Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Are you a member of the Splunk Community?
Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- About SecureIA
SecureIA
Path Finder
Member since:
11-10-2015
06-05-2020
Community Statistics
| Posts | 33 |
| Solutions | 1 |
| Karma Given | 0 |
| Karma Received | 7 |
| Member Since | 11-10-2015 |
Activity Feed
- Got Karma for Re: How to configure a role for a user to change their password within their own app?. 09-18-2020 01:38 AM
- Got Karma for How to configure a role for a user to change their password within their own app?. 06-05-2020 12:48 AM
- Got Karma for How to configure a role for a user to change their password within their own app?. 06-05-2020 12:48 AM
- Got Karma for Re: How to configure a role for a user to change their password within their own app?. 06-05-2020 12:48 AM
- Got Karma for Re: How to configure a role for a user to change their password within their own app?. 06-05-2020 12:48 AM
- Got Karma for Re: How to configure a role for a user to change their password within their own app?. 06-05-2020 12:48 AM
- Got Karma for How to edit my search to show a line of an average over the last 30 days on a column graph?. 06-05-2020 12:47 AM
- Posted Re: Peak hours of the week by total daily percentage on Splunk Search. 03-08-2017 04:03 AM
- Posted Re: Peak hours of the week by total daily percentage on Splunk Search. 03-08-2017 03:37 AM
- Posted Peak hours of the week by total daily percentage on Splunk Search. 03-08-2017 03:09 AM
- Posted Re: How to configure a role for a user to change their password within their own app? on Security. 12-14-2016 06:59 AM
- Posted Re: How to configure a role for a user to change their password within their own app? on Security. 12-14-2016 06:54 AM
- Posted How to configure a role for a user to change their password within their own app? on Security. 12-14-2016 04:32 AM
- Tagged How to configure a role for a user to change their password within their own app? on Security. 12-14-2016 04:32 AM
- Posted Alerting on a threshold on Splunk Search. 11-02-2016 05:57 AM
- Tagged Alerting on a threshold on Splunk Search. 11-02-2016 05:57 AM
- Posted Re: How to hide the Search & Reporting app from a user, but allow them access to a custom app? on Security. 11-01-2016 09:36 AM
- Posted Re: How to hide the Search & Reporting app from a user, but allow them access to a custom app? on Security. 11-01-2016 03:41 AM
- Posted How to hide the Search & Reporting app from a user, but allow them access to a custom app? on Security. 10-31-2016 09:08 AM
- Tagged How to hide the Search & Reporting app from a user, but allow them access to a custom app? on Security. 10-31-2016 09:08 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 2 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 1 |
03-08-2017
04:03 AM
That is exactly what I needed. Thank you so much!!
... View more
03-08-2017
03:37 AM
Thank you so much for your reply. I'm sorry my example search was wrong.
My original search is - sourcetype=iis | eval users=cs_username | timechart span=1d dc(users)
Would this change the search string much? I have replaced count with dc(users) in the hope that it would work
... View more
03-08-2017
03:09 AM
Hi,
I need to display the peak times of day that events are occurring. Essentially, I want to find out the peak times of the week that people are logging into my web application but I want to display this by the percent of the daily total
I have my search here - host="" AND "" AND "GET" AND "" This brings the results that I need.
Any help with this would be massively appreciated.
Cheers,
Lee
... View more
By adding list_inputs and rest_properties_get to the user role, the user should then be able to edit their own password. The change_own_password capability also needs to be included of course.
... View more
12-14-2016
06:54 AM
I am using local accounts sir. I have managed to solve my issue by adding list_inputs and rest_properties_get to the user role.
... View more
Hi all,
I have an issue whereby I have created a role which pretty much allows users to simply just look at their dashboards in their own app. However, they cannot change their own passwords.
I have given them the change_own_password capability within the role. Unfortunately, when the users access Edit Account, it leads them to a 500 error.
Would anybody be able to assist or point me in the right direction with this?
Many thanks in advance
... View more
11-02-2016
05:57 AM
Hi all,
I currently have a very simple search that looks at the distinct visitors for a website per day. See below,
sourcetype=iis | stats dc(cs_username)
Is there a way of converting this search to an alert which will trigger when there is an abnormally high amount of visitors?
Any help would be massively appreciated.
... View more
11-01-2016
09:36 AM
Thank you Giuseppe!! I shall try this, I have a solution at the moment but it is a little messy
Cheers,
Lee
... View more
11-01-2016
03:41 AM
Both the user and role have their default app set to the new app. Unfortunately they cannot see the new app without having permissions for the Search & Reporting app.
... View more
10-31-2016
09:08 AM
Hello all,
I have created an app which contains some dashboards which I would like to present to a single user. However, I would like to restrict access to the Search & Reporting app. When I attempt to do this, my user cannot log in and gets a 404 error.
The only way that the user can access the new app is by providing them with read access to the Search & Reporting app.
Is there any solution around this in Splunk?
Regards,
... View more
03-01-2016
05:27 AM
I have read much of it and I am becoming more and more familiar with Splunk with each passing week. Trouble is that I have never been able to successfully implement an idea on a scatter graph.
The main issue I'm having is that I'm trying to plot against time. Therefore, may I ask whether a timechart be more suitable?
... View more
03-01-2016
02:20 AM
Thank you so much!! I remember doing this a while back but had totally forgotten. Thanks for reminding me
... View more
03-01-2016
02:19 AM
Hi helpful people,
I wish to plot login events on a scatter graph. I would like to show when logins have occurred and on what host. (preferably color can symbolize a certain host if that is possible). Here is my search below:
host=??? NOT host=??? NOT host=??? NOT username=??? NOT username=??? NOT username=??? NOT username=??? "new session"
This search returns all the login events, but I cannot seem to understand how to use the scatter graphs in Splunk.
