About leonphelps_s

leonphelps_s · ‎02-26-2018

No, its like a rolling 30 day window.

leonphelps_s · ‎11-14-2017

For "splunk offline" you'll need to give the account a role with the capability "edit_indexer_cluster". It may work for some of those others.

leonphelps_s · ‎06-22-2017

Hello. That error is actually caused by the Search Activity apps default.meta and local.meta settings. I noticed that they have import values set. default.meta:import = search,search_activity local.meta:import = search, search_activity It has been my experience that when you expliciltly import knowledge objects from apps.. anything NOT imported is not avaialble for use. I've commented out the two import lines and then the search command completes correctly. You could probably just add the sa-ldapsearch app to the import line that would also fix it.

leonphelps_s · ‎04-20-2017

Martin was helpful in general as always but did not answer my question. I was able to do this by editing the incident_review.js which is obviously an unsupported modification.

leonphelps_s · ‎02-20-2017

Thanks Martin, you were part of the group that was discussing this with me in Slack. I'll have to do some testing but when I first checked it didn't seem to support sorting.. and then sub sorting.. because I want it to be reverse time sorted after being sorted by severity.

leonphelps_s · ‎02-20-2017

Thanks Anthony. I've used that link before to show unassigned or change the default time window, but it does not support the level of sort/grouping I'm asking for. Thanks again.

leonphelps_s · ‎02-17-2017

How can I change the sort order of the incident review page within Splunk Enterprise Security? The default appears to be _time, but we'd like to do something urgency and then time or custom field and then time.

leonphelps_s · ‎01-30-2017

Somehow ZZ_ does work but U_ which should also work does not

leonphelps_s · ‎01-30-2017

I tried this with TA-splunk app vs U_TA-splunk app and btool shows the TA-splunk winning out .. and still in the UI the TA-splunk app aliases are shown but not the other app.

leonphelps_s · ‎01-30-2017

Yes, tried debug/refresh/ and a full restart. both global, an exact copy of the first one [props] export = system access = read : [*], write : [ admin ] the search is in the "search" app

leonphelps_s · ‎01-30-2017

If what you are saying is true (which I understand why it would) then both aliases should appear via btool.. but do not. Further, when I run btool it ONLY shows the app with the high asciii order based on path. Try it.. two apps same aliases .. btool grep for the aliases.. only one set will show via btool. I'm gathering that btool shows whatever it wants.. not necessarily what splunk actually runs with. I need an apple to apply answer of the scenario I am describing not something different. I am positive I am doing something wrong or just don't understand something but I'm not seeing it.

leonphelps_s · ‎01-30-2017

Ok.. so now it is 'A_app_a' instead of 25_x_x ~/bin/splunk btool props list --debug |grep severity|grep nitro /opt/splunk/etc/apps/A_app_a/default/props.conf FIELDALIAS-cim_for_sev = severity AS severity_OVERRIDE ASCII ordering supports #'s so that should have been fine, but here I tested it with a capital "A' which is higher in order than 'a'. No change. btool still recognizes the correct precedence but splunk seemingly refuses to enforce it at the UI level. This includes a full splunk restart. One item of note.. in both scenarios.. in the "Fields -> Field Aliases" shows both apps and the conflicting aliases.

leonphelps_s · ‎01-30-2017

Simple scenario app_a/default/props.conf 25_app_a/default/props.conf The 25_app_a is an exact copy aside from the change noted below. both contain field aliases for the same sourcetype. the fields/classes are the same aside from a simple "as" clause. app_a says severity as severity_id and 25_app_a you can see below. Due to ASCII ordering of apps 25_ should override, and from a btool perspective it does. However in the UI the base app is still winning. ~/bin/splunk btool props list --debug |grep severity /opt/splunk/etc/apps/25_app_a/default/props.conf FIELDALIAS-cim_for_sev = severity AS severity_OVERRIDE Please don' t offer solutions such as "use app_a and /local/" there is a reason I'm doing it this way and I want emphasis to be on understanding precedence and btool.

leonphelps_s · ‎11-03-2016

My issue ended up being a command ordering issue. Inadvertently had the eval command before the mv

leonphelps_s · ‎11-03-2016

Did you ever figure this out? "No values" when there are multiple values in the field.

Posts	22
Solutions	4
Karma Given	0
Karma Received	15
Member Since	‎07-27-2016

Online Status	Offline
Date Last Visited	‎06-05-2020 02:04 AM

Splunk Enterprise Security: How can I change the s...

Need help with what should be a simple precedence ...

search peer searching requires invocation of splun...

Add-on for JIRA: Is there a character limit in jir...

Re: Report scheduling/acceleration question...

Re: Capabilities needed for a service account to e...

Re: SA-ldapsearch in Search Activity App

Re: Splunk Enterprise Security: How can I change t...

Re: Splunk Enterprise Security: How can I change t...

Re: Splunk Enterprise Security: How can I change t...

Splunk Enterprise Security: How can I change the s...

Re: Need help with what should be a simple precede...

Re: Need help with what should be a simple precede...

Re: Need help with what should be a simple precede...

Re: Need help with what should be a simple precede...

Re: Need help with what should be a simple precede...

Need help with what should be a simple precedence ...

Re: Concatenate fields into a single string

Re: Concatenate fields into a single string