About tomapatan

tomapatan · ‎04-18-2023

Sorry to bring up such an old topic, but would really appreciate if you could share an example.

tomapatan · ‎04-18-2023

Hi, I`m looking to export a scheduled report using the REST API but I`m struggling with the syntax. I was able to run a new search inside "curl" and export it, but can`t seem to be able to do the same for saved reports. Would be grateful if someone could help with the syntax for exporting the following report as a CSV file: curl -k -H "Authorization: Bearer myValidToken" https://myValidDomain.splunkcloud.com:8089/servicesNS/userName/app/saved/searches/%20Test%20/history

tomapatan · ‎04-11-2023

Worked like a charm, much appreciated.

tomapatan · ‎04-06-2023

Hi Everyone, I`m learning about the Splunk REST API and I`m experiencing some temperamental behaviour, for example I can fetch results using the query listed below from some reports, but it fails for others, example below: curl -k -H "Authorization: Splunk myValidToken" https://myValidDomainName.splunkcloud.com:8089/services/saved/searches/%5BLOOKUP%5D%20Active%20Directory%20Devices%20No2/acl Response: <?xml version="1.0" encoding="UTF-8"?> <response> <messages> <msg type="ERROR">Could not find object id=[LOOKUP] Active Directory Devices No2</msg> </messages> </response> The report name is correct. Have you got any suggestions for me ? Many thanks, Toma

tomapatan · ‎04-03-2023

Thanks for the reply. I`ve managed to create the token using a native user account and I can successfully query the Admin Config Services API, but I`m having issues getting data from the REST API, receiving a timed out message. curl https://[myValidStackName].splunkcloud.com:8089/services/saved/searches/ Am I using the correct endpoint ? Also, can the REST API be queried using the token, or do I have to provide credentials ? Many thanks.

tomapatan · ‎04-03-2023

I`m trying to query Splunk Cloud using the REST API so that I can export some data externally, however I`m not entirely sure how to download/install/configure the ACS Open API 3.0 specification. The Splunk documentation is a bit ambiguous. I`m also unable to setup a new authentication token, receiving the error below. I`m using an admin account. curl -u username:password -X POST https://admin.splunk.com/[myValidStackName]/adminconfig/v2/tokens {"code":"401-unauthorized","message":"{\"messages\":[{\"type\":\"ERROR\",\"text\":\"Unauthorized\"}]}. Please refer https://docs.splunk.com/Documentation/SplunkCloud/latest/Config/ACSerrormessages for general troubleshooting tips."}

tomapatan · ‎03-31-2023

Hi, Can someone recommend a way to save the results of a Splunk search locally or to shared drive? We`re using a hybrid deployment (Cloud and Enterprise), but the data we require is available in Cloud only. Many thanks, Toma

tomapatan · ‎03-27-2023

We have a requirement to share a Splunk report externally and I`m aware we can achieve this by using iframes to embed the report. My question is who can access the iframe - assuming it`s everyone who has a copy of the iframe/URL - and if there`s a way to restrict access to certain users only ? Can the restriction be applied within Splunk, or does it need to be applied within the external web app that we`re sharing with ?

tomapatan · ‎03-24-2023

Hi Everyone, I was reading through this article that led me to believe it`s possible to display external web content in Splunk, however it doesn`t appear to be working for me. Interestingly, it works fine outside of Splunk (ie: if I save the source as an HTML file locally on my computer), but it doesn`t display the iframe if I put it in a Splunk dashboard. Any assistance would be greatly appreciated. Source code below. <?xml version='1.0' encoding='utf-8'?> <dashboard version="1.1"> <label>My iFrame Dashboard</label> <row> <html> <h2>Embedded Web Page!</h2> <iframe src="https://myValidDomainName" width="100%" height="300">></iframe> </html> </row> </dashboard>

tomapatan · ‎02-20-2023

The following article answered all my questions: https://community.splunk.com/t5/All-Apps-and-Add-ons/Ingesting-logs-from-Microsoft-Teams/m-p/506702 Thanks.

