Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About gabriel_vasseur
gabriel_vasseur
Contributor
Member since:
03-14-2016
a month ago
Community Statistics
| Posts | 112 |
| Solutions | 7 |
| Karma Given | 70 |
| Karma Received | 34 |
| Member Since | 03-14-2016 |
Activity Feed
- Posted Re: How to format 86401 seconds as 24:00:01 on Splunk Search. a month ago
- Got Karma for Re: How to remove \ (backslash) using from URLs rex sed?. 03-17-2022 04:44 PM
- Posted Re: 8.0.9 indexers all stuck "batchadding" after upgrading cluster master to 8.2.2 on Installation. 09-06-2021 05:11 AM
- Posted 8.0.9 indexers all stuck "batchadding" after upgrading cluster master to 8.2.2 on Installation. 09-06-2021 01:14 AM
- Got Karma for How can I search the content of all my lookups?. 08-11-2021 02:34 AM
- Got Karma for Re: Enterprise Security 6.6.0 Incident review shows suppressed notables. 08-10-2021 10:45 PM
- Posted Re: Enterprise Security 6.6.0 Incident review shows suppressed notables on Splunk Enterprise Security. 08-10-2021 08:22 AM
- Karma Re: Enterprise Security 6.6.0 Incident review shows suppressed notables for danilomb. 08-10-2021 08:20 AM
- Posted Re: How to encode a URL for a Hipchat notification alert action if there is no urlencode() function? on Splunk Search. 08-03-2021 01:42 AM
- Got Karma for Re: How to remove \ (backslash) using from URLs rex sed?. 08-02-2021 09:09 AM
- Posted Re: Next Scheduled Time for all alerts is showing none on Alerting. 07-28-2021 06:59 AM
- Posted How can I search the content of all my lookups? on Splunk Search. 06-16-2021 02:16 AM
- Posted Re: Disable identitymerge in older enterprise security? on Splunk Enterprise Security. 03-25-2021 04:06 AM
- Posted Disable identitymerge in older enterprise security? on Splunk Enterprise Security. 03-23-2021 03:42 AM
- Posted Re: entitymerge for identity_lookup_expanded doesn't produce any results on Splunk Enterprise Security. 03-15-2021 03:39 AM
- Posted Re: Why is every single piece of text in identity_lookup_expanded lowercased? on Splunk Enterprise Security. 03-05-2021 04:24 AM
- Posted entitymerge for identity_lookup_expanded doesn't produce any results on Splunk Enterprise Security. 03-02-2021 07:57 AM
- Posted Why is every single piece of text in identity_lookup_expanded lowercased? on Splunk Enterprise Security. 03-02-2021 07:48 AM
- Karma Re: Ultimate Hostname from GUID for richgalloway. 03-02-2021 07:40 AM
- Posted Ultimate Hostname from GUID on Deployment Architecture. 02-22-2021 02:37 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 1 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 1 | |||
| 0 |
a month ago
You do not want the %60 in: | eval hrs=floor((test/3600)%60) Otherwise a duration of 66 hours will become 06 hours...
... View more
09-06-2021
05:11 AM
Turns out the solution is: do not put the cluster master in maintenance mode before upgrading it. I'm pretty sure I saw in the docs on a previous upgrade that if the maintenance mode wasn't on whilst upgrading the cluster master it could cause problems... Every upgrade is different I guess!
... View more
09-06-2021
01:14 AM
Hi, I'm trying to upgrade splunk from 8.0.9 to 8.2.2. According to the docs, the upgrade starts with the cluster master. After upgrading the cluster master and removing the maintenance mode, all the indexers are stuck at in the "batchadding" status. Looking at the logs from one indexer, it goes through a cycle of: event=addPeer Batch=1/9 ...success... event=addPeer Batch=2/9 ...success... ... event=addPeer Batch=9/9 ERROR Read Timeout... WARN Master is down! Make sure pass4SymmKey is matching if master is running... WARN Failed to register with cluster master... Master is back up! Rinse and repeat. So basically it talks ok to the cluster master for a while and then get a timeout and starts over. Any idea what's going on? I did check the pass4SymmKey and they are the same everywhere, they haven't changed. Cheers, Gabriel.
... View more
Labels
- Labels:
-
upgrade
08-10-2021
08:22 AM
1 Karma
This should be the proper answer. We had the same issue and it fixed it. According to btool, before fixing it, the "replicate.macros" setting didn't even exist on our search heads. But after setting it to true, suppressions started working in IR. Another quality software update from splunk 🙄
... View more
08-03-2021
01:42 AM
Do you have a version compatible with python3?
... View more
07-28-2021
06:59 AM
Long shot, but it might be worth checking who owns the alerts. "settings" (in the top right corner) > "Searches, reports, and alerts" > search for your alerts and check the owner If for whatever reason the owner isn't a user that exists, the scheduler will not try to schedule it.
