Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- Find Answers
- :
- About maciep
maciep
Champion
Member since:
09-18-2013
10-22-2024
Community Statistics
| Posts | 826 |
| Solutions | 118 |
| Karma Given | 98 |
| Karma Received | 251 |
| Member Since | 09-18-2013 |
Activity Feed
- Got Karma for Re: How do I stop datamodel accelerations from turning themselves back on?. 08-19-2024 09:33 AM
- Got Karma for Re: What is the correct way to edit conf files and propagate changes in a search head cluster ?. 06-12-2024 09:48 AM
- Got Karma for Re: How do I stop datamodel accelerations from turning themselves back on?. 12-06-2023 11:53 AM
- Posted Re: Join query with condition and comparison on Splunk Search. 01-20-2023 06:43 AM
- Got Karma for Re: How can I return specific results using head and tail commands?. 01-20-2023 04:22 AM
- Posted Re: Join 3 sources without join on Splunk Search. 11-28-2022 10:03 AM
- Got Karma for Re: Join 3 sources without join. 11-28-2022 06:33 AM
- Got Karma for Re: Join 3 sources without join. 11-25-2022 04:30 PM
- Posted Re: Join 3 sources without join on Splunk Search. 11-25-2022 08:12 AM
- Got Karma for Re: How to join search based on multiple values?. 11-16-2022 01:48 AM
- Got Karma for Re: How do I stop datamodel accelerations from turning themselves back on?. 10-26-2022 12:56 AM
- Got Karma for Re: Unable to distribute to peer from search head. 10-10-2022 09:14 AM
- Posted Re: Error in 'eval' command: The expression is malformed on Dashboards & Visualizations. 09-29-2022 04:58 AM
- Got Karma for Re: Heavy Forwarder data loss prevention. 09-22-2022 08:05 AM
- Posted Re: Heavy Forwarder data loss prevention on Splunk Cloud Platform. 09-22-2022 05:42 AM
- Posted Re: How to event break on multiple dashes? on Splunk Enterprise. 09-22-2022 05:23 AM
- Posted Re: How to join search based on multiple values? on Splunk Search. 09-16-2022 12:26 PM
- Posted Re: How to compare 2 Search's percentage results? on Splunk Search. 09-16-2022 11:43 AM
- Got Karma for Re: [udp://:portnumber] Event Blacklist. 09-14-2022 05:45 AM
- Posted Re: [udp://:portnumber] Event Blacklist on Getting Data In. 09-14-2022 04:10 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 2 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 0 | |||
| 7 | |||
| 0 | |||
| 0 | |||
| 1 |
05-13-2019
04:10 AM
Good to hear...be sure to accept the answer if it solved your problem.
... View more
05-11-2019
08:38 AM
i think autoregress could work for you...maybe like this:
<your search>
| autoregress RFS3 as prev_RFS3 | autoregress decision as prev_decision
| eval decision = coalesce(prev_RFS3 + RFS3 - prev_decision,0)
... View more
05-09-2019
04:37 PM
1 Karma
So when wanting to loop in Splunk, I typically try to take advantage of the fact that splunk is already looping through my events. But sometimes to do that, you have to use spl to add/remove/modify events in order to have the right result set to then take advantage of that inherent looping. It took me a while to get it, but i really think of spl as more like jiu jitsu to programming's boxing...if that makes any sense.
So in this case, i would probably do something like this:
For each event, create a multi-value field with numbers ranging from 1 to 100
Then i would mvexpand that field - so now each original event is actually 100 events - the only difference between them is the new number field (your i iterator)
So now splunk will inherently loop for me
So i can calculate whatever that is that's inside your loop, and drop it in a new field for that event
Then, i can filter my events similarly to your case statements
and then when done, should similar to your desired output i think
Maybe something like this:
<your search>
| eval i = mvrange(1,100)
| mvexpand i
| eval reference = 50, prev=factor1_min+factor1_hierarchy_flag*(i-1), next=factor1_min+factor1_hierarchy_flag*(i)
| eval keep = case(next > reference AND prev < reference, 1)
| where keep=1
| fields - keep
| rename i AS factor1_grouping
Honestly, i have no idea what you're actually doing in your calculations or what that reference value is, and so not sure if this search produces the expected results. But hopefully it at least gives you an idea of how i would handle the looping part of the question. It's all about manipulating your result set with SPL until you have something that will work for splunk's inherent looping.
... View more
05-06-2019
08:32 AM
I'd probably start with segmenters.conf to be sure they are the same between systems. That's the file that defines the rules for major/minor breakers that ultimately create the terms that are indexed with your events. I think TERM is essentially matching your term filter against the terms found using these breakers.
