Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About ejwade
ejwade
Contributor
Member since:
03-17-2016
Wednesday
Community Statistics
| Posts | 99 |
| Solutions | 7 |
| Karma Given | 37 |
| Karma Received | 23 |
| Member Since | 03-17-2016 |
Activity Feed
- Got Karma for Re: How do I create AWS inputs using Splunk's REST API?. a week ago
- Posted Re: How do I create AWS inputs using Splunk's REST API? on All Apps and Add-ons. a week ago
- Posted Re: Automatic Lookup, matching on multivalue not working? on Splunk Search. a week ago
- Posted Re: Matching an IP address to a Lookup with IP ranges on Splunk Search. a week ago
- Karma Re: Matching an IP address to a Lookup with IP ranges for yuanliu. a week ago
- Posted How to match an IP address to a lookup with IP ranges? on Splunk Search. 4 weeks ago
- Karma Re: What is the order if precedence with default_namespace? for gcusello. 4 weeks ago
- Posted Re: What is the order if precedence with default_namespace? on Dashboards & Visualizations. 4 weeks ago
- Karma Re: What is the order if precedence with default_namespace? for gcusello. 4 weeks ago
- Posted Re: What is the order if precedence with default_namespace? on Dashboards & Visualizations. a month ago
- Posted What is the order if precedence with default_namespace? on Dashboards & Visualizations. 05-08-2023 09:53 PM
- Posted Automatic Lookup, matching on multivalue not working? on Splunk Search. 05-04-2023 08:38 AM
- Posted Re: Outputting the same field for two automatic lookups on Knowledge Management. 04-06-2023 05:09 PM
- Posted Outputting the same field for two automatic lookups on Knowledge Management. 04-06-2023 01:17 PM
- Got Karma for How do I create AWS inputs using Splunk's REST API?. 03-24-2023 08:48 AM
- Posted Re: Qualys TA: WARNING: Failed to parse API Output...XML or text declaration not at start of entity on Getting Data In. 03-10-2023 08:48 AM
- Posted How do I create AWS inputs using Splunk's REST API? on All Apps and Add-ons. 03-08-2023 10:09 AM
- Posted Qualys TA: WARNING: Failed to parse API Output...XML or text declaration not at start of entity on Getting Data In. 03-06-2023 09:01 AM
- Posted Re: How do I apply a format color rule based on another field's data? on Dashboards & Visualizations. 01-20-2023 08:33 AM
- Posted How do I apply a format color rule based on another field's data? on Dashboards & Visualizations. 01-19-2023 02:51 PM
a week ago
1 Karma
After working with support, it sounds like Splunk will update their documentation. For now, I provided the following for reference. Create an IAM role: curl -u admin:password https://localhost:8089/servicesNS/nobody/Splunk_TA_aws/splunk_ta_aws_iam_roles -d name=<name> -d arn=<arn> Create a Metadata input: curl -u admin:password https://localhost:8089/servicesNS/nobody/Splunk_TA_aws/splunk_ta_aws_aws_metadata -d account=<account> -d aws_iam_role=<aws_iam_role> -d index=<index> -d regions=<regions> -d name=<name>
... View more
a week ago
I discovered the issue. KV store collections need to be replicated to leverage automatic lookups. https://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Makeyourlookupautomatic#Enable_replication_for_a_KV_store_collection
... View more
a week ago
@yuanliuthis is a great approach. However, I need to be able to do this in SPL at search time. I was able to develop a little external lookup to do this, using the native ipaddress Python module. For those of you interested, here's the Python file "cidr_lookup.py". #!/usr/bin/env python
from __future__ import print_function
import csv
import ipaddress
import sys
# Given start and end IP addresses, return the CIDRs
def lookup(ip_start, ip_end):
try:
cidrs = [str(ipaddr) for ipaddr in ipaddress.summarize_address_range(
ipaddress.IPv4Address(ip_start),
ipaddress.IPv4Address(ip_end)
)
]
cidr_list = ','.join(cidrs)
return cidr_list
except:
return ''
def main():
if len(sys.argv) != 4:
print("Usage: python cidr_lookup.py "
"[ip_start field] [ip_end field] [cidr_list field]")
sys.exit(1)
ip_start_field = sys.argv[1]
ip_end_field = sys.argv[2]
cidr_list_field = sys.argv[3]
infile = sys.stdin
outfile = sys.stdout
r = csv.DictReader(infile)
header = r.fieldnames
w = csv.DictWriter(outfile, fieldnames=header)
w.writeheader()
for result in r:
if result[ip_start_field] and result[ip_end_field]:
result[cidr_list_field] = lookup(result[ip_start_field],
result[ip_end_field])
if result[cidr_list_field]:
w.writerow(result)
main() Here's the transforms.conf. [cidrlookup]
external_cmd = cidr_lookup.py ip_start ip_end cidr_list
fields_list = ip_start, ip_end, cidr_list Here's a screenshot of the lookup in use.