... View more
06-16-2021
02:16 AM
1 Karma
I want a way to search the content of all my lookups. If I had just one lookup, I would do something like: | inputlookup myonelookup.csv
| foreach *
[| eval matching_field_and_value = mvappend( matching_field_and_value, if( match( '<<FIELD>>', "mysearchpattern" ), "<<FIELD>>" . "::". '<<FIELD>>' , null() ) )]
| search matching_field_and_value=*
| table matching_field_and_value * If I knew I wanted to search a few known lookups I would replace the first line with | inputlookup append=t lookup1.csv
| inputlookup append=t lookup2.csv
| inputlookup append=t lookup3.csv But what if I want to search through all my lookups? I can get a list of lookups via the right rest commands, and I've been thinking about converting the list in a list of fields and using a foreach loop on these fields but you can't put a "non streaming command" such as inputlookup inside a forearch subsearch... Any other idea? The solution needs to work in cloud, so needs to be pure splunk. On premise I know my way with grep and I know it works really well.
... View more
- Tags:
- lookup
Labels
- Labels:
-
lookup
03-25-2021
04:06 AM
Yes, ES 6.0. The problem we have arises when people leave the company and come back later, which happens regularly, especially for contractors. Even if they are given a brand new account and brand new employee number, as they should, if they have the same email address identitymerge will merge the two entries. So suddenly we have employees who exist but splunk thinks they have an endDate in the past. And we want to keep the old entry in identities, as it's useful to check activity from expired accounts or when investigating old events. Splunk didn't think this through obviously. I worked around this issue by massaging the data before ES ingests it.
... View more
03-23-2021
03:42 AM
I am aware of this https://docs.splunk.com/Documentation/ES/6.4.0/Admin/Merge however, we have a version of ES older than 6.4 and that feature does not exist there. The behaviour of identitymerge is really unhelpful and has been causing many headaches. Is there a way to turn it off?
... View more
Labels
- Labels:
-
administration
03-15-2021
03:39 AM
According to https://docs.splunk.com/Documentation/ES/6.5.0/Admin/Searchpreview "The results are the delta since the last merge. If nothing has changed in the source files since the last merge, you do not see any output." That answers my question. This behaviour is really weird and unexpected! :-$
... View more
03-05-2021
04:24 AM
I did try that before and it doesn't help. I had another go today and it only works with these extra steps: run "| outputlookup identity_lookup_expanded" to obliterate the old content. open in search the identity merge search preview, and run it with "| outputlookup identity_lookup_expanded" added at the end. I don't understand why these extra steps are needed. And then of course, I had to change the way we ingest identities and the lookup macro casing is consistent for usernames and email addresses. On top of that, I have a lot of problem with identity merging search. entity_merge doesn't seem to work correctly and consistently and sometimes returns much fewer results than it should. I have no confidence in this framework now.
... View more
03-02-2021
07:57 AM
This is the search that merges identities, according to the search preview: | inputlookup append=T "administrative_identity_lookup"
| fillnull value="administrative_identities" _source
| inputlookup append=T "simple_identity_lookup"
| fillnull value="static_identities" _source
| eval identity=split(identity, "|"),identity=if(_source=="administrative_identities", mvappend(identity,email,replace(email,"@.*","")), identity),identity=if(_source=="static_identities", mvappend(identity,email,replace(email,"@.*","")), identity),identity=mvjoin(mvdedup(identity), "|")
| table "_source","bunit","category","email","endDate","first","last","managedBy","nick","phone","prefix","priority","startDate","suffix","watchlist","work_city","work_country","work_lat","work_long","identity"
| eval `iden_mktime_meval(startDate)`,`iden_mktime_meval(endDate)`,identity=mvsort(identity)
| sort 0 +identity
| inputlookup append=T "identity_lookup_expanded"
| entitymerge "identity" If identity_lookup_expanded is empty (because I've flushed it), it produces results. If I pipe these results into an "outputlookup identity_lookup_expanded" it is populating identity_lookup_expanded ok (except all text is lowercase, but see my other question regarding that). Now if I run the above search again, it returns no results. It's ok until it hist entitymerge. What does this mean?
... View more
Labels
- Labels:
-
troubleshooting
-
upgrade
03-02-2021
07:48 AM
We upgraded to enterprise security 6.0.2 and now every single piece of text in identity_lookup_expanded is lowercased. For instance, instead of having 'first' be "Gabriel" it's now "gabriel". Does this for every single fields, including job title ('category') etc. How can I fix it?
... View more
Labels
- Labels:
-
upgrade
-
using Enterprise Security
02-22-2021
02:37 AM
This has been asked before but the solutions I have seen are only for indexers. The best one I've seen is: | rest /services/cluster/config
| fields splunk_server guid But like I said this is only for indexers. I want something for search heads. Also, why not also include the cluster master, license manager, deployment server, search head deployer, and all the data forwarders, that would be quite useful.
