About gcusello

gcusello

Hi @mah., if this solves your need, please accept my answer for the other people of Community. Ciao and happy splunking. Giuseppe P.S.: Karma Points are appreciated 😉

gcusello

Hi @mah, using wineventlog is running in my Splunk. Ciao. Giuseppe

gcusello

Hi @mah, the initial value for text2 is missing. Please try again. Giuseppe

gcusello

Hi @mah, try not using base search because I think that the problem could be there, if it will run, you can search the problem in base search. You could also see if your dashboard runs without the second text box, my idea is that it shouldn't run. Ciao. Giuseppe

gcusello

Hi @mah, please, try to using this as base search: index=test sourcetype=test_st $text1$ $text2$ | fields env _time TxName Id Ciao. Giuseppe

gcusello

Hi @mah., it's strange, this solution runs on my Splunk also using base search: <form> <label>Test Dashboard</label> <fieldset submitButton="false"> <input type="text" token="text1"> <label>Text 1</label> <default>*</default> </input> <input type="text" token="text2"> <label>Text2</label> <default>$form.text2$</default> <initialValue>*</initialValue> </input> </fieldset> <search id="base"> <query> index=_internal $text1$ $text2$ | head 1000 | fields sourcetype source user component </query> <earliest>-24h@h</earliest> <latest>now</latest> <sampleRatio>1</sampleRatio> </search> <row> <panel> <table> <search base="base"> <query> | table sourcetype source user component </query> </search> <option name="count">100</option> <option name="dataOverlayMode">none</option> <option name="percentagesRow">false</option> <option name="rowNumbers">false</option> <option name="totalsRow">false</option> <option name="wrap">true</option> <option name="drilldown">cell</option> <drilldown> <set token="form.text2">$click.value2$</set> </drilldown> </table> </panel> </row> </form> The only difference I seee with mine is refresh in base search; I cannot test it, could you try to delete refresh to understand if this is the problem? Ciao. Giuseppe

gcusello

Hi @mah, sorry, my error, in the second input please try: <input type="text" token="text2"> <label>Text2</label> <default>$form.text2$</default> <initialValue>*</initialValue> </input> Ciao. Giuseppe

gcusello

Hi @mah, see if this example could be useful for you: <form> <label>Test Dashboard</label> <fieldset submitButton="false"> <input type="text" token="text1"> <label>Text 1</label> <default>*</default> </input> <input type="text" token="text2"> <label>Text2</label> <default>form.text2</default> </input> </fieldset> <row> <panel> <table> <search> <query> index=_internal $text1$ $text2$ | head 1000 | table sourcetype source user component </query> <earliest>-24h@h</earliest> <latest>now</latest> <sampleRatio>1</sampleRatio> </search> <option name="count">100</option> <option name="dataOverlayMode">none</option> <option name="percentagesRow">false</option> <option name="rowNumbers">false</option> <option name="totalsRow">false</option> <option name="wrap">true</option> <option name="drilldown">cell</option> <drilldown> <set token="form.text2">$click.value2$</set> </drilldown> </table> </panel> </row> </form> Ciao. Giuseppe

gcusello

Hi @sun1000, in blacklist and whitelist options, you have to use a regex not only insert your conditions. So please find the correct regex and try something like this: | rex "(?ms)EventCode\=5145.*Message\=Relative Target Name:\s.+Registry\.xml" You can see a similar regex at https://regex101.com/r/7HVoS2/1 Ciao. Giuseppe

gcusello

Hi @saiteja1111n, Ok, you don't want to index logs and you want to use Universal Forwarders. In this case you have to put in acustom App at least two conf files: inputs.conf, outputs.conf; the second containing the destination for each input to use then in the inputs.conf; the first containing the list of the inputs to take with options for: index, sourcetype, destination (_TCP_ROUTING = systemGroup). then, if you're using a Deployment Server, also a third conf file: deploymentclient.conf. Then, as every configuration on UFs, you have to restart Splunk on UF so the changes will be applied, there isn't any other way to do this. About REST API, for my knowledge, you can use them also on on-premise installations. Ciao. Giuseppe

