Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- Find Answers
- :
- About dflodstrom
dflodstrom
Builder
Member since:
04-28-2014
10-15-2024
Community Statistics
| Posts | 221 |
| Solutions | 22 |
| Karma Given | 223 |
| Karma Received | 77 |
| Member Since | 04-28-2014 |
Activity Feed
- Got Karma for Re: increase dropdown limit values : 1000 values / 25 000 values. 11-12-2025 04:21 AM
- Posted Re: increase dropdown limit values : 1000 values / 25 000 values on Dashboards & Visualizations. 10-15-2024 02:43 PM
- Got Karma for Re: Unset token after timepicker/time is changed. 10-06-2022 07:28 AM
- Got Karma for Re: License usage dashboard results vary when using split. 05-28-2021 03:24 PM
- Got Karma for Re: Steps to remove a cluster member permanently. 04-14-2021 02:58 PM
- Got Karma for Re: how can I keep the original host name in my summary index?. 03-03-2021 07:50 AM
- Karma Re: Mac OS client logs into splunk for dfronck. 10-07-2020 07:03 AM
- Karma Re: Latest eStreamer not CIM compliant? for bmorgenthaler. 08-05-2020 07:24 AM
- Got Karma for Why is Restrict Search Terms not working. 07-15-2020 02:09 AM
- Karma Re: How come sha256(_raw). Does not give result for Sukisen1981. 06-05-2020 12:50 AM
- Karma Re: How come sha256(_raw). Does not give result for Sukisen1981. 06-05-2020 12:50 AM
- Karma Re: How can I execute two Netwitness query sentence at the same time? how to configure this? for DalJeanis. 06-05-2020 12:50 AM
- Karma Re: How can I execute two Netwitness query sentence at the same time? how to configure this? for rataide. 06-05-2020 12:50 AM
- Karma Re: Modifying Permissions for Lookup Files viewed in the App for richgalloway. 06-05-2020 12:50 AM
- Karma How come the comment "macro" is not working? for weidertc. 06-05-2020 12:50 AM
- Karma Re: How come the comment "macro" is not working? for weidertc. 06-05-2020 12:50 AM
- Karma Re: Splunk with Menlo Integration for richgalloway. 06-05-2020 12:50 AM
- Karma Re: Why are some tokens not expanding in incident review even though the fields are present in the notable event? for DavidHourani. 06-05-2020 12:50 AM
- Karma Re: Splunk Enterprise Security: Cisco ASA logs extracting in ES search- in search and reporting, but not in ES search? for tiaatim. 06-05-2020 12:50 AM
- Karma Re: Checkpoint logs being indexed incorrectly ( One hour earlier ) for jacobpevans. 06-05-2020 12:50 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 1 | |||
| 2 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 1 |
10-15-2024
02:43 PM
1 Karma
Yes, really but not 25k. My list is longer than 1000 entries and works just fine in classic dashboards. Users don't have to scroll through the whole list, they can start typing in the dropdown input to filter the list.
... View more
05-01-2020
12:01 PM
bump. We applied this fix ages ago but still seems to be an issue today.
... View more
12-09-2019
10:23 AM
bump. no answers from the community or support.
... View more
11-07-2019
06:28 PM
Thats an important distinction. Glad you got it working!
... View more
11-07-2019
06:18 PM
That is definitely strange. Glad you got it working!
... View more
11-07-2019
04:27 PM
Have you tried escaping the quotation marks in your TIME_PREFIX ?
TIME_PREFIX = \"created\":\s\"
... View more
11-07-2019
02:59 PM
Where is it prompting you to create a user, when you run splunk edit or when you run splunk start after the 6 lines you are showing?
Have you tried using the no-prompt flag? If you do that and Splunk doesn't start after its initial run you may have to move your password edit line after the initial splunk start and then issue a splunk restart.
... View more
11-07-2019
02:48 PM
and in app imports the "Application Regular Expression" still includes Splunk_[ST]A_.* right?
Have you tried restarting Splunk or issuing a debug/refresh since applying any of these changes?
... View more
11-07-2019
02:37 PM
What tags do you see? For these logs you should see: network, communicate, session, vpn, start, end, and probably a few others. Is any of the field extraction happening in your ES search?
... View more
11-07-2019
02:16 PM
You just need to schedule the search to do that and it will access the latest results using the loadjob command... make sure you | tstats sumarriesonly=true
🙂
... View more
11-07-2019
02:13 PM
You're on the right path. One thing to check is Apps>Manage Apps and under "Sharing" for Splunk Add-on for Cisco ASA make sure it is set to global. I believe this takes precedence over the permissions for each knowledge object inside of the app.
