About kmfpo

kmfpo · ‎03-31-2021

@ITWhisperer The only thing wrong that needs adjustment is the month sorting. It is listed as Feb, Jan, Mar (alphabetical I am guessing). How can I force the order to be calendar order (Jan, Feb, Mar...)?

kmfpo · ‎03-30-2021

Hello all. I am trying to find the average by closed_month, but I want the average duration to include events from previous months in its average. So, average for Feb should include Jan + Feb. Average for March should include Jan + Feb + Mar. I figured out how to get the average for each month, but I don't know how to get include the previous months average_duration along with the current month. Sample Table of Data Case opened closed closed_month duration aaa Jan-01 Jan-31 Jan 30 bbb Feb-10 Feb-26 Feb 16 ccc Feb-13 Feb-28 Feb 15 ddd Feb-14 Feb-28 Feb 14 eee Feb-17 Mar-01 Mar 11 fff Feb-24 Mar-13 Mar 17 ggg Mar-03 Mar-11 Mar 8 hhh Mar-11 Mar-16 Mar 5 iii Mar-22 Mar-24 Mar 2 Avg Jan = (30) = 30 Avg Feb = (30+16+15+14)/4 = 18.8 Avg Mar = (30+16+15+14+11+17+8+5+2)/9 = 13.1 The desired result is a column chart, with 3 columns, one for each resolved month. Then each would go have the value 30, 18.8, and 13.1 respectively.

kmfpo · ‎09-08-2020

I would like to send uncooked and a cooked feed of the same events to the same destination receiver but on different ports.

kmfpo · ‎09-05-2020

I have logs on a HF. I need to filter the logs and only identify those containing the string "AAA". This subset of logs, I need to send two outputs: uncooked (raw) logs to receiving systems on port 9977 parsed (cooked) logs to receiving systems on port 9997 LOG FLOW ################### ON A SINGLE HF ################### transforms LOG FILES ----------> SPECIFIC LOGS |---:9977---> UNCOOKED tcpout | |---:9997---> COOKED tcpout Unfortunately, I don't have a test environment, so I have come up with some ideas on what might work, but I am hoping to get input before I deploy them. Here is what I have so far: ############# OUTPUTS ############# [tcpout:raw_IndexPool] sendCookedData = false server = 10.1.1.1:9977,10.1.1.2:9977,10.1.1.3:9977 [tcpout:IndexPool] indexAndForward=false server = 10.1.1.1:9997,10.1.1.2:9997,10.1.1.3:9997 ############# INPUTS ############# [monitor:///var/log/*.log] disabled = 0 index = proxy sourcetype = bluecoat:proxysg _TCP_ROUTING = IndexPool ############# PROPS ############# [bluecoat:proxysg] TRANSFORMS-bluecoatrex = nullqueue,raw_bluecoat,bluecoat_tcpout ############# TRANSFORMS ############# [raw_bluecoat] REGEX = \sAAA\s DEST_KEY = _TCP_ROUTING FORMAT = raw_IndexPool [bluecoat_tcpout] DEST_KEY = queue FORMAT = indexQueue

kmfpo · ‎08-19-2020

I built a simple TA using the Add-On Builder (v3.0.1) on Splunk 8.0.4. Once thing I noticed is that the TA only pulls the first page of results and at the bottom of the pulled data are URLs for the existing, next, and last pages. How do I configure this so that my TA iterates through all the pages? I thought it would be using the checkpoint settings, but I'm not sure how to set that up. I am not a developer so this endeavor has been a tough learning experience. Splunk documentation lacks examples for these things. The API I am pulling from says I can use page[number] and page[size] but I don't know how to have the TA pull from 1 to last (6 in this case). Existing Setup REST URL: https://api.website.com/${rest_endpoint}?page[number]=${page_number} Event Extraction settings JSON path $.data Checkpoint settings Checkpoint parameter name: page_number Checkpoint field path: $.links.last Checkpoint initial value: 1 My Data { "data":[ { "id":"52", "type":"report", "attributes":{ "name":"Bonorum", "description":"Lorem ipsum dolor sit amet.", "created_at":"2019-01-05T01:51:19.000Z" } }, { "id":"7", "type":"report", "attributes":{ "name":"Perspiciatis", "description":"Quia dolor sit amet.", "created_at":"2017-01-05T01:51:19.000Z" } } ], "links":{ "self":"https://api.website.com/reports?page%5Bnumber%5D=1", "next":"https://api.website.com/reports?page%5Bnumber%5D=2", "last":"https://api.website.com/reports?page%5Bnumber%5D=6" } }

