About jip31

jip31

not sure to understand when you say "1. Use EventTypes to apply the tags to the events so they end up in the correct data model. E.g. tag "network" and "communicate" to put it in the NetworkTraffic data model." imagine that my searc is index=main uri="*.php*" OR uri="*.py*" Do you meant that i have to onboard this in a tag called "network"? And if i have a field called "ip" in my apps does it mean i have to tag it as "dest_ip" following the Network Traffic datamodel?

jip31

Hi I have developped a dashbord relative to firewall metrics. I need to make my dashboard CIM compliant Do i need my searches linked to the firewall datamodel with the firewall tstats datamodel (tstats where datamodel=....) or do i just need to create tags and eventtypes following the firewall datamodel ? I understand anything so is someone can d'escrime clearly all the steps for having my apps CIM compliant ? Thanks

jip31

ok is the latency explain in seconds? Imagine the latency is 180 does it mean i have to put -3m@m in earliest and now() in latest?

jip31

i just want to calculate the latency between _indextime and _time in order to define a time range in my alert which take into account this latency

jip31

hi is anybody could give me a search to calculate the _indextime average for my events once it's done, what i have to do in the cron parameters of my alert to take into account this metric? thanks

jip31

i have anything displayed under label... is anybody can help? Here is what i see

jip31

Hi <search> <query>index=* EventCode=25753 | stats count(EventCode) as toto | append [| search index=* EventCode=* | stats count(EventCode) as toto2]</query> <earliest>-7d@h</earliest> <latest>now</latest> <done> <condition> <set token="NbHost">$result.toto$</set> <set token="NbHost2">$result.toto2$</set> </condition> </done> </search> <option name="drilldown">none</option> <option name="underLabel">$NbHost$ / $NbHost2$</option> I dont succeed to display the NbHost2 value under my single panel what is wrong please?

jip31 · ‎06-04-2024

is anybody can help please?

jip31 · ‎02-16-2024

index=mem tag=a return results but not tag=a you are right, when I add the tage add the index level tag=a works

jip31 · ‎02-16-2024

hi I can see the tag But when I am doing tag="a", i have no results

jip31 · ‎02-15-2024

hi I have created a tag for the field "counter" called "a" But when I run a search with tag=a or with tag::counter="a", there is no results what is the problem please?

jip31 · ‎02-15-2024

when you say "to match those expected by the DM ("high", "medium", "low", etc. in severity, for example)", where I can see this information in the DM?

jip31 · ‎02-15-2024

Imagine I have an app with Intrusion Detection data If I want to make my app CIM compliant I need to add aliases, tags and calculated fields like in the Intrusion Detection Datamodel ? For example, if I have a field called "Alert level", I need to create an aliases in my app in order to rename it as "severity_id"? Or is it better to create a own datamodel from my app and to query from this datamodel with tstats? | tstats count from datamodel=TEST

jip31 · ‎02-15-2024

Hello I have great difficulties to understand where to begin for using the CIM datamodel Is anybody can clearly summarize the different ways to apply a CIM datamodel in my own apps? Thanks in advance

jip31 · ‎02-13-2024

hi i try to use a table icon viz like below in the static folder i have put the "table_icons_rangemap.js" and the 'table_decorations.css" files I call these file in my xml like this : <dashboard version="1.1" script="table_icons_rangemap.js" stylesheet="table_decorations.css"> when I run the dashboard nothing happens I just have severe, high instead an icon I use 9..1.0.1 Splunk Enterprise version is anybody cant help please?? thanks

jip31 · ‎02-06-2024

thanks

jip31 · ‎02-06-2024

hello I need to display 2 curves in my line chart from two different index so i am doing this : index="disk" sourcetype="Perfmon:disk" | bin span=10m _time | eval time=strftime(_time, "%H:%M:%S") | stats avg(Value) as Disque by time | eval Disque=round(Disque, 2) | append [ search index="mem" sourcetype="Perfmon:mem" | bin span=10m _time | eval time=strftime(_time, "%H:%M:%S") | stats avg(Value) as Mémoire by time | eval Mémoire=round(Mémoire, 2)] the problem I have is that on the x axis my curves are not aligned on the same time slot what is wrong please? thanks

jip31 · ‎01-09-2024

Hi I have to create correlation searches in Splunk ES My cron schedule will be */60**** Is it better to use a real-time schedule or a continuous schedule? Is it necessary to fill the time range (start time and end time)? Last question : if an alert event exists, does it means that this event will be created many times in the incident review dashboard? I need to creat just an incident for the same alert. How to do this? Thanks in advance

jip31 · ‎11-27-2023

Hi I want to inventory all Splunk tools related to artificial intelligence and observability Here is the list: Splunk AI Assistant - PREVIEW (formerly SPL Copilot) Splunk Machine Learning Toolkit (MLTK) Splunk App for Data Science and Deep Learning (DSDL) Splunk IT Service Intelligence Splunk App for Anomaly Detection Did I forget some tools? Thanks

jip31 · ‎11-13-2023

thanks for your answer even if it's not really easy to understand the data are approximatively indexed every 20 minutes so concerning my problem i dont understand why my last related event vs my alert happened last Friday and why my alert has occurend once again today

jip31 · ‎11-13-2023

Have you an example to filter events that have already looked at? Is there any alert customization for doing that like throttle or expiration?

jip31 · ‎11-13-2023

Hi I use a splunk alert with a 24 hours slottime what is strange is that this alert show me an event older than 24 hours so I have 2 questiosn 1) How is it possible that an alert occurs with an event outside the slot time specified? 2) How to customize the alert for being sure that it shows only new events and not events already shown? It means that I need the alert occurs just one time when an event is detected thanks

jip31 · ‎11-01-2023

hello I have a admin role when I create a field alias, I can see it in the props.conf file but when I run the search the field names are unchanged [sourcetype="Perfmon:mem"] FIELDALIAS-Value = Value AS titi counter AS tutu what is wrong please?

jip31 · ‎10-30-2023

it seems to be I have also the message Datamodel 'TEST' had an invalid search, cannot get indexes to search

jip31 · ‎10-30-2023

Hi Gcusello I can see the fields extracted in my datamodel And even if i use your search below I have no results | tstats count from datamodel=TEST where TEST.EventCode=100 I have only results heriteld fields like host, sourcetype, source

Posts	1719
Solutions	11
Karma Given	9
Karma Received	19
Member Since	‎03-22-2018

Online Status	Offline
Date Last Visited	yesterday

Help to make my apps CIM compliant

help to calculate _indextime

help on under label token

help on tag

How to make data CIM compatible

help on custom_table_icon_set_rangemap viz

help on append command in a line chart

Help on correlation search scheduling

help on Splunk AI and observability tools

help on Splunk alert recurrence

Re: Help to make my apps CIM compliant

Help to make my apps CIM compliant

Re: help to calculate _indextime

Re: help to calculate _indextime

help to calculate _indextime

Re: help on under label token

help on under label token

Re: help on custom_table_icon_set_rangemap viz

Re: help on tag

Re: help on tag

help on tag

Re: Help on CIM datamodel usage

Re: Help on CIM datamodel usage

How to make data CIM compatible

help on custom_table_icon_set_rangemap viz

Re: help on append command in a line chart

help on append command in a line chart

Help on correlation search scheduling

help on Splunk AI and observability tools

Re: help on Splunk alert recurrence

Re: help on Splunk alert recurrence

help on Splunk alert recurrence

help on splunk field aliases not visible

Re: help on tsats command with datamodel

Re: help on tsats command with datamodel