About sudoritz

sudoritz · ‎02-12-2020

would be nice if they could extend that option GUI click in maybe the Data Source panel (like in core splunk panel) but awesome you found it in code 😉

sudoritz · ‎12-11-2019

will this utilize a puppeteer like screen scraping for an export like. separately i wanted to look at an ability to do somewhat timelapse of what the dashboard was doing during say an event we can look back on (our case is user traffic/heatmaap/walk path/Core router flows). or aggreate that in a dashboard-mini summary index so screen playback on when an event happened you can see how the dashboard interacted with data. but thats cool a newer framework is coming i left PLENTY of feedback a month ago i hope it just gets better and better.

sudoritz · ‎09-12-2019

ya i was able to use that which is cool so my structure to apply building icon to 10 different propertys with the append and labely to set it lower sample Start---PROP---Stop_prop good=230 view ..................................................---------- prop-F1 ----- Prop_stop ....Start ----good:230----- PROP ---------- prop-F2 ----- Prop_stop ..................................................----------- prop-F4 ----- Prop_stop which they all connect to 1 Property and count from Start --- Prop = good:230 aand it splits the math by matching parent start---middle---end but . what is cool is that the links from PROP to prop-F1 (it divides the actual number between then) what i was trying to do is $VAR$ catching that path path you had under hood and so its a dynamic rewrite of your logic with just changing good label not the number . | eval lblstart="Starts: " .$good$ so it wouldn't match the cause i think there's many more this def gives me ideas to change color based on threshold where count is low im just scratching the surface on alot of different cool ideas.

sudoritz · ‎09-12-2019

Ya it brings some awesome creativity. wish some Gtables had this expose out to query like this and open it up. i did have a question say when i push path to eval it like this | eval path=from. "---" .prop. "---" .to its cool that it builts a parent -to- and what i noticed each of them the counters are like so start-prop-to good: 182 good: 32 good: 6 (it all adds to 230) But i wanted to change the word good to start but if i do label the numbers are off due to 1-1 mapping but you auto math out if split by same node ID start----(prop 3 results) each a separated line so it uses the count good/warn to then layout the number data my main question is you have some magic to build if split by each number which is awesome (due to the magic you have done with can i call a variable to . show the label because i have 58 paths by generating query. but with that aa---bb---ccc . bb i cant change the label (would be kind of narly to do a output lookup and custom label) Or maybe a better thing could i change the word good or warn internally and i see . you have 3 good/warn/error if we could have like 5 or more so we can have options on different . datapoint/color it original is aa-cc but i added a hop in the middle and its total is 230 count

sudoritz · ‎09-12-2019

haha whoops just about answering my own question Oh i actually just found that theres a field called label in your example 2 in the documentation where you can change the label of the link text. x request/min with html tags too lol =). i could probably have fun with this on a map of some sort too

sudoritz · ‎09-12-2019

I wanted to work in a radius fashion where theres start/stop or have the ablity to change Warn to a custom one .(would be cool to have different colors based on different data points.) good/warn/error i see 3 but my thought is to be able to change the name so good would show start warn would show stop etc etc. thanks this app really shows the beauty of viz potential 🙂

sudoritz · ‎07-02-2019

The Tableau WDC is kind of clunky where if you make a change on your saved search you have to regenerate WDC and doesn't feel where you can just see all your searches/reports . i heard of JDBC driver but having to pay for something that is broke and splunk cant support when it used to work. wish there was more movement on this too. i had to spin up a 7.0 so this would work but there comes a time where it might even fail here. whats funny is the JSON payload from 7.1+ response via 8089 has alot of blank spaces in front of the query where 7.0 doesnt so not sure if on splunk end can actually fix that if looking deep into the query.

sudoritz · ‎05-19-2019

this is one of the main reasons why we push reports to Tableau to control it but not everyone has a nice reporting tool on the fly 🙂 Hope core splunk has this soon.

