Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- Find Answers
- :
- About mrgibbon
mrgibbon
Contributor
Member since:
08-30-2012
06-05-2020
Community Statistics
| Posts | 114 |
| Solutions | 8 |
| Karma Given | 22 |
| Karma Received | 27 |
| Member Since | 08-30-2012 |
Activity Feed
- Got Karma for Re: Does Splunk support fields with whitespace from custom drill-down. 05-10-2022 06:34 AM
- Got Karma for Re: How to get Office 365 integrated as my SMTP server for Splunk alerting?. 06-24-2020 01:41 PM
- Karma Re: How to pass token during check and uncheck of the checkbox? for kyaparla. 06-05-2020 12:49 AM
- Karma Subsearch produced 50000 results, truncating to maxout 50000 for sureshwalmart. 06-05-2020 12:49 AM
- Karma Re: Indexing results from JKats Toolkit cURL for jkat54. 06-05-2020 12:48 AM
- Karma Re: What is the best practice for setting time zone? for jkat54. 06-05-2020 12:48 AM
- Karma Re: How to set a token in XML which is not displayed on table ?? for bruceclarke. 06-05-2020 12:48 AM
- Karma Adding Melbourne and Sydney Australia as available time zones in GUI. for Lucas_K. 06-05-2020 12:48 AM
- Karma Re: How to display 2 fields as a single field in Splunk with the greater value first? for MuS. 06-05-2020 12:48 AM
- Karma Is it possible to generate a PDF of a full dashboard and all its panels in a single page with Splunk 6.4? for o_calmels. 06-05-2020 12:48 AM
- Karma a couple of MS Windows AD Objects add-on macro fixes for mpf. 06-05-2020 12:48 AM
- Karma Re: Splunk Enterprise Security: How to troubleshoot why a Threat Intelligence download is failing for a single download source? for gjanders. 06-05-2020 12:48 AM
- Got Karma for Re: How to automatically log in to Splunk to display a dashboard on a TV screen with no interaction?. 06-05-2020 12:48 AM
- Got Karma for Re: how to show current ERROR trend as a single value. 06-05-2020 12:48 AM
- Got Karma for Re: Adding Melbourne and Sydney Australia as available time zones in GUI.. 06-05-2020 12:48 AM
- Got Karma for Re: Is it possible limit user access to an index on a Search Head level?. 06-05-2020 12:48 AM
- Got Karma for Cell value colours in 6.5, wildcards?. 06-05-2020 12:48 AM
- Got Karma for Re: If the Universal Forwarder doesn't do parsing, why do I see an abundance of "Failed to parse timestamp" errors in splunkd.log?. 06-05-2020 12:48 AM
- Got Karma for Re: How to search and table the retention time of each hot, warm, cold, and frozen bucket by each index?. 06-05-2020 12:48 AM
- Got Karma for Re: How to search and table the retention time of each hot, warm, cold, and frozen bucket by each index?. 06-05-2020 12:48 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 2 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 2 | |||
| 0 |
12-04-2016
04:43 PM
Hi acharlieh, We have tried all of those settings and are still coming up empty.
If you have any other ideas, please let me know.
Many thanks
... View more
12-01-2016
08:28 PM
We are trying to configure IMAP Mailbox app for Splunk with a Google Apps for Education account and receiving the follow error.
"11-29-2016 14:12:39.207 +1000 ERROR ExecProcessor - message from "python /app/splunk/etc/apps/IMAPmailbox/bin/get_imap_email.py" __main__.LoginError: Could not log into server: imap.gmail.com with password provided"
I can confirm the IMAP details are correct and have tested them with a desktop mail client. I suspect the issue is that the account requires user interaction to allow IMAP Mailbox/Splunk access to the account. For example when configuring Thunderbird there is a pop up to permit access.
IMAP Mailbox does not prompt to allow this access.
Do you have any advice on how to authorize IMAP Mailbox to access the Google Apps account or any info on what API scopes would need to be authorized so that IMAP Mailbox could access the account?
We have been in touch with the developer and between us we haven't found an answer yet.
Please help! 🙂
... View more
11-30-2016
04:07 PM
Take a look here, it mentions a timechart command may produce the result you want:
link text
So you may already have the code you need. Have you tried looking at the options for the trend in the xml?
... View more
11-30-2016
03:13 PM
1 Karma
Why not just add on a '| stats count' or a '|stats count | table count' on the end, that would give you a count of the events you have found.
... View more
11-30-2016
02:26 PM
Hi, you would have to start looking into custom javascript and CSS in order to do this, but it can be done 🙂
... View more
11-23-2016
03:06 PM
Yeah, it wasnt a complete answer, but a guide in the right direction, teach a man to fish and all that. 🙂
... View more
11-23-2016
03:06 PM
Can you edit your post and use the code sample button?
The above doesn't work, I think its missing a few things 🙂
... View more
11-22-2016
07:41 PM
Try this:
https://answers.splunk.com/answers/293049/calculating-the-time-difference-between-fields-how.html
... View more
11-22-2016
03:23 PM
This rex should point you in the right direction:
\s{1}\w+\d{4}(?P<username>[^ ]+)
... View more
11-22-2016
03:18 PM
This should start you down the right path:
index=_audit action=search info=granted search=* NOT "search_id='scheduler" NOT "search='|history" NOT "user=splunk-system-user" NOT "search='typeahead" NOT "search='| metadata type=* | search totalCount>0" | stats count by user search _time | sort _time | convert ctime(_time) | stats list(_time) as time list(search) as search by user
... View more
11-22-2016
03:07 PM
In essence, It can be taught via SPL and alerting to detect and respond to any threat you wish.
