About mcm10285

mcm10285 · ‎09-10-2013

Hi, I have a dashboard that have 2 independent dropdowns. Using my account, no problem is encountered using the dashboard. However, other users of different profile, find the dashboard intermittent. The dropdowns sometimes only show the "Any" option, then sometimes it works for them as well. Has anybody encountered the same issue or has an idea on what could cause this?

mcm10285 · ‎08-01-2013

tried the CLI and returned the message below In handler 'monitor': Cannot create another input with the name "/splunksearches/SH/etc/apps/search/lookups/IP_Blocklist.csv", one already exists. However, when I checked, the data is already indexed. Wonder how long it took. Thanks for the suggestions anyway.

mcm10285 · ‎08-01-2013

I don't. I just placed a file in the lookups folder and I want to index that. Input lookup needs a search against it. I need to search on the file itself.

mcm10285 · ‎07-31-2013

Does splunk read $SPLUNKHOME/etc/apps/search/lookups in a special manner? I placed a csv file in that directory of a search head to be monitored and it seems like it is not being indexed, or at least it's not searchable. Using it as an inputlookup works though. I want to monitor that file and use it in a form search, an inventory search. Checked /var/log/splunk/splunkd.log, below is the only log found on the directory/path where the file is: INFO TailingProcessor - Parsing configuration stanza: monitor:///splunksearches/SH/etc/apps/search/lookups/filename.csv INFO TailingProcessor - Adding watch on path:///splunksearches/SH/etc/apps/search/lookups/filename.csv

mcm10285 · ‎07-12-2013

Hi, anybody has an idea on how to drilldown to a new popup window? That's taking the value of a click from a graph then taking that value and using it in a different search that will result to a table in another popup window (flashtimeline). I was able to do Drilldown to a new chart. (http://docs.splunk.com/Documentation/Splunk/5.0.3/AdvancedDev/TableChartDrilldown) Then this stood out in answers, but it's calling another saved search. (http://splunk-base.splunk.com/answers/47755/chart-drilldown-to-another-chart-in-popup-window)

mcm10285 · ‎06-26-2013

Figured this one out. Had to use transaction to make events as one event and get an actual multivalue field.

mcm10285 · ‎06-26-2013

Hi, don't seem to see the problem but makemv doesn't work on the search below. sourcetype=st1 < some search >|rename field3 as mvfield|makemv mvfield delim=","|stats count by field1 field2 mvfield This results to 3 matching events and the table below: field1a field2b mvfield3C field1a field2b mvfield3D field1a field2b mvfield3E I was hoping it would be: field1a field2b mvfield3C,mvfield3D,mvfield3E Or instead of commas, a carriage return. Not really sure if makemv is the right command.

mcm10285 · ‎06-25-2013

Hi Chetan, as mentioned to your colleague Mithun, I'm looking at having the agent version and virus definition installed data in Splunk.

mcm10285 · ‎06-25-2013

Hi Mithun, I'm looking into having the information at hand in Splunk, not in the SEP GUI. But I think if we can collect the sylink.log, we may be able tp use that to crossmatch the devices. Does sylink.log also include the virus definition installed? Will look into this, thanks.

mcm10285 · ‎06-25-2013

Ayn and /K, thanks for the detailed explanation. That clarifies it.

mcm10285 · ‎06-24-2013

just trying to get back on old questions....subsearch is definitely the way to go but not efficient for multiple subsearch results.

mcm10285 · ‎06-24-2013

Hi, anyone here collecting Symantec Endpoint (SEP) logs? I've been trying out the Symantec App but I don't find any of the logs showing me the version of the SEP agent of a certain device. Any tweaking needed on Symantec? Testing on SEP11. Appreciate any assitance.

mcm10285 · ‎06-24-2013

/K I understood your initial answer...it is comparative to those with higher values. My curiosity is the ratio by which it decides it is rare..is it 1:1000? 1:5000? etc...does it compare with the highest count? ave count? those are the lines of my question....

mcm10285 · ‎06-18-2013

Thanks /K and MuS...I was really asking about the value in a field, not the field itself, thanks for clarifying that... But let's say I'm searching user-agents being used in the environment, how does it say a result is rare? is it the number of counts it appeared in the search? If it is the count, is there a value/threshold/algorithm "rare" is looking into? That is what I would like to understand.

mcm10285 · ‎06-17-2013

Hi, just curious how the rare command qualifies a field as rare.

mcm10285 · ‎05-14-2013

If you have not found a solution yet, there's an app called prelert in splunkbase.

mcm10285 · ‎03-22-2013

Thanks for this. However I don't think it will work since it is still looking into the "host=ip1" as the log source and just returning that value as something to pass from the subsearch. What I need is a search to look into the values of all defined in the tag and pass them to the main search. It looks like lookup table is the way to go.