sudoritz · ‎09-18-2018

Tableau connection issue with Splunk ODBC 2.1.1 After Upgrading Splunk to 7.1 from 7.0 We are having a Tableau connection Issue with Splunk ODBC 2.1.1 after Upgrading Splunk to 7.1 from 7.0. Every time we upgraded before, we didn't have an issue. I'm not sure if there was a big change from 7.0 to 7.1.2 but for some reason we are now getting errors on our Tableau. We tried downgrading to ODBC 2.0 and 2.1.0 , but that didn't work. Here's the error from =Tableau refresh. com.tableausoftware.nativeapi.dll.TableauException: [Splunk][SplunkODBC] (60) Unexpected response from server. Veriy the server URL. Error parsing JSON: Text only contains white space(s) Not sure what changed or what release notes

sudoritz · ‎11-10-2017

oops i need to move my answer to my comment when approved

sudoritz · ‎11-10-2017

question1 how do i know from ciscos SIZE output based on the field how to map out size1=uint8 size2=uint16 size4=uint32 size8= uint64 size32=string size40=string The Type tag must consist of one of the following supported data types: uint8, uint16, uint32, uint64, shortstring, string, longstring, blob. But not sure how to get size32/40 on shortstring/longstring/blob i cant find in Cisco where it states on how to on those.

sudoritz · ‎11-02-2017

Im having an issue myself. But i dont know if its different in the new Ruckus controller version or output . 2017-11-02T15:10:17-07:00 SCG01 Core: User[AA:FD:BB:28:91:AA] disconnects from WLAN[wifi] at AP[dW-con-007@AA:BB:C4:29:F1:10] with session data(Client Mac[CC:FD:CC:28:AA:2B],Client IP[],OS Type[],Host Name[],BSSID[1C:B9:C4:CC:F1:FF],User Name[DD:AA:17:FF:91:2B],VLAN[80],Encryption[None],Association Time[11 02 22:09:46 2017],Disconnect Reason[client Disconnect],Session Duration[30s],Bytes to User[0],Bytes from User [374],RSSI[10],SNR[-102],Client Radio[g/n],AP Location[],AP GPS[]) inputs.conf [monitor:///opt/syslog/ruckus/*.log] index = ruckus sourcetype = ruckus:log host_segment = 4 disabled = false props.conf [ruckus:log] category = Network description = Output produced by the Ruckus Wireless Controller pulldown_type = true SHOULD_LINEMERGE = false MAX_TIMESTAMP_LOOKAHEAD = 16 TRANSFORMS-sourcetype = ruckus_core,ruckus_core_disconnect,ruckus_core_reconnect, ruckus_core_join, ruckus_core_authorize, ruckus_sshd, ruckus_kernel [ruckus_core] rename = ruckus:core [ruckus:core] KV_MODE = None BREAK_ONLY_BEFORE=\w{3}\s{1,2}\d{1,2}\s SHOULD_LINEMERGE = false TIME_PREFIX=^ TIME_FORMAT=%b %d %H:%M:%S transforms.conf [ruckus_core] DEST_KEY = MetaData:Sourcetype REGEX = ^\w{3}\s{1,2}\d{1,2}\s\d{2}:\d{2}:\d{2}\s(?:[0-9]{1,3}.){3}[0-9]{1,3}\sCore: FORMAT = sourcetype::ruckus:core

