Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About sirajnp
sirajnp
Path Finder
Member since:
05-12-2016
10-05-2022
Community Statistics
| Posts | 22 |
| Solutions | 0 |
| Karma Given | 0 |
| Karma Received | 6 |
| Member Since | 05-12-2016 |
Activity Feed
- Got Karma for Re: How to get Splunk sendemail command to send multiple emails based on search results?. 06-03-2024 09:03 PM
- Got Karma for Re: How do you send an email alert based on search results?. 02-15-2023 05:07 AM
- Posted Re: How to resolve issue after updating HF: 'Indicator 'ingestion_latency_gap_multiplier' exceeded configured value...' on Deployment Architecture. 08-03-2022 09:55 PM
- Posted Re: Splunk SOAR vault file update(read/write) on Splunk SOAR. 05-29-2022 10:39 AM
- Posted Re: Splunk SOAR vault file update(read/write) on Splunk SOAR. 05-26-2022 09:39 PM
- Posted Re: Splunk SOAR vault file update(read/write) on Splunk SOAR. 05-26-2022 02:15 AM
- Posted Splunk SOAR vault file update: How to write custom code to read/write vault files? on Splunk SOAR. 05-25-2022 01:38 AM
- Got Karma for Re: How to get Splunk sendemail command to send multiple emails based on search results?. 01-11-2022 01:43 PM
- Posted Re: How to send email to multiple recipients using map command with Python3? on Reporting. 06-30-2021 12:55 AM
- Posted Re: How to get Splunk sendemail command to send multiple emails based on search results 2016 on Reporting. 06-30-2021 12:39 AM
- Posted Re: How to get Splunk sendemail command to send multiple emails based on search results? on Reporting. 06-30-2021 12:38 AM
- Posted Re: How to use the sendemail command to send an email to different recipients from a lookup per event? on Splunk Search. 06-30-2021 12:30 AM
- Posted Re: How to send individual emails that appear in the search results on Splunk Search. 06-30-2021 12:29 AM
- Posted Re: How to send email to multiple recipients using map command with Python3? on Reporting. 06-30-2021 12:29 AM
- Posted Re: How do you send an email alert based on search results? on Reporting. 06-30-2021 12:27 AM
- Posted Re: sending emails to users that appear in search results on Splunk Search. 06-30-2021 12:26 AM
- Posted Re: How to get Splunk sendemail command to send multiple emails based on search results 2016 on Reporting. 06-30-2021 12:26 AM
- Posted Re: How to use the sendemail command to send results to different emails created with eval? on Splunk Search. 06-30-2021 12:24 AM
- Got Karma for Re: Why is the Splunk Add-on for F5 BIG-IP not separating sourcetypes as expected?. 06-28-2021 08:44 AM
- Got Karma for Re: Why is the Splunk Add-on for F5 BIG-IP not separating sourcetypes as expected?. 06-05-2020 12:48 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 |
08-03-2022
09:55 PM
Hi, Did you find any solution for this?
... View more
05-29-2022
10:39 AM
@Dave_Burns By saying in original format, my understanding was phantom changes the format while storing into vault. Thanks for correcting it. My job will be done if I can open the vault document to modify it. Kindly share if you have any example on how to do it. Either csv or excel.
... View more
05-26-2022
09:39 PM
Hi @Dave_Burns , Yes, I need the output in excel format hence I have created an app to support this. I'm looking for that piece of code to read/write the vault document in the original format. I have the output of vault api info(). Let's say we have the name of the file and location where it is stored. I'm stuck here on how to open this document in original format from vault to write/read this file. Ex: file "name" = test.xlsx file "path" = $PHANTOM_HOME/vault/1d/53/1232876KJHDFKJDGSWQ8EWDJSSDJH I think it should be the same way you can modify the excel file like you do for .csv. It will be great if you can share me that code on how to edit a .csv file.
... View more
05-26-2022
02:15 AM
Hi @Dave_Burns , I'm using json_excel_convertor [xlsxwriter] package to convert json input to excel file. My issue is I'm able to convert to excel and attach to vault. However, I can't read the excel file from vault to update it later on. I fetched the vault_info() using vault_id but looking for a method to open that file in the original format and update it since it is stored in vault.
... View more
05-25-2022
01:38 AM
Hi,
I'm trying to load a excel file from phantom vault for updating the data inside. I'm able to fetch file but couldn't open it for updating the cell values. Can anyone help me with the custom code to read and write the vault files.
... View more
- Tags:
- splunk-soar
Labels
- Labels:
-
configuration
-
using SOAR ⁄ Phantom
06-30-2021
12:55 AM
Just use a stats by email address at the end. Then will have only one email per recipient.
