About bowesmana

bowesmana · ‎10-06-2023

There are a number of viz that may help. The Itsy Bitsy App for Splunk - https://splunkbase.splunk.com/app/5256 is an example app that shows some interesting simple XML/CSS techniques. Also, not sure if Treemap would work for your use case https://splunkbase.splunk.com/app/3118

bowesmana · ‎10-05-2023

This? - Update your field names as necessary search events | timechart sum(number_of_widgets) as widget_count sum(creation_time) as creation_time

bowesmana · ‎10-05-2023

You can't use regex in a search command but could do this search ... | where match(user, "^[A-L]") which will filter only users starting with A-L or this search... [| makeresults | fields - _time | eval user=split("ABCDEFGHIJKL","") | mvexpand user | eval user=user."*" ] which uses a subsearch which effectively turns the search into search ((user=A* OR user=B* OR user=C*...))

bowesmana · ‎10-05-2023

What is your time range for both searches?

bowesmana · ‎10-05-2023

Without seeing how you assign the tokens, it's hard to say why they are not showing anything, but you have to assign the click names and values in the <drilldown> section - these will not show any value outside that, so this will never work. <b>$$clickname$$</b>: $click.name$<br/> <b>$$clickvalue$$</b>: $click.value$<br/> <b>$$clickname2$$</b>: $click.name2$<br/> <b>$$clickvalue2$$</b>: $click.value2$<br/> Here is a working example of a <row> that shows you how it works <row> <panel> <chart> <search> <query>index=_audit | chart count over user by action</query> <earliest>-4h@m</earliest> <latest>now</latest> <sampleRatio>1</sampleRatio> </search> <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option> <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option> <option name="charting.axisTitleX.visibility">visible</option> <option name="charting.axisTitleY.visibility">visible</option> <option name="charting.axisTitleY2.visibility">visible</option> <option name="charting.axisX.abbreviation">none</option> <option name="charting.axisX.scale">linear</option> <option name="charting.axisY.abbreviation">none</option> <option name="charting.axisY.scale">linear</option> <option name="charting.axisY2.abbreviation">none</option> <option name="charting.axisY2.enabled">0</option> <option name="charting.axisY2.scale">inherit</option> <option name="charting.chart">column</option> <option name="charting.chart.bubbleMaximumSize">50</option> <option name="charting.chart.bubbleMinimumSize">10</option> <option name="charting.chart.bubbleSizeBy">area</option> <option name="charting.chart.nullValueMode">gaps</option> <option name="charting.chart.showDataLabels">none</option> <option name="charting.chart.sliceCollapsingThreshold">0.01</option> <option name="charting.chart.stackMode">stacked</option> <option name="charting.chart.style">shiny</option> <option name="charting.drilldown">all</option> <option name="charting.layout.splitSeries">0</option> <option name="charting.layout.splitSeries.allowIndependentYRanges">0</option> <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option> <option name="charting.legend.mode">standard</option> <option name="charting.legend.placement">right</option> <option name="charting.lineWidth">2</option> <option name="trellis.enabled">0</option> <option name="trellis.scales.shared">1</option> <option name="trellis.size">medium</option> <drilldown> <set token="user">$row.user$</set> <set token="CV">$click.value$</set> <set token="CN">$click.name$</set> <set token="CV2">$click.value2$</set> <set token="CN2">$click.name2$</set> </drilldown> </chart> <html depends="$CV$"> <h2>CV=$CV$</h2> <h2>CN=$CN$</h2> <h2>CV2=$CV2$</h2> <h2>CN2=$CN2$</h2> <h2>User=$user$</h2> </html> </panel> </row>

bowesmana · ‎10-04-2023

That is really interesting and you are right - I tried these variants C:\Windows\system32\cmd.exe /d /c C:\ProgramData\Symantec\Symantec Endpoint Protection\14.3.8289.5000.105\Data\Definitions\WebExtDefs\20230830.063\webextbridge.exe* C:\Windows\system32\cmd.exe /d /c C:\ProgramData\Symantec\Symantec Endpoint Protection\14.3.8* C:\Windows\system32\cmd.exe /d /c C:\ProgramData\Symantec\Symantec Endpoint Protection\*\webextbridge.exe* and the top two do not work, the last does. If I make the second one end in 14.3.* then it DOES work. Not sure what's going on there,

bowesmana · ‎10-04-2023

You would either have to include that subsearch part as an OR in the outer search and munge the data so you could join the data sets with stats somehow, or create a lookup through a saved search on a regular basis (if it changes) and use the lookup to filter rather than the subsearch, then you'd have anything you need

bowesmana · ‎10-04-2023

It's not confusing, it should work if configured correctly. So having changed the <condition>, what does it do when you click google? What is the config for your <option name="drilldown">XXX</option> for that table? XXX should be row

bowesmana · ‎10-04-2023

@Naa_Win In your drilldown code do <condition field="Organization"> <link target="_blank">$row.URL$</link> </condition> Note that if you want to add any characters to the URL or url string that must be encoded, use $row.URL|s$ or if you want to prevent any character encoding use $row.URL|n$ If you also want to do the same if the URL field is clicked, add a new condition with the field=URL

bowesmana · ‎10-04-2023

Please refer to my first post - these are the tokens that represent the attributes of your chart for when you click on the chart. Your stats statement will NOT show the clicked values because it's an incorrect statement. What is your HTML panel and what are you seeing when you click values and what are you expecting to see. Please show the XML for your drilldown and HTML panel.

