Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About gabriel_vasseur
gabriel_vasseur
Contributor
Member since:
03-14-2016
3 weeks ago
Community Statistics
| Posts | 105 |
| Solutions | 6 |
| Karma Given | 69 |
| Karma Received | 30 |
| Member Since | 03-14-2016 |
Activity Feed
- Posted Re: Disable identitymerge in older enterprise security? on Splunk Enterprise Security. 3 weeks ago
- Posted Disable identitymerge in older enterprise security? on Splunk Enterprise Security. 4 weeks ago
- Posted Re: entitymerge for identity_lookup_expanded doesn't produce any results on Splunk Enterprise Security. 03-15-2021 03:39 AM
- Posted Re: Why is every single piece of text in identity_lookup_expanded lowercased? on Splunk Enterprise Security. 03-05-2021 04:24 AM
- Posted entitymerge for identity_lookup_expanded doesn't produce any results on Splunk Enterprise Security. 03-02-2021 07:57 AM
- Posted Why is every single piece of text in identity_lookup_expanded lowercased? on Splunk Enterprise Security. 03-02-2021 07:48 AM
- Karma Re: Ultimate Hostname from GUID for richgalloway. 03-02-2021 07:40 AM
- Posted Ultimate Hostname from GUID on Deployment Architecture. 02-22-2021 02:37 AM
- Posted Re: Data Model Acceleration TSTATS where clause NOT working on Splunk Search. 11-23-2020 04:45 AM
- Karma Data Model Acceleration TSTATS where clause NOT working for simpkins1958. 11-23-2020 04:45 AM
- Got Karma for Re: How to remove \ (backslash) using from URLs rex sed?. 11-12-2020 05:11 AM
- Got Karma for Re: How to display earliest and latest dates of searches in a dashboard and PDF report?. 10-17-2020 01:45 PM
- Karma Re: Why is my very simple dashboard token condition not working? for vnravikumar. 06-05-2020 12:51 AM
- Karma Comprehensive implementation of a WORKING submit button? for nick405060. 06-05-2020 12:50 AM
- Karma Re: Comprehensive implementation of a WORKING submit button? for nick405060. 06-05-2020 12:50 AM
- Karma Re: Do splunk upgrades ever remove any files? for wmyersas. 06-05-2020 12:50 AM
- Got Karma for Do splunk upgrades ever remove any files?. 06-05-2020 12:50 AM
- Got Karma for Re: Major bugs in searches in splunk 7.3 DO NOT UPGRADE. 06-05-2020 12:50 AM
- Got Karma for Major bugs in searches in splunk 7.3 DO NOT UPGRADE. 06-05-2020 12:50 AM
- Karma Unset token after click for bharathkumarnec. 06-05-2020 12:49 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 1 | |||
| 0 | |||
| 0 | |||
| 0 |
3 weeks ago
Yes, ES 6.0. The problem we have arises when people leave the company and come back later, which happens regularly, especially for contractors. Even if they are given a brand new account and brand new employee number, as they should, if they have the same email address identitymerge will merge the two entries. So suddenly we have employees who exist but splunk thinks they have an endDate in the past. And we want to keep the old entry in identities, as it's useful to check activity from expired accounts or when investigating old events. Splunk didn't think this through obviously. I worked around this issue by massaging the data before ES ingests it.
... View more
4 weeks ago
I am aware of this https://docs.splunk.com/Documentation/ES/6.4.0/Admin/Merge however, we have a version of ES older than 6.4 and that feature does not exist there. The behaviour of identitymerge is really unhelpful and has been causing many headaches. Is there a way to turn it off?
... View more
Labels
- Labels:
-
administration
03-15-2021
03:39 AM
According to https://docs.splunk.com/Documentation/ES/6.5.0/Admin/Searchpreview "The results are the delta since the last merge. If nothing has changed in the source files since the last merge, you do not see any output." That answers my question. This behaviour is really weird and unexpected! :-$
... View more
03-05-2021
04:24 AM
I did try that before and it doesn't help. I had another go today and it only works with these extra steps: run "| outputlookup identity_lookup_expanded" to obliterate the old content. open in search the identity merge search preview, and run it with "| outputlookup identity_lookup_expanded" added at the end. I don't understand why these extra steps are needed. And then of course, I had to change the way we ingest identities and the lookup macro casing is consistent for usernames and email addresses. On top of that, I have a lot of problem with identity merging search. entity_merge doesn't seem to work correctly and consistently and sometimes returns much fewer results than it should. I have no confidence in this framework now.