gcusello

Hi @saiteja1111n, you could take all the logs in a Splunk installation (on-premise or Cloud) and create an alert for each destination that sends data in a csv file as attachment. Another solution could be create one syslog or a SNMP output for each destination. In every cases you have to index data. If you don't want to index data and you tale logs with Universal Forwarders, you could configure them (using outputs.conf) to send data to different Splunk installations as described at https://docs.splunk.com/Documentation/Splunk/8.1.3/Forwarding/Routeandfilterdatad#Route_inputs_to_specific_indexers_based_on_the_data_input Ciao. Giuseppe

gcusello

Hi @Itzloi, are you speaking of both Search Heads and Indexers Clusters or only one? Did you already make a Capacity Plan of your needs? Did you designed an architecture for your infrastructure? (for your info see at https://www.splunk.com/pdfs/technical-briefs/splunk-validated-architectures-it.pdf) if you already did these preliminary steps, you can see at: https://docs.splunk.com/Documentation/Splunk/8.1.3/DistSearch/AboutSHC https://docs.splunk.com/Documentation/Splunk/8.1.3/Indexer/Aboutclusters for configuration steps Ciao. Giuseppe

gcusello

Hi @aditsss, please try this: | rex "\/[^\/]+\/((nifi-api\/flow)|(nifi-api))\/(?<your_field>[^\/]+)" that you can test at https://regex101.com/r/Fa01uS/2 Ciao. Giuseppe

gcusello

Hi @aditsss, if you need to extract the string between "nifi-api/" and the first "/", you could use a regex like this: | rex "nifi-api\/(?<your_field>[^\/]+)" that you can test at https://regex101.com/r/Fa01uS/1 Ciao. Giuseppe

gcusello

Hi @Harold, as @scelikok said, if you're speaking about hardening, you should see at https://docs.splunk.com/Documentation/Splunk/8.1.3/Security/WhatyoucansecurewithSplunk, in addition in the last .Conf there was an interesting webinar https://conf.splunk.com/files/2020/slides/TRU1537C.pdf about Splunk hardening. Anyway, if you want the connections used by Splunk, you should see at https://docs.splunk.com/Documentation/Splunk/8.1.3/InheritedDeployment/Ports Ciao. Giuseppe

gcusello

Hi @morganj1, I'm not sure to completely understand your need, but I think that you could use eval command to distinguish your temparature: | eval index2_temperature=if(index=index2,temperature,""), index1_temperature=if(index=index1,temperature,"") in this way you could have a variable that contains temperature from a specific index and use it in your stats command. Ciao. Giuseppe

gcusello

Hi @morganj1, if you have the ESN field in both indexes you can correlate data from both the indexes using the stats command, some thing like this: index=index1 OR index=index2 | stats values(UnitTemperature) AS UnitTemperature values(ClosestFrontThermocoupleTemperature) AS ClosestFrontThermocoupleTemperature values(ClosestBackThermocoupleTemperature) AS ClosestBackThermocoupleTemperature BY ESN if ENS has a different name in one index, you have to rename it. If you have more values for Temperature, you have to define the function to use: min, max, avg, etc... If you have spaces in the field names, rename them. Ciao. Giuseppe

gcusello

Hi @chuck_life09, Sorry but I don't understand your requirement: you have a multiselect, the values of this multiselect are "my name is" "the desktop is mine" "there are many likes", you want to have these values in a lookup to dinamically manage them, and use them to filter events in dashboard's panels. What's the problem, to have these values in the lookup? or what else? As I said, did you tried to put each value in a different row of the lookup, so you can call all the values from the lookup? Ciao. Giuseppe

gcusello

Hi @chuck_life09, did you tried to create a lookup like this: Name Type AAA ttt AAA sss BBB fff BBB ggg CCC eee CCC hhh CCC qqq Calling it in the multivalue? Ciao. Giuseppe