... View more
06-30-2021
12:39 AM
It's pretty simple. Just enable send email alert action and in to: field set $result.email$ (email - depend upon your field name in Splunk result) and select trigger "for each result". Email will be send to the respective email address for each line of result. https://docs.splunk.com/Documentation/Splunk/6.3.3/Alert/Emailnotification#Send_email_to_different_recipients_based_on_search_results
... View more
It's pretty simple, don't even need to use map command. Just enable send email alert action and in to: field set $result.email$ (email - depend upon your field name in Splunk result) and select trigger "for each result". Email will be send to the respective email address for each line of result. https://docs.splunk.com/Documentation/Splunk/6.3.3/Alert/Emailnotification#Send_email_to_different_recipients_based_on_search_results
... View more
06-30-2021
12:30 AM
It's pretty simple, don't even need to use map command. Just enable send email alert action and in to: field set $result.email$ (email - depend upon your field name in Splunk result) and select trigger "for each result". Email will be send to the respective email address for each line of result. https://docs.splunk.com/Documentation/Splunk/6.3.3/Alert/Emailnotification#Send_email_to_different_recipients_based_on_search_results
... View more
06-30-2021
12:29 AM
It's pretty simple, don't even need to use map command. Just enable send email alert action and in to: field set $result.email$ (email - depend upon your field name in Splunk result) and select trigger "for each result". Email will be send to the respective email address for each line of result. https://docs.splunk.com/Documentation/Splunk/6.3.3/Alert/Emailnotification#Send_email_to_different_recipients_based_on_search_results
... View more
06-30-2021
12:29 AM
It's pretty simple, don't even need to use map command. Just enable send email alert action and in to: field set $result.email$ (email - depend upon your field name in Splunk result) and select trigger "for each result". Email will be send to the respective email address for each line of result. https://docs.splunk.com/Documentation/Splunk/6.3.3/Alert/Emailnotification#Send_email_to_different_recipients_based_on_search_results
... View more
It's pretty simple, don't even need to use map command. Just enable send email alert action and in to: field set $result.email$ (email - depend upon your field name in Splunk result) and select trigger "for each result". Email will be send to the respective email address for each line of result. https://docs.splunk.com/Documentation/Splunk/6.3.3/Alert/Emailnotification#Send_email_to_different_recipients_based_on_search_results
... View more
06-30-2021
12:26 AM
It's pretty simple, don't even need to use map command. Just enable send email alert action and in to: field set $result.email$ (email - depend upon your field name in Splunk result) and select trigger "for each result". Email will be send to the respective email address for each line of result. https://docs.splunk.com/Documentation/Splunk/6.3.3/Alert/Emailnotification#Send_email_to_different_recipients_based_on_search_results
... View more
06-30-2021
12:26 AM
It's pretty simple, don't even need to use map command. Just enable send email alert action and in to: field set $result.email$ and select trigger "for each result". Email will be send to the respective email address for each line of result.
... View more
06-30-2021
12:24 AM
It's pretty simple, don't even need to use map command. Just enable send email alert action and in to: field set $result.email$ (email - depend upon your field name in Splunk result) and select trigger "for each result". Email will be send to the respective email address for each line of result. https://docs.splunk.com/Documentation/Splunk/6.3.3/Alert/Emailnotification#Send_email_to_different_recipients_based_on_search_results
... View more
03-21-2020
10:14 PM
05-14-2019 10:54:16.517 -0400 ERROR KVStorageProvider - An error occurred during the last operation ('saveBatchData', domain: '2', code: '4'): Failed to send "update" command with database "s_cpz-coU94dWXKCN+jKROv8LHlXVG8O_testingcollectionBfrJQ4CnAkHyN4DnrvYrGQiU": Failed to read 4 bytes: socket error or timeout
@DavidHourani - We are restoring KVStore from one search head to another, getting above error. What could be the issue
... View more
10-09-2019
03:07 AM
I'm creating a new dashboard with custom layout/style in Splunk enterprise security app. I'm experiencing an issue while adding my custom.js script to dashboard. I have placed the custom.js file in splunkenterprisesecurity/appserver/static/custom.js. When I debug the script I can view that the script being loaded successfully and the layout & style being applied based on the condition. However when it exit from the inner function(function (newValue)) and go back to main function (common.js), Splunk removes all the custom styles applied by inner function based on the condition. Below is the code.
Any help is highly appreciated, not sure what I'm doing wrong.
Please note that the id #demo is correctly defined in the html class for the panel. As I said I can see it being applied in the debug mode.
custom.js
require([
"splunkjs/mvc",
"splunkjs/mvc/simplexml/ready!",
], function (mvc)
{
console.log("inside");
var defaultTokenModel = mvc.Components.get("default");
defaultTokenModel.on("change:csi", function (newValue)
{
var csi = defaultTokenModel.get("csi");
if ((csi>=0) && (csi<=2.5))
{
$('#demo').removeClass('pan_yellow');
$('#demo').removeClass('pan_green');
$('#demo').addClass('pan_red');
}
else if ((csi>2.5) && (csi<=4))
{
$('#demo').removeClass('pan_red');
$('#demo').removeClass('pan_green');
$('#demo').addClass('pan_yellow');
}
else if ((csi>4) && (csi<=5))
{
$('#demo').removeClass('pan_yellow');
$('#demo').removeClass('pan_red');
$('#demo').addClass('pan_green');
}
});
});
css file.
.pan_red
{
background: #FE2B57 !important;
}
.pan_yellow
{
background: #FBAA49 !important;
}
.pan_green
{
background: #00ea77 !important;
}
... View more
03-20-2017
07:22 AM
Splunkers,
I faced the same issue, however managed to resolve the issue.
... View more
02-27-2017
12:01 AM
Hello drbones,
May I know how you granted permission for forwarder agent on the mounted drive. Whether your Site Protector system and forwarder installed machines is part of same domain.
In our case Site protector is not in domain hence forwarder could not read the mounted drive due to permission issues.
... View more
01-16-2017
07:02 AM
3 Karma
Hi,
Got same problem here. Add-on cannot extract fields for ASM audit events.
Sourcetype: f5:bigip:syslog
Port: udp:9514
Have you guys get through this issue?
... View more
01-04-2017
06:07 AM
Hi
Did you find a solution for this.
... View more
