About livehybrid

livehybrid · ‎05-13-2020

Here you go @andrewtrobec - This is what I am currently using. Doesnt have all of them but its a start - let me know if you want others adding and I'll try and add them... https://github.com/livehybrid/splunk_drawio_icons

livehybrid · ‎05-13-2020

Funnily enough I was talking about this just this morning. I'll see if I cna get something uploaded tonight!

livehybrid · ‎05-09-2020

Ive uploaded a new version 1.0.6 which should fix this issue. It was caused by the build pipeline excluding some JS files. Please let me know if you have any other issues. Thanks

livehybrid · ‎05-09-2020

Ive uploaded a new version 1.0.6 which should fix this issue. It was caused by the build pipeline excluding some JS files. Please let me know if you have any other issues. Thanks

livehybrid · ‎05-09-2020

Hi, Im double checking this against 8.0.3 currently, but in the meantime you should be able to access the inputs config at https://yourInstance:8000/en-US/manager/TA-aws-trusted-advisor/data/inputs/aws_trusted_advisor Let me know how you get on. Thanks Will

livehybrid · ‎05-09-2020

Hi, Im double checking this against 8.0.3 currently, but in the meantime you should be able to access the inputs config at https://yourInstance:8000/en-US/manager/TA-aws-trusted-advisor/data/inputs/aws_trusted_advisor Let me know how you get on. Thanks Will

livehybrid · ‎11-15-2019

Hi @sylbaea It looks like you havent configured the app to point to an authentication.conf file with your intended SAML roles in. I'll be writing better documentation for this over the coming weeks, however in the meantime: Navigate to the app's configuration page from the nav bar once within the app. Populate the authorization_conf_url field (badly named!) with a link to your authentication.conf file, along with any auth headers required to get to the url. It must be HTTPS. Once done, try the command again and let me know how you get on!

livehybrid · ‎10-31-2019

Hi, Have you configured this by copying the existing config files from your Windows host, or have you gone through the SAML configuration from scratch in the GUI? Cheers Will

livehybrid · ‎08-13-2019

Hi all, I'm using the Maps+ app and running a search that ends with the following: | table _time longitude latitude The fields are populated correctly, and the correct coords are mapped on the map, however the time in the bottom right corner is set to 1970, and cannot use the playback, even though the _time field contains the correct date/time. Any one have any ideas what might be wrong? Do I need to do anything special with the time format/field name? Ultimately what I'm trying to show is vehicle positions over time. Thanks Will

livehybrid · ‎08-11-2019

Hi! Im not sure if any apps currently extract fields from the aws:sqs:securityhub sourcetype. Is this as sourcetype that you have defined in your Splunk instance? If so, does it match what you'd expect to see? Im not familiar with this sourcetype, but is it JSON format? If so, I'd consider adding your own sourcetype and setting kvmode=json Let me know Will

livehybrid · ‎07-21-2019

Hi, Do you have any proxies setup on that instance? If not, does it have outbound port 443 access?

livehybrid · ‎06-11-2019

This application has now been updated to resolve this issue.

livehybrid · ‎05-31-2019

Hi, I've just uploaded a new version of the app (1.0.3) which should be available shortly. Please do get in touch directly if there are any issues that I can help with, contact details are on the App page on Splunkbase! Cheers

livehybrid · ‎11-28-2018

Late to the party on this one - but this app is appended to allow multiple accounts: https://splunkbase.splunk.com/app/4207/ Will

livehybrid · ‎11-28-2018

Apologies in the delay getting back to you on this...did you manage to get this working? I havent been able to replicate the above error... Thanks Will

livehybrid · ‎10-05-2018

Sorry about the delay getting back to you on this. Looks like a typo that I missed. Can you try replacing your file: /opt/splunk/etc/apps/TA-aws-trusted-advisor/bin/input_module_aws_trusted_advisor.py with this: https://pastebin.com/UheNeDDz Give it a restart/toggle on/off and see if it works? Let me know how it goes so I can update the app on Splunkbase! Thanks Will

livehybrid · ‎10-03-2018

Hi, I’ll look into this and get back to you tomorrow (currently at Splunk Conf!) I’ll also remove the default inputs from the next version of the app. Thanks Will (Author)

livehybrid · ‎08-15-2018

If you already have an enterprise license installed then when you upgrade it will keep your existing license (not revert to the free license). If you're already on the free license then this will continue, and if you are currently on a trial license then this will also continue (it will not reset the trail). I hope this helps. Regards Will

livehybrid · ‎08-14-2018

That did cross my mind after I posted it - In that case you might need the transaction, unless you have a list of the things that could come after it, and not before it... transactions are generally quite an "expensive" command, so limiting to calls that have the /makeCreditCardPaymentSD will save a bit of resource!

