Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- Find Answers
- :
- About jawaharas
jawaharas
Motivator
Member since:
02-09-2017
05-05-2025
Community Statistics
| Posts | 298 |
| Solutions | 30 |
| Karma Given | 183 |
| Karma Received | 67 |
| Member Since | 02-09-2017 |
Activity Feed
- Got Karma for Re: Why am I receiving "cannot concatenate 'str' and 'NoneType' objects" error when uploading a log file?. 03-18-2026 04:42 AM
- Karma Re: Splunk Edge Processor | Popular Use Cases to Get Started with Edge Processor for adepp. 05-05-2025 03:42 PM
- Karma Re: A link to another apps in navigation menu for MuS. 04-28-2025 06:50 PM
- Got Karma for Re: How to disable monitoring console using command line.. 04-15-2025 12:22 AM
- Karma Re: what is a stack id? for richgalloway. 03-19-2025 08:05 PM
- Karma Splunk Edge Processor | Popular Use Cases to Get Started with Edge Processor for adepp. 09-08-2024 11:30 PM
- Karma Re: How to search for "*" (asterisk) values in a field? for somesoni2. 10-22-2023 07:42 PM
- Karma Re: is there a cleaner way to zeropad numeric values, ie add leading zeros? for jhodgepason. 07-25-2023 09:48 PM
- Karma Re: Is it possible to get a list of available indices? for PickleRick. 07-11-2023 05:58 PM
- Got Karma for Re: How to disable monitoring console using command line.. 02-21-2023 02:14 AM
- Got Karma for Re: How to disable monitoring console using command line.. 02-21-2023 02:14 AM
- Got Karma for Re: Why am I receiving "cannot concatenate 'str' and 'NoneType' objects" error when uploading a log file?. 02-08-2023 01:06 AM
- Got Karma for Re: Permissions on /var/log. 12-29-2022 08:47 AM
- Karma Re: install add-on: Error connecting to /services/apps/local: The read operation timed out for vgtk4431. 09-18-2022 07:13 PM
- Posted Re: How to add a field from a subsearch to every event in a parent search? on Splunk Search. 08-23-2022 07:10 PM
- Karma Re: How to change the width of panels in xml? for niketn. 08-11-2022 08:21 PM
- Karma Re: How to add a field from a subsearch to every event in a parent search? for somesoni2. 08-11-2022 07:00 PM
- Posted Re: Installed Splunk Enterprise 7.2.1 and promoted it as cluster master. Splunk Web is not loading. on Deployment Architecture. 06-21-2022 08:57 PM
- Karma Embed Field values in Title for a correlation search for bharathkumarnec. 06-10-2022 06:16 PM
- Karma Re: How to query a lookup table based on time for woodcock. 04-03-2022 05:15 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
09-12-2019
05:33 PM
1 Karma
I'm glad it helped.
... View more
09-12-2019
05:30 PM
The query under 'Notable Events By Urgency' panel is not filtering events by severity.
Query used in the panel:
| `es_notable_events` | search timeDiff_type=current | stats sum(count) as count by urgency | `stats2chart("urgency")`
Tip: Press Ctrl + Shift + E (in Windows) to expand the macro in the query.
If the notable events (including 'High' and 'Critical' ones) exists in the lookup table es_notable_events , you can see them under the 'Notable Events By Urgency' panel
... View more
09-12-2019
12:00 AM
Thanks. It helped me as well.
... View more
09-10-2019
10:21 PM
@martin_mueller
The client name (/xyz/splunk/bin/splunk restart splunkweb) mentioned the answer is edited.
... View more
09-10-2019
03:23 PM
Glad it helped you.
... View more
09-09-2019
11:25 PM
Glad it helped you.
Regarding your new requirement, why you want to do that when the user can able to see the results already in the dashboard panels?
... View more
09-09-2019
10:27 PM
3 Karma
Let me answer to my own question with the inputs from Splunk support.
512kb limit for crash log is hardcoded in Splunk crash dump creation code. It is a pretty reasonable size and captures the necessary information.
Some crashes, like ones from a search process, may contain the last lines from the search.log and could get cut off. The setting itself is NOT configurable unfortunately.
... View more
09-09-2019
08:31 PM
Probably, little more details from your end will help us to assist you.
What you mean by - "prolonged the expiration of an identity"?
Also, which alert keep getting triggered?
... View more
09-09-2019
06:58 PM
@prajapatividhyut2
I have updated my answer with sample code which is working.
As mentioned in the app's documentation , the custom command | virustotal (bundled with this app) uses the https://www.virustotal.com/vtapi/v2/file/report endpoint to communicate with the VirusTotal API.
