About marios_kstone

marios_kstone · ‎08-05-2021

HI all, in our identity feed there are some instances where different identities are registered with the same email address. ES by default merges using "key" fields and email. I want to disable this behaviour, but I cannot find how to do that. In the documentation it is written "The key field is identity and the default merge convention is email.". Anyone knows how can I change the default merge convention? Thanks Mario

marios_kstone · ‎07-07-2021

After some investigation and analyzing the "Incident Review - Main" new query, I found out that the suppression removal is moved way up in the new query compared to previous one. Modifying the query placing the suppression near the end of the query fixed it...

marios_kstone · ‎07-07-2021

Hello, we just updated ES from 6.4 to 6.6. The new incident review dashboard completely ignores suppressed events, showing them in the list. Is this a known issue or something caused by the upgrade? Anyone has a solution for this? (Splunk Enterprise version 8.1.3) Thanks

marios_kstone · ‎02-14-2019

I have a similar issue after upgrading from 6.6.0 to 7.2.1. We noticed the slowness is present in searches with a lot of append operations. In some cases searches that previously took few seconds, now take 10+ minutes. Analyzing search.log we pinpointed the issue to be on the search optimization. Disabling search optimizatiion appending | noop search_optimization=false to the query partially solves the problem (the search is slower than before, but at least acceptable).

marios_kstone · ‎12-06-2018

The "user name" is a nice idea, unfortunately we use the same ldap server for authentication and the same user. The CSS override is per-app/per dashboard and not global... unless there is some way I couldn't find to globally override the default CSS.

marios_kstone · ‎11-29-2018

I need to make some visual change to our test Splunk environment in order to make clear that you are in the test environment and not in the production one. The login disclaimer is not enough as for the most time you are actually logged on and with multiple tabs mistakes may happen. I thought to change the top black bar (not the app navigation bar) to a different color but I have been unable to track down the css setting that allows me to do that and where to define it as a global, not per-app, change. Anyone faced and solved a similar issue? Thanks

marios_kstone · ‎11-19-2018

Check https://answers.splunk.com/answers/686946/tableau-connection-issue-with-splunk-odbc-211-afte.html. Splunk ODBC is not supported (yet?) on Splunk 7.*. Hopefully it will be fixed in the future.

marios_kstone · ‎02-26-2018

Yes, I tried. The header is rotated but the columns width does not change. Also, the header overlaps other stuff on page... very weird

marios_kstone · ‎02-26-2018

I am trying to override the standard CSS to format table header in order to rotate the text by 90 degrees. I need this on some numeric tables with a lot of columns. Unfortunately just adding "transform: rotate(90deg);" to the "th" CSS does not seem to be enough as the header is rotated but the column width is preserved. Anyone successfully managed to achieve this?

marios_kstone · ‎11-14-2017

We have a very similar issue on OPSEC LEA 4.2.0 and Splunk Core 6.6.0. Actually, events are logged 13 times and this is obviously destroying our licenses. An easy query to detect the issue is: sourcetype=opsec*|stats count, dc(_raw) as dedup by host|eval ratio=count/dedup Strange thing is that a couple of weeks ago, events were indexed 9 times and now 13 times, which means that things get worse over time. Restarting splunk, resetting/recreating OPSEC inputs did not help either. We have an open case with Splunk...

marios_kstone · ‎03-04-2016

Thanks a lot. A really clean and creative approach and I like it. I still see some issue in feeding the data seamlessly to the target infrastructure (I mean - like you say - I will have to mangle the data a little bit on arrival), but I see this a lot easier than passing through the nightmare of CSVs or JSON data backfilling. I will work on it and let you know how it goes.