mcm10285 · ‎03-21-2013

I'm trying to find a way to use tags to be used in search as such that the tag entries are cross-matched to the search. This would sound like a job for lookups but is there a way to use the tag? I found this link (below), but I'm not sure it works for me or if I did anything wrong. eventtype=foo [search tag::host=tagname | dedup host | fields host | rename host as foo_field]... http://splunk-base.splunk.com/answers/1325/using-host-tags-or-similar-when-searching-on-fields My objective: To get the same result as the search below. eventtype=foo ip1 OR ip2 OR ip3|table foo_field field1 field2 foo_field is a field from the eventtype that would correspond to the ip1, ip2, ip3, etc. Given: tagname: host=ip1, host=ip2, host=ip3 Except for using lookup table, any other ideas?

mcm10285 · ‎02-28-2013

I did try the subsearch, however i kept running into the error "Error in 'fields' command: Invalid argument: 'fieldname=field_value'. Then I ran into one of the Answers on another post, saying I Should add "|rename field as query". This one doesn't go into errors but doesn't get results either. I'm looking into a document about creating State Tables. Thanks.

mcm10285 · ‎02-27-2013

This is really an old post, but I'm still looking for a way here. The join doesn't seem to resolve this as it mixes the results. Just to be exact, I want to match an IP address from a proxy log to a device name or username from AD logs since there is no device name in the proxy logs. I want to input the IP address seen in proxy logs to the AD logs search for device name.

mcm10285 · ‎02-21-2013

Is it possible to use one lookup table for 2 sourcetypes in a single search? For example, lookup.csv contains IP and Category. I would like to alert on IPs matching the lookup.csv from cisco firewalls (e.g. sourcetype=asa, match with field "dest_ip") and proxy gateways (sourcetype=bcoat, match with field "dst"). Assumption is there are no similar fields between the two sourcetypes. sourcetype=asa OR sourcetype=bcoat[|inputlookup lookup.csv..........]

mcm10285 · ‎02-20-2013

btool looks to be it, will try it out...thanks!

mcm10285 · ‎02-20-2013

So I guess what you're saying is to go through the props.conf files from different apps and check what configurations are assigned to which sourcetypes? Is there no way to check that could easily map sourcetype/source/index/etc and props.conf files they are included in? something like..... SOURCETYPE props location foo1 $SPLUNK_HOME/etc/apps/app1/local/props.conf foo2 $SPLUNK_HOME/etc/apps/app2/default/props.conf

mcm10285 · ‎02-19-2013

Is there a way to determine which field extraction (transforms or search rex) was used for a specific sourcetype?

mcm10285 · ‎07-03-2012

Hi, anybody has an idea on how to get a value from one search and input it to another search, then display them in a table? Sample below. I’ll search for IP_Address on 1st search, then take that into 2nd search and find the Hostnames of those ip address…then display them Search1: sourcetype=srctype1 OR sourcetyp=srctype2 dstIP=1.1.1.1 OR dstIP=2.2.2.2|fields + srcIP dstIP|stats count by srcIP Search2: sourcetype=srctype3 (input srcIP from Search1)|fields + Hostname|stats count by srcIP Hostname Display Table: srcIP__________Hostname a.b.c.d_______________abcd

Posts	57
Solutions	4
Karma Given	7
Karma Received	14
Member Since	‎02-09-2011

Online Status	Offline
Date Last Visited	‎06-05-2020 02:02 AM

Shifting from advanced XML to simple XML: How to r...

What is the most efficient way to move all saved s...

How do I include fields from a subsearch to the ma...

Is Splunk mobile access unable to display advanced...

My Named Searches are being Audited, can I put a t...

How to improve search efficiency for monthly vpn u...

Can a drilldown that redirects to an external site...

Multiple Custom Dynamic Drilldowns

2 independent dropdowns data does not show in some...

Monitoring a file in $SPLUNKHOME/etc/apps/search/l...

2 independent dropdowns data does not show in some...

Re: Monitoring a file in $SPLUNKHOME/etc/apps/sear...

Re: Monitoring a file in $SPLUNKHOME/etc/apps/sear...

Monitoring a file in $SPLUNKHOME/etc/apps/search/l...

Drilldown to a flashtimeline table

Re: makemv delims not working

makemv delims not working

Re: Symantec EndPoint version

Re: Symantec EndPoint version

Re: rare command

Re: Search result as input to another search

Symantec EndPoint version

Re: rare command

Re: rare command

rare command

Re: Finding events that have never happened before

Re: Using tags to search other fields

Using tags to search other fields

Re: Search result as input to another search

Re: Search result as input to another search

1 search, 2 sourcetypes, 1 lookup file

Re: Field Extraction identification

Re: Field Extraction identification

Field Extraction identification

Search result as input to another search

Join the Conversation