About willadams

willadams · ‎10-20-2020

I have the following props and confs which works fine and does what I need it to do. PROPS [mydata_logs] LINE_BREAKER = ([\r\n]+) SHOULD_LINEMERGE = true NO_BINARY_CHECK = true TIME_PREFIX = ^ TIME_FORMAT = %Y-%m-%d %H:%M:%S MAX_TIMESTAMP_LOOKAHEAD = 20 TRANSFORMS-set = setnull,keptevents TRANSFORMS [setnull] REGEX = . DEST_KEY = queue FORMAT = nullQueue [keptevents] REGEX = ^.+INFO: DEST_KEY = queue FORMAT = myindex This leaves me with events in my log such as follows 2020-10-02 17:01:32,360 INFO: User.val (value, value2, value3, value4): User not found. Parameters: myid: 1; orig: userKO: userId: 1234567 2020-10-02 17:09:48,123 INFO: Helper.loadObjects(): Username does not exist. mystique 2020-10-02 18:01:48,546 INFO: CleanupProcess.executeHelper(): Running cleanup process for Silly 1.2.3.4000 ... What I am trying to do from the left over logs is to remove the lines that are system events. In the above example I want to remove the events that read 2020-10-02 17:09:48,123 INFO: Helper.loadObjects(): Username does not exist. mystique 2020-10-02 18:01:48,546 INFO: CleanupProcess.executeHelper(): Running cleanup process for Silly 1.2.3.4000 ... This should leave me with the following event making it to my index 2020-10-02 17:01:32,360 INFO: User.val (value, value2, value3, value4): User not found. Parameters: myid: 1; orig: userKO: userId: 1234567 Through REGEX (and using the CleanupProcess.executeHelper as an example) - ^CleanupProcess.+ would target that line so I could regex it out but I need help on how I construct the props / transforms to do this. This is the props and transforms adjusted (I tried changing order so that "keptevents" was directly after the first null (i.e. setnull) or at the end (ensuring that props reflected the order). UPDATED PROPS [mydata_logs] LINE_BREAKER = ([\r\n]+) SHOULD_LINEMERGE = true NO_BINARY_CHECK = true TIME_PREFIX = ^ TIME_FORMAT = %Y-%m-%d %H:%M:%S MAX_TIMESTAMP_LOOKAHEAD = 20 TRANSFORMS-set = setnull,keptevents,cleanupprocess_filter,helper_filter UPDATED TRANSFORMS [setnull] REGEX = . DEST_KEY = queue FORMAT = nullQueue [cleanupprocess_filter] REGEX = ^CleanupProcess.+ DEST_KEY = queue FORMAT = nullQueue [helper_filter] REGEX = ^Helper.+ DEST_KEY = queue FORMAT = nullQueue [keptevents] REGEX = ^.+INFO: DEST_KEY = queue FORMAT = myindex The above is an example as there are more filters I need to apply as I work through my data set. Unfortunately I have no way on the syslog instance to isolate these logs at the source. Thanks in advance

willadams · ‎10-19-2020

Thanks @gcusello. I just have to fiddle with seperate nulls but almost there. If need be will log another community question if need be.

willadams · ‎10-16-2020

Hi @gcusello Thanks it was a good puzzle to solve. The exclusion was as per the latter comments (exclude other events like Cleanup process). It didn't occur to me to just re-use the null with the REGEX to remove that content. I will give it another crack and see how that goes. Thanks!