gcusello

Hi @aditsss, I see that there isn't any search in this panel. As I said I don't understand why create a panel with this input instead to put it in the dashboard header, but it isn't a problem because you know why. The question is what's the condition to display this panel? maybe when you have results in another search? if this panel must be displayed when you have results in another panel with search, you can use this other search to configure the visibility of the panel as I described in the other answer. e.f. taking part of the previous question code: <dashboard> <label>Your dashboard</label> <search id="your_search"> <query> your_search | fields your_fields </query> <earliest>-24h@h</earliest> <latest>now</latest> <sampleRatio>1</sampleRatio> <progress> <condition match="'job.resultCount' == 0"> <set token="show_html">foob</set> </condition> <condition> <unset token="show_html"></unset> </condition> </progress> </search> <row> <panel> <table rejects="$show_html$"> <title>Process</title> <search base="your_search"> <query> | table your_fields </query> </search> <option name="count">100</option> <option name="dataOverlayMode">none</option> <option name="drilldown">none</option> <option name="percentagesRow">false</option> <option name="refresh.display">progressbar</option> <option name="rowNumbers">false</option> <option name="totalsRow">false</option> <option name="wrap">true</option> </table> <html depends="$show_html$"> <p style="color:red;margin-left:30px;font-size:24px">No data:</p> <br/> <p style="color:blue;margin-left:30px;font-size:24px">in search results</p> </html> </panel> </row> <row> <panel> <title>Number of Licenses (Total, Used , Unused)</title> <input type="dropdown" token="license" searchWhenChanged="true" rejects="$show_html$"> <label>Licenses (Total, Unused, Used)</label> <choice value="a">Total</choice> <choice value="b">Unused</choice> <choice value="c">Used</choice> <default>a</default> <change> <condition value="a"> <unset token="b-details"></unset> <unset token="c-details"></unset> <set token="a-details"></set> </condition> <condition value="b"> <unset token="a-details"></unset> <unset token="c-details"></unset> <set token="b-details"></set> </condition> <condition value="c"> <unset token="a-details"></unset> <unset token="b-details"></unset> <set token="c-details"></set> </condition> </change> </input> <html depends="$show_html$"> <p style="color:red;margin-left:30px;font-size:24px">No data:</p> <br/> <p style="color:blue;margin-left:30px;font-size:24px">in search results</p> </html> </panel> </row> </dashboard> At least, I'd put it in the dashboard header! Ciao. Giuseppe

Posts	5825
Solutions	976
Karma Given	78
Karma Received	1305
Member Since	‎01-02-2019

Online Status	Offline
Date Last Visited	13 hours ago

Hardware reference for Stream App

Integrate FireEye logs in Enterprise Security

App Developers Gadgets

more than 50,000 rows in a KV Store

using lookup editor is missing the central part

Splunk Platform Upgrade Readiness App

parsing syslogs from Tiesse systems

Host overriding on syslogs

Eventgen: is it possible to create events taking p...

break a json log

Re: How filter all panels by clicking on a cell ?

Re: How filter all panels by clicking on a cell ?

Re: How filter all panels by clicking on a cell ?

Re: How filter all panels by clicking on a cell ?

Re: How filter all panels by clicking on a cell ?

Re: How filter all panels by clicking on a cell ?

Re: How filter all panels by clicking on a cell ?

Re: How filter all panels by clicking on a cell ?

Re: Wineventlog blacklist not working

Re: Send event/log data to muptiple splunk custome...

Re: Send event/log data to muptiple splunk custome...

Re: Configuration of single site

Re: How to extract the field from the raw data

Re: How to extract the field from the raw data

Re: Outbound connections required by splunk

Re: Use data from two indexes, with separate event...

Re: Use data from two indexes, with separate event...

Re: Multiselect input

Re: Multiselect input

Re: How to display messages instead of "No Result...