kmfpo · ‎08-19-2020

I "solved" the issue by recreating my TA on a dev Splunk 8.0.4 and using the Add-On builder 3.0.1. Once I did this, I was able to go to my built TA and add my API credentials under the configuration tab.

kmfpo · ‎08-18-2020

Unfortunately, the custom TA I am building does not have a /default/inputs.conf nor /default/restmap.conf I already had a /local/restmap.conf and changed every instance of python to python2. This caused the "Inputs" tab in the GUI of the TA to stay stuck on "loading" in addition to the "Configuration" tab. I reverted back to python (from python2) and now the Inputs page loads, but the Configuration remains stuck on loading.

kmfpo · ‎08-17-2020

I am trying to use the Splunk Add-On Builder (v2.2.0) to build a TA to pull data via REST API in Splunk (v7.3.3). I am not a developer but used it to build the most basic single input configuration setup with a Global Account field. When I go to my TA (visible) and select Configuration, it stays stuck on "Loading". I am using a global text box for my API key identifier and token value so in the configuration menu, I am unable to configure this. I saw this post here and learned of a dev command. Output from the developer debug command =================================================== Found scheme="hackerone". Locating script for scheme="hackerone"... No regular file="/opt/splunk/etc/apps/TA-ta-hackerone/linux_x86_64/bin/hackerone.sh". No regular file="/opt/splunk/etc/apps/TA-ta-hackerone/linux_x86_64/bin/hackerone.py". No regular file="/opt/splunk/etc/apps/TA-ta-hackerone/linux_x86_64/bin/hackerone.js". No regular file="/opt/splunk/etc/apps/TA-ta-hackerone/linux_x86_64/bin/hackerone". No script found in dir="/opt/splunk/etc/apps/TA-ta-hackerone/linux_x86_64/bin" No regular file="/opt/splunk/etc/slave-apps/TA-ta-hackerone/linux_x86_64/bin/hackerone.sh". No regular file="/opt/splunk/etc/slave-apps/TA-ta-hackerone/linux_x86_64/bin/hackerone.py". No regular file="/opt/splunk/etc/slave-apps/TA-ta-hackerone/linux_x86_64/bin/hackerone.js". No regular file="/opt/splunk/etc/slave-apps/TA-ta-hackerone/linux_x86_64/bin/hackerone". No script found in dir="/opt/splunk/etc/slave-apps/TA-ta-hackerone/linux_x86_64/bin" No regular file="/opt/splunk/etc/apps/TA-ta-hackerone/bin/hackerone.sh". Found script "/opt/splunk/etc/apps/TA-ta-hackerone/bin/hackerone.py" to handle scheme "hackerone". XML scheme path "/scheme/title": "title" -> "hackerone" XML scheme path "/scheme/description": "description" -> "Go to the add-on's configuration UI and configure modular inputs under the Inputs menu." XML scheme path "/scheme/use_external_validation": "use_external_validation" -> "true" XML scheme path "/scheme/streaming_mode": "streaming_mode" -> "xml" XML scheme path "/scheme/use_single_instance": "use_single_instance" -> "false" XML arg path "/scheme/endpoint/args/arg": "name" -> "name" XML arg path "/scheme/endpoint/args/arg/title": "title" -> "hackerone Data Input Name" XML arg path "/scheme/endpoint/args/arg": "name" -> "rest_version" XML arg path "/scheme/endpoint/args/arg/title": "title" -> "rest_version" XML arg path "/scheme/endpoint/args/arg/required_on_create": "required_on_create" -> "0" XML arg path "/scheme/endpoint/args/arg/required_on_edit": "required_on_edit" -> "0" XML arg path "/scheme/endpoint/args/arg": "name" -> "program_id" XML arg path "/scheme/endpoint/args/arg/title": "title" -> "program_id" XML arg path "/scheme/endpoint/args/arg/required_on_create": "required_on_create" -> "0" XML arg path "/scheme/endpoint/args/arg/required_on_edit": "required_on_edit" -> "0" XML arg path "/scheme/endpoint/args/arg": "name" -> "hackerone_api_credentials" XML arg path "/scheme/endpoint/args/arg/title": "title" -> "hackerone_api_credentials" XML arg path "/scheme/endpoint/args/arg/required_on_create": "required_on_create" -> "0" XML arg path "/scheme/endpoint/args/arg/required_on_edit": "required_on_edit" -> "0" XML arg path "/scheme/endpoint/args/arg": "name" -> "rest_endpoint" XML arg path "/scheme/endpoint/args/arg/title": "title" -> "rest_endpoint" XML arg path "/scheme/endpoint/args/arg/required_on_create": "required_on_create" -> "0" XML arg path "/scheme/endpoint/args/arg/required_on_edit": "required_on_edit" -> "0" Setting up values from introspection for scheme "hackerone". Setting "title" to "hackerone". Setting "description" to "Go to the add-on's configuration UI and configure modular inputs under the Inputs menu.". Setting "use_single_instance" to false. Setting "use_external_validation" to true. Setting "title" to "hackerone_api_credentials". Setting "required_on_create" to false. Setting "required_on_edit" to false. Setting "title" to "hackerone Data Input Name". Setting "title" to "program_id". Setting "required_on_create" to false. Setting "required_on_edit" to false. Setting "title" to "rest_endpoint". Setting "required_on_create" to false. Setting "required_on_edit" to false. Setting "title" to "rest_version". Setting "required_on_create" to false. Setting "required_on_edit" to false. Introspection setup completed for scheme "hackerone".

