Activity Feed
- Posted Update a notable once an incident is opened or closed in ServiceNow on Splunk Enterprise Security. 09-10-2024 04:43 AM
- Posted How to create incidents in ServiceNow for notables in Splunk ES. on Alerting. 08-04-2024 11:03 PM
- Posted How to search for same field with different ip address? on Splunk Search. 01-09-2023 01:28 AM
- Posted Re: Extracting field with different type of data on Splunk Enterprise Security. 10-20-2021 02:14 AM
- Posted Extracting field with different type of data on Splunk Enterprise Security. 10-20-2021 12:22 AM
- Posted why Splunk is not able to index all the data from a txt file? on Getting Data In. 04-16-2021 03:49 AM
- Got Karma for How to add color in a column based on other columns using conditions?. 06-05-2020 12:50 AM
- Karma Re: Some splunk command lines ask for username; forwarders don't have user? for jbsplunk. 06-05-2020 12:46 AM
- Posted Compare two different tables from different sources and get the matching and non matching on Splunk Search. 02-24-2020 05:31 AM
- Posted Re: How to replace whole row with null, based on if statement? on Splunk Search. 02-05-2020 04:27 AM
- Posted Re: How to replace whole row with null, based on if statement? on Splunk Search. 02-03-2020 11:59 PM
- Posted Re: How to replace whole row with null, based on if statement? on Splunk Search. 02-03-2020 07:39 AM
- Posted How to replace whole row with null, based on if statement? on Splunk Search. 02-03-2020 04:14 AM
- Tagged How to replace whole row with null, based on if statement? on Splunk Search. 02-03-2020 04:14 AM
- Tagged How to replace whole row with null, based on if statement? on Splunk Search. 02-03-2020 04:14 AM
- Tagged How to replace whole row with null, based on if statement? on Splunk Search. 02-03-2020 04:14 AM
- Posted How to dynamically remove a field from search & how to dynamically use threshold from lookup file and change color based on it? on Splunk Search. 12-11-2019 01:11 AM
- Tagged How to dynamically remove a field from search & how to dynamically use threshold from lookup file and change color based on it? on Splunk Search. 12-11-2019 01:11 AM
- Tagged How to dynamically remove a field from search & how to dynamically use threshold from lookup file and change color based on it? on Splunk Search. 12-11-2019 01:11 AM
- Tagged How to dynamically remove a field from search & how to dynamically use threshold from lookup file and change color based on it? on Splunk Search. 12-11-2019 01:11 AM
Topics I've Started
Subject | Karma | Author | Latest Post |
---|---|---|---|
0 | |||
0 | |||
0 | |||
0 | |||
0 | |||
0 | |||
0 | |||
0 | |||
0 | |||
0 |
09-10-2024
04:43 AM
Hi All, Hope you all are doing well. I am very new to Splunk Enterprise security, and i need your help to understand how i can create a reverse integration with ServiceNow. So we are using ServiceNow Security Operation Integration to manually create incidents in ServiceNow for notables. We have a new ask from SOC to update the notables when the incidents are being created and closed in ServiceNow. We are using Splunk enterprise and wanted to know what endpoints we need to provide so that we can achieve reverse communication. I have created a user in splunk who has access to edit notables but i am not sure what endpoint i need to provide, is it just the url of my instance or do i need to add any services as well. Please let me know if you have any other questions. Thanks in advance.
... View more
Labels
- Labels:
-
notable event
08-04-2024
11:03 PM
Hi Guys, Hope you all the doing good. I have recently started to use Splunk ES and i am trying to create security incidents in ServiceNow for notables. I am using ServiceNow Security Operations Integration addon for this and i have created a workflow action to create incident. I am using below search in the workflow action but i am not able to create any incidents. Please let me know if i am missing any thing. Thanks in advance.
