Hi Splunk Community,
I have been working with Splunk for quite a while and recently wanted to create my own Splunk form using XML. A form that I am currently attempting to create is for a user to input multiple source IP addresses (ex. 10.1.1.1.1, 10.2.2.2.2,...) and Splunk would display all of the user's information including their full name, phone number, and email address from the source IP addresses that were inputted into the form. For example, if I type in 10.1.1.1.1,10.2.2.2.2 then Splunk would display the full name, phone number, and email addresses of those two source IP addresses. This is what I have so far:
Splunk Phishing Email Form:
A simple XML form that displays the user's information once the Source IP address is inputted.
<input type= "text" token="Source_IP">
<label>Enter a Source IP Address </label>
</input>
<row>
<panel>
<search>
<query>
index="wineventlogs" user!= "*$"
[ eval src_ip = "Source_IP" | makemv src_ip delim="," | mvexpand src_ip | fields src_ip]
| dedup user | table user, user_nick, user_phone, user_email
</query>
</search>
</panel>
</row>
I cannot test this into Splunk because for some reason I am not able to access it at home. I would very much appreciate it if anybody would tell me if the XML code is right. If not, could you please tell what is wrong with it and how I could fix it. Thank you!
... View more