sudoritz · ‎10-07-2017

Im trying to find some documentation to help aid in ingesting Custom IPfix outside 1-400 IDs. But I read that there's not much documentation in this arena hehe .. Here's what I have tried: Main goal is to pretty much ingest IPFIX data for application URL/URI / source/dest other Netflow stats but it seems i need to code either in vocabularies or something else. Cisco ASR 1004 --> streamfwd standalone app --> SH / indexer load I've noticed Template ID of 294 and enterprise ID of 9 but i dont see it in ipfix.xml in the IETF org assignments connection client ipv4 address ID = 12236 connection server ipv4 address ID = 12237 i tried setting this in streamfwd.conf cat streamfwd.conf [streamfwd] port = 8889 netflowReceiver.0.ip = 10.1.1.1 netflowReceiver.0.protocol = udp netflowReceiver.0.port = 9991 netflowReceiver.0.decoder = netflow netflowReceiver.0.decodingThreads = 8 netflowElement.0.enterpriseid = 9 netflowElement.0.id = 12235 netflowElement.0.termid = cisco.12235 netflowElement.1.enterpriseid = 9 netflowElement.1.id = 12236 netflowElement.1.termid = cisco.12236 and tried setting this in vocabularies vocabularies]# cat cisco.xml <?xml version="1.0" encoding="UTF-8"?> <CmConfig xmlns="http://purl.org/cloudmeter/config" version="7.1.1"> <Vocabulary id="cisco"> <Locked>true</Locked> <Name>Cisco Netflow Protocol Vocabulary</Name> <Term id="cisco.12235"> <Type>blob</Type> <Comment>12235 status.</Comment> </Term> <Term id="cisco.12236"> <Type>blob</Type> <Comment>12236 status</Comment> </Term> </Vocabulary> </CmConfig> theres some things im trying to figure out and stitch together like how do i know how to state its a uint32/64 i tried to look at the exporter part of the router to then build in the vocabularies size1=unsigned8 size4=unsigned32 size8=unsigned64 size32=string size40=string but its not 1-1 on some of them so im kinda lost on how i can bridge some of these inbound. This is the Exporter information from our cisco router showing Template ID of 294 along with IDs and Ent ID Client: Flow Monitor cisco-flow Exporter Format: IPFIX (Version 10) Template ID : 294 Source ID : 1280 Record Size : 95 + var Template layout _____________________________________________________________________________ | Field | ID | Ent.ID | Offset | Size | ----------------------------------------------------------------------------- | connection client ipv4 address | 12236 | 9 | 0 | 4 | | connection server ipv4 address | 12237 | 9 | 4 | 4 | | ip dscp | 195 | | 8 | 1 | | ip protocol | 4 | | 9 | 1 | | connection client transport port | 12240 | 9 | 10 | 2 | | connection server transport port | 12241 | 9 | 12 | 2 | | routing vrf input | 234 | | 14 | 4 | | connection initiator | 239 | | 18 | 1 | | connection id | 12242 | 9 | 19 | 4 | | flow observation point | 138 | | 23 | 8 | | application id | 95 | | 31 | 4 | | flow direction | 61 | | 35 | 1 | | flow sampler | 48 | | 36 | 1 | | services waas segment | 9252 | 9 | 37 | 1 | | services waas passthrough-reason | 9253 | 9 | 38 | 1 | | application http uri statistics | 9357 | 9 | 39 | var | | application http host | 12235 | 9 | 41 | var | *** i have it coming in Splunk cause i edited the app /streams/netflow and i see 12235 but it doesnt show like its correct) mabye because i did it with blob.*** Does anyone have example custom Cisco setup (i thought this would be like an easy 1-1 also in my streamfwd log i have this but not sure if i built it right 2017-10-07 11:06:29 WARN 140323433604864 stream.NetflowReceiver - NetFlowDecoder::decodeFlow Unable to decode flow set data. No template with id 261 received for observation domain id 6 from device 10.0.1.1 . Dropping flow data set of size 1358

sudoritz · ‎07-14-2017

is there a file to edit where red=value or somewhere i can add if/then maybe i was thinking if value = xx then color all the tiles a certain color(meaning Ticketed items devices) thanks

sudoritz · ‎04-03-2017

Thanks That WORKS 🙂

Posts	16
Solutions	0
Karma Given	0
Karma Received	3
Member Since	‎07-29-2016

Online Status	Offline
Date Last Visited	‎06-05-2020 02:04 AM

Flow_map Link-Labels change Name(of warn/error/goo...

Tableau connection issue with Splunk ODBC 2.1.1 Af...

Splunk Stream - Cisco IpFIX . Can't figure out how...

Re: How to automatically refresh searches?

Re: Is it possible to generate a PDF of a full das...

Re: Flow_map Link-Labels change Name(of warn/error...

Re: Flow_map Link-Labels change Name(of warn/error...

Re: Flow_map Link-Labels change Name(of warn/error...

Flow_map Link-Labels change Name(of warn/error/goo...

Re: Tableau connection issue with Splunk ODBC 2.1....

Re: Is it possible to generate a PDF of a full das...

Tableau connection issue with Splunk ODBC 2.1.1 Af...

Re: Splunk Stream - Cisco IpFIX . Can't figure out...

Re: Splunk Stream - Cisco IpFIX . Can't figure out...

Re: Splunk Add-on for Ruckus Wireless - Fields not...

Splunk Stream - Cisco IpFIX . Can't figure out how...

Re: Treemap - Custom Visualization: How to specify...

Re: How to parse Radius log files into splunk? Wha...