There isnt really any "most effective" as such, as it can do anything you want, and do it consistently well.
... View more
11-22-2016
03:02 PM
\"(?P<message>[^\"]+) should give you a good start.
Sometimes the rex can be funny with quote marks, you may end up having to add in multiples e.g. \" or \\"
... View more
11-22-2016
02:56 PM
1 Karma
Have you tried grabbing a sample of the data and using that to go through the "Add Data" wizard on another Splunk machine?
That might give you a heads up on the formatting needed on the time-stamp and also allow you to play with settings until its correct.
... View more
11-22-2016
02:47 PM
3 Karma
Hmm, try this for indexes:
| rest /services/admin/indexes | eval yr = floor(frozenTimePeriodInSecs/86400/365)| eval dy = (frozenTimePeriodInSecs/86400) % 365 | eval ret = yr . " years, " . dy . " days" | stats list(splunk_server) list(frozenTimePeriodInSecs) list(ret) by title
And this for buckets:
| dbinspect index=* | join index [|rest /services/data/indexes| eval index=title | table index frozenTimePeriodInSecs ] | eval toNow=now()-endEpoch | convert num(toNow) | convert num(frozenTimePeriodInSecs) | convert ctime(endEpoch) AS endEvent | convert ctime(startEpoch) AS startEvent | eval shouldBeFrozen=if( ( state!="hot" AND state!="thawed" ) AND toNow>frozenTimePeriodInSecs,"yes","no") | table index path id state startEvent endEvent shouldBeFrozen toNow frozenTimePeriodInSecs
... View more
11-22-2016
02:41 PM
In theory you should be able to take your new data, search the KVStore for anything that doesn't match and then use the outputlookup command to store the new data inside the KVStore.
I cant help right now with the specific commands, but that approach should work.
http://dev.splunk.com/view/webframework-developapps/SP-CAAAEZH
... View more
11-22-2016
02:36 PM
A space in regex is \s not \S, try replacing that.
... View more
11-21-2016
02:51 PM
Hi, To keep it simple, would a simple monitor stanza in your inputs.conf pointing at the lookup file work?
Presuming its just a CSV or similar.
Then if it changes, the changes should be ingested. In that case, any event produced could be used to trigger an alert, and the ingested data would be the change / delta.
Cheers
... View more
11-20-2016
08:03 PM
Also, I want the value of the field, not the count of those fields.
... View more
11-20-2016
08:00 PM
I added it in as when I view the event that number is actually below the leading text, like this:
nBad Password Count:
4
So I added it in to cope with that, but if you copy out the event its directly following the colon and a space. I have tried without it, still the same result.
Thanks
... View more
11-17-2016
06:30 PM
Hmm, Im using 6.5.0.
Might be something quirky in the way the event is ingested, its only ADFS logs though, fairly std.
index=adfs "Event ID"=403 OR "Event ID"=516 NOT "Audit Success"
| rex "blah.internal\\\(?P[^ \n]+)"
| rex "Activity ID: (?P[^\n \"]+)"
| rex "((\\d{1,3}\.\\d{1,3}\.\\d{1,3}\.\\d{1,3}).+?(?P\\d{1,3}\.\\d{1,3}\.\\d{1,3}\.\\d{1,3}))"
| rex "nBad Password\s{1}\w{5}\:\s(?P[^ \n]+)"
| rex "nLast Bad Password Attempt: (?P[^\"]+)"
This is just one variation I have tried, of course I have tried the most basic one I listed first.
... View more
11-17-2016
05:31 PM
1 Karma
Personally I would create a deployment app and push it out where needed.
But if you are only running one machine, you can put it in either place you mention, just be aware in /system/local/ it will overrule anything in the /apps/myapp/local folders.
Cheers
... View more
11-17-2016
05:29 PM
You might have to replace 'Time' with '_time' in the queries, and then you may have to do some playing around with the drop-downs.
The time field is always a little tricky to mess around with. Quirky.
I use something like this to use the drop down time ranges:
detail.utr="*" earliest=$dashboardTime.earliest$ latest=$dashboardTime.latest$ | stats count by detail.formId
... View more
11-17-2016
05:11 PM
Just wondering if anyone has ever seen this before?
This is the data I’m extracting from:
"Classic,Audit Failure",11/14/2016 9:32:27 AM,AD FS Auditing,516,-3,"The following user account has been locked out due to too many bad password attempts. Additional Data Activity ID: 00000000-0000-0000-0000-000000000000 User: sausages\Abel.Caine Client IP: 103.1.1.1,10.1.1.1 nBad Password Count: 4 nLast Bad Password Attempt: 11/14/2016"
I’m trying to extract the bad password count.
By all means, this should work:
| rex "Password Count: (?P[^ \n]+)"
But it appears that Splunk sees the string ‘Count’ as a command, not just a string.
I get the total ‘count’ of those fields it finds.
I’ve tried escaping it, using “\s{1}\w{6}” and a load of others things.
Seen this before?
... View more
11-10-2016
04:00 PM
You need href if you want to reference a dash from another app.
Which is what I want to do.
I have tried:
<a href="cars_twitter_analysis__test_app" default=“true”>Cars tweet analysis</a>
<a href="overview.html" default=“true”>Overview</a>
Etc, nothing seems to work.
I want to put in a link to the forwarder mgmt page:
"/manager/system/deploymentserver?t=2"
Thanks
... View more