tomapatan · ‎02-17-2023

Hi Paul, Unfortunately I didn`t get that far - when I created a new input in Splunk - add Teams Webhook, there`s no option to specify the URL, as per the screenshot attached. So I`m not sure where/how the webhook needs to be defined.

tomapatan · ‎02-17-2023

Thanks Paul, The Microsoft Teams Add-on for Spunk includes a Microsoft Teams-specific webhook that I`ve configured, but the documentation (link above) does not include the webhook URL for me to test., which is what I`m after.

tomapatan · ‎02-17-2023

Hi, I`m following this article in an attempt to ingest Teams data into Splunk and I need some help with testing the webhook - can someone confirm what the webhook URL is ? curl WEBHOOK_ADDRESS -d '{"value": "test"}' Also, looking at the documentation for the Teams Add-on for Splunk it states that "theTeams Webhook is not available for Splunk Cloud installations." - has anyone found an alternative solution for Cloud Deployments ? We use Splunk in a hybrid (cloud + on prem) environment. Many thanks.

tomapatan · ‎02-02-2023

Thanks Paul, I made the mistake of encapsulating $tokenFilter$ in double quotes. Works fine without the quotes.

tomapatan · ‎02-02-2023

Thanks Paul, unfortunately it now does the opposite as before: displays correctly when the checkbox is selected and no content when it`s checked.

tomapatan · ‎02-02-2023

I have the following search which returns a table of all hostnames and operating systems. | inputlookup hosts.csv | search OS="*server*" | table hostname, OS I would like to add a checkbox to exclude Windows Server 2008 builds. This is what I have so far: <row> <panel> <input type="checkbox" token="checkbox" searchWhenChanged="true"> <label></label> <choice value="Windows Server 2008*">Exclude Server 2008</choice> <change> <condition match="$checkbox$=="Enabled""> <set token="setToken">1</set> </condition> <condition> <unset token="setToken"></unset> </condition> </change> </input> </panel> </row> New panel to show server builds depending on the checkbox: <query> | inputlookup hosts.csv | search OS="*server*" AND OS!="$checkbox$" | stats count as total <query> This only works when the checkbox is selected and correctly excludes the 2008 builds from the search, but doesn`t display anything when the checkbox is unselected. I would like to display all devices when the checkbox is unselected.

tomapatan · ‎02-01-2023

How would this work if the csv file is located in Splunk Cloud and needed to be copied over to our Enterprise SH ? I had a look at the documentation, but couldn`t get it working. Any help would be greatly appreciated.

tomapatan · ‎01-23-2023

Here`s another way to hide the drilldown panel: <row depends="$tokenName$"> <panel> <single> <search> <query> |makeresults |eval label="Close" </query> </search> <option name="drilldown">all</option> <option name="height">50</option> <drilldown> <unset token="tokenName"></unset> </drilldown> </single> </panel> </row>

tomapatan · ‎01-18-2023

Recently we needed to update the Client Secret for one of our tenants and I wanted to ask what is the most efficient way of tracking what the token expiry date is and to create an alert in Splunk? I had a look at the logs and couldn`t find anything to indicate when the access token is about to expire.

tomapatan · ‎12-14-2022

Hi yuanliu, Appreciate the response, exactly what I needed.

tomapatan · ‎12-13-2022

Hi Everyone, I have a field called "User" that contains similar values and I was wondering how to remove or merge similar values? For example: "Tony W" and "Anthony W" (both values of the same field) should be merged together. I was looking at the fuzzy search and jellyfish apps on SplunkBase, but couldn't find a solution to the problem. My search query: (index="abc" Name=*) OR (index="xyz" department=* displayName=*) | eval User=if(isnull(Name), upper(displayName), upper(Name)) | stats values(department) as department by User

tomapatan · ‎11-28-2022

Hi All, The solution was very simple, I had to create another static token="tokShift" and edit the drilldown as follows: - for the overall pie chart: "tokShift"=* - for the day pie chart: "tokShift"=Day for the night pie chart: "tokShift"=Night Also had to pass the token to the table panel: | search agent="$tokNames$" shift="$tokShift$" Regards, Toma

