Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- About elliotproebstel
elliotproebstel
Champion
Member since:
10-12-2017
02-15-2021
Community Statistics
| Posts | 881 |
| Solutions | 206 |
| Karma Given | 82 |
| Karma Received | 367 |
| Member Since | 10-12-2017 |
Activity Feed
- Got Karma for Re: Understanding the LOOKUP command. 12-06-2023 11:23 AM
- Got Karma for Re: License usage for one index broken down by sourcetype. 12-06-2023 05:56 AM
- Got Karma for Re: Pass value to another search. 11-04-2023 05:50 AM
- Got Karma for Re: How to display a custom field with underscore from search result. 10-30-2023 03:46 AM
- Got Karma for Re: I am using a lookup table and I only want the results that have a match in the look up table.. 09-07-2023 06:29 AM
- Got Karma for Re: how to edit the title after alert saved?. 05-24-2023 02:12 AM
- Got Karma for Re: SavedSplunker - Max alive instance count=1 reached for saved search_id. 04-07-2023 12:54 AM
- Got Karma for Re: how to edit the title after alert saved?. 03-31-2023 09:36 AM
- Got Karma for Re: Is it possible to do a lookup based on IF statement?. 01-31-2023 06:35 PM
- Got Karma for Re: Can we categorize the into fields based on the value of the field?. 01-30-2023 03:14 AM
- Got Karma for Re: Drop Down based on radio button selection. 01-15-2023 11:53 PM
- Got Karma for Re: disable the all the alert?. 11-21-2022 01:59 AM
- Got Karma for Re: I am using a lookup table and I only want the results that have a match in the look up table.. 08-19-2022 04:50 AM
- Got Karma for Re: how to edit the title after alert saved?. 07-07-2022 12:18 PM
- Got Karma for Re: Is it possible to create Time chart with search with base search?. 05-11-2022 11:30 AM
- Got Karma for Re: how to get the list of non matching values of lookup with search?. 04-27-2022 11:54 AM
- Got Karma for Re: How do I parse one large comma-delimited field into multiple fields with numbered names?. 02-17-2022 03:12 PM
- Got Karma for Re: Dashboard - Base Search not returning results into panel. 02-03-2022 06:43 AM
- Got Karma for Re: Eval field based on multiple fields?. 02-03-2022 06:37 AM
- Got Karma for Re: Understanding the LOOKUP command. 02-01-2022 11:17 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 1 |
04-19-2018
08:04 AM
It's possible to take the approach you're suggesting, but it's certainly not the recommended route. If you combine all these configuration files together and later decide you no longer need the settings from a given app, you'll have to do all the work of manually finding which settings came from that app and remove them. You'll lose the traceability that allows you to answer questions like, "Why is this extraction here in the first place? What purpose does it serve?"
But moreover, you will lose the ability to update an add-on in a straightforward manner. The modularity of Splunk add-ons is a feature, not a bug. It may seem early on that you would benefit from having one single inputs.conf file that rules them all (insert Lord of the Rings reference here), but trust me - you will be in far better shape six months from now if you maintain the usual app/add-on structure and distribute apps as bundles rather than appending little bits and pieces here and there.
That said - if you are finding that you only need one extraction here, another single input specification from there, etc...you can definitely pull the bits you like and put them together. I just don't think you'll get as much benefit as you expect from doing this wholesale across many add-ons.
... View more
04-19-2018
07:58 AM
If I understand your data and needs correctly, I think this might get you there:
index=a (sourcetype=asset vulnerabilities>0) OR (sourcetype=vuln ip)
| stats values(host) AS host values(user) AS user values(cve) AS cve BY ip
If that doesn't work, can you share some sample events from each sourcetype and how you'd like them combined (what you'd like the final result to look like)?
... View more
04-19-2018
07:22 AM
Give this a shot:
search sourcetype=apache "/apps/public/client1/local/" OR "/apps/public/v4/client1/local/"
| rex "\/apps\/public(\/v4)?\/(?<client>[^\/]+)\/(?<region>[^\/]+)"
This should ignore v4 if present but still allow it to work on URLs that do not contain v4. If you need it more generic, please share some examples where it fails, and I can help you iterate.
... View more
04-19-2018
07:16 AM
It sounds like your event might have more data after the account number(s). Can you paste a full sample event, so that we can help you figure out how to extract all account numbers but not the text after the accounts?
... View more
04-19-2018
06:00 AM
The commands are executing in order. After the table command on line 11, you have a table with three columns/fields: id , action , and message . The next command is this:
| streamstats window=1 current=false last(activeids) as activeids_prev
But that's asking streamstats to act on a field called activeids , which does not yet exist.
... View more
04-19-2018
05:29 AM
As I posted in a comment above, it seems like the correct solution is probably in modifying the TTL for the alert, but even then - you'll be specifying some period of time during which the search artifacts will continue to live, and after that, they will be gone. If you want a bit of a workaround that's not super clean but will give your alert an indefinite lifetime, you could pass the tokens: $result.info_min_time$ and $result.info_max_time$ into the alert body. Those will come through as epoch strings. As @damien_chillet mentioned above, this will also mean that your search results will all have four fields that they didn't have before we started all this: info_min_time , info_max_time , info_sid (the search ID assigned by Splunk), and info_search_time (the time, in epoch value, at which the search was run). To use the epoch strings to re-run the search, you can either add them directly into the SPL ( earliest=1524052800 latest=1524140780 , for example) or you can paste them into the "Advanced" section in the time picker dropdown.
... View more
04-19-2018
05:17 AM
My thinking in using addinfo was based on experience with drilldowns where I was able to directly pass the info_min_time and info_max_time through a drilldown to dynamically create a new search running in the same time window. It was meant as a workaround to allow the user to re-run the same search at an arbitrary time in the future, as requested.
