Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Are you a member of the Splunk Community?
Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- About goji
goji
Path Finder
Member since:
03-28-2016
03-27-2025
Community Statistics
| Posts | 14 |
| Solutions | 1 |
| Karma Given | 1 |
| Karma Received | 3 |
| Member Since | 03-28-2016 |
Activity Feed
- Posted Re: Why can't I download from OpenCTI Stream Feed into Splunk? on Getting Data In. 03-27-2025 07:20 PM
- Karma Re: Why can't I download from OpenCTI Stream Feed into Splunk? for livehybrid. 03-27-2025 07:20 PM
- Posted Why can't I download from OpenCTI Stream Feed into Splunk? on Getting Data In. 03-27-2025 01:02 AM
- Got Karma for What is the "enable to risk index" and "enable to test index" in Content Management of Splunk ES?. 03-14-2025 12:28 PM
- Got Karma for What is the "enable to risk index" and "enable to test index" in Content Management of Splunk ES?. 12-14-2023 10:15 AM
- Posted What is the "enable to risk index" and "enable to test index" in Content Management of Splunk ES? on Splunk Enterprise Security. 06-08-2023 12:33 AM
- Posted Re: Is it possible to enable correlated search in ES by editing savedsearch.conf directly in the CLI without Web UI? on Deployment Architecture. 08-22-2022 06:15 PM
- Posted Re: Is it possible to enable correlated search in ES by editing savedsearch.conf directly in the CLI without Web UI? on Deployment Architecture. 08-21-2022 02:34 AM
- Posted Is it possible to enable correlated search in ES by editing savedsearch.conf directly in the CLI without Web UI? on Deployment Architecture. 08-16-2022 08:50 PM
- Tagged Is it possible to enable correlated search in ES by editing savedsearch.conf directly in the CLI without Web UI? on Deployment Architecture. 08-16-2022 08:50 PM
- Got Karma for Re: props.conf を編集してフィールド抽出する方法について. 06-05-2020 12:48 AM
- Posted Re: How do I index one _time field from separated different time data? on Getting Data In. 08-10-2018 06:29 PM
- Posted Re: How do I index one _time field from separated different time data? on Getting Data In. 08-10-2018 02:38 AM
- Posted How do I index one _time field from separated different time data? on Getting Data In. 08-04-2018 12:17 AM
- Tagged How do I index one _time field from separated different time data? on Getting Data In. 08-04-2018 12:17 AM
- Tagged How do I index one _time field from separated different time data? on Getting Data In. 08-04-2018 12:17 AM
- Tagged How do I index one _time field from separated different time data? on Getting Data In. 08-04-2018 12:17 AM
- Tagged How do I index one _time field from separated different time data? on Getting Data In. 08-04-2018 12:17 AM
- Posted Re: How to calculate min/max/avg/stdev by each line on Splunk Search. 04-04-2017 04:36 AM
- Posted How to calculate min/max/avg/stdev by each line on Splunk Search. 03-29-2017 04:38 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 2 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
03-27-2025
07:20 PM
After all, there is such a thing as the norm not being the norm, By default, the opencti URL is http://ip:8080 (not https) Splunk's OpenCTI forces you to enter only “https://” as you are operating. And I can't change it back to “http”. So I guess there was an error. I edited the URL of the file ta_opencti_add_on_settings.conf in ta directly (https -> https) and restarted. Then I was able to load the data. Thanks!
... View more
03-27-2025
01:02 AM
Hi, I just want to input OpenCTI feed from OpenCTI to Splunk. I followed installation instruction. https://splunkbase.splunk.com/app/7485 But, there is an error in _internal index as follows. 2025-03-27 16:50:02,889 ERROR pid=17581 tid=MainThread file=base_modinput.py:log_error:309 | Error in ListenStream loop, exit, reason: HTTPSConnectionPool(host='192.168.0.15', port=8080): Max retries exceeded with url: /stream/2cfe507d-1345-402d-82c7-eb8939228bf0?recover=2025-03-27T07:50:02Z (Caused by SSLError(SSLError(1, '[SSL: UNKNOWN_PROTOCOL] unknown protocol (_ssl.c:1106)'))) And I was able to access OpenCTI feeds using curl in Splunk enfironement and browser as well, but I can't access the OpenCTI stream using StreamID from Splunk to fetch the data. I think SSL is one of the issues. Please tell me if you know how to fetch the OpenCTI data to Splunk
... View more
Labels
- Labels:
-
JSON
06-08-2023
12:33 AM
2 Karma
There are two selection "enable to risk index" and "enable to test index" from Content Management view, but these two option is dis-highlighted from default. It seems does not work properly. I think this function is that we can select each of correlation search, and then I can set to risk index but we can not do it them. Is it possible to select multiple correlation searches and enable the risk index all at once?
