About vamshikn72

vamshikn72 · ‎01-14-2022

What is the character limit of an alert name in splunk ES?

vamshikn72 · ‎09-28-2021

Hi Splunkers, How to create Incidents on SNOW from Splunk SPL? We have "ServiceNow Event Integration" alert action in use which creates incidents when an alerts triggers an event but trying to use the same from Splunk search. Tried using sendalert command as below and got an error: | sendalert servicenow param.severity="4" param.assigned_to="Assignment group" param.short_description="Alert Name" param.description="This is a test" param.u_environment="Dev" param.node=hostname param.resource="Nothing" param.type="Name" Error: Error in 'sendalert' command: Alert action "Servicenow" not found.

vamshikn72 · ‎09-08-2021

Hello Splunkers, I am looking for an html page in a dashboard with ID, ID_Name, an other fields with Text box, dropdown and other inputs. Something like below/Attached example. I am planning to create a form where people can enter details and store everything into a kv store using outputlookup. Example: ID ID_Name Submit

vamshikn72 · ‎05-03-2021

Thanks @MaverickT. We came to know about this later and asked our admins to upgrade.

vamshikn72 · ‎04-28-2021

Hi @bowesmana, Passing blank values in the response action and adding scores to the eval helped me a lot. Thanks for your quick help. Search example I used: | makeresults | eval field_user="noob", field_ip="8.8.8.8", field_host="machine" | eval risk_object=if(isnotnull(field_host),field_host,null()),risk_object_type=if(isnotnull(field_host),"system",null()) | appendpipe [| eval risk_object=if(isnotnull(field_user),field_user,null()),risk_object_type=if(isnotnull(field_user),"user",null())] | appendpipe [| eval risk_object=if(isnotnull(field_ip),field_ip,null()),risk_object_type=if(isnotnull(field_ip),"system",null())] | eval risk_score=20 | fields - _time field_user field_ip field_host

vamshikn72 · ‎04-27-2021

How to assign multiple risk object fields and object types in Risk analysis response action. I know it's possible from search using appendpipe and sendalert but we want this to be added from the response action. Example as below: Risk Score - 20 Risk Object Field - user, ip, host Risk Object Type - System, user

Posts	7
Solutions	0
Karma Given	2
Karma Received	1
Member Since	‎03-28-2016

Online Status	Offline
Date Last Visited	‎06-05-2024 12:23 PM

Character limit of alert/correlation name?

ServiceNow Event Integration

HTML Web form

Assign multiple risk objects in Risk Analysis

Character limit of alert/correlation name?

ServiceNow Event Integration

HTML Web form

Re: Assign multiple risk objects in Risk Analysis

Re: Assign multiple risk objects in Risk Analysis

Assign multiple risk objects in Risk Analysis