About etoombs

richgalloway

I just checked on a Splunk Cloud SHC and saw to difference in expansion time so I suspect there's something happening in your environment. Do you see any relevant messages in splunkd.log on the SH?

jwray97

Thanks however I worked out what was causing the issue. There was another app which was supposed to be deployed to the Search Head Custer but mistakenly it was deployed to the Indexer Cluster. After I removed this app from the Master Apps Folder I redeployed the new one and it successfully validated and pushed down to the Indexer nodes.

rajnsoni92 · ‎11-20-2023

Thank @etoombs It worked.

tomapatan · ‎11-10-2023

Hi, The filename is called "lookup_edit" and you can navigate to it using the UI: Settings - User Interface - Views.

bowesmana · ‎10-17-2023

Try something like this index=bla "JOB Initiated" OR "JOB Completed" ``` If your ID is not already extracted, then extract it ``` | rex field=_raw "(?<id>your_regex_to_extract_id)" | stats count as eventCount range(_time) as duration by ID So this will assume 2 events per ID and the range(_time) will calculate duration. You can always then check eventCount=2 to make sure you have seen both events.

L_Petch · ‎09-22-2023

Hi, So this error was due to the Admin user being deleted and the owner being set to admin still. I managed to fix this by changing the owner but after talking to PS deleting Admin is a mistake as so many services rely on it that it has been changed back.

jpvalenc · ‎09-21-2023

No, I never did but it did stop happening so I have no idea what caused it.

etoombs · ‎09-20-2023

The Tenable TA only pulls in events with new information ( a new scan date, change in a field or status) each time it accesses the data. Once an item is pulled in, it doesn't pull it a second time. That means if you scan half of your devices on Monday and half of your devices on Tuesday, you need to search looking back 2 days to see all of your current data. Once an individual finding has been pulled in, it doesn't grab the same item again unless there is a change.

etoombs · ‎09-20-2023

You can start out doing this in Splunk. Expand on the configs you want to look for in the search below, and then after you've pulled all of the configs you care about from rest endpoints, run a search for the keyword you're looking for in it. You can find a list of configuration files here: https://docs.splunk.com/Documentation/Splunk/9.1.1/Admin/Listofconfigurationfiles | rest/services/configs/conf-macros | eval config="macros" | append [| rest/services/configs/conf-lookups | eval config="lookups"] | append [| rest/services/configs/conf-savedsearches | eval config="searches"] You can add in views and such using other endpoints, like | rest /services/data/ui/views

suvi6789 · ‎09-13-2023

It worked perfectly for me. Thank you again.

mafruma · ‎09-07-2023

Wow... This worked! Thank you very much. This has been a journey. Looks like I just need to shorten my relative time to avoid the max results and timeouts for the "map" function but that is totally worth it.

LearningGuy · ‎08-31-2023

Your suggestion worked. Thank you so much | dbxquery connection=visibility query="select \"abc:def\" from tableCompany"

bhavesh0124 · ‎08-28-2023

That worked! Thanks a lot

etoombs · ‎08-25-2023

If you're still having this issue, check your logs for the lag between event time and index time. The Tenable add-on pulls all of your open vulnerability data first, and only pulls in the fixed data after all of the open stuff is complete. If you've got a large lag time, it may not be getting as far as actually pulling in the fixed vulns. Check the /opt/splunk/etc/apps/TA-tenable/default/inputs.conf, (and the local inputs.conf if you have one) and look for the "page_size". Increasing this number may resolve the issue. When I was troubleshooting a similar issue, Tenable indicated the number hadn't been changed - but it was set to 1000 - meaning it ran API calls for 1000 records at a time - and wasn't ever finishing with a large number of vulns. We increased this to 10000, reducing the api calls by a factor of 10 - and allowing the process to complete so all our vulns got pulled in.

tomapatan · ‎06-29-2023

Update: DBConnect is sending the logs to both our Cloud and On Prem instances - some events are missing from the Cloud indexer, although they are present on the local indexer. We`ve raised a support ticket with Splunk to investigate.

osasfrancis · ‎05-27-2022

I am using Version 5.2.4. Yes, the field does not exist on this version, but it once did on older versions. Just cannot filter data based on scan name.