This session might help (more than I will)
https://conf.splunk.com/files/2016/recordings/fields-indexed-tokens-and-you.mp4
... View more
05-06-2019
08:16 AM
1 Karma
Didn't test, but maybe something like this:
LINE_BREAKER = ([\r\n]+)(?=CIB\s+\d{4}\-\d{2}\-\d{2})
In general i typically include the line breakers in the capture group followed by the thing that starts each event in a positive lookahead.
... View more
04-30-2019
09:51 AM
this also happens after splunk's auto kv functionality which sort of defeats the overall goal having Splunk parse the json for me like it does for kv_mode=json on all full json events.
https://docs.splunk.com/Documentation/Splunk/7.2.6/Knowledge/Searchtimeoperationssequence
... View more
04-30-2019
09:47 AM
Thanks Woodcock. I know it can be done at index time. More than anything, I'm trying to confirm here that it is not possible to do at search time before Splunk does its kv processing.
... View more
04-29-2019
12:05 PM
one day we hope that splunk will build a fully functional/reliable azure add-on like they have aws, We were using Azure Monitor add-on to get data from an event hub, but like most azure add-ons out there, it stopped working too often. So we are now pushing data to log analytics so that we can consume them in Splunk.
As long as the add-on can keep up with the load, we should be good....
... View more
04-29-2019
05:46 AM
We are starting to rely on the Log Analytics add-on a bit more these days, and I noticed that the value field is just sort of hard-coded to a simple string. But often, it's actually json itself. And since the whole event is built as a json object, I wanted to the values to effectively be nested json in those cases.
That said, I've modified input_module_log_analytics.py in my test environment, and it seems to be working. I wanted to share it here in case anyone had feedback or if somebody else would be interested .... and of course to let @jkat54 know.
So I changed this (line 89):
for n in range(len(data["tables"][0]["rows"][i])):
field = str(data["tables"][0]["columns"][n]["name"])
value = str(data["tables"][0]["rows"][i][n]).replace('"',"'").replace("\\", "\\\\").replace("None", "").replace("\r\n","")
if value == "":
continue
else:
data1 += '"%s":"%s",' % (field, value)
To the following. Here I try to process the value field as json. If it succeeds, we use it. If it fails, I use the original logic. But note that i put the surrounding double quotes directly into the value assignment instead of in the data1 assignment, because they don't belong there if the value itself is json.
for n in range(len(data["tables"][0]["rows"][i])):
field = str(data["tables"][0]["columns"][n]["name"])
value = str(data["tables"][0]["rows"][i][n])
try:
value = json.dumps(json.loads(value))
except ValueError:
value = '"' + value.replace('"',"'").replace("\\", "\\\\").replace("None", "").replace("\r\n","") + '"'
if value == "":
continue
else:
data1 += '"%s":%s,' % (field, value)
I also don't think I need the empty value check now, but left it in there just in case...it's not hurting anything.
... View more
04-29-2019
04:19 AM
The goal is to be able to use the resulting fields in the base search, e.g. index="blah" parent.child.subchild="whatever" ...i don't want to have to pull back all of the results and then parse the json and then filter events. Even if i specify a keyword in the base search to limit the initial results, it's not the desired functionality.
... View more
04-29-2019
04:16 AM
I haven't looked at trying since around the time i posted this, but no I haven't
... View more
04-19-2019
10:17 AM
I would not leave it default...it may not be used often but it can be exploited for bad things. For example, somebody connecting to it with the default username/password, pointing it to a rogue deployment server, pushing down scripts to run in context of the splunk user and possibly owning the box.
On the UF's, we set a random password for the admin account and disable the management port.
Have a look at this .conf session from a couple years back:
https://conf.splunk.com/files/2016/recordings/universal-forwarder-security-dont-input-more-than-data-into-your-splunk-environment.mp4
... View more
03-18-2019
08:34 AM
i wonder if you can set a token to the blocked/completed fields after search and use that token in the option...hmmm
... View more
03-13-2019
04:01 AM
I feel like it's something silly. I have the same config on my laptop and any time i upload your test file, it's broken correctly. Not sure if you are capable of trying to upload it manually on your indexer via the web? You don't need to ingest it, but at least see if the data preview looks right when you choose the teamsite_xml sourcetype....
... View more
03-12-2019
05:17 PM
Yeah i typically type all the code, highlight it and then click the code button.
And just to check, where are you ingesting this file from? I've been assuming a universal forwarder so I wanted to be sure it's not an indexer or search head or heavy forwarder etc. Because that could change things.