willadams · ‎10-15-2020

I have been able to filter some of the events and at least it looks like I am going in the right direction. Adding back for the question, this is what I have done so far: PROPS [silly_logs] LINE_BREAKER = ([\r\n]+) SHOULD_LINEMERGE = true NO_BINARY_CHECK = true TIME_PREFIX = ^ TIME_FORMAT = %Y-%m-%d %H:%M:%S MAX_TIMESTAMP_LOOKAHEAD = 20 TRANSFORMS-set = setnull,kept_logs TRANSFORMS [setnull] REGEX = . DEST_KEY = queue FORMAT = nullQueue [kept_logs] REGEX = ^.+INFO: DEST_KEY = queue FORMAT = silly_index This has been able to get rid of all the stuff I don't want and just get the INFO logs. The biggest problem I have now is to try and remove other INFO fields that are not useful and also do some DELIM's. I tried adding a FIELD_DELIMITER=: to PROPS but this didn't seem to do anything. I also tried adding to props a "REPORT-extract=myextract" and the associated transforms stanza (i.e. [myextract] DELIMS=: This didn't work and I am stuck. My log now shows as follows 2020-10-02 17:01:32,360 INFO: User.val (value, value2, value3, value4): User not found. Parameters: userId: 1; requester: userVO: userId: 66666 status: V username: joe.blogs@someplace.com authenticationMethod: PASSWORD emailAddress: joe.blogs@someplace.com firstName: Joe middleName: lastName: Bloggs displayName: Joe Blogs createdBy: 123456 dateCreated: 2019-07-02 17:17:29.68 lastUpdatedBy: 66666 dateLastUpdated: 2020-07-20 16:49:30.409 signupCompletedDate: 2019-07-03 14:24:52.389 lastSignInDate: 2020-10-01 19:04:21.787 title: Person company: Somewhere addressLine1: 1 This Street addressLine2: city: Somewhere state: ST1 zipCode: 1234 country: ThatCountry workPhoneNumber: homePhoneNumber: +001122334455 mobilePhoneNumber: otherPhoneNumber: faxNumber: secretQuestions: [] signInLocked: false signInFailureCount: 0 signInTotalFailureCount: 0 signInLastFailureDate: <null> resetPasswordFailureCount: 0 resetPasswordTotalFailureCount: 0 resetPasswordLastFailureDate: <null> recipientInclusionList: recipientExclusionList: allowSMTPInput: false lastPasswordResetDate: 2019-08-20 15:06:00.856 passwordExpires: true forcePasswordReset: false externalUser: false lastSignInUserName: joe.blogs@someplace.com lastSignInDomain: activationCode: expiryDate: <null> expiredOn: <null> lastActivityDate: 2020-10-01 19:07:12.088 autoUnlockCount: 0 manualUnlockRequired: false selfRegIPAddress: 192.168.0.1 senderRoleExpired: false externalUser: false channelType: Web ipAddress: 10.1.1.1 As well as 2020-10-02 17:06:48,123 INFO: Helper.word(): Purging range: (123456, 123654) And 2020-10-02 17:09:48,123 INFO: Helper.loadObjects(): Username does not exist. mystique 2020-10-02 18:01:48,546 INFO: CleanupProcess.executeHelper(): Running cleanup process for Silly 1.2.3.4000 ... I want to be able to adjust my PROPS to remove the items with "CleanUpProcess" or "Purging Range" but keep the valid data as well as the "Helper.loadObjects(): Username does not exist..." values. I also want to be able to extrac the fields from the event based on ":" but also going back to the main log ignore the other fields that contain dates in them (i.e. "lastPasswordResetDate: 2019-08-20 5:06:00.856", "dateLastUpdated: 2020-07-20 16:49:30.409", "signupCompletedDate: 2019-07-03 14:24:52.389", "lastSignInDate: 2020-10-01 19:04:21.787". I suspect I would need to extract the date fields specifically (maybe using REX) and maybe strptime them to get around the ":" delim problem that this may cause (once the DELIM is sorted). Any help appreciated