... View more
03-02-2021
07:57 AM
This is the search that merges identities, according to the search preview: | inputlookup append=T "administrative_identity_lookup"
| fillnull value="administrative_identities" _source
| inputlookup append=T "simple_identity_lookup"
| fillnull value="static_identities" _source
| eval identity=split(identity, "|"),identity=if(_source=="administrative_identities", mvappend(identity,email,replace(email,"@.*","")), identity),identity=if(_source=="static_identities", mvappend(identity,email,replace(email,"@.*","")), identity),identity=mvjoin(mvdedup(identity), "|")
| table "_source","bunit","category","email","endDate","first","last","managedBy","nick","phone","prefix","priority","startDate","suffix","watchlist","work_city","work_country","work_lat","work_long","identity"
| eval `iden_mktime_meval(startDate)`,`iden_mktime_meval(endDate)`,identity=mvsort(identity)
| sort 0 +identity
| inputlookup append=T "identity_lookup_expanded"
| entitymerge "identity" If identity_lookup_expanded is empty (because I've flushed it), it produces results. If I pipe these results into an "outputlookup identity_lookup_expanded" it is populating identity_lookup_expanded ok (except all text is lowercase, but see my other question regarding that). Now if I run the above search again, it returns no results. It's ok until it hist entitymerge. What does this mean?
... View more
Labels
- Labels:
-
troubleshooting
-
upgrade
03-02-2021
07:48 AM
We upgraded to enterprise security 6.0.2 and now every single piece of text in identity_lookup_expanded is lowercased. For instance, instead of having 'first' be "Gabriel" it's now "gabriel". Does this for every single fields, including job title ('category') etc. How can I fix it?
... View more
Labels
- Labels:
-
upgrade
-
using Enterprise Security
02-22-2021
02:37 AM
This has been asked before but the solutions I have seen are only for indexers. The best one I've seen is: | rest /services/cluster/config
| fields splunk_server guid But like I said this is only for indexers. I want something for search heads. Also, why not also include the cluster master, license manager, deployment server, search head deployer, and all the data forwarders, that would be quite useful.
... View more
Labels
11-23-2020
04:45 AM
We've just witnessed the exact same issue for us. Looks like tstats will return results if the first 16 characters are the same, ignoring any change beyond that. Unbelievable.
... View more
05-27-2020
07:31 AM
Thanks, this helped me so much! To make this perfect, I would suggest the following:
Simplify the javascript so that it only sets submit_trigger . That way it can be used in more than one dashboard and you don't have to keep tweaking it when you develop your dashboard. To prevent the annoyance of the searchWhenChanged=false being ignored again, simply add this to the search that is to be ran when submit is pressed:
<search>
<done>
<unset token="submit_trigger"/>
</done>
...
That way, after the search is ran once, you can take your time to adjust your inputs and only when you're ready you can click submit to run it again. Works a treat.
Finally, unlike what I initially assumed when I saw your solution, the inputs (including the submit button) can be part of the standard <fieldset> at the top of your dashboard, in case you want them to have a grey background as usual, not a white one.
Also, it's worth noting that your solution allows to hide the submit button with a "depends" clause so that it only appears if the inputs satisfy some kind of condition. I found that useful.
Thanks again!
... View more
02-24-2020
05:47 AM
Thanks, that works!
... View more
02-24-2020
03:57 AM
I can't seem to set/unset a token based on whether some search result is equal or not to 1.
Can anybody point out why this doesn't work:
<form>
<label>TEMP Endpoint Processes Clone</label>
<fieldset submitButton="true" autoRun="false">
<input type="text" token="number" searchWhenChanged="false">
<label>Host count</label>
<default>100</default>
<initialValue>100</initialValue>
</input>
</fieldset>
<row>
<panel>
<html>
<p>host_count=$host_count$</p>
<p>host_count1 is 1=$host_count1$</p>
<p>host_count2 catchall=$host_count2$</p>
<p>gotuniquehost=$gotuniquehost$</p>
</html>
</panel>
</row>
<row>
<panel>
<table>
<search>
<done>
<condition match="$result.host_count$ == 1">
<set token="gotuniquehost">True</set>
<set token="host_count">$result.host_count$</set>
<set token="host_count1">$result.host_count$</set>
</condition>
<condition>
<unset token="gotuniquehost"></unset>
<set token="host_count">$result.host_count$</set>
<set token="host_count2">$result.host_count$</set>
</condition>
</done>
<query>|stats count as host_count | eval host_count=$number$</query>
<earliest>$earliest$</earliest>
<latest>$latest$</latest>
</search>
<option name="drilldown">none</option>
<option name="refresh.display">progressbar</option>
</table>
</panel>
</row>
</form>
And yet this is working:
<form>
<label>TEMP Endpoint Processes Clone</label>
<fieldset submitButton="true" autoRun="false">
<input type="text" token="number" searchWhenChanged="false">
<label>Host count</label>
<default>100</default>
<initialValue>100</initialValue>
</input>
</fieldset>
<row>
<panel>
<html>
<p>host_count=$host_count$</p>
<p>host_count1 gt 1=$host_count1$</p>
<p>host_count2 lt 1=$host_count2$</p>
<p>host_count3 catchall=$host_count2$</p>
<p>gotuniquehost=$gotuniquehost$</p>
</html>
</panel>
</row>
<row>
<panel>
<table>
<search>
<done>
<condition match="$result.host_count$ > 1">
<unset token="gotuniquehost"></unset>
<set token="host_count">$result.host_count$</set>
<set token="host_count1">$result.host_count$</set>
</condition>
<condition match="$result.host_count$ < 1">
<unset token="gotuniquehost"></unset>
<set token="host_count">$result.host_count$</set>
<set token="host_count2">$result.host_count$</set>
</condition>
<condition>
<set token="gotuniquehost">True</set>
<set token="host_count">$result.host_count$</set>
<set token="host_count3">$result.host_count$</set>
</condition>
</done>
<query>|stats count as host_count | eval host_count=$number$</query>
<earliest>$earliest$</earliest>
<latest>$latest$</latest>
</search>
<option name="drilldown">none</option>
<option name="refresh.display">progressbar</option>
</table>
</panel>
</row>
</form>
I run splunk enterprise 7.3.3. This seems to be a bug.