| expandtoken rule_title rule_description drilldown_searches
| fields title rule_description src dest user file_path file_hash file_name _time source severity event_hash
| eval src=coalesce(src, src_ip), dest = coalesce(dest, dest_ip)
| fillnull value=N/A dvc src dest user file_path file_hash file_name
| eval external_link = xyz
| eval md5_hash = if(file_hash == "N/A", "N/A", if(len(file_hash) == 32, file_hash, "N/A"))
| eval sha256_hash = if(file_hash == "N/A", "N/A", if(len(file_hash) == 64, file_hash, "N/A"))
| eval snow_event_ts = strftime(_time, "%m-%d-%Y %H:%M:%S")
| eval severity = case(severity=="informational", 0, severity=="low", 4, severity=="medium", 3, severity=="high", 2, severity=="critical", 1)
| eval ticket_contents = "short_description \"".title."\""
| eval ticket_contents = ticket_contents." assignment_group \"ABC\""
| eval ticket_contents = ticket_contents." contact_type \"SIEM\""
| eval ticket_contents = ticket_contents." description \"".rule_description."\""
| eval ticket_contents = ticket_contents." source_ip \"".src."\""
| eval ticket_contents = ticket_contents." dest_ip \"".dest."\""
| eval ticket_contents = ticket_contents." u_offence_id \"".event_hash."\""
| eval ticket_contents = ticket_contents." u_source \"".src."\""
| eval ticket_contents = ticket_contents." u_destination \"".dest."\""
| eval ticket_contents = ticket_contents." u_md5_hash \"".md5_hash."\""
| eval ticket_contents = ticket_contents." u_sha256_hash \"".sha256_hash."\""
| eval ticket_contents = ticket_contents." u_event_timestamp \"".snow_event_ts."\""
| eval ticket_contents = ticket_contents." u_event_name \"".source."\""
| eval ticket_contents = ticket_contents." severity \"".severity."\""
| return $ticket_contents
... View more
Labels
- Labels:
-
alert action
01-09-2023
01:28 AM
Happy New Year to all of you.
So I have syslog in which we have details of the devices and switches. The requirement is to find the old and new ip address for the NetworkName which were recently added to a group. To get this i have to follow below steps.
1. get the NetworkName which has been recently added to group. 2. than get the latest CallingStation for the NetworkName .
# search for step 1 & 2 index=xyz NetworkGroups="Device Type#All Device Types#DNAC#SingleIONBranch" (Diag_Message="Authentication succeeded") NetworkName =USAZSLKRR01FIF0001 |stats latest(CallingStation ) as CallingStation by NetworkName
3. search in the index with the CallingStation to get IPAddress(it has to ran for last 24 hours)
index=na3rc Calling_Station_ID=B0-22-7A-32-32-26 | bin span=1d _time | stats latest(IPAddress) as IPAddress by _time CallingStation | eval IP=if(_time<relative_time(now(),"@d"),"Old","New") The problem here is that IPAddress field has both old and new IPAddress. I tried join but it is showing no results as it is being maxout and when i try to use it in same search it is only showing new IPAddress. Thank in Advance 🙂
index=xyz NetworkGroups="Device Type#All Device Types#DNAC#SingleIONBranch" (Diag_Message="Authentication succeeded") NetworkName=USAZSLKRR01FIF0001
| stats latest(CallingStation) as CallingStation by NetworkName
| join CallingStation type=left [| search index=xyz
| bin span=1d _time
| stats latest(IPAddress) as IPAddress by _time CallingStation
| eval IP=if(_time<relative_time(now(),"@d"),"Old","New")]
... View more
Labels
- Labels:
-
join
10-20-2021
02:14 AM
Hi @PickleRick , We have a field named POREFERENCE in that we have three type of data 0561170-0443 :- 0561170 this is reference number 0213_DFS_201021004 :- 201021004 this is reference number 0159_1606766A_191021016 :- 1606766A this is reference number i want to extract the reference number from them.
... View more
10-20-2021
12:22 AM
Hi All, Hope you all are doing good. I am trying to extract a field which the different types of data. I want to extract the reference number. DATA:- 0561170-0443 :- 0561170 this is reference number 0213_DFS_201021004 :- 201021004 this is reference number 0159_1606766A_191021016 :- 1606766A this is reference number Can you please let me know how i can achieve this, i tried rex but it wont work. Is there any other way to do it? Thanks in advance 🙂
... View more
Labels
- Labels:
-
Other
04-16-2021
03:49 AM
Hi All, Hope you all are doing good. I am trying to read two simple txt files containing just the numeric value . These files get updated twice every day, morning and evening. I have used same props.conf for both the files. Splunk is able to read the first txt file properly in the morning and evening, but when it comes to 2nd txt file if their is same type of data present in the morning than splunk ignores that data in the evening. Example. If in morning in 2nd txt file the value is 1 and in evening the value is 15 than splunk only reads 5 in the evening file. [monitor://C:\test.txt] sourcetype = test ignoreOlderThan = 60d disabled = false crcSalt = <SOURCE> [test] DATETIME_CONFIG=CURRENT SHOULD_LINEMERGE=false LINE_BREAKER=([\r\n]+) TRUNCATE=100
... View more
Labels
- Labels:
-
inputs.conf
-
props.conf
02-24-2020
05:31 AM
Hi All,
Hope you all are doing good.