willadams · ‎10-15-2020

I have an annoying log that I am trying to extract data from and I am lost and don't know where to go from here. What I am trying to extract is as follows 2020-10-02 17:01:32,360 INFO: User.val (value, value2, value3, value4): User not found. Parameters: userId: 1; requester: userVO: userId: 66666 status: V username: joe.blogs@someplace.com authenticationMethod: PASSWORD emailAddress: joe.blogs@someplace.com firstName: Joe middleName: lastName: Bloggs displayName: Joe Blogs createdBy: 123456 dateCreated: 2019-07-02 17:17:29.68 lastUpdatedBy: 66666 dateLastUpdated: 2020-07-20 16:49:30.409 signupCompletedDate: 2019-07-03 14:24:52.389 lastSignInDate: 2020-10-01 19:04:21.787 title: Person company: Somewhere addressLine1: 1 This Street addressLine2: city: Somewhere state: ST1 zipCode: 1234 country: ThatCountry workPhoneNumber: homePhoneNumber: +001122334455 mobilePhoneNumber: otherPhoneNumber: faxNumber: secretQuestions: [] signInLocked: false signInFailureCount: 0 signInTotalFailureCount: 0 signInLastFailureDate: <null> resetPasswordFailureCount: 0 resetPasswordTotalFailureCount: 0 resetPasswordLastFailureDate: <null> recipientInclusionList: recipientExclusionList: allowSMTPInput: false lastPasswordResetDate: 2019-08-20 15:06:00.856 passwordExpires: true forcePasswordReset: false externalUser: false lastSignInUserName: joe.blogs@someplace.com lastSignInDomain: activationCode: expiryDate: <null> expiredOn: <null> lastActivityDate: 2020-10-01 19:07:12.088 autoUnlockCount: 0 manualUnlockRequired: false selfRegIPAddress: 192.168.0.1 senderRoleExpired: false externalUser: false channelType: Web ipAddress: 10.1.1.1 The first line is the current date (i.e. 2020-10-02 17:01:32,360 INFO: ) and this would used for my indexed time. Between this user event and the next user event, the log is interspersed with the following garbage 2020-10-02 16:59:36,409 ERROR: Mail.send(): (Task ID: x4) Error while sending message: javax.mail.SendFailedException: Invalid Addresses; nested exception is: com.sun.mail.smtp.SMTPAddressFailedException: 501 5.1.3 Invalid address javax.mail.SendFailedException: Invalid Addresses; nested exception is: com.sun.mail.smtp.SMTPAddressFailedException: 501 5.1.3 Invalid address at com.sun.mail.rcptTo(SMTPTransport.java:1862) at com.sun.mail.sendMessage(SMTPTransport.java:1118) at com.neesh.util.Mail.send(Unknown Source) at com.neesh.fds.util.EmailHelper.sendEmail(Unknown Source) at com.neesh.fds.core.MailSenderProcess.sendEmail(Unknown Source) at com.neesh.fds.core.MailSenderProcess.executeHelper(Unknown Source) at com.neesh.fds.core.AbstractFDSProcess.execute(Unknown Source) at com.neesh.fds.core.AbstractFDSProcess.startup(Unknown Source) at com.neesh.fds.core.MailSenderProcess.startup(Unknown Source) at com.neesh.fds.core.FDSProcessThread.run(Unknown Source) Caused by: com.sun.mail.smtp.SMTPAddressFailedException: 501 5.1.3 Invalid address at com.sun.mail.smtp.SMTPTransport.rcptTo(SMTPTransport.java:1715) ... 9 more 2020-10-02 16:59:36,409 WARN: Mail.send(): (Task ID: x4) Exiting send() with error code: -2 2020-10-02 16:59:36,409 ERROR: MailSenderProcess.executeHelper(): Invalid Addresses I started with adding data in and then using the Advanced configuration to try and break this up starting with BREAK_ONLY_BEFORE_DATE set as true and this starts to break the log but then (as expected) breaks at every date. So the log then breaks up at every field that has a date (e.g. lastSignInDate, dateCreated, etc.). The problem here is that the timestamp then gets impacted as it will read the time properly and my indexing for that specific break with be all over the place instead of the first time (i.e. 2020-10-02 17:01:32) What I would like to do is capture everything between "2020-10-02 17:01:32,360 INFO:" and "ipAddress: 10.1.1.1" (using the example above). The log is a rolling log so it is constantly being written to. I would also like to get rid of the garbage but have not tried doing NULLs to remove events before ingest. There is no recognised sourcetype nor does the product have any TA's in SPLUNK Base so I am trying to effectively create a new TA for this data source. Thankyou for any assistance.

