Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- Find Answers
- :
- About agentsofshield
agentsofshield
Path Finder
Member since:
07-01-2018
04-14-2025
Community Statistics
| Posts | 38 |
| Solutions | 3 |
| Karma Given | 19 |
| Karma Received | 9 |
| Member Since | 07-01-2018 |
Activity Feed
- Karma Re: Changing the severity level of a notable ARAs event of a correlation search for livehybrid. 04-14-2025 12:07 AM
- Posted Changing the severity level of a notable ARAs event of a correlation search on Splunk Enterprise Security. 04-10-2025 03:46 AM
- Got Karma for How to delete a KV STORE lookup?. 11-06-2021 07:57 PM
- Got Karma for Re: Which command can I use to get data from a database? (not "dbxquery"). 06-19-2020 10:57 AM
- Karma Re: How to create a custom alert action Python script with parameters from search results? for schose. 06-05-2020 12:50 AM
- Karma Re: "Where Will Your Karma Take You?" Spam alert for ppablo. 06-05-2020 12:50 AM
- Karma Re: How to add a new row to a lookup using a Splunk query? for nickhills. 06-05-2020 12:50 AM
- Karma Re: How to reset dashboard when I press submit? (or send using HTTP POST) for kmorris_splunk. 06-05-2020 12:50 AM
- Karma Re: How to add a new row to a lookup using a Splunk query? for harsmarvania57. 06-05-2020 12:50 AM
- Karma Re: How to add a new row to a lookup using a Splunk query? for vnravikumar. 06-05-2020 12:50 AM
- Karma Why can't I use tokens ($result.host$) in my custom alert for micheldejong. 06-05-2020 12:50 AM
- Got Karma for "Where Will Your Karma Take You?" Spam alert. 06-05-2020 12:50 AM
- Got Karma for "Where Will Your Karma Take You?" Spam alert. 06-05-2020 12:50 AM
- Got Karma for How to reset dashboard when I press submit? (or send using HTTP POST). 06-05-2020 12:50 AM
- Got Karma for How to add a new row to a lookup using a Splunk query?. 06-05-2020 12:50 AM
- Got Karma for Splunk service on search heads going inactive after rolling restart. 06-05-2020 12:50 AM
- Karma Re: What is the identification process for SplunkForwarder? for richgalloway. 06-05-2020 12:49 AM
- Karma Re: How to create alert for server / forwarder / index that doesn't work? for renjith_nair. 06-05-2020 12:49 AM
- Karma Re: How to create an alert when process appears in multiple IPs? for renjith_nair. 06-05-2020 12:49 AM
- Karma Re: How to configure Load Balancing on Splunk Search Heads? for renjith_nair. 06-05-2020 12:49 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 1 | |||
| 1 | |||
| 1 | |||
| 0 | |||
| 2 | |||
| 0 | |||
| 0 | |||
| 0 |
04-10-2025
03:46 AM
Hello, I've recently encountered a problem with the severity level within the ARAs, my current severity level for this specific event is Medium but I want depending on the output of a specific field to alter that severity level to high or even critical but I just couldn't find a way to alter it without creating a completely new correlation search that checks that specific field and is always on
... View more
Labels
- Labels:
-
administration
-
splunk-assist
09-02-2019
01:20 AM
Hi, I tried to create a custom alert action that operates a script, but I didn't understand how to send parameters from the search results to the script.
For example: a script that checks Windows version for every IP address in the search results. How do I send the results to my script? What do I have to put in alert_actions.conf and in my script?
Please try to explain instead of just sending links to Splunk Docs, I read these and still didn't find my answer.
Thanks
... View more
Labels
- Labels:
-
Python
07-30-2019
04:38 AM
This is a cool answer that helps a little, BUT the results are still in the URL.
This means that if I refresh the page, it repeats the action again and I don't want it to.
... View more
07-28-2019
11:00 PM
1 Karma
I have a Splunk dashboard that sends data as variables to a script.
I don't want the script to run every time they refresh the page or go back a page. What should I do?
Is there a way to "submit" the form using HTTP POST so that the results won't appear in the URL?
Is there a way to run the search AND refresh the page at the same time while pressing "submit"?
Or is there an easy way to do it using JavaScript?
Example of what I have:
<form>
<label>Capture Packets</label>
<fieldset submitButton="True">
<input type="text" token="host">
<label>Host</label>
</input>
<input type="dropdown" token="runtime">
<choice value="30">30 Seconds</choice>
<choice value="60">1 Minute</choice>
<choice value="120">2 Minutes</choice>
</input>
</fieldset>
<row>
<panel>
<title>Run Script</title>
<table>
<search>
<query>| script capture $host$ $runtime$</query>
</search>
<option name="refresh.display">progressbar</option>
</table>
</panel>
</row>
</form>
... View more
Labels
- Labels:
-
scripted input
-
SplunkJS
-
visualization
03-12-2019
07:39 AM
1 Karma
I solved it, my mistake was that the query originally included a lot of quotations, so I added a config file where I wrote all the queries, then imported it to the script with this:
https://docs.python.org/2/library/xml.etree.elementtree.html
So, it's mostly a Python issue not a Splunk issue.
