.
... View more
07-17-2018
04:56 AM
Hi all,
We're using Splunk 7.0. Recently we're being ordered by boss to open up Splunk web interface for a customer to do searching.
I created role for the user to restrict search terms and indexes, and create app cloned from search app by removing some menu items like Datamodel, Alerts. As we've lot of apps/add-on installed, it's tedious to update permission for all one by one. However, unable to hide the App navigation drop down menu. How can we do that? Or will it be any better way to create accounts/roles/apps in a multi-tenant environment?
Thanks a lot.
Regards
/ST wong
... View more
- Tags:
- splunk-enterprise
06-22-2018
01:35 AM
Noted and thanks. Will try it out.
... View more
06-21-2018
07:34 PM
It should be on heavy forwarder or indexer
Got it. Will this overrides host part for all data with sourcetype=syslog?
Chances are we hope to use host_segments for syslog data on some UF, while keep using host in log content for some other UF.
Sorry to bother again.
Thanks a lot.
... View more
06-21-2018
05:53 AM
stupid me. sorry for the newbie mistake...
Just put following in props.conf but seems no effect.
[source::/ssd///cyrus.log]
TRANSFORMS =
TRANSFORMS-host =
splunk btools props list shows the setting is correct. Would you help? Thanks again.
... View more
06-21-2018
04:52 AM
tried but seems not working - still gets hostname from log content. My inputs.conf looks like following:
[monitor:///ssd///cyrus.log]
ignoreOlderThan=1d
disabled = false
TRANSFORMS =
TRANSFORMS-host =
host_segment = 3
index = test
sourcetype = cyrus
Did I miss anything?
Thanks and rgds
... View more
06-21-2018
04:24 AM
Got it. Thanks a lot.
... View more
06-20-2018
11:52 PM
Hi all,
Seems we have to override the sourcetype to sourcetype other than 'recognized' ones (e.g. syslog) in order to make host_segment work. e.g.
[monitor:///ssd/*/*/cyrus.log]
disabled = false
host_segment = 3
index = test
sourcetype = cyrus
However, for some cases, we hope to make use of sourcetype from Splunk (e.g. syslog) but use host_segment instead of host parsed in the log content for that particular sourcetype. Possible to do that at inputs.conf without touching other config files like props.conf or transform.conf?
Sorry for the newbie question.
Thanks and regards
... View more
05-20-2018
06:50 PM
Update:
We tried on another Splunk 7.0 installation without IPv6 support. The same error didn't occur.
... View more
05-20-2018
06:50 PM
Update:
We tried on another Splunk 7.0 installation without IPv6 support. The same error didn't occur.
... View more
05-20-2018
06:41 PM
Hi,
Thanks for the reply. The input file looks like following, which was created by the Add-On's GUI:
----------------- cut here ----------------
[MS_AAD_signins://Azure_AD_Signins]
interval = 5
start_date = 2018-05-01 00:00:00
tenant_domain = mytenant.onmicrosoft.com
[MS_AAD_audit://Azure_AD_Audit]
interval = 5
start_date = 2018-05-01 00:00:00
tenant_domain = mytenant.onmicrosoft.com
----------------- cut here ----------------
Regarding the Sign-On URL, we just follow instruction at https://docs.microsoft.com/en-us/azure/active-directory/active-directory-reporting-api-prerequisites-azure-portal, to put https://localhost there:
c. In the Sign-on URL textbox, type https://localhost.
I wonder if "localhost" resolves to ::1 as our heavy forwarder runs dual IPv4 and IPv6 stack.
Thanks a lot.
Regards,
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
12-30-2022
05:03 AM
|
Karma given to