willadams · ‎09-14-2020

I will give a shot but I have to do the replace first before the rex.

willadams · ‎09-14-2020

{"log_message";"{\"version\":\"1.00000\",\"account_id\":\"12345678\",\"region\":\"myarea\",\" and so on until this blocks ends with }}". The remainder of the log after this is parsed appropriately "log_group":"/logs","log_location":"mylogs","account_information":"38430495"} for example.

willadams · ‎09-14-2020

I have a JSON file with an embedded JSON field that I am trying to extract. I have been doing some searching and have finally come up with an SPL search that will extract the information into my relevant key pairs. The SPL is basically index=foo sourcetype=foosource | eval log_message=replace(log_message, "\\\"\"","") | rex "log_message\\\\\":\\\\\"(?<log_message>[^\\\]+)" | spath input=log_message I have also read that I shouldn't need the spath however if I remove this from my SPL then it doesn't extract as required. I would like to put this into transforms but unsure how to apply the "spath". Thoughts around my props/transforms so far is: props.conf REPORT-logmessage = log_message transforms.conf [log_message] INGEST_EVAL = eval_log_message=replace(log_message=replace(log_message, "\\\"\"","") REX = "log_message\\\\\":\\\\\"(?<log_message>[^\\\]+)"

willadams · ‎09-09-2020

I am using the SPLUNK time picker and have this set at 24 hours. I also substituted the time picker with an explicit "earliest=-24h latest=now" in the SPL and still takes a long time. The run time is 132 seconds (just over 2 minutes). The search without To return the results almost immediately I still have to add that secondary constraint in the second index (i.e. machine_name=mysrv1). The run time when adding this additional constraint is 2.2 seconds. One potential workaround I am thinking may be useful is to seperate my search and basically (particularly from a dashboard view) Do my first search and output to a CSV using an outputlookup Then run my second search against the CSV

willadams · ‎09-08-2020

I ran this but found that the search takes a phenomenal time. To reduce the search time I ended up adjusting as follows (index=assets host_name=mysrv1) OR (index=software machine_name=mysrv1) | eval host_name=coalesce(host_name,machine_name) | eventstats dc(index) as dc_index by host_name | where dc_index=2 | stats values(sw_installed) as sw_installed by host_name | eval jobinstalled=if(match(sw_installed,"jobsw"),"Yes","No") | table host_name,jobinstalled This means that the search takes almost no-time to run (I get a result almost instantly). However without the second "machine_name=mysrv1", the search takes a good couple of minutes. I am intending to put this in a dashboard where someone uses a pick list to select a "parent" which will show related children and then have this generate relevant tables. The problem is the time between someone selecting it and it running executing. I might try and see if I can possibly token the pick list and add this to the code somehow.