livehybrid · ‎08-14-2018

Try this: index="yourIndex" callid [index="yourIndex" "/makeCreditCardPaymentSD" | dedup callid | table callid] | stats min(_time) AS startTime max(_time) as endTime latest(callid) as callid by callid | eval duration = endTime-startTime That should be quicker than a transaction and works by first finding all the callid's for "/makeCreditCardPaymentSD" before evaluating the time between the first and last event for that callid, would that work?

livehybrid · ‎08-14-2018

So, schedule a search that runs every 10 minutes that does this: index=main | timechart span=1m dc(src_ip) as testCount | eval error=IF(testCount>0, 1, 0) | streamstats window=5 sum(error) as errorSample | eval alert=IF(errorSample>=5,"ALERT","OKAY")

livehybrid · ‎08-14-2018

If you extract the field at index time then it may be easier to find your results later on, especially if searching for large amounts of data, as if you run a regex at search-time then it must do all the regexing at the same time. I'd personally stick with index-time extractions as your searches will be much more performant. Regex is quite an expensive command to run in either case, so keep an eye on your data ingestion pipelines. The Monitoring console (https://docs.splunk.com/Documentation/Splunk/7.1.2/DMC/DMCoverview) may be able to give you an idea on how much processing the regex is taking at extraction time, if this helps. Let me know if this helps. Thanks Will

livehybrid · ‎08-14-2018

Ive raised a bug for this with the above info.

livehybrid · ‎08-14-2018

I'm assuming it goes from EXECUTING->WAITING->COMPLETED? Try something like this: index="events" NOT "COMPLETED" [index="events" reference=* "EXECUTING" | dedup reference | table reference] | stats min(_time) AS startTime max(_time) as endTime latest(reference) as reference by reference | eval duration = endTime-startTime The part in brackets should return all the references that have been in executing state, and then include that in a search for events that have not completed. Instead of transaction this uses min/max _time to get the duration, which should be quicker...

livehybrid · ‎08-14-2018

Ive found the issue with this now. It looks like the space after the comma and before the " is causing it to break in the regions.csv Ive removed the space and now it works. There are also regions missing from regions.csv (Paris and Asia Pacific (Osaka-Local)) which I have added manually.

Posts	1941
Solutions	279
Karma Given	80
Karma Received	820
Member Since	‎08-15-2013

Online Status	Online
Date Last Visited	4 hours ago

Issue using Map+ app with _time

Splunk AWS App not populating pricing info for eu-...

Does anybody have a working draw.io Library with S...

Re: Splunk draw.io icon library

Re: Splunk draw.io icon library

Re: Splunk Enterprise 8.0.3,Splunk 8.0.3

Re: Install on 8.0.3

Re: Splunk Enterprise 8.0.3,Splunk 8.0.3

Re: Install on 8.0.3

Re: error when executing samlpull command

Re: Help configuring ADFS SSO for Splunk on Linux

Issue using Map+ app with _time

Re: aws:sqs:securityhub splunk sourcetype jason fo...

Re: Amazon AWS SQS Monitoring: Receiving error mes...

Re: Can you help me with the following authenticat...

Re: Can you help me with the following authenticat...

Re: AWS Trusted Advisor for Splunk: Multiple Accou...

Re: Can you help me with the following authenticat...

Re: Can you help me with the following authenticat...

Re: Can you help me with the following authenticat...

Re: Will there be any changes to licenses when we ...

Re: How to extract all events in a transaction?

Re: How to extract all events in a transaction?

Re: How to get an alert only when the count is con...

Re: What is the difference between extracting fiel...

Re: Splunk AWS App not populating pricing info for...

Re: Can you filter transactions that do not contai...

Re: Splunk AWS App not populating pricing info for...

Are you a member of the Splunk Community?