About dxw350

dxw350 · ‎05-31-2019

Not available on free version. can't schedule reports but can create manual reports and email

dxw350 · ‎11-21-2018

I am trying to understand how when I downloaded an app from Splunkbase in .tgz and I put it on my Mac Desktop I was able to install on Splunk without having to physically untar and move it to the Ubuntu /splunk/etc folder. How did it do this automatically even if the .tgz was only available from the host MAC desktop? My Splunk enterprise was installed in a VM Ubuntu distro.

dxw350 · ‎11-13-2018

Why is the Home Monitor not an available app when doing a search on the Splunk server for Apps? It doesn't show up?

dxw350 · ‎08-23-2017

Thank you fornall the posts. The issue was definitely the Ubuntu installer. I worked the .deb with the CLI just fine. It was recommended in the documentation that the splunk install not be put in root, but some of the add-ons prefer it, i.e homemonitor. If not in root I needed to change syslog port 514 to a highorder port number. Interesting details

dxw350 · ‎08-14-2017

Thanks. I used the CLInand it worked. It was definitely the Ubuntu package installer that was the problem. Not Splunk

dxw350 · ‎08-13-2017

Jkat, I understand your reasoning, but doesn't that than defeat the purpose of having a Splunk .deb version???? We can all just use tar. I appreciate your feedback on this and I will resort to the CLI, although Linux GUI will soon become very common.

dxw350 · ‎08-13-2017

Here is the details. I downloaded the latest Splunk .deb 64-bit on the latest Ubuntu desktop 64-bit version 17.04. I first tried on the latest VMware with all memory requirements and sizing needed for Ubuntu 2048M memory and 10G storage. Once installed I loaded the Splunk .deb on the virtual Ubuntu through Firefox Afer successful download I tried to doubleclick "install" and it stayed in a frozen state "calculating". Note this also was the same result in the latest version of Virtualbox

dxw350 · ‎08-12-2017

I have tried Splunk Install on both VMware and Virtualbox Ubuntu Desktop version so I can use the graphical install interface. IN ALL CASES it does not work. In addition, the Splunk video introduction to the install doesn't load either on any operating system. If there is someone from Splunk that could address these issues it would be helpful since many of us don't want to use the CLI. Thanks

dxw350 · ‎07-29-2017

I guess my question is then why when uskng dbxquery you can't use a commas or spaces for the fields in splunk does it have to be separated by %20 and %2C? Example. |dbxquery %20name%2C%20address%2C%20phone

dxw350 · ‎07-28-2017

I am trying to use the fields that are pulled from the SQL database that were enriched with Splunk DB Connect. When creating a dashboard drop-down list I am trying to replace the previous input of user names using " |inputlookup Employees.csv|search name " and instead replace with a search directly from the database itself. Any command to replace the inputlookup? I was thinking just the "|search name " would have worked, but it didn't

dxw350 · ‎07-28-2017

Is there any reference material to understand dbquery script - purpose of %20, %2C, %22 etc....????

dxw350 · ‎07-27-2017

I am not getting it to work. I am trying to get an answer as to whether DB Connect would work with SPlunk. I am using OSX

dxw350 · ‎06-30-2017

How come I am in the search mode and I don't have an interesting fields sidebar. Sometimes it is there and sometimes it is not depending on the app I am running. Is there a configuration setting needed?

dxw350 · ‎06-28-2017

Hi. So I got it to work with the script dashboard example in Splunkbase for cascade drop down. I don't understand why the following was needed as described in the Splunk cascade |stats count by host (in my case) or |stats count by sourcetype (as stated in the splunk dashboard example). Couldn't I have just used |search host ?????

dxw350 · ‎06-28-2017

thank you. I will look at the search since it looks like that replaced "populatingsearch" in my 6.5 version

dxw350 · ‎06-28-2017

If you have two dropdowns for a dashboard where the second dropdown is dependent on the first, is there a way to create this using dynamic fields in the UI creation tab? I only found that you need to use something like "populatingsearch" but that is not part of the UI creation tab as follows and it is not working: <label>Firewall</label> <choice value="Tfw*">T firewalls</choice> <choice value="Xfw*">X firewalls</choice> <choice value="*">All Locations (includes JC)</choice> <fieldForLabel>host</fieldForLabel> <fieldForValue>host</fieldForValue> <default>*</default> <delimiter> OR </delimiter> </input> <input type="dropdown" token="param_fwname"> <label>fwname</label> <fieldForLabel>host</fieldForLabel> <fieldForValue>host</fieldForValue> <populatingsearch>earliest="0" latest="" fieldForLabel="fwname" fieldForValue="fwname" index=firewall_juniper param_fw=$param_fw$|dedup param_fw</populatingsearch> <choice value="*">all</choice> </input>

dxw350 · ‎06-26-2017

hi, I tried your appendpipe solution and it didn't work. I only have one inputlookup csv called "data_file.csv". How can the following be corrected to work? index=firewall_juniper sourcetype="juniper:junos:firewall" |dedup src_ip dest_ip | lookup data_file HOST_IP as src_ip output APPLICATION_SERVICE SERVER_IP |search APPLICATION_SERVICE=$param_app$ | inputlookup data_file| appendpipe [ | eval hold=HOST_IP | eval HOST_IP=SERVER_IP | eval SERVER_IP=hold | fields-hold] | dedup HOST_IP SERVER_IP | outputlookup append=f PARITY_SERVER_IP |search APPLICATION_SERVICE=$param_app$ |table src_ip src dest_ip HOSTNAME SERVER_IP

dxw350 · ‎06-26-2017

thank you. I will try today and report the results. Your help has been very valuable and I am learning the flexibility and approach.

