About cgalligan

landen99 · ‎10-06-2020

index=m1 sourcetype=m1a | head 999 | fieldsummary | where count>0 | table field count distinct_count values

hkeswani_splunk · ‎11-02-2018

If you trying to find common patterns in numerical fields then you can use Correlation Matrix algorithms on your whole dataset consisting of only numerical values to find relations between them. This algorithms is not already available in MLTK but is very easy to implement using ML-SPL API as the code for the algorithms is already written and you just have to put it in your app files. Link for ML-API : http://docs.splunk.com/Documentation/MLApp/4.0.0/API/Introduction. And Link for the pre-written algorithm: http://docs.splunk.com/Documentation/MLApp/4.0.0/API/CorrelationMatrix . Hope this helps , if this is not what you were looking for let us know.

alpsholic · ‎01-09-2019

I faced the same issue. The problem is with the "_source" key in the input json. Replace it with something like "data". Then Splunk recognizes all fields.,I have the same problem. The issue is with key "_source" in the input json. Replace it with some else for example: "data". Then you see all the fields inside data subjson.

cgalligan · ‎12-08-2017

thanks, I didn't realize that it was returning newest first

Graham_Hanningt · ‎09-16-2019

I've not spent much time delving into how Splunk Web defines the colors in its style guide: /en-US/static/docs/style/style-guide.html#colors but from what I've seen, it doesn't use CSS variables that you can refer to in your own CSS rules in Simple XML. For example, I'd hoped to be able to do this: background-color: var(--accentColorL10); but, nope. For colors, Splunk appears to be using CSS classes, not CSS variables. I'd be happy to be shown otherwise.

elliotproebstel · ‎11-01-2017

Because the field name is different in the two lookups, you'll need to use an AS clause to alias the field you're looking up. Try this: |inputlookup FILE1|lookup FILE2 scanIp AS IP OUTPUTNEW deviceId,POC|table IP,deviceId,POC

ChrisG · ‎04-24-2018

Update: This is fixed in the Splunk Enterprise 7.1 release. The fix will also appear in a future 7.0.x maintenance release.

mokuso · ‎12-08-2014

The dashboards should not rely on a specific index. I'll attempt to try and reproduce and see if I have a similar result. Is any data returned when you search for "eventtype=pvs"?

cgalligan · ‎12-05-2014

I would be interested. I looked into generating the .nessus file that contains the results automatically from the backend and shipping over to splunk (importing into the Nessus app maybe?), but I haven't found a way to do that.

Posts	12
Solutions	0
Karma Given	0
Karma Received	2
Member Since	‎05-30-2014

Online Status	Offline
Date Last Visited	‎06-05-2020 02:04 AM

Identifying Common Traits of Similar Items

JSON Import Into Splunk with Nested Fields

Deduping Results But Preserving Most Recent Value

How can I add HTML and background colors in a dash...

Comparing Two Lookup Files

Splunk 7.0.0 on Mac failing to run

PVS App Data Not Appearing in Dashboard After Send...

PVS App Not Parsing Vulnerabilities Correctly

Re: How to display a list of fields for an index?

Re: Identifying Common Traits of Similar Items

Re: JSON Import Into Splunk with Nested Fields

Re: Deduping Results But Preserving Most Recent Va...

Re: How can I add HTML and background colors in a ...

Re: Comparing Two Lookup Files

Re: Splunk 7.0.0 on Mac failing to run

Re: PVS App Data Not Appearing in Dashboard After ...

Re: PVS App Not Parsing Vulnerabilities Correctly