willadams · ‎09-08-2020

I have 2 large data sets Data Set 1 (Assets) contains information about devices. For example the dataset will have the following fields hostname ipaddress status parent Data Set 2 (Software) contains software installed for those devices (I did a check on the number of events and there is somewhere around 4.5 million events returned over a 24h window). For example the dataset will have the following fields machine_name sw_installed installed_date What I am working on is to join these 2 data sets based on the machine_name / host name. I am then specifically looking for specific software and doing a match if found. A simple join here would be something like (the following example shows 1 eval, but this could conceivably be 2,3 or more depending on the requirement) index=assets | dedup host_name | rename host_name AS machine_name | join machine_name [search index=software | fields matchine_name sw_installed] | eval jobinstalled=if(match(sw_installed,"jobsw"),"Yes","No") | table machine_name jobinstalled If I then change this search to be a little more specific index=assets host_name=mysrv1 | dedup host_name | rename host_name AS machine_name | join machine_name [search index=software | fields matchine_name sw_installed] | eval jobinstalled=if(match(sw_installed,"jobsw"),"Yes","No") | table machine_name jobinstalled I get maybe 1 result or maybe a couple of nothing at all. I know the reason why and this is due to hitting the maximum of 50000 returned events in my subsearch (the finished job drop down shows subsearch produced 50000 results truncating to maxout 50000. If I configure with a max=0 I run into the similar problem and again my results are skewed index=assets host_name=mysrv1 | dedup host_name | rename host_name AS machine_name | join machine_name max=0 [search index=software | fields matchine_name sw_installed] | eval jobinstalled=if(match(sw_installed,"jobsw"),"Yes","No") | table machine_name jobinstalled If I write the following SPL index=software machine_name=mysrv1 | dedup sw_installed | table sw_installed machine_name that search will produce for example 90 events for the software installed on the server. If I run the following search for example index=assets host_name=mysrv1 | dedup host_name I will get the 1 events as intended. How do I fix my search so that I can get around this constraint?

willadams · ‎09-07-2020

Spoke with SPLUNK support and the problem was resolved by changing the limits.conf configuration for [kv] within SPLUNK Enterprise. Created under system\local the file limits.conf and added the following stanza to it and restarted SPLUNK. [kv] limit = 235

willadams · ‎09-02-2020

My data is already delim'd with "," and thats proven by the manual upload of the csv. This would do additional extractions to capture those specific fields but not allow for changes to the fields over time (which is likely to happen). How can this be done without having to props it for specific fields and be more "dynamic". What's causing it in the first instance.

willadams · ‎09-02-2020

I have an interesting problem that I am not sure how to solve. I have a CSV that I am monitoring. The CSV has approximately 232 column headings given its a big data source. The data is being pulled in but there are some columns that are not being indexed for some reason. For example a missing column heading is say "comp_ip". SPL search in both smart or verbose mode, doesn't show the field "comp_ip". If I then write SPL as follows index=foo sourcetype=csv | dedup comp_ip | table comp_ip then SPLUNK happily shows me a table with all the values. If I run my search in verbose mode and then look back at "events" I can see my field in the interesting fields. However if I then revert back to normal search (i.e. index=foo sourcetype=csv) then my interesting fields no longer show this field. I have also checked to make sure that there are no more "interesting fields" that have not been selected. If I manually take the CSV file and do a manual "Add Data" and apply the sourcetype, I can see the column "comp_ip" with the relevant data. I am at a loss..

willadams · ‎08-31-2020

I have a CSV that I am monitoring. The CSV has lots of fields and my extraction works appropriately. What I have noticed is that depending on the item in the CSV the field either has a value or not. I have noticed that this appears to be common with fields all prefixed with the same term. An example of the data set comp_domain comp_cputype comp_department last_logon_date Enabled Name If I run the following SPL then for all the fields EXCEPT comp_*, SPLUNK will populate it with my value index=foo | fillnull value="Nothing" So using the above fields field value comp_domain comp_cputype comp_department last_logon_date Nothing Enabled Nothing Name Nothing If I run an eval to look for null for one of the value (e.g. comp_domain) I get the same result index=foo | eval job=if(isnull(comp_domain),"Nothing here",comp_domain) field value comp_domain The same will happen for any field with "comp_" prefixed but works fine for fields that don't have a prefix.

willadams · ‎08-24-2020

willadams · ‎08-24-2020

I have configured the REST API Modular Input to query data from an application we need. The rest API is configured to do a GET and everything works as expected (i.e. it connects, authenticates and returns data into an index). The problem it only returns 1 entry in the query I am making. The parsing is fine (json) and I can see lots of key-value pairs as expected. The returned result is always the same result. This is despite changing the REST configuration to do multiple queries or removing any flags that may constrain this. If I do this natively using a curl for example, I return over 1200 records.

