About richgalloway

richgalloway · ‎10-23-2023

So far, Splunk only supports HTTP 1.1. Go to https://ideas.splunk.com to make a case for HTTP 2.0.

richgalloway · ‎10-23-2023

Those fields are not present in every event. See https://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Usedefaultfields

richgalloway · ‎10-23-2023

Splunk ES supports any device that can send text. Enterprise Security is a Splunk app so any platform that can run Splunk can run ES, however most admins will recommend using Linux.

richgalloway · ‎10-21-2023

I suppose it depends on what you mean by "high availability". In my book, Splunk doesn't do HA, but I come from a fault-tolerant computing background. The closest you'll get requires search head and indexer clusters, which is a bit more of an investment (both in servers and in management) than single instance Splunk servers. Note that Splunk does not support HA for forwarders, Deployment Servers, or SHC Deployers. See https://docs.splunk.com/Documentation/Splunk/9.1.1/Deploy/Useclusters and https://docs.splunk.com/Documentation/Splunk/9.1.1/Deploy/Indexercluster for more information.

richgalloway · ‎10-21-2023

The second argument to mvindex must be an integer. I think perhaps you want something like this: | where (mvindex(description, mvfind(description,"User login to Okta")) == 0) or, even better | where (isnotnull(mvfind(description, "User login to Okta")))

richgalloway · ‎10-20-2023

I think you have the right idea by using streamstats and timechart, but you have them in the wrong order. Try this untested SPL as an alternative to nesting latest within avg. | streamstats latest(codecoverage.totalperc) as totalperc by reponame | timechart span=1mon avg(totalperc) as avgtotalperc by team

richgalloway · ‎10-20-2023

The KOs will remain, but will become "orphans" (owned by nobody). They can be re-assigned to another user, however.

richgalloway · ‎10-20-2023

Where did you come across this feature? As I recall, Splunk removed the ability to run a script as an alert action years ago.

richgalloway · ‎10-20-2023

To determine if a given field value is in a lookup file, use the lookup command. | eval email_domain = mvindex(split(TargetUserOrGroupName, "@"),1) | lookup free_email_domains.csv.csv email_domain OUTPUT is_free_domain ``` If email_domain is not in the lookup file then is_free_domain will be null ``` | where isnotnull(is_free_domain)

richgalloway · ‎10-20-2023

Using just the where command to filter results just removes one Server1 event rather than all of them. Instead, you can use the eventstats command to associated the Deleted status with all events from the same server. Then filter on that association. | eventstats count(eval(Status="Deleted")) as is_deleted by Name | where is_deleted=1 | fields - is_deleted

richgalloway · ‎10-20-2023

As I understand it, there is no default replication port. The cluster will use whatever is in the [replication_port://<port>] or [replication_port-ssl://<port>] stanza.

richgalloway · ‎10-20-2023

They have to change the password with the LDAP provider. Splunk does not offer a means to do so.

richgalloway · ‎10-19-2023

The join command is an inefficient way to combine datasets. Alternative commands are described in the Search Reference manual (https://docs.splunk.com/Documentation/Splunk/9.1.1/SearchReference/Join#Alternative_commands). Splunk has a manual for SQL users. See https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/SQLtoSplunk

richgalloway · ‎10-19-2023

I believe that's covered by the schedule_search capability.

richgalloway · ‎10-19-2023

Anything written by a script to stdout is indexed as a raw event by Splunk. You can use props.conf settings to extract fields from the event. By default, Splunk will extract key and values that are in key=value format, so perhaps your PS script could do that.

richgalloway · ‎10-19-2023

Try using sed. | rex mode=sed "s/rawjson=\\\"//"

richgalloway · ‎10-18-2023

That sounds about right, although I would expect each index to be on a separate line with the corresponding index name. Do you have a screenshot?

richgalloway · ‎10-18-2023

I strongly encourage you to take the free Using Splunk ES (Using Splunk Enterprise Security ) and the (not free) Administering Splunk ES (Administering Splunk Enterprise Security ) courses. ES uses correlation searches to create notable events. A CS is like a saved search, but will a few added attributes. You can create a CS in ES by going to Configuration->Content Management and clicking on the New Correlation Search button.

richgalloway · ‎10-18-2023

Interesting. I see _internal and non-internal indexes when I run it on one of my sandboxes. What do you see when you run the tstats query alone?

richgalloway · ‎10-18-2023

This should do it. It just runs both queries and uses the stats command to regroup the results. index=_internal source=*metrics.log group=tcpin_connections | eval sourceHost=if(isnull(hostname), sourceHost,hostname) | rename connectionType as connectType | eval connectType=case(fwdType=="uf","univ fwder", fwdType=="lwf", "lightwt fwder",fwdType=="full", "heavy fwder", connectType=="cooked" or connectType=="cookedSSL","Splunk fwder", connectType=="raw" or connectType=="rawSSL","legacy fwder") | eval version=if(isnull(version),"pre 4.2",version) | rename version as Ver | dedup sourceIp | append [ | tstats values(host) as sourceHost where index=* by index | mvexpand sourceHost ] | stats values(*) as * by sourceHost | table connectType, sourceIp, sourceHost, Ver, index

richgalloway · ‎10-18-2023

This thread is almost a year old with an accepted solution. For a better chance at helpful responses, please post a new question.

richgalloway · ‎10-18-2023

I don't get it, either. When I plug your numbers into the query I get the expected 21.67. Can you share a screenshot just so we're sure we're looking at the right numbers?

richgalloway · ‎10-18-2023

Try again Verify the lookup file permissions have not changed Make sure no one else is editing the file Make sure no other programs (outside of Splunk) have locked the file or have it open for exclusive access

richgalloway · ‎10-18-2023

The fill_summary_index.py script referenced in the above link merely runs your saved searches that populate a summary index. You can use the same script to run other saved searches that populate/update a KVStore.

richgalloway · ‎10-17-2023

I just checked a Splunk Cloud stack and the only users with the delete option are local. The SAML users do not have the Edit action, therefore no delete.

Posts	16784
Solutions	2989
Karma Given	2037
Karma Received	6728
Member Since	‎07-24-2012

Online Status	Online
Date Last Visited	yesterday

Receiving notifications that are disabled

collectd reports "write_http plugin: curl_easy_per...

How do you restart splunk?

stats count(eval) always returns zero

Need help getting right timestamp from CSV

How to display more than 5 questions per page on A...

What will break if I set coldPath to /dev/null?

Knowledge Object Explorer won't load

How to use a field in SingleValue label?

How to move an index to another app?

Re: Splunk web Service Using Http Version 2.0

Re: Splunk time parse

Re: Splunk Enterprise Security Devices support

Re: Implement Splunk high availability servers

Re: Can you help me fix my Splunk search?

Re: two aggregations? latest and average

Re: how users are deprovisioned from Splunk Cloud

Re: Run a custom script

Re: Check if domain is found in local lookup file ...

Re: filter a table result

Re: Multisite Indexer Cluster Replication Port

Re: ldap/s update user password

Re: Left Outer Join in Splunk

Re: Capability to edit alerts

Re: How to forward separate keys and values from a...

Re: Splunk DB connect - JSON datas

Re: Host Metrics with associated indexes

Re: Splunk ES fortinet new source

Re: Host Metrics with associated indexes

Re: Host Metrics with associated indexes

Re: RF AND SF NOT MET

Re: get all fields

Re: How do I resolve the error: The lookup file co...

Re: Incremental Saved Search

Re: how users are deprovisioned from Splunk Cloud

Join the Conversation