Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- Find Answers
- :
- About rasty
rasty
Path Finder
Member since:
03-12-2018
06-05-2020
Community Statistics
| Posts | 18 |
| Solutions | 1 |
| Karma Given | 2 |
| Karma Received | 1 |
| Member Since | 03-12-2018 |
Activity Feed
- Karma Re: XML nested field issues for niketn. 06-05-2020 12:49 AM
- Karma Re: Failed to Index Data && SSL CERT. VERIFY FAILED on Splunk Add-on For Tenable for p_gurav. 06-05-2020 12:49 AM
- Got Karma for Re: XML nested field issues. 06-05-2020 12:49 AM
- Posted Re: How to do a vulnerability trending dashboard? on Dashboards & Visualizations. 07-05-2018 06:54 AM
- Posted How to do a vulnerability trending dashboard? on Dashboards & Visualizations. 07-05-2018 12:45 AM
- Tagged How to do a vulnerability trending dashboard? on Dashboards & Visualizations. 07-05-2018 12:45 AM
- Tagged How to do a vulnerability trending dashboard? on Dashboards & Visualizations. 07-05-2018 12:45 AM
- Tagged How to do a vulnerability trending dashboard? on Dashboards & Visualizations. 07-05-2018 12:45 AM
- Posted Re: How can use map command ? on Dashboards & Visualizations. 04-16-2018 10:10 AM
- Posted Re: XML nested field issues on Splunk Search. 04-16-2018 10:07 AM
- Posted Re: XML nested field issues on Splunk Search. 04-16-2018 09:35 AM
- Posted How can use map command ? on Dashboards & Visualizations. 04-16-2018 05:53 AM
- Tagged How can use map command ? on Dashboards & Visualizations. 04-16-2018 05:53 AM
- Posted Re: XML nested field issues on Splunk Search. 04-16-2018 03:08 AM
- Posted XML nested field issues on Splunk Search. 04-16-2018 01:49 AM
- Tagged XML nested field issues on Splunk Search. 04-16-2018 01:49 AM
- Tagged XML nested field issues on Splunk Search. 04-16-2018 01:49 AM
- Posted kv_mode - xml: How can I use extracted fields to create dashboards? on Dashboards & Visualizations. 04-09-2018 06:08 AM
- Tagged kv_mode - xml: How can I use extracted fields to create dashboards? on Dashboards & Visualizations. 04-09-2018 06:08 AM
- Tagged kv_mode - xml: How can I use extracted fields to create dashboards? on Dashboards & Visualizations. 04-09-2018 06:08 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
07-05-2018
06:54 AM
thanks @renjith.nair its working 🙂
... View more
04-16-2018
10:10 AM
We solved my problem with @niketnilay in https://answers.splunk.com/answers/642422/xml-nested-field-issues.html
... View more
04-09-2018
06:08 AM
Hello everyone
I have xml formalt like:
<CxXMLResults>
<Query>
<Result>
</Result>
</Query>
</CxXMLResults>
So my fields looks like that in Splunk:
So I select Stored_XSS vulnerability in search for example CxXMLResults.Query{@name}=Stored_XSS and I want to count how many are there Stored_XSS with CxXMLResults.Query.Result{@NodeId}.
And I am doing searching like:
CxXMLResults.Query{@name}=* | stats count(CxXMLResults.Query.Result{@NodeId}) by CxXMLResults.Query{@name}
The result is all the same 😞 because these are in a single event. How can I select these with parent, child relations?
... View more
04-09-2018
01:34 AM
hi @p_gurav,
I think splunk is having performance problems. Because, I am trying this props.conf:
[test_cx3]
BREAK_ONLY_BEFORE = \<CxXMLResults\s
DATETIME_CONFIG =
LINE_BREAKER = \<CxXMLResults\s
MAX_EVENTS = 1000000
SHOULD_LINEMERGE = true
TRUNCATE = 0
pulldown_type = 1
KV_MODE = xml
NO_BINARY_CHECK = true
category = Custom
disabled = false
EVENT_BREAKER =
MUST_BREAK_AFTER = \</CxXMLResults>
I sent two Report to splunk 562000 lines and 547 lines. When I send 547 lines there is no problem. But When I send 562000 lines report, Splunk break lines randomly 100.000, 46.000, 150.000 e.g
Do you think, what could be the reason ?
... View more
03-19-2018
04:52 AM
I solved problem with theese steps: https://answers.splunk.com/answers/584167/-splunk-add-on-for-tenable-how-can-i-resolve-basic.html
... View more
03-16-2018
12:14 PM
For the certificate verify issue, these steps are helpful
https://answers.splunk.com/answers/7164/how-do-i-set-up-ssl-forwarding-with-new-self-signed-certificates-and-authentication.html
And when you create the certs and complete the openssl "questionaire" make sure the common name/FQDN is different for the root cert and the server cert. It will not work is you use the same value for both. (even if the value is blank)
... View more
