Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- About micahkemp
micahkemp
Champion
Member since:
02-11-2014
12-13-2022
Community Statistics
| Posts | 822 |
| Solutions | 135 |
| Karma Given | 111 |
| Karma Received | 275 |
| Member Since | 02-11-2014 |
Activity Feed
- Got Karma for Re: How to combine wildcard results into one field?. 04-08-2025 06:26 AM
- Got Karma for Re: How to use timepicker from a CSV lookup?. 12-27-2024 01:27 PM
- Got Karma for Re: How to use timepicker from a CSV lookup?. 11-12-2024 03:02 AM
- Got Karma for Re: Why is the inputlookup not returning any records?. 02-05-2024 04:44 AM
- Got Karma for Re: Easiest way to exclude ingestion of events for a specific IP address from a SourceType. 09-21-2023 04:52 PM
- Got Karma for Re: Is it possible to use base search in append sub search?. 05-25-2023 01:44 PM
- Got Karma for Re: How to index all locally and forward specific sourcetype to a 3rd party indexer?. 05-07-2023 11:02 PM
- Got Karma for Re: Indexes.conf. 12-02-2022 06:49 AM
- Got Karma for Re: Splunk Add-on for MS IIS and INDEXED_EXTRACTIONS. 11-02-2022 03:51 AM
- Got Karma for Re: Apply search field extraction to props.conf and/or transforms.conf so extraction done at index-time. 10-10-2022 07:51 AM
- Got Karma for Re: How can I extract a license file from existing license volume. 10-07-2022 07:17 AM
- Got Karma for Re: Why is coalesce working only for one of the two fields I am combining, depending on the sequence the fields are being combined?. 10-05-2022 04:24 AM
- Got Karma for Re: Setting the timestamp when using the collect command. 09-05-2022 03:42 AM
- Got Karma for Re: Help with multivalue field count. 05-22-2022 12:21 AM
- Got Karma for Re: Why is "rex field" not producing results when used in an API call?. 05-19-2022 01:16 AM
- Got Karma for Re: Can I use props/transform to make MULTIPLE changes to the same event from a log?. 04-13-2022 07:48 AM
- Got Karma for Re: How to use timepicker from a CSV lookup?. 03-24-2022 06:24 AM
- Got Karma for Re: Is it possible to use base search in append sub search?. 03-17-2022 01:37 PM
- Got Karma for Re: Can I concatenate a complete search query to the already filtered stats results which only executes if an input checkbox is checked. 03-04-2022 06:59 AM
- Got Karma for Re: How to combine wildcard results into one field?. 09-13-2021 12:11 AM
Topics I've Started
No posts to display.
12-13-2017
06:17 AM
1 Karma
Please post your solution as an answer and accept that answer so that others may benefit from your findings.
... View more
You can nest the menu (navigation bar) that links to them, as referenced here in the Dashboard links section . Note the nested collection groups.
<!-- Use the view tag to create a dashboard link -->
<view name="dashboard1" />
<!-- Use the collection tag to create a list of items -->
<collection label="Menu name">
<!-- Add items to the list -->
<view name="dashboard2" />
<view name="dashboard3" />
<!-- Add a nested list with items -->
<collection label="Submenu name">
<view name="dashboard4" />
<view name="dashboard5" />
</collection>
</collection>
I'm assuming this is the functionality you are looking for, essentially, as opposed to having a nested folder structure on disk, which users aren't exposed to anyway.
This doesn't set the permissions, and isn't customizeable based on the user's role or identity, but only dashboards that the user has permissions to view will be shown, and collections that have no dashboards visible to the logged in user won't be displayed either. So if you set the dashboard permissions and organize them as you want them to appear in the navigation menu this should work for well for you.
... View more
12-12-2017
09:56 AM
I'm not sure that the search I pasted actually accomplishes anything of value, because I don't really understand your use case. Can you explain more about what it is you are looking for in terms of searching and how the CSV could be used?
What I have above looks like it would end up performing basic lookup capabilities, which would be better accomplished by using the lookup command with the csv in question.
... View more
12-12-2017
09:01 AM
A pie chart is only going to work with one value broken out by label, and needs to be split by that label. Try something like:
host="app-1" source="df" | timechart max(storage_used) BY filesystem
... View more
12-12-2017
08:43 AM
I suggest you move your search strings around such that your inputlookup is the one inside your join search:
index=* sourcetype=syslog eventtype=DNS host="device1" OR host="device2"
| where domain=""
| join domain
[| inputlookup URLs.csv
| fields Domains
| rename Domains as domain
]
| table domain
In your example (and in mine as I tried to keep it the same as yours), you are searching for an empty domain field, but are also joining on the same domain field. This seems like it would cause an issue with your join .