... View more
03-12-2019
05:31 AM
But I'm not taking my new values from a Splunk search. It's from a Python script. How do I just put specific values in the lookup?
... View more
03-12-2019
05:30 AM
How do I "make results"?
... View more
03-12-2019
05:20 AM
Sorry, I tried and it says "curl: (35) TCP connection reset by peer" even after replacing the values you mentioned ever with different admin users.
Is there no way to use the GUI to delete?
... View more
03-12-2019
02:01 AM
Didn't help, can I get the specific example?
... View more
03-12-2019
02:01 AM
I tried to use clean command, on the server it said "deleted" but Lookup Editor still claims the lookup exists.
The simple command "|outputlookup " won't help me because I want to delete the lookup table itself and not just the data.
... View more
03-12-2019
01:45 AM
1 Karma
Is there a Splunk query to add a new row or a new column to a lookup table?
I specifically ask for a query because I want my Python script to append rows automatically.
Thanks.
... View more
03-12-2019
01:41 AM
1 Karma
I have write permissions on a KV Store lookup. When I try to press "delete" on the Lookup Editor app, it says "Lookup file could not be deleted". I'm not trying to delete information, I want to delete the whole lookup. How can I do this?
... View more
01-06-2019
01:06 AM
I usually use "dbxquery" but it only works in the search app. I'm trying to export data from a database through Splunk SDK, so I'd like to know if there's an alternative command for the same purpose.
... View more
01-01-2019
12:57 AM
Hi
I usually export data from a database using the "dbxquery" command, but when I try doing it through Splunk SDK it doesn't recognize the command.
I learned that dbxquery can only be performed in the "search" app, so which alternative command can I use for my script?
Thanks
... View more
11-26-2018
02:52 AM
Hey there i am trying to do some data manipulation on some kvstore lookup table i have and i want to use python for it so i managed to get the information to python using the sdk but i can't find anywhere how to use the sdk to push data back into the lookup.
any help would be much appreciated!
... View more
10-31-2018
02:17 AM
The problem was with some debug incidents that made thousands of alerts per day, which made searching the alerts index very slow. I ended up disabling those alerts and deleting them from the alerts index.
... View more
10-31-2018
02:16 AM
Apparently the problem was with some debug incidents that made thousands of alerts per day, which made searching the alerts index very slow.
... View more
10-29-2018
01:45 AM
Hey, I've been using the Incident Posture dashboard as the SOC monitoring platform for about 6 months now and it worked great, now suddenly the dashboard is super slow, it takes about 3 minutes to load the incidents, which is a lot. Normal searches work fine.
Any idea why? The search heads are virtual and have 32GB RAM and 8 CPUs each.
Thanks in advance.
... View more
10-23-2018
12:51 AM
The problem was indeed with Restart=on-failure it should be Restart=always and then it works like a charm!
... View more
10-22-2018
04:34 AM
1 Karma
I made a splunk.service file inside /etc/systemd/system so I could manage splunk like a service.
Here is what i wrote inside it:
`[Unit]
Description=Splunk
[Service]
Type=forking
ExecStart=/opt/splunk/bin/splunk start
ExecStop=/opt/splunk/bin/splunk stop
Restart=on-failure`
After I made the service, every time I did a rolling restart on the search heads the service became inactive in all of them.
Is the Restart=on-failure interfering with the restart? what can I do to fix it?
Thanks.
... View more
09-06-2018
01:12 AM
Hi guys, we use alerts all the time and I always want my entire team to be able to see every alert. Which is why I get annoyed by changing every permission one by one. Any way to make it global by default or just change everything to global at once? Thanks
... View more
09-04-2018
07:16 AM
Say I have a table of processes and IP addresses. I want to make an alert when a certain process was monitored in multiple computers during the last 24 hours. How can I do it?
Very specific question I know, I just didn't know how to phrase it otherwise.
... View more
08-27-2018
02:13 AM
Your calculation is wrong for mb and onwards. it should be one 1024 less
... View more
08-16-2018
12:01 AM
I want to make changes to web.conf and distribute them. Any way to do it for search heads? Thanks.
... View more
08-12-2018
07:47 AM
Hello! So I installed the Cyberark add on in order to monitor Cyberark.
I already have a syslog server which produces .log files from Cyberark. Is there any way to monitor it directly from the .log files, or do I absolutely have to do it they way they specified in: https://docs.splunk.com/Documentation/AddOns/released/CyberArk/Setup (translating the files)?
It's just, so much easier if I could just translate the log files locally on the syslog server. Thank you!
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
04-14-2025
01:02 AM
|
Karma given to