... View more
11-08-2019
12:30 AM
1 Karma
I did try your suggestions to leave no stones unturned, but as I expected it made no difference. I do know the subsearch does nothing, it's just to illustrate that any subsearch triggers the bug, before or after the first pipe. Even the following triggers the bug:
index="_audit" sourcetype=audittrail action=success src!=127.0.0.1 login attempt NOT *uba
| foreach blah* [ eval foo_<<MATCHSTR>>=lower(<<FIELD>>) ]"
... View more
11-08-2019
12:26 AM
We haven't tried version 8 yet. Adding | noop search_optimization=false has no impact on either bug.
... View more
11-07-2019
01:34 AM
1 Karma
The first bug we noticed is triggered when using NOT in the where clause of tstats commands using datamodel summaries. To summarise it:
| tstats summariesonly=t count from datamodel=Authentication where NOT ( index=myindex ) by index sourcetype
| tstats summariesonly=t count from datamodel=Authentication where NOT ( sourcetype=mysourcetype ) by index sourcetype
| tstats summariesonly=t count from datamodel=Authentication where NOT ( index=myindex sourcetype=mysourcetype ) by index sourcetype
The first 2 searches returns results, as they should, but the last one returns nothing at all. Awful for accuracy!
The other bug affects raw searches with subsearches. Any kind of subsearch, even a foreach command. For instance:
index="_audit" sourcetype=audittrail action=success src!=127.0.0.1 login attempt NOT *uba
| search [| stats count as index | eval index="*" ]
This search completely ignores the "action=success " and the "src!=127.0.0.1". This yields a lot more results than it should, also bad for accuracy.
I'd be curious if people on different versions of splunk (especially 7.3.*) can reproduce these.
If you're thinking to upgrade, make sure you test for it before. As far as I can see, I do not believe that these issues are mentioned in the known issues in the release notes, even though splunk is aware that something is wrong.
We have open cases with splunk support and unfortunately, at least for the first bug, there doesn't seem to be a fix coming any time soon.
... View more
Labels
- Labels:
-
other
10-09-2019
03:51 AM
Thanks. Maybe things are not too bad for splunk core.
Have you ever used Enterprise Security? It has a health check feature that reveals a LOT of "unshipped" files, and a significant portion of these really do not look like anything the team could ever have created themselves. So I believe they are accumulated junk, except I don't feel confident removing them.
... View more
09-27-2019
04:11 AM
1 Karma
The upgrade process on linux is basically to unpack the tgz file over the existing splunk home directory.
I understand that will add any new file where they need to be, update any file that needs updating, but what about the files that are no longer needed after the upgrade? Are they ever removed or do we just accumulate rubbish over the years?
... View more
- Tags:
- splunk-enterprise
03-26-2019
02:11 AM
Interesting, but like you said unlikely to be the case here. We have PS on site this week so if there is time I'll ask them to take a look and will update this question if anything transpires.!
... View more
03-06-2019
08:12 AM
I'm using the following search to measure throughput of each forwarder:
index=_internal sourcetype=splunkd metrics source=*metrics.log group=per_sourcetype_thruput | stats sum(kb) as kb by host
This works well generally, but there is one forwarder for which this gives nothing. I really don't understand why.
We do get its metrics logs in _internal, but they have no thruput logs. The docs say:
Thruput is measured in the indexing pipeline. If your data is not reaching this pipeline for some reason, it will not appear in this data.
I don't understand what that means. The forwarder in question is a universal forwarder. We have very similar forwarders for which we have no problem, so I can't really understand what's different.
Can anyone shed some light on this?
... View more
03-04-2019
06:57 AM
I came here with a similar question and as the existing answers didn't help me I kept on looking and found the Timeline - Custom Visualization app ( https://splunkbase.splunk.com/app/3120/ ). I haven't played with it yet but I believe it's exactly what I want to achieve. I also think it's a better solution to your problem as it will make it more obvious if you have overlaps between your jobs and you'll be able to visualise how many jobs were running at any given point.
... View more
01-10-2019
02:42 AM
1 Karma
We have the same problem. Lots of analysts are hitting their maximum concurrent search quotas and getting their searches queued, sometimes for several minutes, even though they are not running much at all. I'm disappointed no one answered that question. Did you figure out any solution yourself?
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
3 weeks ago
|
Karma given to