... View more
12-12-2017
08:38 AM
Your nessus scan wouldn't necessarily see the certificate...especially if you disable the splunkd port on your universal forwarders (or just don't open up that port on your host-based firewall).
... View more
12-12-2017
08:30 AM
It appears that there is no way for a user to have read-only access to an index while also allowing said search head to write to the same index. You could potentially work around this if you had one search head for users to perform searches (with read-only for that index enabled) and another search head to perform summary indexing (with read/write allowed to the index).
Reference: https://answers.splunk.com/answers/390225/how-to-prevent-users-from-writing-to-indexes.html
... View more
12-12-2017
07:22 AM
What does your monitor stanza look like, and how are you rotating (filename, compression, etc)?
... View more
12-12-2017
07:08 AM
It sounds like you aren't searching all indexes by default. Check your roles configuration(s) to see which indexes will be searched by default.
Settings -> Access Controls -> Roles -> (select role) -> Indexes searched by default
You will need indexes.conf on the search head to be able to select the indexes. It needs to match that of the cluster master.
... View more
12-12-2017
06:44 AM
Splunk requires a restart when making changes to inputs (or other index-time configurations) are made. There is some documentation on this, but I didn't see any reference to input changes specifically. I have submitted feedback that it be included.
Edit: this answer assumes you are referencing adding new data to splunk, not just when new files are made available that should already be handled by an existing input.
... View more
12-12-2017
06:20 AM
You may be able to use time-based lookups (configured in transforms.conf).
time_field = <string>
* Used for temporal (time bounded) lookups. Specifies the name of the field
in the lookup table that represents the timestamp.
* Defaults to an empty string, meaning that lookups are not temporal by
default.
time_format = <string>
* For temporal lookups this specifies the 'strptime' format of the timestamp
field.
* You can include subseconds but Splunk will ignore them.
* Defaults to %s.%Q or seconds from unix epoch in UTC an optional milliseconds.
max_offset_secs = <integer>
* For temporal lookups, this is the maximum time (in seconds) that the event
timestamp can be later than the lookup entry time for a match to occur.
* Default is 2000000000 (no maximum, effectively).
min_offset_secs = <integer>
* For temporal lookups, this is the minimum time (in seconds) that the event
timestamp can be later than the lookup entry timestamp for a match to
occur.
* Defaults to 0.
In this case I think your transforms.conf might look something like this:
[lookupname]
filename = lookupfile.csv
timefield = start_date
This would allow you to run a search like
<base search> | lookup lookupname activity
The caveat is this doesn't limit results to those between start_date and end_date, only those that are at or after start_date. You may be able to tune the max/min_offset_secs sufficiently for your needs to accomplish what you want. If not the solution would be a bit more involved, potentially by comparing _time to end_time that your lookup emitted.
... View more
12-11-2017
06:12 PM
It will absolutely hit your index volume a second time, assuming you are forwarding via syslog or splunk output.
You can make use of summary indexing or collect to search and index the results of said search, which won't hit your license cost again, but you don't want to do this for large amounts of data as a means to have two copies of all your data.
... View more
12-11-2017
05:56 PM
Have you configured your remote instances appropriately on the setup page?
... View more
12-11-2017
05:47 PM
It sounds like your DMC is only searching itself (or peers that only have those indexes). Do you have it configured with your indexers as search peers, and have you configured it for distributed mode?
... View more
12-11-2017
05:36 PM
1 Karma
The TAs aren't the issue in this case. Check out tags.conf in the Windows and nix TAs and you won't find any mention of setting the default tag.
What you're seeing is the ES identity management setting this tag based on the usernames.
