About mw

mw · ‎06-23-2011

The Manager link doesn't immediately just give them admin access. Users have their own "knowledge objects" such as searches and macros. They access to these through Manager. They have access to what they create or what you give them access to. If you don't want them to have access to something, manage the permissions of it.

mw · ‎06-23-2011

... | top something showperc=f

mw · ‎06-23-2011

It depends on what you're doing. Obviously, Splunk isn't able to read your mind and show you what you want, so you'll have to communicate it somehow. If there's a way to group those items by some method, that should do it, but if they're very unique and subject to your whim at the moment of search, you'll probably have to specify everything explicitly. Can you give some examples of the data and how you would imagine making this more terse? Obviously, you can use wildcards to search, so if what you're searching for is similar it could be as simple as: myfield=*val* It may be possible to use a lookup: myfield,newfield someval,1 otherval,1 lastval,0 with a search: ... newfield=1 | ... It's also possible to do something similar with regular expressions: ... | eval newfield=if(match(myfield, "^...$"), 1, 0) And there's a cidrmatch() function for eval as well.

mw · ‎06-23-2011

I'm not sure I'm following the part where you want to match the pid to the user -- it appears to already be matched up. Does this work for you: host=sftpserver source=*/sftp.log sftp_action=open | stats values(sftp_file) by sftp_user

mw · ‎06-22-2011

Sorry, I meant: is there an app doing the field extractions (i.e. the Windows app), or are they your own?

mw · ‎06-21-2011

Untested, but I believe this will work: # transforms.conf [some_stanza] REGEX = (\d+)\s+(\d+)\s+(\d+)...and so on FORMAT = F_$1_$2::$3 F_$4_$5::$6 ...and so on # props.conf [my_sourcetype] REPORT-tel_extract = some_stanza

mw · ‎06-21-2011

try searching the _internal index for any mention of one of the files that wasn't indexed: index=_internal myfilename

mw · ‎06-21-2011

What app are you using?

mw · ‎06-21-2011

So you edited inputs.conf and restarted?

mw · ‎06-21-2011

Great! Please be a good netizen and accept the answer if it solved your problem. 🙂

mw · ‎06-21-2011

GeoLiteCity.dat is a binary file. You could read through MAXMIND/bin/init.py and figure out how to write it out, change it, and then write it back. But, depending on what you're doing, you may also be able to override the results from it with another lookup command as well that references your own csv file with the relevant data.

mw · ‎06-21-2011

I think this should work. Maybe you were just missing the rename operation (i.e. "... as free_config_GB"): ... | chart eval(sum(free_config) / 1024) as free_config_GB over source by RaidGroup_Type

mw · ‎06-21-2011

Find the relevant stanza in your inputs.conf and add: crcSalt=<SOURCE> That's a literal " ". From the inputs.conf doc: crcSalt = <string> * Use this setting to force Splunk to consume files that have matching CRCs (cyclic redundancy checks). (Splunk only performs CRC checks against the first few lines of a file. This behavior prevents Splunk from indexing the same file twice, even though you may have renamed it -- as, for example, with rolling log files. However, because the CRC is based on only the first few lines of the file, it is possible for legitimately different files to have matching CRCs, particularly if they have identical headers.) * If set, <string> is added to the CRC. * If set to the literal string <SOURCE> (including the angle brackets), the full directory path to the source file is added to the CRC. This ensures that each file being monitored has a unique CRC. When crcSalt is invoked, it is usually set to <SOURCE>. * Be cautious about using this attribute with rolling log files; it could lead to the log file being re-indexed after it has rolled. * Defaults to empty.

mw · ‎06-21-2011

I think it uses a wiki format. Would be nice if it showed some help there though, eh? Maybe try something like 4 spaces and a dash (i.e.: - my change)

mw · ‎06-21-2011

Please update your post to provide more details.

mw · ‎06-21-2011

There's nothing special about a "summary index" except that the data it holds is summarized. If you have data that is already summarized you can just stuff it in any index (just create a new one) and use it just like you would any other data (i.e. index=accounting_data | timechart sum(income) by department).

mw · ‎06-21-2011

Yeah, I'm confused by that. I don't see much at the other url either. Everything I see at those urls starts with $SPLUNK_HOME and the data is in the default index...

mw · ‎06-21-2011

That seems to work ok enough to allow the setup page to render, but I still get the same error when I attempt to save (on my [script://.\bin\nmap.cmd] input). I'm at a loss. I don't know if I'm being an idiot, or this is some weird bug... My comment on format for both Unix and Windows was really directed at inputs.conf (i.e. if I have a python input, why do I need to muck around with forward vs. backslash if I've taken the time to code my python to work on any platform) -- it was a bit of a tangent. 🙂

mw · ‎06-20-2011

Thanks for the help. I actually don't see many of my scripted inputs at that url. In fact, the only place that I could find a reference is here: https://your-splunk-server:8089/services/apps/local/asset_discovery/setup. However, I'm not sure how reliable that is for Splunk's idea of what the encoded path should be versus what my setup routine has specified...