I have to check 2 table from different sources and get a new table where its says match or not match.
Column1 Column2 One
abc abc match
pqr xyz not match
I tried to use a query to get the details but still it is not working reason maybe due to logs coming on different time. My query
index=main source="Replicationlogs_*.txt" AND sourcetype=replication Store.*
| rex field=source Replicationlogs_(?<store_number>\d{4}).txt
| search store_number=*
| dedup SCD
| stats count by SCD store_number
| rename SCD as SCD1
| appendcols [search index=main source=*.log sourcetype=nitrogen_logs (SCD!=: AND SCD!=-)
| rex field=source (?<store_number>\d{4}).log
| search store_number=*
| dedup SCD
| stats count by SCD store_number
]
| eval Match=if(match(SCD1,SCD),"Yes","No")
| fillnull value=0
| fields - count
And the values i get are like this:-
STORE.brand 0010 No STORE.c-lens-fit
STORE.bridge-size 0010 No STORE.c-lens-issue-history
STORE.c-lens-fit 0010 No STORE.c-lens-payment-history
STORE.c-lens-issue-history 0010 No STORE.contact-detail
STORE.c-lens-payment-history 0010 No STORE.cust-c-lens-contract
STORE.c-lens-status-history 0010 No STORE.cust-c-lens-scheme
17 matches should appear but as they not in same row so the match is not displaying.
Please help me resolve this issue.
Thanks in advance
... View more
02-05-2020
04:27 AM
Hi to4kawa,
M already using a trigger condition...
If | where temp_count=1 raise alerts. And i think we can't use multi trigger condition....
... View more
02-03-2020
11:59 PM
Hi 13tsavage,
Thanks for your reply.
Yes i can use it but it wont work for other alerts.
There are 10 alerts which i have merged in one search, whenever ABC alert comes i have to ignore to alerts and when other alerts comes apart from ABC i have to capture them. When m using case or if and then i'm trying to use search or where it is just taking for ABC, which it should.
So i was trying to find a different way to do it.
Please do let me know if you have one.
Thanks in advance 🙂
... View more
02-03-2020
07:39 AM
Hi to4kawa,
Sorry i forgot to use code sample. Now i have updated it.
Yes only ABC will be displayed. I was asking is there any other way to do it?
Thanks for your help 🙂
... View more
02-03-2020
04:14 AM
Hi All,
Hope you all are doing well.
I was trying to setup email alert and event creation using Splunk and it was working fine. But i got a new condition in the existing alert.
The condition is to avoid 2 alerts and event creation when there is a specific alert. In my case when there is ABC alert then i have to ignore XYZ and PQR.
Logic seems to be simple, when ABC comes avoid XYZ and PQR....
But i am unable to execute it on Splunk. I tried below query but i think it will yield a null when there are any other alerts apart from the ABC.
index="myindex" sourcetype="mysourcetype" lab_hub_name="XYZ Hub" rag_status="0" ( lab_hub_tag="LKJ" OR
lab_hub_tag="ABC" OR
lab_hub_tag="PQR" OR
lab_hub_tag="XYZ" OR
lab_hub_tag="QWE" OR
lab_hub_tag="ERT" OR
lab_hub_tag="FGH") earliest=-7m latest=now
| stats latest(_time) as latest_tim, count by lab_hub_tag
| rename count as rag_count
| join type=left lab_hub_tag [search index="myservicenow" sourcetype="snow:incident" short_description="Splunk Alert - XYZ*" state!="7" earliest=-1d latest=now
| rex field=short_description "Splunk Alert - XYZ - (?[\S ]+$)"
| stats latest(state) as state, count by lab_hub_tag short_description
| fields - count]
| eval one=if(lab_hub_tag="ABC" AND rag_count>0,"yes","Null")
| search one= yes
| fillnull state short_description
| eval temp_count=if(rag_count>0 AND state="6" OR state="0",1,0)
| eval correlation_id=latest_tim.lab_hub_tag
| where temp_count=1
Please let me know how i can achieve this one.