For the app import navigate to ES and then Configure>General>App Import Update (may vary slightly by version). I don't think that will be your issue since the default regexes include Splunk patterns to match Splunk_TA*.
Since its not working in ES or CIM I hope its just a top level permission issue for you.
... View more
11-07-2019
01:35 PM
1 Karma
Be sure to add "summariesonly=true" to your tstats search, that should speed things up considerably.
... View more
11-07-2019
01:32 PM
Make sure the permissions for Splunk_TA_cisco-asa are set to share KOs from it globally and that the app import configuration in ES hasn't be modified to somehow exclude that particular TA. By default I believe that app will be imported by name but depending on your version of ES may not be imported automatically because of permissions issues.
... View more
11-07-2019
01:28 PM
The field names themselves have no spaces or special characters; $signature$, $dest$ The values do sometimes have special characters, especially signature, but not always but the token expansion fails regardless of the values.
... View more
11-06-2019
11:16 AM
The limitations listed in that doc do not apply to my case:
"The search command does not support token delimiters in the middle of a field name." and "If you have tokens dependent on the expansion of other tokens, those tokens might not be reliably expanded because you cannot specify the order in which tokens are expanded."
... View more
11-06-2019
06:39 AM
Splunk Version 7.3.2, ES Version 5.3.1
Post-upgrade a couple of our notables are displaying tokens in the notable title rather than expanding to the values of those fields from the notable event; I can see these fields and their values when I search index=notable. I've re-created these rules manually and the issue exists in the new rules too. I've also tried running " notable | expandtoken field1 field2" and the tokens do not expand, I see $tokens$ in the Title and Description. I've seen this issue in the past when a token is misspelled and therefore the field doesn't exist, like $desst$.
Any suggestions are appreciated.
... View more
10-29-2019
07:03 AM
The CrowdStrike Falcon App for Splunk version 1.0.4 ships with a macro called summariesonly which translates to "summariesonly=false". Because of how configurations are merged, Splunk was using the macro from this app instead of the pre-configured macro that ships with ES. Disabling CrowdStrike's macro fixed this for me.
... View more
10-29-2019
06:58 AM
After installing the CrowdStrike app for Splunk, version 1.0.4, any saved/scheduled/correlation search using tstats are running extremely slow.
... View more
05-21-2019
10:06 AM
^ Convert that comment to an answer. You're looking for sha256()
... View more
04-08-2019
07:44 AM
To solve this issue I used the lower case values in my eval. So in your case try: eval urgency=case(infection_count<=1, "low", infection_count>1 AND infection_count<=5, "medium", infection_count>5 AND infection_count<=10, "high")
... View more
04-01-2019
08:07 PM
1 Karma
You can use an eval to store the original host value: | eval orig_host=host | collect ...
... View more
03-27-2019
09:49 AM
From what I can tell this is a limitation of the TA. Evidently this type of input won't be supported in future versions but this is a real setback for a lot of users.
... View more
03-26-2019
08:19 PM
To run a second NetWitness query using this app, netwitness_query, you can copy the nwsdk_query.conf file to a new file like nwsdk_query_dns.conf . Configure the query and last_mid_file values and then create a stanza for this file in inputs.conf. [script://./bin/nwsdk_query.py nwsdk_query_dns] .
@rataide provided this answer in the comments, I only expanded on it slightly. There is no need to copy or modify the script.
... View more
01-31-2019
07:56 AM
If you only want those with write access to have read access then it shouldn't be that difficult to add this to all of the apps with lookups you want to hide. I'm not suggesting doing this one-by-one by hand but manipulating the permissions with metadata seems to be how this is done.
... View more
01-24-2019
02:34 PM
If you at least know a regex pattern you can use to extract the field name and value combinations you can use an EXTRACT statement in props, or a combination of props and transforms, to extract your field names and values.
If, for example your events have something like "field=value" you could use (?<_KEY_1>[a-z]+)=(?<_VAL_1>[a-z]+)
Here's an example of a config I've created in props to solve this very issue:
[mysourcetype]
EXTRACT-custom_sourcetype_extract= (?<_KEY_1>[\w\s]+)\:\s?(?<_VAL_1>[^\n]+)
For reference: Regex Field Name Extraction
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
10-15-2024
06:04 PM
|
Karma given to