... View more
4 weeks ago
I have an IP field that I'm trying to match against a lookup that contains DHCP ranges.
For example, assume the lookup contains the following:
Start_Address,End_Address 10.0.0.5,10.0.0.254 10.2.0.5,10.3.0.254 10.4.0.5,10.4.0.254
When matching the IP field, 10.0.0.10 would match, but 10.0.0.2 would not. That said, simply determining the CIDR notation (10.0.0.0/24) won't work. I've consider enumerating all IPs, resulting in a huge lookup, but I'm wondering if anyone has any other ideas.
... View more
Labels
- Labels:
-
lookup
a month ago
I tested this further, and it appears roles do have a lexicographical precedence based on the role name.
... View more
05-08-2023
09:53 PM
I'm trying to determine the order of precedence when a user has two roles that both assign a default app (i.e., user-prefs.conf, default_namespace).
For example, user "bob" has the following roles: workspace_default and workspace_engineering.
On the search head, in the acme_zglobal_ta app:
user-prefs.conf
[role_workspace_default]
default_namespace = global_app
In the acme_engineering_ta app:
[role_workspace_engineering]
default_namespace = engineering_app
The lexicographical sorting of the apps doesn't seem to play into it, since the global_app is given to Bob. Any insights?
... View more
Labels
- Labels:
-
other
05-04-2023
08:38 AM
I'm trying to configure an automatic lookup and match multivalue field of IP addresses (in the lookup) on an IP field (in the SPL results). The lookup is a KV Store, and the definition targets that collection.
When I run the lookup definition manually, it works fine.
index=my_index eventtype=my_event_type | lookup lookup_definition ip_mv AS ip OUTPUTNEW dns
However, when I create an automatic lookup using the same information, it doesn't work.
Any ideas?
... View more
Labels
- Labels:
-
lookup
04-06-2023
05:09 PM
Thank you for responding @woodcock! I was hoping you'd see this. I am trying to do this in an automatic lookup. I've been doing this in SPL, but I'd rather use automatic lookups to find the department for IPs in my logs. My ultimate plan is to put these lookup outputted fields into our data models. The problem - not all IPs are in the IP inventory, and I want to use the network inventory when that happens.
... View more
04-06-2023
01:17 PM
I am trying to perform an automatic lookup on IP field against two lookup definitions/tables. One is a list of IPs with their department, and another is a list of networks with their department (with CIDR match configured). I would like the two automatic lookups to use the following logic. - If there is match on the IP list, use the department from that IP record. - Else if there is a CIDR match on the network list, use the departmnet from that network record. - Else if there are no matches from either, do nothing (default behavior). Here's an example of the lookup text for each - ip_list ip OUTPUT(NEW) dept AS ip_dept - network_list network AS ip OUTPUT(NEW) dept AS ip_dept I tried doing OUTPUT on the ip_list, and OUTPUTNEW on the network_list, but that excludes network lookups. I tried doing OUTPUTNEW on both, hoping for an alphabetical order of operations, but that doesn't seem to be working either. Any ideas would be appreciated - thank you!
... View more
Labels
- Labels:
-
lookup
03-10-2023
08:48 AM
Thank you - this is good information on how the TA works. I'm working with Qualys support now and hoping to find an answer. I gave them feedback about their lack of exception handling. 🙂
... View more
03-08-2023
10:09 AM
1 Karma
I would like to dynamically create AWS Metadata inputs using Splunk's REST API. When referencing Splunk's documentation, it looks to be incomplete and incorrect. https://docs.splunk.com/Documentation/AddOns/released/AWS/APIreference Has anyone done this?
... View more
Labels
- Labels:
-
troubleshooting
03-06-2023
09:01 AM
My Qualys VM detection pull stopped working. I found a new warning log. TA-QualysCloudPlatform (host_detection): 2023-03-06 08:54:15 PID=30479 [Thread-3] WARNING: Failed to parse API Output for endpoint /api/2.0/fo/asset/host/vm/detection/. Message: XML or text declaration not at start of entity: line 7, column 0 Has anyone come across this? I have no idea where to start when it comes to troubleshooting.
... View more
Labels
- Labels:
-
data
01-20-2023
08:33 AM
@ITWhisperer- this is great! Very clever - thank you for the solution!
