Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About jpolcari
jpolcari
Communicator
Member since:
01-11-2016
06-05-2020
Community Statistics
| Posts | 59 |
| Solutions | 10 |
| Karma Given | 5 |
| Karma Received | 17 |
| Member Since | 01-11-2016 |
Activity Feed
- Got Karma for Re: How to generate a list of users and Active Directory groups?. 07-08-2022 07:34 AM
- Karma Re: Why does my saved search not appear in the navigation bar on a dashboard? for FRoth. 06-05-2020 12:48 AM
- Karma Re: How to check if a field contains a value of another field? for Raschko. 06-05-2020 12:48 AM
- Karma Re: How to check if a field contains a value of another field? for woodcock. 06-05-2020 12:48 AM
- Karma $result.fieldname$ not available in script for sunilm411. 06-05-2020 12:48 AM
- Got Karma for Re: How to create a new field using eval and display it in a table?. 06-05-2020 12:48 AM
- Got Karma for Re: Why are Win Event Logs (Security logs) (Win10) generating gigs of data related to SeBackupPrivilege?. 06-05-2020 12:48 AM
- Got Karma for Re: How to change Cluster Map marker color?. 06-05-2020 12:48 AM
- Got Karma for Re: Can I use Splunk 6.5 to monitor Windows 7 hosts?. 06-05-2020 12:48 AM
- Got Karma for Windows event log XML not parsing with KV_MODE = xml. 06-05-2020 12:48 AM
- Got Karma for Re: My dashboard modifies the search command "sor"t and "fields". 06-05-2020 12:48 AM
- Got Karma for Re: How to create a new field using eval and display it in a table?. 06-05-2020 12:48 AM
- Got Karma for Re: Calculating Trends in tables. 06-05-2020 12:48 AM
- Got Karma for Re: How to create a new field using eval and display it in a table?. 06-05-2020 12:48 AM
- Got Karma for How to check if a field contains a value of another field?. 06-05-2020 12:48 AM
- Got Karma for How to check if a field contains a value of another field?. 06-05-2020 12:48 AM
- Got Karma for How to check if a field contains a value of another field?. 06-05-2020 12:48 AM
- Got Karma for Re: Dashboard panel solid border. 06-05-2020 12:48 AM
- Got Karma for Re: Dashboard panel solid border. 06-05-2020 12:48 AM
- Got Karma for Re: Dashboard panel solid border. 06-05-2020 12:48 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 3 | |||
| 0 | |||
| 0 | |||
| 1 |
08-30-2016
08:11 AM
Yes, it is possible. Sorry, I don't know too much beyond that but here are some examples of using jQuery in Splunk dashboards. Hopefully these help:
http://blogs.splunk.com/2013/10/21/toggle-visibility-of-dashboard-components-with-jquery/
http://dev.splunk.com/view/webframework-tutorials/SP-CAAAEN5
... View more
08-30-2016
08:04 AM
Sorry, didn't realize you were attempting to load the actual jquery file. Splunk already includes jQuery as it uses it within the application. No need to import another copy.
... View more
08-30-2016
06:44 AM
This doesn't make too much sense to me. Why do you want to enable SSL and then still allow unprotected traffic as well? With the current Splunk web.conf (where you manage this setting) you can only toggle between HTTP and HTTPS.
This shows the various settings for the web.conf file:
https://docs.splunk.com/Documentation/Splunk/6.4.3/Admin/Webconf
... View more
08-30-2016
06:32 AM
The src_ip is NOT available from Event ID 4740
More info: https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4740
If you are looking for more information on what caused the lockout, you would need to look more into the failed logon attempts that lead up to the lockout.
... View more
08-30-2016
06:18 AM
1 Karma
Check out the sort documentation: http://docs.splunk.com/Documentation/Splunk/6.2.1/SearchReference/Sort
Give this a shot instead. This is the correct syntax:
sort 0 -_time
... View more
08-30-2016
06:13 AM
3 Karma
This isn't really a Splunk question but you just need to change the dashed part to solid:
.dashboard-row .dashboard-panel {
border: 1px solid black;
}
... View more
08-30-2016
06:11 AM
That error is merely telling you that it found a blank line within the CSV file. Notice it is just a WARN. It appears the file is still importing without issue. I think you can safely ignore these warnings.
... View more
08-30-2016
06:01 AM
Files such as javascript and css can be added to the statis folder for the app:
$SPLUNK_HOME/etc/apps/<app_name>/appserver/static/
Once the file is added there, you can link it within your dashboard XML config:
<dashboard stylesheet="myStyleSheet.css" script="myJavaScript.js">
. . .
You will also have to restart Splunk once those files are added.