... View more
Labels
08-22-2022
06:15 PM
Hi, @gcusello , Yes, I agree. I gonna certainly try to post to Splunk Idea as well since this is about ES functionality. Well, I don't know if I can do it, but I will try this one. Chao!!
... View more
08-21-2022
02:34 AM
@gcusello Thank you for telling me your opinion! There are two reasons. The first reason is that the ES content management web interface does not allow data source selection; you can specify data sources in SSE, but not in ES. So after selecting data sources in SSE, I have to enable them visually one by one in the ES content management web interface. Its like a copy/past, copy/past copy/past, This feels like a waste of time. So I am thinking of creating a script that simply extracts default/savedsearch.conf for each Apps and let them specify the data source using rest, and save only the necessary ones in local/savedsearch.conf for each App. But when I changed savedsearch.conf in the CLI, it didn't reflect the change, which is why I asked this question. Debug/reflesh didn't work, so if I need to reboot, that's what I'm going to do. The second is from a backup/recovery perspective. I want to manage multiple generations of each policy set. And if necessary, I want to easily restore what I have saved in the CLI. I understand that we can still do backups to the Apps we have created, but I am fed up with the large number of Apps that will be created if we manage them frequently. Also, I only intend to set diabled=1/0 for local/savedsearch. I don't set anything else, so I don't think there are any configuration issues. Ciao
... View more
08-16-2022
08:50 PM
Hi, There are many app and correlation searches in each app in Enterprise Security. I understand that I can enable/disable correlation search using ES Web Interface, but I want to manage using CLI about enabling/disabling correlation search. I mean, I just want to change many rules and many apps to "disabled = 0" or "disabled =1" in savedsearch.conf using CLI(like shell). I already tried the below test after savedsearch.conf from CLI access to : https://ip:8000/en-US/debug/refresh access to : https://ip:8000/en-US/_bump However, the disable/enable changes are not reflected when I look at the web for purpose of checking. Does anyone know how to make changes to ES correlation rules(savedsearch.conf) in the CLI and update searches without rebooting Splunk?
... View more
- Tags:
- es savedsearch
Labels
- Labels:
-
Linux
08-10-2018
06:29 PM
nittala_surya,
This data was a bit old, so I could read it by increasing the value of MAX_DAYS_AGO.
Thank you!!!
... View more
08-10-2018
02:38 AM
I use "&" instead of "?" in front of year, but it doesn't work.
... View more
08-04-2018
12:17 AM
This is my data from with html tags. This is just single line.
03/<tr class="mtx" style="text-align:right;"><td style="white-space:nowrap"><div class="a_print"><a href="hourly_s1.php?prec_no=44&block_no=47662&year=1980&month=03&day=1&view=p1">1</a></div></td><td class="data_0_0">997.3</td><td class="data_0_0">1001.6</td><td class="data_0_0">13.5</td><td class="data_0_0">5.5</td><td class="data_0_0">1.5</td><td class="data_0_0">9.1</td><td class="data_0_0">14.2</td><td class="data_0_0">4.5</td><td class="data_0_0"> 59</td><td class="data_0_0"> 40</td><td class="data_0_0">6.5</td><td class="data_0_0">13.6</td><td class="data_0_0" style="text-align:center">–k–k¼</td><td class="data_0_0">24.6</td><td class="data_0_0" style="text-align:center">–k</td><td class="data_0_0">--</td><td class="data_0_0">--</td><td class="data_0_0">--</td><td class="data_0_0" style="text-align:left">‰J</td><td class="data_0_0" style="text-align:left">~
‚È‚µ</td></tr>
The time of this data consists of three pieces of information: year=, month=, and date=.