willadams · ‎08-23-2020

I have a problem with a 2nd NOT inputlookup that doesn't work. If I break out of the 2nd inputlookup and run this within SPL it works. For example the following search would work index=foo sourcetype=foosource [| inputlookup mystuff.csv | rename field1 AS interest | fields interest ] | search NOT interest IN ("*jump*","*sheet*","*hang*","*worry*") | table interest however if I then move this into a lookup it ignores the CSV file and shows me data that I have omitted index=foo sourcetype=foosource [| inputlookup mystuff.csv | rename field1 AS interest | fields interest ] | search NOT [|inputlookup myexcludedstuff.csv | rename field1 AS interest | fields interest] | table interest

willadams · ‎08-09-2020

I have written a rule that is trying to use a transaction and based on the transaction value to either alert or not. For example the main fields I have in my index are as follows: rid label title rid would be the common field and each rid could have from 2-5 events. For example: Event 1 --> Aug 10 00:10:00 ......... label="News" Title="mytitle" user="bob" rid=12345 Event 2 --> Aug 10 00:10:00 ......... label="Catalog" Title="mytitle" user="bob" rid=12345 Event 3 --> Aug 10 00:10:00 ......... label="Match" Title="mytitle" user="bob" rid=12345 The search I have configured is as follows: index=main NOT (sender="administrator" AND label="System Generated") NOT label="Match" | transaction rid If I run the above search my transaction shows 2 of the events as above and removes Event 3. What I am trying to do is alert on rid's where they have not yet been labelled "Match". However the above search would trigger for ones that have already been matched. An example may be Event 1 --> Aug 10 00:12:00 ......... label="News" Title="mytitle" user="bob" rid=45678 Event 2 --> Aug 10 00:12:00 ......... label="Catalog" Title="mytitle" user="bob" rid=45678 So using the examples above, I want to be able to alert when rid "45678" occurs but not "12345". I have tried using a ....| transaction rid keepevictions=true and then searching for where this doesn't occur. I have also tried the following which doesn't seem to garner the results I want. index=main NOT (sender="administrator" AND label="System Generated") | transaction startswith="News" endswith="Match" mid | search NOT label IN ("Match") This generates 0 results. I have also tried running with keepevicted=true with no results either index=main NOT (sender="administrator" AND label="System Generated") NOT label="Match" | transaction rid keepevicted=true

willadams · ‎08-02-2020

I have a working connection with ServiceNow and can pull data from the database based on my inputs. However one thing I am trying to do is pull down information related to a custom database view that is not a database table that would normally be found in the SNOW database. For example I have a custom view called u_customview_splunk. Is there a way to pull down a custom view from ServiceNow with the current TA? I have tried configuring the input as follows [snow://u_customview_splunk] account = servicenowaccount duration = 60 id_field = sys_id index = snow_index since_when = 2000-01-01 00:00:00 table = u_customview_splunk timefield = sys_updated_on disabled = 0 Is there another variable that can be called (i.e. instead of "table = xxxxx", something like "view = ......"). I haven't seen this yet in the doco.

willadams · ‎07-14-2020

I am unable to get additional columns from a CSV I have referenced in an SPL query that I have written. In the CSV there are numerous columns however I want to add additional columns based on my search. From a data view, my index has details about devices for example 3 fields (user, status, machinename). My query searches for "status = "in use"" and then tries to match this up to the CSV in question. The output I am after is that on a match to show the detail from the CSV as required (i.e. columns are labelled firstname, lastname, type) My query is index=devices status="in use" | rename prim_user as userid | search userid="*" [|inputlookup mycatalog.csv | search type="valued" | fields userid] | table userid type machinename When I run this query a table is produced but the "type" column is not returned from the CSV. I tried editing my search to be index=devices status="in use" | rename prim_user as userid | search userid="*" [|inputlookup mycatalog.csv | search type="valued" | fields userid, type] | table userid type machinename This however returns a null value. I then tried to use a lookup but this fails too index=devices status="in use" | rename prim_user as userid | search userid="*" [|inputlookup mycatalog.csv | search type="valued" | fields userid] | lookup mycatalog.csv prim_user as userid OUTPUT userid, type | table userid type machinename This returns an error in my lookup advising "could not find all of the specified lookup fields in the lookup table even though they are there. Any help appreciated.