Thanks for your help.
... View more
12-11-2019
01:11 AM
Hi All,
Hope you all are doing good.
I am stuck with 2 questions may be due to my Splunk query knowledge, hope you allcan help me in resolving the same.
Question 1:-
I have to dynamically remove a Responsetime field from a search when ComponentName is XYZ. I treid using if command splunk fields is not supported in it i believe. We are getting the ComponentName from drilldown via a token.
Question 2:-
I have to dynamically change the color of a panel based on the threshold value from a lookup table. Example:-
for ComponentName=xyz the threshold is 900 than the color should should be changed when threshold > 900 to red and threshold <900 to green.
Please do let me know if you any questions.
Thanks for your help 🙂
... View more
11-29-2019
12:04 AM
Its weird thought, when m giving same command just for an hour then m getting correct count of active machines.
... View more
11-28-2019
11:55 PM
HI Giuseppe,
Thanks for your reply.
I have already tried earliest one option but still m getting the same result. For other scenarios m able to get the correct data displayed to splunk but for this case m not getting able to display correct data.
Regards,
Nishant
... View more
11-28-2019
07:10 AM
Hi All,
Hope you all are good.
I was working on displaying the number of machines which are active for last one hours and showing a trend increase or decreased based on last hour. I used the below query to get the details.
index=emea-app-lol sourcetype="Vision_Labs"
| dedup machine_name
| timechart cont=false span=1h count
When i'am using this query and giving time range for 2 or 4 hours m getting the results as below:-
_time count
2019-11-28 13:00 10
2019-11-28 14:00 109
when i click on the count of 1 PM, i can see data being displayed for 13:00:00:00 to 13:00:00:00 and same for the 2 PM as well.
In this case the active machine count and trend both are displaying wrong. As when i do stats count than we I can see the accurate count of the data. I have tried to change the Span as well but no luck.
I'm getting the data every 15 minutes and in the below format
11/28/19
2:43:31.000 PM ('15','WPE',1,'BMRNRP','ScanPoint','Tracking','Tracking','2019-11-28 14:43:31')
11/28/19
2:43:31.000 PM ('15','PC02',1,'BMRGLM','ScanPoint','Tracking','Tracking','2019-11-28 14:43:31')
11/28/19
2:43:31.000 PM ('15','Non Manufacturing',1,'BMRR5X','Unknown','Non Manufacturing','Non Manufacturing','2019-11-28 14:43:31')
11/28/19
2:43:31.000 PM ('15','G05',1,'BMRPPK','Generator','Generating','Surfacing','2019-11-28 14:43:31')
Please do let me know if you have any questions.
Thanks in advance...
... View more
10-18-2019
07:39 AM
Hi gcusello,
I have to monitor a log (/export/mail/inbox) under this i have to display the below mentioned in events as they will get updated every 10 mins and the file names will change accordingly.
/export/mail/inbox/1243156.PSV
/export/mail/inbox/3575838.PSV
/export/mail/inbox/1253489.CSE
/export/mail/inbox/processed/2473580.CSE
/export/mail/inbox/qw648385.CSE
/export/mail/inbox/processed/12354675.CSE
I have written a configuration to monitor the path. But the issue which is happening is that splunk is displaying the details of files as an event rather than displaying it the file name mentioned above.
I want that in source:-/export/mail/inbox :- sourcetype inbox
i should see only the name of the files not the details inside the file as a events in splunk.
... View more
10-18-2019
04:00 AM
Hi All,
Hope you all are doing well.
Recently i was ingesting data to Splunk from a server and i had to get the file names under the inbox folder. I used below mentioned config file.
[monitor:///export/mail/inbox]
sourcetype = inbox
index = global-app-compiere
ignoreOlderThan = 60d
disabled = false
After the restarting splunk i was getting details of each files as events and file name as source.
So inside inbox folder we have files like this:-
/export/mail/inbox/1243156.PSV
/export/mail/inbox/3575838.PSV
/export/mail/inbox/1253489.CSE
/export/mail/inbox/processed/2473580.CSE
/export/mail/inbox/qw648385.CSE
/export/mail/inbox/processed/12354675.CSE
I wanted to just get the file names under the sourcetype inbox but i am getting the details of each file and the file is stored as source.
