Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Are you a member of the Splunk Community?
Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- Find Answers
- :
- About tungntran
tungntran
Explorer
Member since:
11-02-2015
01-29-2022
Community Statistics
| Posts | 7 |
| Solutions | 1 |
| Karma Given | 0 |
| Karma Received | 1 |
| Member Since | 11-02-2015 |
Activity Feed
- Posted Re: Deleting reports on Splunk SOAR. 09-08-2021 10:57 PM
- Got Karma for Re: ForeScout CounterACT Integration Module: How to change the index for the counteract web_event sourcetype?. 06-05-2020 12:47 AM
- Posted Re: Using "stats count by" after "case eval", why am I not getting any results? on Splunk Search. 08-04-2016 12:58 PM
- Posted Using "stats count by" after "case eval", why am I not getting any results? on Splunk Search. 08-04-2016 12:48 PM
- Tagged Using "stats count by" after "case eval", why am I not getting any results? on Splunk Search. 08-04-2016 12:48 PM
- Tagged Using "stats count by" after "case eval", why am I not getting any results? on Splunk Search. 08-04-2016 12:48 PM
- Tagged Using "stats count by" after "case eval", why am I not getting any results? on Splunk Search. 08-04-2016 12:48 PM
- Tagged Using "stats count by" after "case eval", why am I not getting any results? on Splunk Search. 08-04-2016 12:48 PM
- Tagged Using "stats count by" after "case eval", why am I not getting any results? on Splunk Search. 08-04-2016 12:48 PM
- Posted Re: ForeScout CounterACT Integration Module: How to change the index for the counteract web_event sourcetype? on Deployment Architecture. 02-22-2016 05:22 PM
- Posted ForeScout CounterACT Integration Module: How to change the index for the counteract web_event sourcetype? on Deployment Architecture. 02-22-2016 12:24 PM
- Tagged ForeScout CounterACT Integration Module: How to change the index for the counteract web_event sourcetype? on Deployment Architecture. 02-22-2016 12:24 PM
- Tagged ForeScout CounterACT Integration Module: How to change the index for the counteract web_event sourcetype? on Deployment Architecture. 02-22-2016 12:24 PM
- Tagged ForeScout CounterACT Integration Module: How to change the index for the counteract web_event sourcetype? on Deployment Architecture. 02-22-2016 12:24 PM
- Posted Re: Splunk Add-on for Nessus: Why am I unable to pull Nessus data after configuring the API key? "ParseError: not well-formed (invalid token)" on All Apps and Add-ons. 12-23-2015 08:47 AM
- Posted Splunk Add-on for Nessus: Why am I unable to pull Nessus data after configuring the API key? "ParseError: not well-formed (invalid token)" on All Apps and Add-ons. 12-21-2015 03:49 PM
- Tagged Splunk Add-on for Nessus: Why am I unable to pull Nessus data after configuring the API key? "ParseError: not well-formed (invalid token)" on All Apps and Add-ons. 12-21-2015 03:49 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 |
09-08-2021
10:57 PM
I have the same issue. It's frustrating a simple action like that takes so much time to research and all the docs and Googling refer back to Splunk Enterprise.
... View more
08-04-2016
12:58 PM
Dude, that's it! thank you for the explanation on the single quote.
... View more
08-04-2016
12:48 PM
Hello,
I'm trying to change a value of a field using eval case then do a stats count based on that field. I'm getting no results.
In the code below I'm searching for an event with 2 specific field values, then alter the value to something meaningful then attempt to do a stats enter code here on it.
index=myindex sourcetype=mysourcetype
(action.objectType=core.user_auth.login_success OR action.objectType=core.user_auth.login_failed) |
eval status=case(action.objectType==core.user_auth.login_success,"Login Successful",action.objectType==core.user_auth.login_failed,"Login Failed")|
stats count by status
The closest Splunk answer I can find is this https://answers.splunk.com/answers/98575/unable-to-use-case-with-stats.html?utm_source=typeahead&utm_medium=newquestion&utm_campaign=no_votes_sort_relev but still not returning any results. What am I doing wrong? I verified the field "action.objectType" exists with the values I'm checking for.
Thanks,
... View more
02-22-2016
05:22 PM
1 Karma
Figured it out.
In the counteract policy for Splunk, edit the condition. Under the "HTTP Request" tab for the "DEX Send Web..." action add the index name.
Original:
https://[IP]:[port]/services/receivers/simple?source=CounterACT&sourcetype=web_event
Changed index:
https://[IP]:[port]/services/receivers/simple?index=counteract&source=CounterACT&sourcetype=web_event
... View more
02-22-2016
12:24 PM
Hi All,
I was able to get counteract module to forward data using "web_event" sourcetype. However, all the data resides in the "main" index. Does anyone have any tips on how to change the index for the data being forwarded by counteract integration module?
Thanks,
Tung
... View more
12-23-2015
08:47 AM
Thanks for responding, adding the single quote didn't help. I'm getting the same error.
... View more
12-21-2015
03:49 PM
Hi,
I installed Splunk Add-on for Nessus on a search head and configured the API key for Nessus, but I'm not seeing any data. Running the debug I get the following:
2015-12-21 14:32:24,525 ERROR pid=2708 tid=MainThread file=nessus.py:get_nessus_modinput_configs:157 | Traceback (most recent call last):
File "C:\Program Files\Splunk\etc\apps\Splunk_TA_nessus\bin\nessus.py", line 135, in get_nessus_modinput_configs
config.remove_expired_credentials()
File "C:\Program Files\Splunk\etc\apps\Splunk_TA_nessus\bin\nessus_config.py", line 142, in remove_expired_credentials
creds = self._get_raw_stanza(stanza_type="cred", check_exist=False)
File "C:\Program Files\Splunk\etc\apps\Splunk_TA_nessus\bin\nessus_config.py", line 262, in _get_raw_stanza
stanza = self.cred_mgr.get_clear_password(stanza_name)
File "C:\Program Files\Splunk\etc\apps\Splunk_TA_nessus\bin\splunktalib\credentials.py", line 159, in get_clear_password
return self._get_credentials("clear_password", name)
File "C:\Program Files\Splunk\etc\apps\Splunk_TA_nessus\bin\splunktalib\credentials.py", line 179, in _get_credentials
passwords = xdp.parse_conf_xml_dom(content)
File "C:\Program Files\Splunk\etc\apps\Splunk_TA_nessus\bin\splunktalib\common\xml_dom_parser.py", line 19, in parse_conf_xml_dom
xml_conf = et.fromstring(xml_content)
File "<string>", line 124, in XML
ParseError: not well-formed (invalid token): line 32, column 38
Any help is appreciated.
-Thanks
... View more