In which API endpoint you can see below fields?
Registrar field
Creation and Last fields
Update field
... View more
09-09-2019
05:41 PM
Answer to my query -
Adding below config in alert_actions.conf file fix the issue.
[thehive_alert_create_alert]
param._cam = {"supports_adhoc": true}
... View more
09-09-2019
04:50 PM
Here you go - http://prnt.sc/p40i0c
Just create fields in alert_actions.conf corresponding to each field in the 'Adaptive Response Action' page.
... View more
09-09-2019
08:12 AM
1 Karma
You can use "Panel Visualization Elements'.
Use the syntax shown below within each panel element:
<!-- disable all panel links -->
<option name="link.visible">false</option>
<!-- selectively disable each of the links -->
<option name="refresh.link.visible">false</option>
<option name="link.openSearch.visible">false</option>
<option name="link.inspectSearch.visible">false</option>
<option name="link.exportResults.visible">false</option>
Reference:
https://docs.splunk.com/Documentation/Splunk/6.1.4/Viz/PanelreferenceforSimplifiedXML#Panel_visualization_elements
... View more
09-06-2019
02:20 AM
@davietch
Did you try to increase server.socket_timeout parameter value as mentioned in the answer?
... View more
09-06-2019
12:13 AM
You can try below App.
VirusTotal Malware Lookup for Splunk
This app is used to supplement your data with information from VirusTotal.
The custom command | virustotal (bundled with this app) uses the https://www.virustotal.com/vtapi/v2/file/report endpoint to communicate with the VirusTotal API.
Example code:
| makeresults
| eval file_md5_hash="99017f6eebbac24f351415dd410d522d"
| virustotal hash=file_md5_hash
... View more
09-05-2019
11:59 PM
A picture speaks a thousand words - https://prnt.sc/
Just create fields in alert_actions.conf corresponding to each field in the 'Adaptive Response Action' page.
... View more
09-05-2019
05:47 PM
2 Karma
You can use mvexpand command for your use-case as shown below..
| makeresults
| eval message=" {
\"target\":[
{
\"detailEntry\":{
\"signOnModeType\":\"dummy info\"
},
\"alternateId\":\"AppName1\",
\"displayName\":\"dummy info\",
\"id\":\"dummy info\",
\"type\":\"AppInstance\"
},
{
\"detailEntry\":null,
\"alternateId\":\"[email protected]\",
\"displayName\":\"dummy info for email\",
\"id\":\"dummy info\",
\"type\":\"AppUser\"
}
]}"
| spath input=message
| eval _time=now()
| rename target{}.alternateId as appId
| mvexpand appId
| fields appId, _time
| regex appId!="([a-z0-9][-a-z0-9_\+\.]*[a-zA-Z0-9])@([a-zA-Z0-9][-a-zA-Z0-9\.]*[a-zA-Z0-9]\.(ca|com|org|net)|([0-9]{1,3}\.{3}[0-9]{1,3}))"
| timechart count by appId usenull=f limit=5 useother=f
As per your query, the RegEx was not working with timechart command as there are multi-values in the appId field. The mvexpand command expands the values of a multivalue field into separate events and the your can use the regex to filter events.
... View more
09-05-2019
05:06 PM
1 Karma
Once you assign the notable event/incident to an user, you can notice records in incident_review_lookup file.
... View more
You can do that - "creating a custom "soc_team_admin" role inheriting from the ess_analyst one, adding the missing capabilities between ess_admin compared to ess_analyst"
Further, I don't think any object ownership need to changed.
Note: Pls provide your comments using 'Add comment' link of corresponding answer rather than post as a new answer.
... View more
09-04-2019
10:05 PM
Does the log event has values for dlpdictionaries and threatname fields? Or can you post sample log event and your props.conf file for 'Zscaler Splunk App'?
... View more
You are right. Splunk doesn't recommend assigning 'ES Admin Role' to users who don't have 'admin' role.
You can modify the permissions in ESS app as per your requirement. ES > Configure > General > Permissions
... View more
09-04-2019
07:52 PM
By using timechart command, you no longer has a field name appId. Obviously, your RegEx filter will fail.
... View more
09-04-2019
06:48 PM
@santosh_scb
If my answer helped you, please accept and/or upvote it!
... View more
09-04-2019
06:47 PM
@Nadhiyaa
Kindly accept the answer if it helped you, so others can refer it.
... View more
09-04-2019
06:46 PM
@willadams
If my answer helped you, please accept and/or upvote it!
... View more
@jnsd03
Ideally, you should click Accept to close this question and if you have different query (even if related), ask another question.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
05-05-2025
03:42 PM
|
Karma given to