Any help would be truly appreciated.
... View more
02-29-2016
05:58 AM
Hi Helpful People,
I have a table which tells me perfectly well who is logged in to systems. My results show the words "Opened" and "Closed". I wish for them to say "In" or "Out" instead. Is there anyway that I can achieve this so that my results are more readable. My search is as follows:
host=?? NOT host=?? NOT host=?? NOT username=?? NOT username= ?? NOT username= ?? NOT username=?? "Session opened" OR "Session closed" | sort username time | chart latest(lstate) over username by host.
... View more
01-15-2016
07:07 AM
From this I get an error:-
"Error in 'eval' command: The expression is malformed. Expected )."
I put in a ')' after line 4 to which I get:-
"Error in 'eval' command: The arguments to the 'isnull' function are invalid."
... View more
01-15-2016
06:09 AM
It basically logs in, then in again - out - in - out. Thats a single login. Also when you exit, it will send a log out.
Your assumption below is exactly right:-
"In which case you want to discard all the short, intermediate login/logout sequences and just see the big one that wraps around those?"
... View more
01-15-2016
02:58 AM
Hi Guys,
I'm having a bit of trouble with this. Basically I wish to show who is into this device on a dashboard and I have a great search which takes the last login state and should work. My problem is that the device logs in such a way that the last state is always 'out' and will show users being 'logged out' even if they are in fact 'logged in' as the example below states. Would there possibly be way in which my search could discount the last login state? Or perhaps do this another way, I'm open to any suggestions.
<device> (2016-01-15T10:39:04) sessiond[1627]: msg_id="3E00-0004" Management user lheath@<device> from 10.20.84.39 logged out
host = <device> source = udp:514 sourcetype = syslog
<device> (2016-01-15T10:39:01) sessiond[1627]: msg_id="3E00-0002" Management user lheath@<device> from 10.20.84.39 logged in
host = <device> source = udp:514 sourcetype = syslog
<device> (2016-01-15T10:39:00) sessiond[1627]: msg_id="3E00-0004" Management user lheath@<device> from 10.20.84.39 logged out
host = <device> source = udp:514 sourcetype = syslog
<device> (2016-01-15T10:38:59) sessiond[1627]: msg_id="3E00-0002" Management user lheath@<device> from 10.20.84.39 logged in
host = <device> source = udp:514 sourcetype = syslog
<device> (2016-01-15T10:38:36) sessiond[1627]: msg_id="3E00-0002" Management user lheath@<device> from 10.20.84.39 logged in
host = <device> source = udp:514 sourcetype = syslog
Any help would be massively appreciated.
Cheers
... View more
01-14-2016
07:14 AM
I am alerting on a failed login search provided below:-
host=CATSG14 "Failed login" GATEWAY="" USER_IDv3=""| stats count by USER_IDv3
I would like my email alert to say:
The alert condition for '$name$' was triggered.
User $result.USER_IDv3$ is having trouble accessing the $GATEWAY$ gateway.
The email picks out the USER_IDv3 field, but leaves the GATEWAY field blank. Is there anyway to grab the GATEWAY field?
... View more
01-13-2016
12:39 AM
Thank you so much 🙂 I managed to get it to work. All the best!!
... View more
01-13-2016
12:37 AM
Absolutely bang on mate!! Thank you so much!! Cheers!! 🙂
... View more
01-12-2016
08:19 AM
Cheers for replying, it doesn't seem to work I'm afraid.
... View more
01-12-2016
05:11 AM
Sure,
Gateway Activity Clone
Dashboard showing activity on ARCA gateways
<input type="time" token="field1" searchWhenChanged="true">
<label>Time</label>
<default>
<earliest>@d</earliest>
<latest>now</latest>
</default>
</input>
<input type="text" token="USER_IDv3" searchWhenChanged="true">
<label>User Search</label>
<default>*</default>
<prefix>*</prefix>
<suffix>*</suffix>
</input>
<input type="dropdown" token="GATEWAY" searchWhenChanged="true">
<label>Gateway Search</label>
<default>*</default>
<prefix>*</prefix>
<suffix>*</suffix>
<choice value="*">Overall</choice>
<choice value="RLIGWAUTH">RLI</choice>
<choice value="INTGWAUTH">Internet</choice>
<valuePrefix>*</valuePrefix>
<valueSuffix>*</valueSuffix>
</input>
... View more
01-12-2016
04:35 AM
Thanks for your reply, I've tried this and still nothing. When I put GATEWAY in the stats, it looks promising but then asks for numeric data.
... View more
01-12-2016
02:24 AM
Hi helpful people,
I have an interactive dashboard which can search different time scales and drilldown on users. Next, I wish to drilldown on two different locations; more specifically, two different gateways. My current search string is below:
host=CATSG14 "Failed login" GATEWAY="*" AND "Failed login" | stats count by USER_IDv3 | sort - count | search USER_IDv3="$USER_IDv3$" GATEWAY="$GATEWAY$"
My idea is to have a drop-down box which lists the gateways and from this, I can sort. The problem I'm getting at the moment is that no Statistics are being shown. Only when I delete the GATEWAY="$GATEWAY$" from the string, do stats finally appear. Where I am I going wrong?
Any help would be massively appreciated.
... View more
01-12-2016
01:45 AM
Thanks alot guys, I managed this 🙂
... View more