kmfpo · ‎04-20-2020

So I have a default value for col1 that is "Pending completion of search". What I wanted was for col1 to input its value once the query is complete (using a base search). I want it to keep the "Pending completion of search" until the search is actually done. For some reason, my dashboard displays This dashboard is Pending completion of search (1second) .. changes to .. This dashboard is $result.col1$" .. query finishes 10 seconds later .. This dashboard is Acceptable

kmfpo · ‎04-20-2020

I want to set the title of one of my dashboards after the search is complete. I have tried using various event handlers but can't get the token to set. What am I missing? <search base="myBaseSearch"> <query> | search foo</query> <done> <condition match=" 'job.isDone' == true"> <set token="col1_token">$result.col1$</set> </condition> </done> </search>

kmfpo · ‎04-13-2020

Hello all, I created a malformedEventIndex ( malformedevent ), per inputs.conf. I see 400 million+/day from thousands of hosts going to this index from my syslog servers (have a HF that sends to indexer cluster). I tried looking at the events to see what would cause them to end up in this index, and patterns shows: 100% __default_indexprocessor_body This doesn't tell me anything. I went through the reasons as to why events may end up here and none seem to match. * Routes the following kinds of events to the specified index: * events destined for read-only indexes ### we don't have these * log events destined for datatype=metric indexes ### no logs on syslog server go to metric indexes * log events with invalid raw data values, like all-whitespace raw ### I cat log files on syslog server and they are not all-whitespace * metric events destined for datatype=event indexes ### these systems are not sending metric events * metric events with invalid metric values, like non-numeric values ### see above * metric events lacking required attributes, like metric name ### see above Documentation on this index is extremely sparse so I am not sure where to go from here. Please help.

Posts	11
Solutions	1
Karma Given	4
Karma Received	0
Member Since	‎03-19-2019

Online Status	Offline
Date Last Visited	‎04-01-2021 12:45 AM

How to count cumulative average by month?

How to send two feeds (uncooked and cooked) to a s...

Add-On Builder - How to pull multiple pages from R...

Add-on Builder stuck on configuration "loading"

How to set a token for XML dashboard using an even...

malformedEventIndex, how to troubleshoot and fix l...

Re: How to count cumulative average by month?