If you look at the output of bin/splunk btool tags list --debug you'll see (at least) these entries, as provided by ES identity management:
etc/apps/Splunk_SA_CIM/default/tags.conf [is_default=true]
etc/apps/Splunk_SA_CIM/default/tags.conf default = enabled
etc/apps/Splunk_SA_CIM/default/tags.conf [src_user_category=default]
etc/apps/Splunk_SA_CIM/default/tags.conf default = enabled
etc/apps/Splunk_SA_CIM/default/tags.conf [user_category=default]
etc/apps/Splunk_SA_CIM/default/tags.conf default = enabled
And if you look at the builtin identity CSVs you'll probably see some of this:
./etc/apps/SA-IdentityManagement/lookups/administrative_identities.csv:3comcso,,,,,,,,,,,,default|privileged,,,,,,,
./etc/apps/SA-IdentityManagement/lookups/administrative_identities.csv:adfexc,,,,,,,,,,,,default|privileged,,,,,,,
./etc/apps/SA-IdentityManagement/lookups/administrative_identities.csv:adm,,,,,,,,,,,,default|privileged,,,,,,,
./etc/apps/SA-IdentityManagement/lookups/administrative_identities.csv:admin|administrator,,,,,,,,,,,,default|privileged,,,,,,,
./etc/apps/SA-IdentityManagement/lookups/administrative_identities.csv:anonymous,,,,,,,,,,,,default|privileged,,,,,,,
./etc/apps/SA-IdentityManagement/lookups/administrative_identities.csv:adminuser,,,,,,,,,,,,default|privileged,,,,,,,
./etc/apps/SA-IdentityManagement/lookups/administrative_identities.csv:advmail,,,,,,,,,,,,default|privileged,,,,,,,
./etc/apps/SA-IdentityManagement/lookups/administrative_identities.csv:bciim,,,,,,,,,,,,default|privileged,,,,,,,
./etc/apps/SA-IdentityManagement/lookups/administrative_identities.csv:bcms,,,,,,,,,,,,default|privileged,,,,,,,
./etc/apps/SA-IdentityManagement/lookups/administrative_identities.csv:browse,,,,,,,,,,,,default|privileged,,,,,,,
./etc/apps/SA-IdentityManagement/lookups/administrative_identities.csv:cisco,,,,,,,,,,,,default|privileged,,,,,,,
./etc/apps/SA-IdentityManagement/lookups/administrative_identities.csv:cusadmin,,,,,,,,,,,,default|privileged,,,,,,,
./etc/apps/SA-IdentityManagement/lookups/administrative_identities.csv:cust,,,,,,,,,,,,default|privileged,,,,,,,
ES is configured to set the default tag if any of the identities it has are found in the username fields it knows about are defined in your identity lookups with the default category.
... View more
12-11-2017
04:03 PM
2 Karma
Your search query returns a field SubDivisionList but your input is set to use the field subdivision . Your input is looking for a field that doesn't exist so it has no values to display.
... View more
12-11-2017
04:00 PM
You can use a single certificate for all forwarders if you like, or you could give each forwarder its own certificate. The latter is probably only worth the extra effort if you want to enable requireClientCert and sslCommonNameToCheck (and want to be able to potentially revoke, via removing from the allowed common name list, client certificates).
If you only want to enable the UFs to send over TLS to the indexers you only need the certificate on the client as a means to enable that encryption. It can certainly be reused amongst your UFs for this purpose.
... View more
12-11-2017
03:51 PM
I would suggest moving to the SDK (referenced in your script as splunklib but not actually used). Check out the filter.py example that comes with the SDK for guidance.
... View more
12-11-2017
03:39 PM
2 Karma
Remember that the UI will append the inferred search command, but the API will not. This means that a search string passed to the API needs to either start with the search command or | to use a generating command.
See the Python Example for sample code that handles this.
If you believe this isn't the issue please paste the search query you are passing to the API for further comment.
... View more
12-01-2017
02:19 PM
1 Karma
If your search results are small, you can use mvexpand . With larger result sets this can be a memory hog, so proceed with caution. Something like <base search> | table hostname cve | mvexpand cve | lookup priority_cve cve| table hostname cve patch | stats values(patch) AS patch BY hostname .
... View more
12-01-2017
02:04 PM
If you index a line like the working example above, but well after the fact (specifically on a different date that the event itself), does it still work? For example, if you index the event 14-Nov-17,SOME_RANDOM_DATA,1525 right now what does it parse the timestamp as?
... View more
11-30-2017
09:41 AM
eventtypes don't parse your data., props and transforms do. If you are creating a custom sourcetype for field extraction purposes you need to create the extractions in props.conf and transforms.conf.
... View more
11-30-2017
07:55 AM
What is the point of <unset token="productsearchquery"></unset> after each <set> ?
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
12-13-2022
02:28 PM
|
Karma given to
| User | Karma Count |
|---|---|
| 2 | |
| 2 | |
| 2 | |
| 3 | |
| 16 |