bowesmana · ‎10-04-2023

This probably means that they are defined as automatic lookups, so will always be executed if the matching conditions are true for that lookup definition, e.g. it is the correct sourcetype. The fact that it is failing could be that you don't have permissions to see some part of the lookup or that the lookup is not present and the definition is trying to refer to a non existent lookup, or that the automatic lookup definition is wrong. For example you can cause this problem by creating a field in the automatic lookup that does not exist in the lookup file and you will get this message. Do you have a Splunk sys admin - they should look at this to find out what is wrong with the automatic lookup.

bowesmana · ‎10-04-2023

You CAN actually do conditional lookup, as long as your lookup is a CSV https://docs.splunk.com/Documentation/Splunk/9.1.1/SearchReference/ConditionalFunctions#lookup.28.26lt.3Blookup_table.26gt.3B.2C.26lt.3Bjson_object.26gt.3B.2C.26lt.3Bjson_array.26gt.3B.29 I don't think it's very commonly used, but works well ... search... | eval output=if(field1!=field2, lookup("mylookup.csv", json_object("department", field2), json_array("output_field1","output_field2")), "{}") You will get back a field output with a JSON representation of the output fields listed in the JSON array

bowesmana · ‎10-03-2023

suorce key is the field name, change _raw to log. You don't need the format, as you have specified the field names in the extraction string Note that the existing JSON needs to be auto extracted, which means that it has to have been set up to do so. It's easy to see just do index=x and look down the left hand side of the display in verbose mode to see if the 'log' field is shown as a field.

bowesmana · ‎10-03-2023

Why do you need them in one token. You will not be able to search for AA-1* without picking up the AA-10, so if you have a token that is base_id, which contain AA-1, which you search for, i.e. system_id=$base_token$* and then a second token with AA-1($|-) and do a regex, e.g. | regex system_id="$regex_token$"

bowesmana · ‎10-03-2023

You have lots of unnecessary fieldformat statements. I would suggest index=Prod123 methodType='WITHDRAW' currency='GBP' jurisdiction=UK transactionAmount>=3 | search transactionAmount=* | bin span=20s _time | stats list(transactionAmount) as Total, list(currency) as currency, dc(customerId) as Users by _time | where Users>=2 | eval diff=tonumber(mvindex(Total, 0)) - tonumber(mvindex(Total, 1)) | sort - _time you don't need list(_time) as Time because it will contain the same values as your split by _time field as you a binning _time You don't need fieldformat for _time as that is how _time is already displayed.

bowesmana · ‎10-03-2023

Splunk does not support regex patterns in lookups, ONLY wildcards, i.e. *, so your escaped . characters and \ characters should not be in the lookup. Your pattern is a bit odd in that it has C:\\Windows\\system32\\cmd\.exe*C:\\P... where the * in that, if it is a regex, is saying you need to repeat the preceding 'e' character 0 or more times. If your process field contains C:\Windows\system32\cmd.exe ... then that should be the entry in the lookup and in the lookup entry you add * characters where you want to match any character in the data. That * wildcarding is all that is supported in lookups.

bowesmana · ‎10-03-2023

You want to create a transforms entry that has something along the lines of trace_id=\\\\\"(?<trace_id>\w+)\\\\\" event=\\\\\"(?<event>[^\\\\\"]*)\\\\\" program_run_sec=(?<program_run_sec>[\d\.]*) status=\\\\\"(?<status>\w+) using the source field log, which must have already been extracted. Then create a field extraction using that transforms entry against the sourcetype for this data. Then you will get the 4 fields wanted automatically in your data.

bowesmana · ‎10-03-2023

I believe the app supports urifield as well as uri=, so just make | eval uri="https://api.shodan.io/shodan/host/".clientIP."?key=APIKEY" | curl urifield=uri...