tomapatan · ‎11-22-2022

Hi Everyone, I have 3 pie charts in a panel, showing agent statistics as follows: - 1st pie chart displays overall statistics split by analyst; - 2nd pie chart displays daily statistics split by analyst ( | where shift="Day") - 3rd pie chart displays nightly statistics split by analyst ( | where shift="Night"). I've created a drilldown which works fine for the overall pie chart and it correctly displays the data in another panel based on the value of the slice. To accomplish this I`ve created a token called "tokNames" and assigned an initial value of ALL *. <init> <set token="tokNames">*</set> </init> Drilldown for the Overall pie chart: <drilldown> <set token="tokNames">$click.value$</set> </drilldown> The problem starts with the daily and nightly pie charts - when I click on a name, it displays all the statistics of that particular agent, instead of showing only the daily or only the nightly statistics. Any assistance would be greatly appreciated. Thank you in advance. Toma.

tomapatan · ‎10-19-2022

This is what did the trick for me, although I am convinced there are more elegant ways of writing this search. {location_desc}=_time - > pairs each Entrance and Exit with it`s corresponding timestamp Key was to stitch the data together using mvzip then to expand it using mvexpand so I can have Entrance and Exit times displayed on the same row. Search details: | fields first_name last_name _time, location_desc | eval location_desc=if(match(location_desc,"OUT"), "Exit", "Entrance") | eval name=first_name." ".last_name, {location_desc}=_time | stats values(Entrance) as Entrance values(Exit) as Exit by name | eval combined_data=mvzip(Entrance,Exit,"|") | mvexpand combined_data | eval fields=split(combined_data, "|"), Entrance=mvindex(fields,0), Exit=mvindex(fields,1), duration=round((Exit-Entrance)/3600, 2), Entrance=strftime(Entrance, "%d/%m/%Y %H:%M:%S"), Exit=strftime(Exit, "%d/%m/%Y %H:%M:%S") | table name, Entrance, Exit duration

tomapatan · ‎10-18-2022

@gcusello Thanks. I`ve also looked at the transaction command, but I`m only getting the swipe_in time stamp and missing the swipe_out data. Duration is calculated OK, but ideally I`d like to be able to display a table that contains: swipe_in swipe_out duration 2022-10-17 08:02:19 2022-10-17 16:02:19 08:00:00 This is what I`m currently getting: location_desc _time duration swipe_in swipe_out 2022-10-17 08:02:19 08:45:18 swipe_in swipe_out 2022-10-11 08:04:37 08:26:48 swipe_in swipe_out 2022-10-10 08:15:24 08:05:37

Posts	82
Solutions	6
Karma Given	18
Karma Received	4
Member Since	‎09-27-2022

Online Status	Offline
Date Last Visited	a week ago

How to Perform a Lookup in Splunk When Some Fields...

"Connection was reset" when trying to make an API ...

Help with the Splunk Add-on Builder - creating a c...

Help with token setting and unsetting

Conditional token usage

Integrate Akamai Prolexic logs with Splunk

Duplicate field values after indexing JSON formatt...

How to compare 2 lookups and highlight any changes...

Help with time token

File monitoring not working

Re: Can you hide the credentials in the curl comma...

How to export reports using the REST API?

Re: Splunk REST API query (possible issue with URL...

Splunk REST API query (possible issue with URL enc...

Re: Setting up the ACS API for accessing the Splun...

Setting up the ACS API for accessing the Splunk Cl...

Looking for alternatives to outputcsv in a Cloud d...

How to restrict external access to embedded report

Is it possible to display an external web page in ...

Re: Getting Microsoft Teams Data into Splunk

Re: Getting Microsoft Teams Data into Splunk

Re: Getting Microsoft Teams Data into Splunk

Getting Microsoft Teams Data into Splunk?

Re: Exclude results using checkbox

Re: Exclude results using checkbox

How to exclude results using checkbox?

Re: How can I sync the CSV lookup files between un...

Re: How to show & hide panel by drilldown on a das...

Add-on Microsoft Office 365: what is the most effi...

Re: Help with deduping similar values

Help with deduping similar values

Re: How to get pie chart drilldown to show only th...

How to get pie chart drilldown to show only the da...

Re: How to calculate the duration?

Re: Calculate the duration