That said, I honestly can't get that approach to the finish line. I can pass those time values through an alert but can't seem to assemble a full search URL with the tokens available to an alert.
This post from 2016 seems to suggest the solution will lie in editing the TTL for the alert:
https://answers.splunk.com/answers/440040/saving-alert-artifacts-for-longer-periods-of-time.html
Unfortunately, at this moment, I can't seem to get any pages from Splunk Docs to load, so I can't provide any updated official guidance.
... View more
04-18-2018
10:32 AM
1 Karma
I think this should work for you:
your current search
| join type=outer managerID
[ your current search
| fields employeeID employeeName
| rename employeeName AS managerName
| rename employeeID AS managerID ]
... View more
04-18-2018
10:09 AM
Sure! This isn't a Splunk thing per se, but rather more about how to post your question here. It looks like part of your rex command is getting eaten up by the formatting here, so it's hard to diagnose.
When you post code, it's best to click the button that looks like 101010 so that your code can be escaped and all characters preserved. If you can't find that button, you can use a single backtick (the character at the top left of your keyboard, on the same key as the ~ tilde) before and after your code.
... View more
04-18-2018
09:57 AM
Try using the code 101010 button or wrapping your rex command with backticks.
... View more
04-18-2018
09:54 AM
Can you edit this and wrap the middle two lines with the code button (or single backticks, if you can't get the code button to work for you)? The formatter is eating some of your rex, which makes it harder to diagnose!
... View more
04-18-2018
09:51 AM
This should give you what you are looking for:
your base search
| rex field=_raw "(?<email_address>[^\/]+%40[^\/]+)"
| eval email_address=urldecode(email_address)
The rex looks for anything between slashes that contains the urlencoded @ sign: %40 and then the urldecode function will translate that into a usable email address.
... View more
04-18-2018
08:48 AM
The saved results will expire shortly, since the alert is only looking back over 5 mins. I think the expected lifetime of a search like that is twice the interval over which it runs.
... View more
04-18-2018
07:14 AM
1 Karma
You can add the command addinfo to your search to get the timespan over which the search was run. It'll be like this:
your current search
| addinfo
The fields you'll pass to the alert are info_min_time (the "earliest" time in the alert search) and info_max_time (the "latest" time in the alert search). These will be epoch times, so you can pass them around without worrying about relative time functions that are no longer relevant by the time you review them. Here's some guidance about addinfo:
https://docs.splunk.com/Documentation/Splunk/7.0.3/SearchReference/Addinfo
... View more
04-18-2018
07:08 AM
Try replacing the hyphen with an underscore. It's not good practice to assign a field name in Splunk with a hyphen anyway. Do this instead:
index = bcoat
| head 1
| rex field=_raw "(?<c_ip>\d+.\d+.\d+.\d+)"
... View more
04-18-2018
06:04 AM
Can you edit your post and wrap code and regex snippets with the code 101010 button or single backticks on each side? Some of the important part is getting eaten by syntax filters right now.
... View more
04-17-2018
07:48 PM
Hmm, in that case, can you share the query you're using in the drilldown panel? Does it use a token that might not be getting set?
... View more
04-17-2018
07:22 PM
Also - you have put all of that inside a <condition> element with no actual condition defined. I think that's likely your biggest problem. You need to either define a triggering condition or just wrap that in a drilldown with no condition.
... View more
04-17-2018
07:20 PM
Are you intentionally using $row.StartTime$ for both Start and End time? In your XML, you appear to be using that for both, with no modification (beyond parsing with strptime).
... View more
04-17-2018
07:06 PM
Hi Amir, I think the reason your first two searches were not returning anything at all while that last search returns something has to do with the time window, not just the changed query. I see that the values for name and usb_key are not the same, so good change with not renaming name to usb_key - but the fact that you were getting no results at all before either means the search wasn't running (which is honestly what the picture seems to show) or maybe the search was timing out because you were running a transaction command over a 7 day window, which is really hard for Splunk to handle.
... View more
04-17-2018
06:55 PM
1 Karma
So that you can close this out, I'll post this as an answer:
That very much reads like a permissions problem. Try running Splunk as an admin-level user. That should give you permissions to read and write the appropriate files.
... View more
04-17-2018
11:47 AM
1 Karma
Sorry, but that's an accurate error message. Trellis layout does not support PDF export. If you want PDF export, you'll have to refactor the dashboard to not use trellis.
... View more
04-17-2018
11:08 AM
1 Karma
That very much reads like a permissions problem. Using the account from which you tried to start Splunk, can you access those files?
C:\Program Files\Splunk\var\log\splunk\splunkd-utility.log
C:\Program Files\Splunk\etc\auth\splunk.secret
... View more
04-17-2018
10:39 AM
2 Karma
Your base search needs to be wrapped with <search id="baseSearchC"> at the beginning and </search> at the end. Additionally, a post-processed search is only meant to be used with a base search that has a transforming command. Unless there's a lot more to this dashboard, there's no good reason to use a base search and post-process here. If there are other panels, perhaps you can share their searches, and we can help you optimize? If you really want to use a base/post-process search structure here, you'll need to reference the AccountId field in your base search, or else the post-process search won't have access to it. So you could make your base search something like this:
index=a-index* sourcetype="a-srctype"
| fields AccountId
But really, unless you have other panels that need this base search shared, you should combine the base and post-process into a single search in your panel.
... View more
04-17-2018
07:25 AM
Gotcha. In that case, what I've proposed should work for you - with the caveat that the rex you posted is invalid. I'm guessing it might need to be this:
| rex field=_raw "DisplayName=(?<Name>\w.*)$"
... View more