Can anyone please help me to get the details.
Thanks in advance 🙂
... View more
- Tags:
- inputs.conf
- splunk
07-31-2019
03:05 AM
Hi All,
Hope you are doing good.
I wanted to a add a mouse hover option for different panels which will display the details for the panel.
I have used the below code to add a mouse hover which adds an extra text "Details" and hovering over it we can get the details. But i want to that when a user hovers over the panel title than the details should be displayed also i want to use css and js within the XML as i have some credential issues for the servers.
Thanks for your help 🙂
.custom-tooltip{
display: inline;
position: absolute;
}
.custom-tooltip:hover:after{
background: #333 ;
background: rgba(0,0,0,.8) ;
border-radius: 5px ;
bottom: 26px ;
color: #fff ;
content: attr(title) ;
left: 20% ;
padding: 5px 15px ;
position: absolute ;
z-index: 98;
width: 220px;
... View more
07-05-2019
01:28 AM
Hi starcher,
Thanks for your reply.
I can't use HTTP Event Collector as forwarder is not installed on the particular server. I want to try a different approach but have not idea if webhook can help me one this.
If you have any idea please do let me know.
Thanks in advance
... View more
06-17-2019
07:03 AM
Hi all,
I have no idea about webhook and how it works but have seen threads were an alert action is done by webhook.
I was unable to find out if we can use webhook to send data to Splunk cloud.
If anyone has idea regarding this please let me know the steps to follow for the same.
Thanks in advance
... View more
06-10-2019
08:01 AM
So now the i have updated the query and it seems issue was due to dedup.
sourcetype=xyz OR sourcetype=abc
| eval Date=strftime(_time,"%d")
| stats avg(cpu) as Infrastructure, avg(iowait) as Application, avg(.ram) as Database, values(Date) as Date by source.store_num
| rename source.store_num as Store_Number
| eval State=case(Infrastructure>90,"Severe",Application>90,"Severe",Database>90,"Severe")
| stats values(Infrastructure) as Infrastructure,values(Application) as Application,values(Database) as Database, sum(eval(if(Infrastructure>90 OR Application>90 OR Database>90, Date,0))) as Total_Days, values(State) as State by Store_Number
| stats if(Total_Days==0,0,count(Total_Days))
| table Store_Number,Infrastructure,Application,Database, State,Total_Days
Using this is am getting all the store but the Total_Days column is adding all the dates i.e. if date is 9th and 10th June so its adding and displaying 19.
... View more
06-10-2019
05:24 AM
Hi shankarananth,
I tried to run the query line by line, when i don't use eval Date, it displays all the stores but when i use eval Date it displays only 6 store. And if i add full query then it won't display anything.
... View more
06-10-2019
04:27 AM
Hi shankarananth,
Thanks for your reply.
I tried the query but it is not showing any results. Also if i am trying by splitting the query it only displays few store number.
... View more
06-10-2019
03:16 AM
Hi All,
I have created a table that displays Store number and its avg(cpu),avg(ram),avg(iowait) using stats command.
sourcetype=xyz OR sourcetype=abc
| stats avg(cpu) avg(.iowait) avg(ram) by source.store_num
| rename avg(cpu) as Infrastructure
| rename avg(iowait) as Application
| rename avg(ram) as Database
| rename store_num as Store_Number
| eval State=case(Infrastructure>"90","Severe",Application>"90","Severe",Database>"90","Severe")
| table Store_Number,Infrastructure,Application,Database, State
Now I want to add a column which displays number of days the store is in red/severe.
Also if all the three are in green than the counter has to reset and days becomes 0.
Any ideas ???
Thanks in advance.
... View more
06-06-2019
04:31 AM
Hello,
I am currently working is on one use case where i have to display store number on the basis of avg cpu, avg ram and avg iowait.
I have used stats command and created a table and used eval command to put threshold.
I want to display only the color in the column based on the value of avg cpu, avg ram and avg iowait but not there values in the column. Is there any way which i can use to display only colors.
Secondly i was trying to add a 4th column which will display number of days the store's are in red(threshold above 90).
Thanks in advance.
... View more