marios_kstone · ‎02-19-2016

Hi all, consider the following scenario: there are two splunk infrastructures. The first (A) collects data from several forwarders and forwards a subset of this data to a second indexer (B). When B receives the data forwarded from A, it performs several index-time transforms (metadata changes like index. source, sourcetype, host) based on data from the received flow (who was the original host, source etc). A lost connectivity with B for some days for network related issues and now B has a gap in forwarded data. Is there a way to fill this gap in some way? Consider that A is an indexer too, so it has all the data stored. Unfortunately, all the methods I tried (dump, exporttool, moving indexes) do not allow B to reprocess the data using the same index-time rules because the source data IS different (different source, different host etc). I don't care if the imported data will count on indexed daily volume, as I can create chunks and import some each day. If someone already faced this issue or has some suggestion, I would really appreciate. Thank you Mario

marios_kstone · ‎07-17-2015

Actually there is no email and there is no way of sending personal messages from there... tried that

marios_kstone · ‎07-17-2015

I couldn't find a way to contat the Custom Visualization author other than this. I think visjs.org may be a great candidate to further expand it. And btw, great job. Mario

marios_kstone · ‎08-07-2012

Is there a way to be informed on timeline/features roadmap for next Splunk versions? I heard "rumors" about PDF server being fully integrated and supported on Windows platform and this may have an impact on our plans for future Splunk usage. Thanks

marios_kstone · ‎08-07-2012

Heavy forwarder does events parsing, which means you cannot change the index name on the indexer side (the "index=syslog" part on the indexer is ignored). You should switch the Heavy Forwarder with a Universal Forwarder to move the parsing logic to the indexer. Another option is to set the "sendCookedData=false" parameter in the output.conf in the HF to tell Splunk to send RAW unparsed data.

marios_kstone · ‎03-30-2012

Hello, I found out a weird behavior that I managed to track down to a possible UI bug. Issue: fields passed to workflow action do not match to the actual event that triggered the action. Splunk version: 4.3, build 115073 How to reproduce: Define a workflow action to display for an event and associate the URI "http://www.google.com/search?q=$host$", get method. Perform a search returning several events linked to the workflow action filter out the events selecting a time slot in the flashtimeline applet start the workflow action on the first event listed after the filtering Result: The workflow action is triggered but the parameters that are passed are returned from the first event of the unfiltered search. Anyone else can confirm this?

marios_kstone · ‎03-10-2012

Works like a charm. Thank you.

marios_kstone · ‎03-09-2012

Well, let's say that checking in a month timeframe should be acceptable. No other constraints. Right now we are able to do this on a relational DB (not that easy there too) but since the number of records is high and the query is complex, it's taking just too much time to return results.

marios_kstone · ‎03-09-2012

Consider the following three events: 1: time=xxxx,sent=Item1,recd="Item0" 2: time=xxxx,sent=Item2,recd="Item1,Item3,Item7" 3: time=xxxx,sent=Item8,recd="Item9,Item8" I want to be able to extract which Items have been sent but never received. In the above example, would be Item2 (it never appears in "recd" field). Each record can hold a single sent item, but multiple receive items (it is already parsed as a mv field). Log for a received item can be in an event before the "sent" item log. I was considering using transactions, but I am not sure about it. I am banging my head on this issue and would really appreciate any idea. Thank you

Posts	20
Solutions	1
Karma Given	8
Karma Received	7
Member Since	‎07-15-2011

Online Status	Offline
Date Last Visited	‎08-05-2021 06:07 AM

ES Identity: prevent merge for email field

Enterprise Security 6.6.0 Incident review shows su...

Changing the top bar color for all apps

How do I add Vertical headers in dashboards?

How to resend lost data between two splunk servers...

vis.js (visjs.org) would be a good candidate for n...

Where to find beta/upcoming splunk releases infos?

Workflow Action: bug when filtering via flashtimel...

Event correlation: how to find only events _not_ r...

ES Identity: prevent merge for email field

Re: Enterprise Security 6.6.0 Incident review show...

Enterprise Security 6.6.0 Incident review shows su...

Re: My searchhead is slow since I update from 6 to...

Re: Changing the top bar color for all apps

Changing the top bar color for all apps

Re: SplunkODBC issue with Tableua

Re: Vertical headers in dashboards

How do I add Vertical headers in dashboards?

Re: Splunk add-on for opsec (4.0): 2-3 times as mu...

Re: How to resend lost data between two splunk ser...

How to resend lost data between two splunk servers...

Re: vis.js (visjs.org) would be a good candidate f...

vis.js (visjs.org) would be a good candidate for n...

Where to find beta/upcoming splunk releases infos?

Re: warning in my indexer received event for uncon...

Workflow Action: bug when filtering via flashtimel...

Re: Event correlation: how to find only events _no...

Re: Event correlation: how to find only events _no...

Event correlation: how to find only events _not_ r...