Italy1358 · ‎05-23-2022

I did that but the none panel does not display the newly updated lookup table. I have to click on the refresh symbol to see the added results to the csv table. @etoombs

richgalloway · ‎05-23-2022

The literal character 'Z' is representative of the GMT/UTC time zone. It should be written as %Z in a time format string to ensure Splunk applies the right time zone.

ITWhisperer · ‎05-17-2022

This is another way to get count=0 | appendpipe [stats count | where count=0 | eval res="xyz"] Having said that, there may be a better way depending on your full search.

Italy1358 · ‎05-17-2022

Thank You!!! that did work.

etoombs · ‎05-17-2022

It looks like you combined features from the two options. When doing the charting.seriesColors, you don't name the field. Regardless of which you use, the value should be in brackets. <option name="charting.seriesColors">{0xc98b06}</option> or <option name="charting.fieldColors">{"count": 0xc98b06}</option>

jip31 · ‎05-17-2022

perfect ITWhisperer, many thanks

gcusello · ‎05-16-2022

Hi @alexspunkshell, if you could share a sample of your logs I could be more detailed in my answer, anyway, you have two choices: if you want to maintain separates IPs you have to find two different regexes, identifying something as difference, if you're not interested to have different field names for the two IPs, you could use the same regex. in the first case, try something like this: your_search | rex "IP\s+addresses:\s+(?<IP1>\d+\.\d+\.\d+\.\d+).*(?<IP2>\d+\.\d+\.\d+\.\d+)" if you want also the country associated to each IP, you could use something like this (similar to @etoombs solution) : your_search | rex "IP\s+addresses:\s+(?<Country1>[^\(]+)\((?<IP1>\d+\.\d+\.\d+\.\d+).*(?<Country2>[^\(]+)\((?<IP2>\d+\.\d+\.\d+\.\d+)" I prefer the following solution: your_search | rex "(?<Country>[^\(]+)\((?<IP>\d+\.\d+\.\d+\.\d+)" Ciao. Giuseppe

etoombs · ‎09-15-2021

Hi. I know a lookup file can contain wildcards and use them with the WILDCARD(<field>) setting, but is it possible to do the opposite, where the wildcard is in the dataset, rather then the lookup? For more detail: I have a lookup file that contains names and some location information, formatted like this: lastname, firstname, m [us-us] I have some source data that contains names, without the middle initial or the location data. I can manipulate it to get it into lastname, firstname format. Is it possible to do wildcard matching to a lookup when the wildcard is in the data set, as opposed to the lookup file? So, if my data has a field called name as Doe, John* and the lookup file has fullname: Doe, John M [us-us], it would be a match? | lookup myfile fullname as name I appreciate any help. I tried looking around for this, but only found references to the wildcard in the lookup, not in the dataset.

niketn · ‎03-11-2020

Anytime. Field names prefixed with underscore was a trick I learnt from @woodcock 🙂

Posts	32
Solutions	5
Karma Given	2
Karma Received	8
Member Since	‎06-20-2018

Online Status	Offline
Date Last Visited	a week ago

Macro Expansion - Possible Bug

Lookup with wildcard in data, not in lookup table?

Using tokens in XLM dashboard table "fields" tag- ...

Re: Macro Expansion - Possible Bug

Re: Splunk Indexer Cluster not identifying new bun...

Re: limit timechart with span and per_hour to 2 de...

Re: What is this Splunk dashboard javascript error...

Re: How to calculate time duration between 2 event...

Re: HTTP 400 error in DBConnect due to changing ad...

Re: KV Store status is currently unknown- How to r...

Re: Tenable TA - Historical reporting of remediate...

Re: Recently cluster="M5-CLDB" changed this to ...

Re: Splunk create a table using multiple fields

Re: ldapsearch: Trying to search last 2 days in wh...

Re: How to query a field in DBXQuery that contains...

Re: How to Dynamically save model name using a col...

Re: Why are we missing data on Tenable Add-On?

Re: DB connect missing events

Re: Tenable Add-On for Splunk

Re: After dropdown selection, how to return to the...

Re: How to provide a valid start time for the Tena...

Re: How to default stats to zero when no rows retu...

Re: Adjusting search to remove and add user to loo...

Re: How to set bar chart a specific colour?

Re: Help on regex for breaking an url

Re: Extract a field from my raw data using rex?

Lookup with wildcard in data, not in lookup table?

Re: Using tokens in XLM dashboard table "fields" t...