Check this link for some more information:
http://docs.splunk.com/Documentation/Splunk/6.4.3/Viz/CustomizeSimpleXML
... View more
08-26-2016
07:34 AM
You should be able to using the outputlookup command to add the results of the report into a lookup table.
https://docs.splunk.com/Documentation/Splunk/6.4.2/SearchReference/Outputlookup
Asuming it is already formatted how you want it, you could do something like this. If you need to append to continually update the results, that is possible as well:
report search | outputlookup lookuptablename
... View more
08-26-2016
07:28 AM
This is definitely possible without ES. There are a few options for correlating data within Splunk:
-Using the transaction command: http://docs.splunk.com/Documentation/Splunk/6.4.3/SearchReference/Transaction
-Using a sub search: http://docs.splunk.com/Documentation/Splunk/6.4.2/SearchTutorial/Useasubsearch
-Using a lookup: http://docs.splunk.com/Documentation/Splunk/6.4.2/SearchReference/Lookup
Depending on what exactly you are trying to correlate (IPs, etc), you should be able to use one of those methods to correlate between the firewall and ModSecurity.
... View more
08-25-2016
12:40 PM
When you go to download the forwarder there is an option to download the MD5:
https://www.splunk.com/en_us/download/universal-forwarder/thank-you-for-downloading-2.html
... View more
08-24-2016
01:51 PM
Here is a search I use in my environment to do something similar:
index=wineventlog | stats list(Action) as Attempts, count(eval(match(Action,"Failed"))) as Failed, count(eval(match(Action,"Success"))) as Success by Username | where mvcount(Attempts)>=4 AND Success=1 AND Failed>=3
... View more
08-24-2016
01:40 PM
1 Karma
This looks like a good use of bucket https://docs.splunk.com/Documentation/Splunk/6.4.2/SearchReference/Bucket
This should work for you:
base query earliest=-30d | bucket _time span=1d | stats count as events by source
Basically, the bucket command will break your search results into specified time periods. In the search above we take the last month and break them into buckets per day.
... View more
08-24-2016
01:31 PM
A simple solution would be to just type this into the search box: picture* OR *pic
Other than that, you would have to use a multiselect
... View more
08-12-2016
01:49 PM
Where are the lookup files located? Are they in: Splunk\etc\system\lookups?
What is also important are the field names in the csv files. I see that you are calling the fields: Malware_Domains and Exclude_IP. With your current search you would have to have fields that match that name in the proxy and bro sourcetypes. You could add before | fields:
| rename Exclude_IP AS dest_ip
dest_ip would be whatever the IP field in your logs is. Hope this helps.
... View more
07-15-2016
05:36 AM
I've been looking to do the same thing but have no found an easy way of doing this. The best answer I have found is to take SPLUNK_ARG_8 and use the gzip'd results to parse out the hostname.
... View more
07-14-2016
01:50 PM
You can add perfmon monitoring by using either of those stanzas. Both are not required. The default sourcetype name should be "Perfmon:Process". Try searching the following to see if any events are being indexed:
sourcetype="Perfmon:Process"
Here is some additional information: http://docs.splunk.com/Documentation/Splunk/6.4.1/Data/MonitorWindowsperformance
... View more
07-11-2016
06:52 AM
thanks very much! I was able to get it working with this.
... View more
07-08-2016
01:42 PM
3 Karma
I would like to take the value of a field and see if it is CONTAINED within another field (not exact match). The text is not necessarily always in the beginning. Some examples of what I am trying to match:
Ex: field1=text field2=text@domain
Ex2: field1=text field2=sometext
I'm attempting to search Windows event 4648 for non-matching usernames. We have users with admin accounts that are very close to their unprivileged account names but with a couple characters added.
... View more
06-06-2016
11:33 AM
I attempted to add $result.host$ to the .bat and just have the script print it to a file. The script ran but it only printed "$result.host$" to the text document. I also tried the same but with % isntead of $ but that time it only printed Echo is on. Am I missing something? The script is placed in %SPLUNK_HOME%\bin\scripts.
... View more
06-06-2016
08:47 AM
I have an alert setup that finds an error which indicates that a service must be restarted. When the alert triggers, I would like for a script to run that restarts the service on the specific host that service failed on. I saw in the link below that you can pass custom arguments such as a fieldvalue. Is it possible to pass these arguments to a script? I'm interested in grabbing the hostname of the system so I can reference it in my script. This is a Windows environment so I would most likely be using a .bat file to restart the service.
http://docs.splunk.com/Documentation/Splunk/6.4.1/AdvancedDev/ModAlertsLog
... View more
06-03-2016
05:40 AM
I believe you can use this app. Sorry, haven't used it myself: https://splunkbase.splunk.com/app/1887/
... View more
06-03-2016
05:28 AM
You need to supply some more information. What are you looking to do with the data? With csv files, you can set up file/directory monitoring to import changes to the file into Splunk.
... View more
- « Previous
-
- 1
- 2
- Next »
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:04 AM
|
Karma from