... View more
Labels
11-23-2020
04:45 AM
We've just witnessed the exact same issue for us. Looks like tstats will return results if the first 16 characters are the same, ignoring any change beyond that. Unbelievable.
... View more
05-27-2020
07:31 AM
Thanks, this helped me so much! To make this perfect, I would suggest the following:
Simplify the javascript so that it only sets submit_trigger . That way it can be used in more than one dashboard and you don't have to keep tweaking it when you develop your dashboard. To prevent the annoyance of the searchWhenChanged=false being ignored again, simply add this to the search that is to be ran when submit is pressed:
<search>
<done>
<unset token="submit_trigger"/>
</done>
...
That way, after the search is ran once, you can take your time to adjust your inputs and only when you're ready you can click submit to run it again. Works a treat.
Finally, unlike what I initially assumed when I saw your solution, the inputs (including the submit button) can be part of the standard <fieldset> at the top of your dashboard, in case you want them to have a grey background as usual, not a white one.
Also, it's worth noting that your solution allows to hide the submit button with a "depends" clause so that it only appears if the inputs satisfy some kind of condition. I found that useful.
Thanks again!
... View more
02-24-2020
05:47 AM
Thanks, that works!
... View more
02-24-2020
03:57 AM
I can't seem to set/unset a token based on whether some search result is equal or not to 1.
Can anybody point out why this doesn't work:
<form>
<label>TEMP Endpoint Processes Clone</label>
<fieldset submitButton="true" autoRun="false">
<input type="text" token="number" searchWhenChanged="false">
<label>Host count</label>
<default>100</default>
<initialValue>100</initialValue>
</input>
</fieldset>
<row>
<panel>
<html>
<p>host_count=$host_count$</p>
<p>host_count1 is 1=$host_count1$</p>
<p>host_count2 catchall=$host_count2$</p>
<p>gotuniquehost=$gotuniquehost$</p>
</html>
</panel>
</row>
<row>
<panel>
<table>
<search>
<done>
<condition match="$result.host_count$ == 1">
<set token="gotuniquehost">True</set>
<set token="host_count">$result.host_count$</set>
<set token="host_count1">$result.host_count$</set>
</condition>
<condition>
<unset token="gotuniquehost"></unset>
<set token="host_count">$result.host_count$</set>
<set token="host_count2">$result.host_count$</set>
</condition>
</done>
<query>|stats count as host_count | eval host_count=$number$</query>
<earliest>$earliest$</earliest>
<latest>$latest$</latest>
</search>
<option name="drilldown">none</option>
<option name="refresh.display">progressbar</option>
</table>
</panel>
</row>
</form>
And yet this is working:
<form>
<label>TEMP Endpoint Processes Clone</label>
<fieldset submitButton="true" autoRun="false">
<input type="text" token="number" searchWhenChanged="false">
<label>Host count</label>
<default>100</default>
<initialValue>100</initialValue>
</input>
</fieldset>
<row>
<panel>
<html>
<p>host_count=$host_count$</p>
<p>host_count1 gt 1=$host_count1$</p>
<p>host_count2 lt 1=$host_count2$</p>
<p>host_count3 catchall=$host_count2$</p>
<p>gotuniquehost=$gotuniquehost$</p>
</html>
</panel>
</row>
<row>
<panel>
<table>
<search>
<done>
<condition match="$result.host_count$ > 1">
<unset token="gotuniquehost"></unset>
<set token="host_count">$result.host_count$</set>
<set token="host_count1">$result.host_count$</set>
</condition>
<condition match="$result.host_count$ < 1">
<unset token="gotuniquehost"></unset>
<set token="host_count">$result.host_count$</set>
<set token="host_count2">$result.host_count$</set>
</condition>
<condition>
<set token="gotuniquehost">True</set>
<set token="host_count">$result.host_count$</set>
<set token="host_count3">$result.host_count$</set>
</condition>
</done>
<query>|stats count as host_count | eval host_count=$number$</query>
<earliest>$earliest$</earliest>
<latest>$latest$</latest>
</search>
<option name="drilldown">none</option>
<option name="refresh.display">progressbar</option>
</table>
</panel>
</row>
</form>
I run splunk enterprise 7.3.3. This seems to be a bug.
... View more
11-08-2019
12:30 AM
1 Karma
I did try your suggestions to leave no stones unturned, but as I expected it made no difference. I do know the subsearch does nothing, it's just to illustrate that any subsearch triggers the bug, before or after the first pipe. Even the following triggers the bug:
index="_audit" sourcetype=audittrail action=success src!=127.0.0.1 login attempt NOT *uba
| foreach blah* [ eval foo_<<MATCHSTR>>=lower(<<FIELD>>) ]"
... View more
11-08-2019
12:26 AM
We haven't tried version 8 yet. Adding | noop search_optimization=false has no impact on either bug.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
a month ago
|
Karma given to