... View more
01-19-2023
02:51 PM
For a table panel, I would like to create a format rule (<format>) of type="color" that sets a threshold based on another field's data. Here is a sample search (note - "streamstats" and "count_stream" are used just to get sample data): | makeresults count=3
| streamstats
count AS count_stream
| eval count_total = count_stream * 10
,count_metric = count_stream * count_stream * 2
| eval perc_metric = count_metric / count_total * 100
| table perc_metric count_metric, count_total I would like to create color rules for the "count_metric" field/column, but base it on the "perc_metric" value. My goal is to leverage the percentage values in "perc_metric," and apply color to the cells in "count_metric," hiding the "perc_metric" field/column in the final output. Here's my Simple XML <dashboard>
<label>test</label>
<row>
<panel>
<table>
<search>
<query>| makeresults count=3
| streamstats
count AS count_stream
| eval count_total = count_stream * 10
,count_metric = count_stream * count_stream * 2
| eval perc_metric = count_metric / count_total * 100
| table perc_metric count_metric, count_total</query>
<earliest>@d</earliest>
<latest>now</latest>
<sampleRatio>1</sampleRatio>
</search>
<option name="count">50</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">none</option>
<option name="percentagesRow">false</option>
<option name="refresh.display">progressbar</option>
<option name="rowNumbers">false</option>
<option name="totalsRow">false</option>
<option name="wrap">true</option>
<format type="color" field="perc_metric">
<colorPalette type="list">[#DC4E41,#F1813F,#53A051]</colorPalette>
<scale type="threshold">21,41</scale>
</format>
</table>
</panel>
</row>
</dashboard>
... View more
Labels
- Labels:
-
simple XML
-
table
05-12-2022
11:08 AM
1 Karma
@CyberSekure- this is a great approach. I wrapped this into a macro and use it all the time now!
... View more
03-01-2022
12:27 PM
I'm trying to create a calculated field (eval) that will coalesce a bunch of username fields, then perform match() and replace() functions within a case statement.
Here's a scenario:
Possible user fields: UserName, username, User_ID
User values need domain removed (e.g., "user@domain.com" or "ad\user" needs to be "user").
Here is how it can be done in two evals (I newlined and indented each case for readability):
| eval user_coalesced = coalesce(UserName, username, User_ID)
| eval user = case(
match(user_coalesced, ".*@.*"), replace(user_coalesced, "@.*", ""),
match(user_coalesced, "^ad\\\\"), replace(user_coalesced, "^ad\\\\", ""),
true(), user
)
Any ideas on how I can get this down to one? I thought about putting the coalesce() into each case, but that seems inefficient.
... View more
- Tags:
- case-statement
- field
Labels
- Labels:
-
eval
11-05-2021
02:13 PM
I have a tstats search that isn't returning a count consistently. In the where clause, I have a subsearch for determining the time modifiers. Here's the search: | tstats
count
from datamodel=Vulnerabilities.Vulnerabilities
where index=qualys_i
[| search earliest=-4d@d index=_internal host="its-splunk7-hf.ucsd.edu" sourcetype="ta_QualysCloudPlatform*" host_detection ("Done loading detections" OR "Running now")
| stats `stime(_time)` `slist(_raw)` count by PID
| eval duration = last_seen - first_seen ,earliest = strftime(first_seen - 300, "%m/%d/%Y:%H:%M:%S") ,latest = strftime(last_seen + 300, "%m/%d/%Y:%H:%M:%S")
| where count > 1 AND duration < 82800
| sort -last_seen
| head 1
| return earliest latest ] If I run the subsearch on its own... earliest=-4d@d index=_internal host="its-splunk7-hf.ucsd.edu" sourcetype="ta_QualysCloudPlatform*" host_detection ("Done loading detections" OR "Running now")
| stats `stime(_time)` `slist(_raw)` count by PID
| eval duration = last_seen - first_seen ,earliest = strftime(first_seen - 300, "%m/%d/%Y:%H:%M:%S") ,latest = strftime(last_seen + 300, "%m/%d/%Y:%H:%M:%S") ``` Exclude results that ran over 23 hours or didn't finish ```
| where count > 1 AND duration < 82800
| sort -last_seen
| head 1
| return earliest latest I get the time modifiers accurately (e.g., earliest="11/05/2021:06:25:51" latest="11/05/2021:11:31:12"). When I inspect the job (of the first search), it is able to derive the same time modifiers (in phase0, phase1, and remoteSearch). The issue - when I run the first search, my count is double. In other words, it's double counting each record. If I explicitly put the time modifiers in place of the subsearch, the count is accurate (not double). Anyone run into this?
... View more
Labels
- Labels:
-
tstats
11-04-2021
03:47 PM
Hi @woodcock. This is very helpful, and somewhat of a game changer in sending dynamic alerts from Splunk. Thank you! I did have a quick question about outputcsv. From what I've read, outputlookup writes to a lookup file that replicates across a search head cluster, while outputcsv just writes a CSV in the current search head's var/run directory. I'm looking to have this result dataset NOT be persistent. Do you have any recommendations about creating a result dataset for the map command that will age out after the search is run, or some configurable time after?
... View more
11-02-2021
12:05 PM
Awesome - thanks again for the info!
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
Wednesday
|
Karma from
Karma given to