willadams · ‎06-22-2020

Anyone come across this?

willadams · ‎06-11-2020

I downloaded the Palo Alto Networks Add-on to pull down feeds from the MineMeld Service. I have configured the Palo Alto TA with the relevant credentials and output node feed URL's as per our configuration. I have configured proxy settings and can confirm that my instance is attempting a connection. However I noted that when the Palo Alto TA runs to fetch this, I note on the proxy that the "connectionpool.py" in the "Splunk_TA_paloalto_minemeld_feed.log" is starting new HTTPS requests to the loop back adapter (i.e. 127.0.0.1). I have other TA's installed that have their own proxy configurations and these tend to work as expected. Any thoughts on what might be happening here? "MYINSTALL\etc\apps\Splunk_TA_paloalto\bin\splunk_ta_paloalto\modinput_wrapper\base_modinput.py", line 127, in stream_events self.collect_events(ew) File "MYINSTALL\etc\apps\Splunk_TA_paloalto\bin\minemeld_feed.py", line 72, in collect_events input_module.collect_events(self, ew) File "MYINSTALL\etc\apps\Splunk_TA_paloalto\bin\input_module_minemeld_feed.py", line 78, in collect_events kvs_entries = pull_from_kvstore(helper, name, start, stats) File "MYINSTALL\etc\apps\Splunk_TA_paloalto\bin\input_module_minemeld_feed.py", line 45, in inner ret_val = func(*args) File "MYINSTALL\etc\apps\Splunk_TA_paloalto\bin\input_module_minemeld_feed.py", line 120, in pull_from_kvstore parameters={'query': json.dumps({'splunk_source': name})}) File "MYINSTALL\etc\apps\Splunk_TA_paloalto\bin\splunk_ta_paloalto\modinput_wrapper\base_modinput.py", line 476, in send_http_request proxy_uri=self._get_proxy_uri() if use_proxy else None) File "MYINSTALL\etc\apps\Splunk_TA_paloalto\bin\splunk_ta_paloalto\splunk_aoblib\rest_helper.py", line 43, in send_http_request return self.http_session.request(method, url, **requests_args) File "MYINSTALL\etc\apps\Splunk_TA_paloalto\bin\splunk_ta_paloalto\requests\sessions.py", line 488, in request resp = self.send(prep, **send_kwargs) File "MYINSTALL\etc\apps\Splunk_TA_paloalto\bin\splunk_ta_paloalto\requests\sessions.py", line 609, in send r = adapter.send(request, **kwargs) File "MYINSTALL\etc\apps\Splunk_TA_paloalto\bin\splunk_ta_paloalto\requests\adapters.py", line 390, in send conn = self.get_connection(request.url, proxies) File "MYINSTALL\etc\apps\Splunk_TA_paloalto\bin\splunk_ta_paloalto\requests\adapters.py", line 290, in get_connection proxy_manager = self.proxy_manager_for(proxy) File "MYINSTALL\etc\apps\Splunk_TA_paloalto\bin\splunk_ta_paloalto\requests\adapters.py", line 184, in proxy_manager_for **proxy_kwargs File "MYINSTALL\etc\apps\Splunk_TA_paloalto\bin\splunk_ta_paloalto\requests\adapters.py", line 43, in SOCKSProxyManager raise InvalidSchema("Missing dependencies for SOCKS support.") InvalidSchema: Missing dependencies for SOCKS support. DateTimeStamp,039 INFO pid=183272 tid=MainThread file=connectionpool.py:_new_conn:758 | Starting new HTTPS connection (1): 127.0.0.1 DateTimeStamp,352 INFO pid=154016 tid=MainThread file=connectionpool.py:_new_conn:758 | Starting new HTTPS connection (1): 127.0.0.1 DateTimeStamp,655 INFO pid=16340 tid=MainThread file=connectionpool.py:_new_conn:758 | Starting new HTTPS connection (1): 127.0.0.1