Or is it possible you have any other teamsite_xml stanzas in a props.conf somewhere on your indexer that might be in conflict?
splunk btool props list teamsite_xml --debug
... View more
03-12-2019
03:39 PM
great, glad to help...don't forget to accept the answer too
... View more
03-12-2019
03:35 PM
I wish i just had access to your env 🙂 What i have in my original answer is what you need on your indexers. Either you had a copy/paste problem on your last post or it's just wrong - the line_breaker looks incomplete and should_linemerge isn't there at all?
... View more
03-12-2019
04:09 AM
The DATETIME_CONFIG, LINE_BREAKER, SHOULD_LINEMERGE settings need to be on your indexer(s). Otherwise, the events won't be broken correctly as you've noticed.
The FIELDALIAS settings should remain on the SHC, because that's when they'll be applied.
For now, i would just copy that props.conf to your indexers as well and try again.
... View more
03-09-2019
07:19 PM
1 Karma
You could probably accomplish this with a "normal" subsearch, but I think this works if you want to use the IN function. I'm just reformatting your server list so it looks like "server01","server02", xxx since that's what the function expects.
| where IN (servername, [
|search myListSearch
| fields serverlist
|eval serverlist = "\"" . replace(serverlist,":","\",\"") . "\""
| return serverlist
]
)
... View more
03-09-2019
06:36 PM
you're using "domain" as the field for the label and value in your dropdown, but your search only returns a dest_nt_domain. So use that field instead.
<label>Domain</label>
<prefix>(</prefix>
<suffix>)</suffix>
<valuePrefix>src_nt_domain="</valuePrefix>
<valueSuffix>"</valueSuffix>
<delimiter> OR </delimiter>
<fieldForLabel>dest_nt_domain</fieldForLabel> <!-- Here -->
<fieldForValue>dest_nt_domain</fieldForValue> <!-- And Here -->
<search>
<query>index=* (eventtype=msad-failed-user-logons OR eventtype=msad-account-lockout) | fields dest_nt_domain | dedup dest_nt_domain | table dest_nt_domain</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
</search>
</input>
... View more
03-09-2019
08:46 AM
do you have the lb logs in splunk? in my env, i would look at the translated dest to find the hec and source for the originating ip. I've never tried tracking this problem, but those are the lb fields i'd use if I wanted to try....if you have them of course.
... View more
03-09-2019
06:42 AM
1 Karma
Not sure if there is an actual option for that in simple xml, but maybe something like this?
Doesn't seem to work without enabling search on change, but could be something i'm missing there. It's the change tag that decides whether new items are allowed. Essentially after the user adds a 3rd, we change it back to only the first 2. Could also keep the last and remove the first if you wanted.
<input type="multiselect" token="t_comp" searchWhenChanged="true">
<label>Component</label>
<search>
<query>index=_internal | stats count by component</query>
<earliest>-60m@m</earliest>
<latest>now</latest>
</search>
<change>
<eval token="form.t_comp">if(mvcount('form.t_comp')=3, mvindex('form.t_comp',0,1),'form.t_comp')</eval>
</change>
<fieldForLabel>component</fieldForLabel>
<fieldForValue>component</fieldForValue>
<delimiter> OR </delimiter>
<prefix>(</prefix>
<suffix>)</suffix>
<valuePrefix>component = "</valuePrefix>
<valueSuffix>"</valueSuffix>
</input>
And of course if you only want to limit to 2, you could also just build 2 dropdowns.
... View more
03-09-2019
05:55 AM
1 Karma
do you have a load balancer in front of your shc? if so, is there a reason you don't load balance the api as well?
You may be able to tie the access logs to the audit logs but I'm not positive. Not sure if there is any sort of "this is an api" search in the logs or if you have to base it on connections to the management port?
... View more
03-09-2019
05:51 AM
hmm...i've always assumed that you can only have one earliest/latest...just like you can only choose one timeframe in the picker. I wonder if splunk sees two defined, doesn't know what to do and uses the timepicker. Maybe set the timepicker to 30 minutes and confirm whether that does get used...you don't need to confirm with All Time only.
So your goal is to search the 3 indexes over different time periods? Trying to understand the example of 5s & 15min versus the goal of "overnight".
And probably not super efficient either, but in your example you could search both over 15m and then filter for only wineventlog events in the past 5s. It's ugly, but if you can't use append and they have to be separate ranges, it's one thing that comes to mind.
... View more
03-09-2019
05:40 AM
i wonder if maybe you can use the tcpin logs on the hec server to correlate over time/counts of the incorrect index events?
but i agree, that log line is mostly useless and you would think hec at least knows the index and hopefully some other metadata too...just log it.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
10-22-2024
07:27 AM
|
Karma from
Karma given to