bowesmana · ‎10-02-2023

@anissabnk so do you have ONE of each libelle per event, if so then how do you define response time - is it the TIME of the event, so BT time is OUT time - IN time and is there only a SINGLE one of each libelle per flux? Try something like this index="bloc1rg" AND libelle IN (IN_PREC, OUT_PREC, IN_BT, OUT_BT, IN_RANG, OUT_RANG) earliest=-1mon@mon latest=-1d@d | stats max(eval(if(libelle="IN_PREC", _time, null()))) as IN_PREC_TIME max(eval(if(libelle="OUT_PREC", _time, null()))) as OUT_PREC_TIME max(eval(if(libelle="IN_BT", _time, null()))) as IN_BT_TIME max(eval(if(libelle="OUT_BT", _time, null()))) as OUT_BT_TIME max(eval(if(libelle="IN_RANG", _time, null()))) as IN_RANG_TIME max(eval(if(libelle="OUT_RANG", _time, null()))) as OUT_RANG_TIME by id_flux | eval response=(OUT_PREC_TIME-IN_PREC_TIME) + (OUT_BT_TIME-IN_BT_TIME) + (OUT_RANG_TIME-IN_RANG_TIME) | fields - *_TIME so you are collecting all the event times for each of the event types by flux id and then just calculating the response time at the end.

bowesmana · ‎10-02-2023

Use a change stanza in the input, e.g. <input type="text" token="pre_domain"> ... <change> <eval token="actual_domain">replace($pre_domain$,"\\[\\.\\]",".")</eval> </change> </input>

bowesmana · ‎10-02-2023

Have you tried any of the eval json functions https://docs.splunk.com/Documentation/Splunk/9.1.1/SearchReference/JSONFunctions json_extract or json_array_to_mv?

bowesmana · ‎09-28-2023

If your _raw string has multi line events, then this rex statement will create a new field with the first 10 lines into a new field called display | rex "(?<didplay>((?m)^.*$\n){10})"

bowesmana · ‎09-28-2023

So, the regex for the Test extraction is the first part of the message up to a % value, so use this, so it looks for one or more numbers before the %) | rex field=Message "(?<Test>.*\d+%\))" As for making them Field extractions, just define them in the field extractions/transforms section of the Fields menu - I think you will have to use 2 extractions as the Test is a subset of the Message, so will require a transform, unless you make 2 regexes to extract first 3 fields then just the Test field

bowesmana · ‎09-28-2023

Here is an example to get Fruit Timestamp and Message | makeresults | eval _raw="[August 28, 2023 7:22:45 PM EDT] APPLE Interface IF-abcef23fw2/31 [WAN14] Disabled (100%) Designate that a disabled port or surface is the root cause. This event can be circumvent by setting the SuppressDisabledAlerts to FALSE." | rex "^\[(?<Timestamp>[^\]]*)\] (?<Fruit>\w+)\s+(?<Message>.*)" it's impossible - without knowing more - to extract Test from Message You could do this | rex field=Message "(?<Test>.*100%\))" but all that is doing is saying that Test will be extracted up to a string ending in 100%) Does Test have any definining characteristics?

bowesmana · ‎09-28-2023

The double colon :: refers to an indexed field so if the field is NOT indexed, it will not find it. If you run this search index=_audit sourcetype=audittrail | stats count by sourcetype and then insect the job and look at the search log, you will see something called LISPY 09-29-2023 10:26:38.508 INFO UnifiedSearch [3846 searchOrchestrator] - base lispy: [ AND index::_audit sourcetype::audittrail ] where is knows that index and sourcetype are indexed fields and so replaces them with the :: syntax. So, if you KNOW your field is indexed, then using :: will force Splunk to look at the indexed rather than raw data for the results.

Posts	3493
Solutions	752
Karma Given	301
Karma Received	1361
Member Since	‎09-05-2011

Online Status	Offline
Date Last Visited	yesterday

Windows TA not extracting key_path as registry_pat...

Why does FIELDALIAS work or doesn't depending on t...

How can I write this regex for rex to extract mult...

How to rename fields in a table without changing c...

Why doesn't drilldown eval token statement work un...

Performance fields/stats/table

Infoblox TA not extracting response code

Is there any way to create CSS that can be dynamic...

How to break up groups of <input> elements onto th...

tokenlinks.js in Splunk 8.24 broken- working dashb...

Re: Data Visualisation Advice: Representing a Rang...

Re: time chart to show the number of widgets manu...

Re: Splunk search for range of characters

Re: Getting different result when do search query ...

Re: How to capture x,y data from stacked charts fo...

Re: Lookup doesn't work with wildcard within strin...

Re: Moving fields from a subsearch

Re: Multiple drilldowns

Re: Multiple drilldowns

Re: How to capture x,y data from stacked charts fo...

Re: help on could not load lookup message

Re: What's the best way to only do a Lookup based ...

Re: How to set up an automatic way - sourcetype to...

Re: search help, token

Re: Possible to find different of two amounts from...

Re: Lookup doesn't work with wildcard within strin...

Re: How to set up an automatic way - sourcetype to...

Re: Extracting nested JSON from TA-WebTools curl r...

Re: Eval case statement

Re: How to modify a dashboard input token before p...

Re: Extracting nested JSON from TA-WebTools curl r...

Re: How to display the 1st 10 lines in events

Re: How to extract fields from _raw event?

Re: How to extract fields from _raw event?

Re: what are the benefits vs drawback in :: and =

Join the Conversation