About cgalligan

cgalligan · ‎07-24-2018

I'm trying to figure out how to use the Splunk Machine Learning Toolkit to identify common patterns between items (profiling to predict when something is the same). For example a set of domain controllers. Does anyone have experience with this use case or an example?

cgalligan · ‎05-17-2018

I'm trying to import some JSON with nested field using the "Add Data" function, but I can't quite get the regex/ parsing correct. I want to pull everything in the "source" section. The JSON events look like: { "_index": "INDEX", "_type": "EVENT TYPE", "_id": "EVENTID", "_score": #, "_source": { "resp_pkts": #, "type": "TYPE", "id_orig_p": PORT, "duration": DURATION, "proto": "PROTOCOL", "received_timestamp": TIMESTAMP IN EPOCH, "ts": LOG TIMESTAMP } }, I have the following set in the props.conf CHARSET UTF8 DATETIME_CONFIG CURRENT SHOULD_LINEMERGE true NO_BINARY_CHECK true BREAK_ONLY_BEFORE "_source:{" disabled false KV_MODE json

cgalligan · ‎01-23-2018

The search as noted above: index=java | stats values(*) AS * | transpose | table column | rename column AS Fieldnames works, but is there a way to calculate the event coverage as well? fieldsummary doesn't seem to show this

cgalligan · ‎12-08-2017

thanks, I didn't realize that it was returning newest first

cgalligan · ‎12-08-2017

I'm running a query to pull data on some agents, which have each have a unique "aid". For example, my computer would have a unique aid, but if I check in once every hour the most recent up to data detail set is 60min ago. How can I dedup by aid while showing the most recent data? Here is my query - the agentlocaltime and AgentVersion is what would vary based on results: index=<AGENT_INFO> sourcetype=<SOURCETYPE> event_platform=<OS TYPE> event_simpleName=AgentOnline|eval agentlocal_time=strftime(AgentLocalTime,"%m/%d/%y %H:%M:%S")| table aip,aid,SystemProductName,SystemManufacturer,MoboManufacturer,ComputerName,BiosVersion,BiosReleaseDate,BiosManufacturer,AgentVersion,agentlocal_time,aid,aip

cgalligan · ‎11-08-2017

Thanks this is close to what I want. How would I update the HTML so that only one panel on the dashboard has a dark background?

cgalligan · ‎11-07-2017

I'm trying to create a panel on a dashboard with the text white and the background shaded So far this colors the whole page pink: <html> <style> body { background-color: #FFCCE6; } <p style="color:red">Not Completed</p> </html> </panel> </html>

cgalligan · ‎11-01-2017

I have two lookup files: 1) vulnerability results and 2) asset information. I want to take the vulnerability results, compare by IP to the asset information; and add device numbers to the results. Vulnerability results (FILE 1) has a column called "IP" Asset Information (FILE2) has columns called deviceId, POC, and scanIp. IP and scanIp would match Current search (which returns no results): |inputlookup FILE1|lookup FILE2 scanIp OUTPUTNEW deviceId,POC|table IP,deviceId,POC Any ideas?

cgalligan · ‎10-31-2017

Trying to install Splunk on Mac, but getting the following error (with both tgz and dmg installations): homePath='/Applications/splunk/var/lib/splunk/audit/db' of index=_audit on unusable filesystem. Validating databases (splunkd validatedb) failed with code '1'. Running Darwin Anyone been able to resolve this?

cgalligan · ‎12-05-2014

The PVS app is setup and the detail is available when I do a search for "index=pvs", however the dashboards are currently blank. When I set up the Data Input, I elected to create a new index to store these results in lieu of storing in the main index. Is there a way to point the dashboard source to this index? Do the dashboards rely on the data being put into the main index?

cgalligan · ‎12-05-2014

I would be interested. I looked into generating the .nessus file that contains the results automatically from the backend and shipping over to splunk (importing into the Nessus app maybe?), but I haven't found a way to do that.

cgalligan · ‎11-25-2014

The PVS app doesn't seem to parse the vulnerability results correctly (results of the Vulnerability syslog), but seems to process Real Time events only. Has anyone else had this issue?

Posts	12
Solutions	0
Karma Given	0
Karma Received	2
Member Since	‎05-30-2014

Online Status	Offline
Date Last Visited	‎06-05-2020 02:04 AM

Identifying Common Traits of Similar Items

JSON Import Into Splunk with Nested Fields

Deduping Results But Preserving Most Recent Value

How can I add HTML and background colors in a dash...

Comparing Two Lookup Files

Splunk 7.0.0 on Mac failing to run

PVS App Data Not Appearing in Dashboard After Send...

PVS App Not Parsing Vulnerabilities Correctly

Identifying Common Traits of Similar Items

JSON Import Into Splunk with Nested Fields

Re: How to display a list of fields for an index?

Re: Deduping Results But Preserving Most Recent Va...