So, I just use custom DATETIME_CONFIG to ingest the data but it doesn't work. This is my created .xml file.
<datetime>
<define name="test" extract="year, month, day">
<text><![CDATA[(?year\=(\d{4})&month\=(\d{2})&day\=(\d{1,2})]]></text>
</define>
<timePatterns>
<use name="test"/>
</timePatterns>
<datePatterns>
<use name="test"/>
</datePatterns>
</datetime>
I think there is no grammatical error because there was no error at splunk restarted.
How do I index one _time field from three separated time data at index time?
Thank you,
... View more
03-29-2017
04:38 AM
The date are all number field, such as
cluster, field_1, field_2, field_3, field_4, field_5
1 3 56 6 767 8
1 56 6 5432 5 7
2 6 65 987 356 6767
2 65 56 4321 4 56
3 3 5656 65 56456 56
I'd like to calculate min/max/avg/stdev of each line.
I understand that can stats min() max() avg() stdev() by xxxx,
but stats returned like min(field_1) max(field_2) avg(field_3) ..... as new column.
But, I want display min/max/avg/stdev on each line just like tableau or excel pivot table function.
For example,
new_field, field_1, field_2, field_3, field_4, field_5,
min 3 6 6 5 7
max 30 31 2,719 386 8
avg 30 31 2,719 386 8
stdev 37.47 35.35 3836.76 538.81 0.707
I mean, stats can calculate in parallel but I want to calculate it vertically.
Anyone have any idea? If I could, I'd like to group by cluster number with min/max/avg.
Thanks,
... View more
02-01-2017
11:08 PM
自己解決しました。
| eval a1=ltrim(link,"https?://")
で、URLから、http://または、https://を削除します。
そして、ドリルダウンパネルを利用して、
<drilldown>
<condition field="a1">
<link>http://$click.value2|n$</link>
</condition>
<condition field="link">
<link>http://www.google.com/#q=$click.value2$</link>
</condition>
</drilldown>
で渡すとa1をクリックすると実リンクに飛び、linkをクリックすると、workflowアクションのように、URLををGoogleの引数に渡し、検索結果を表示することができました。Dashboardサンプル集が参考になりました。httpでも、httpsでもいけます。以上でございます。
... View more
01-30-2017
07:20 PM
Webアクセスのデータの中にURL Link情報（例えばreferer)データの中に、例えば、www.splunk.comという文字があったとします。
ダッシュボード内に、table refererというデータを表示することで、このURL一覧が表示できますが、このrefererをクリックすることで、splunkの検索ではなく、実際の外部リンクに直接アクセスすることは可能でしょうか？
補足：workflowアクションでは、$!referer$で実現できることはできましたが、ダッシュボードから直接リンクをクリックしてアクセスしたいと考えております。
よろしくお願いいたします。
... View more
- Tags:
- splunk-enterprise
06-20-2016
12:16 AM
1 Karma
props.confのEXTRACTは、フィールド抽出の際に利用されます。マニュアルとしましては、http://docs.splunk.com/images/a/a0/Splunk-6.3.0-ja_JP-Data.pdfになりますが、ちょっとわかりづらいです。
これは実際には正規表現の世界になります。^ \w \s \d + ? の意味については外部サイトになりますが、こちらを参照されるのも方法かと思います。http://homepage2.nifty.com/jr-kun/hidemaru_qa/4_regulr.html#BASIC。
実際にはこの正規表現を利用して、キャプチャという機能を利用してフィールド名を定義して、フィールドを決めています。上記の例ではキャプチャの際のフィールド名の定義がありませんが、キャプチャは, (?P ) 内に囲まれたものになります。このにフィールド名を定義しますが、キャプチャ内の正規表現にマッチした文字列が値となります。例えば、実際のデータが、
NETWORK
の場合、フィールド名にaccessvector
値にNETWORKを取りたいとします。
この場合は、EXTRACT-accessvector = (?P[^<]+)
となります。前の文字、はキャプチャの前にヒットする文字です。(?P<フィールド名>実際の値 ) がキャプチャになります。フィールド名は< >で囲まれたものです。そのあとの [^<] は、”<”でない文字列があり、 その後の"+"で"<"ではない文字が続くまで文字を取得するという意味になります。
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
03-27-2025
10:42 PM
|