willadams · ‎05-25-2020

Is it possible to have a "folder structure" within a single drop down within a dashboard. My use case is to display certain objects within a dashboard. The information displayed is dependent on the user making a selection in the drop down. The drop down would be similar to the following: <Heading 1> <Topic 1> <Topic 2> <Topic 3> <Topic ....> <Heading 2> <Topic A> <Topic B> <Topic C> <Topic .....> The drop down options are static and not dynamic (I intend to add a search function as a phase 2 thing) but initially just trying to get the drop downs as needed. I am using a "panel depends...." configuration in the XML to show the content depending on the selection made. The only way that I am aware of to make the drop down work the way I want is to add multiple inputs but then I can't use the same token value in each input so that when a select changes the panel changes. The alternate way is to prefix each drop down but visually that doesn't look nice, e.g. <heading1 - topic1> <heading1 - topic2> <heading1 - topic3> <heading1 - topic....> <heading2 - topica> <heading2 - topicb> <heading2 - topicc> <heading2 - topic....>

willadams · ‎05-18-2020

I was looking at apps such as "Splunk Security Essentials" and "ATP Threat hunting" available in SPLUNK base. The apps have a great mechanism that can be user driven by clicking on tiles to open additional information. I was wondering how these are created and whether there any apps available that allows these to be created. My thought is around having a work instruction available in SPLUNK where some one has an event that they need to investigate and instead of going elsewhere be able to reference the information through a panel such as the 2 apps do above.

Posts	186
Solutions	8
Karma Given	3
Karma Received	5
Member Since	‎25-10-2017

Online Status	Offline
Date Last Visited	‎03-01-2022 03:31 AM

How to exclude device from all Alerts?

Additional search based off original search

Lookup Editor 3.4.6 Scroll Problem

Splunk Add-on for Microsoft Cloud Services Limits

Date Calculation (Negative Display)

[AWS Trumpet] Kinesis Firehose (no Public IP Addre...

Same sourcetype different data sets

Universal Forwarder managed with Powershell

MMDB Updating

Escaping special characters in text input

Assistance in Nulling Events before Indexing

Re: Assistance with Extraction (PROPS / TRANSFORMS...

Re: Assistance with Extraction (PROPS / TRANSFORMS...

Re: Assistance with Extraction (PROPS / TRANSFORMS...

Assistance with Extraction (PROPS / TRANSFORMS)

Re: EVAL with REX with SPATH (props / transforms)

Re: EVAL with REX with SPATH (props / transforms)

EVAL with REX with SPATH (props / transforms)

Re: Assistance with combining / joining on 2 large...

Re: Assistance with combining / joining on 2 large...

Assistance with combining / joining on 2 large dat...

Re: Index CSV Missing Columns

Re: Index CSV Missing Columns

Index CSV Missing Columns

Fill Null not working as expected

Re: Inputlookup used twice in 1 search with a NOT

REST API Modular Input Single Event

Inputlookup used twice in 1 search with a NOT

SPL Search - Alert if not true (transaction)

ServiceNow User / Custom View Ingestion

Unable to get return results from inputlookup

Re: Connection to Loopback Address - Not working w...

Connection to Loopback Address - Not working with ...

Question regarding Dropdown Input (Folder Structur...

Work Instructions in SPLUNK

Join the Conversation