mw · ‎06-20-2011

I have a setup.xml which uses the following format for scripted inputs on Unix systems: # inputs.conf [script://./bin/nmap.sh] # setup.xml <block title="Ping Scan" endpoint="admin/script" entity=".%252Fbin%252Fnmap.sh"> ... </block> That works just fine, though I'll admit that I'm not clear on what the "25" part of %252F represents (I realize %2F is a "/" character, and I think %25 is a "%" character?). Anyways, I'm having some problems flipping this around for Windows. What should the "encoded" script path look like? The following doesn't work: # inputs.conf [script://.\bin\nmap.cmd] # setup.xml <block title="Ping Scan" endpoint="admin/script" entity=".%5Cbin%5Cnmap.cmd"> ... </block> The input stanza works just fine for me. The setup.xml block displays correctly on the setup page as is, but if I try to save it I get an error: Encountered the following error while trying to update: In handler 'localapps': Cannot edit input ".binnmap.cmd", no input exists with that name The error shows no backslash characters, so I'm wondering if they're getting chewed up on the save operation, or just in displaying the error. In any case, I've tried a few variations on the block, but if I move away from just the "%5C" the setup page won't display at all saying that it can't be found or something similar: <block title="Ping Scan" endpoint="admin/script" entity=".%255Cbin%255Cnmap.cmd"> <block title="Ping Scan" endpoint="admin/script" entity=".%5C5Cbin%5C5Cnmap.cmd"> What am I doing wrong here? Also, as a side note, while it's not such a big deal in this case, it would be awesome if I could use a forward slash in inputs.conf on both Unix and Windows. i.e. why can't the stanza below just work everywhere? [script://.bin/foo.py]

mw · ‎06-16-2011

Here are a couple of examples. Searches are sometimes specific to certain data or field extractions, so you probably won't get too many that will just work right off the bat for you, but these should give you some ideas. For SSH logins: show me cases where there were at least 6 failed logins followed by a successful login (i.e. possible brute force login attack) "failed password" OR "accepted password" | stats list(sshd_action) as list by host, user | eval list = mvjoin(list, " ") | eval alert = if(match(list, "Accepted (?:Failed\s?){6,}"), "True", "False") | where alert == "True" Nice for a chart of the count of failed logins per user vs. the avg number of failed logins per user (failed password) OR (logon failed) | stats count by user, host | eventstats avg(count) as avg | fields user, avg, count

mw · ‎06-16-2011

Dashboards are driven by searches. Searches are either historical or real-time. If a chart on your dashboard isn't "automatically refreshed" it's almost certainly because the search wasn't created with a real-time time range. You can go to Manager -> "Searches and reports" and find your search. Simply edit it and change the timeframe from something like "-24h@h to now" (historical time spec) to "rt-5m to rt" (real-time time spec)

mw · ‎06-16-2011

It's not a file. If you do a "view source" from the search app you'll see it in the source. So, it's some html that gets injected into each view. I wouldn't suggest chasing the actual source of that injection down, but would just try overriding it with your own html.

mw · ‎06-16-2011

I believe this is the javascript that launches that: $('a.aboutLink').click(function(event){ var aboutPopup=new Splunk.Popup($('.aboutPopupContainer'),{ title:_('About Splunk'), buttons:[ { label:_('Done'), type:'primary', callback:function(){ return true; }.bind(this) } ] }); return false;}); You can see the .aboutPopupContainer in the search app's html. I'm not sure if you're trying to do this in your own app or not, but you can create a custom application.js. I imagine you could override the javascript above to display your own html or whatever.

mw · ‎06-16-2011

Manager -> Fields -> Field Extractions You can basically paste a rex regex into the new extraction. However, an extraction must target a source, sourcetype, or host. I suppose you could set the source value to "*" though. Reading up on props.conf will give you some insight into this: http://www.splunk.com/base/Documentation/latest/admin/Propsconf

Posts	191
Solutions	34
Karma Given	88
Karma Received	120
Member Since	‎11-18-2010

Online Status	Offline
Date Last Visited	‎06-05-2020 02:02 AM

Colorize SimpleResultsTable rows based on field va...

setup.xml: problems with windows scripted input fo...

Map internal IPs

outputs.conf defaultGroup wildcard not working

Output XML via a custom search command

Plotting trendlines into the future

Search Commands: analyzefields

Using transforms.conf to create a new field

"AND" a field over multiple events

Sharing a dynamic lookup from an app

Re: Block access to Manager

Re: Splunk Chart Percent

Re: Large complicated search logic

Re: Match PID to user name, then tell me what they...

Re: Network interface Naming problem

Re: numbered fields

Re: Cant add my complete list of sources.

Re: Network interface Naming problem

Re: Cant add my complete list of sources.

Re: How to minipulate chart numbers?

Re: overridding incorrect MAXMIND data

Re: How to minipulate chart numbers?

Re: Cant add my complete list of sources.

Re: Release Notes for an App...formatting lost

Re: Splunk matters

Re: Backfill summary index without original data?

Re: setup.xml: problems with windows scripted inpu...

Re: setup.xml: problems with windows scripted inpu...

Re: setup.xml: problems with windows scripted inpu...

setup.xml: problems with windows scripted input fo...

Re: Identifying Authentication Irregularities

Re: changing the existing dashboard reports to sho...

Re: How can i modify the "About Splunk" Popup?

Re: How can i modify the "About Splunk" Popup?

Re: Automatically extracting field at search time

Are you a member of the Splunk Community?