dxw350 · ‎06-23-2017

Yes i accepted what is up-vote???? Also with respect to my issue I think that another reason the reciprocal inputnew lookup is not being populated is because it is not part of the same application dropdown list that I used to filter. (Is there a way to include reciprocL nex t row entry eventhough it is not part of the same dropdown group For completion example Host Server dest_zone Appl 192.168.1.1 192.168.10.11 dmz Word 192.168.10.11. 192.168.1.1 Trust. Word (This pair was good) 192.168.1.2 192.168.10.12 Dmz. Word But. 192.168.10.12. Not part of word app yet still want the pair as below (the below is missing) 192.168.10.12. 192.168.1.2. Trust. Excel

dxw350 · ‎06-23-2017

Thanks for the reply. It will be separate rows as entries

dxw350 · ‎06-23-2017

I am using lookup commands for data in a csv file and trying to map src_ip to the HOST and the SERVER in different rows. As an example MY ISSUE: There are always entries for both Host and Server, but if the Server entry is not listed as a separate row in the HOST column I need to add it as a reciprocal row. Is there a way to do that with |lookup HOST as src_ip OUTPUT src_ip dest_zone SERVER |lookup SERVER as src_ip OUTPUT src_ip dest_zone SERVER Example: HOST SERVER 192.168..1.1 192.168.2.10 192.168.2.10 192.168.1.1 This pair is good 192.168.1.3 192.168.2.11 Missing reciprocal This row needs the reverse

dxw350 · ‎06-23-2017

Thanks for all your help. I tried to give you points, but don't have any yet. I also tried your code and I guess I wasn't too clear on what I exactly needed, although we are close. MY ISSUE: There are always entries for both Host and Server, but if the Server entry is not listed as a separate row in the HOST column I need to add it as a reciprocal row. Is there a way to do that with |outputnew ? Example: HOST SERVER 192.168..1.1 192.168.2.10 192.168.2.10 192.168.1.1 This pair is good 192.168.1.3 192.168.2.11 Missing reciprocal This row needs the reverse

dxw350 · ‎06-23-2017

This is a great explanation. Thank you

dxw350 · ‎06-22-2017

Thanks for the reply. I didn't understand what you meant by "which ever one works last, wins". I need both sets of input in the results as separate src-ip rows. Also, it seems this is doubling the search processsing. Is there a conditional " OR" that can be used as an input portion the the |lookup????

dxw350 · ‎06-22-2017

if I have a src_ip in a juniper sourcetype and want to match it to a HOST in the csv file and also to a SERVER in the same csv file, is there a way to do that? Here is what I have so far |lookup data_file HOST as src_ip OR SERVER as src_ip Output src_ip destzone srczone

Posts	40
Solutions	0
Karma Given	7
Karma Received	3
Member Since	‎08-03-2016

Online Status	Offline
Date Last Visited	‎06-05-2020 02:04 AM

Help downloading an app from Splunkbase on Mac des...

Home Monitor no longer available on splunk app sea...

Ubuntu Desktop version install - .deb fails to ins...

How to have fields from SQL table to populate dash...

reference material to understand dbquery script - ...

DB Connect with Apple OSX

In Splunk Web, why does the fields sidebar not dis...

nested dropdowns in dashboard

reciprocal entries in next row

multiple input fields for csv lookup

Re: Why can I not embed or schedule reports after ...

Help downloading an app from Splunkbase on Mac des...

Home Monitor no longer available on splunk app sea...

Re: Ubuntu Desktop version install - .deb fails to...

Re: Ubuntu Desktop version install - .deb fails to...

Re: Ubuntu Desktop version install - .deb fails to...

Re: Ubuntu Desktop version install - .deb fails to...

Ubuntu Desktop version install - .deb fails to ins...

Re: reference material to understand dbquery scrip...

How to have fields from SQL table to populate dash...

reference material to understand dbquery script - ...

DB Connect with Apple OSX

In Splunk Web, why does the fields sidebar not dis...

Re: nested dropdowns in dashboard

Re: nested dropdowns in dashboard

nested dropdowns in dashboard

Re: reciprocal entries in next row

Re: multiple input fields for csv lookup

Re: multiple input fields for csv lookup

Re: reciprocal entries in next row

reciprocal entries in next row

Re: multiple input fields for csv lookup

Re: multiple input fields for csv lookup

Re: multiple input fields for csv lookup

multiple input fields for csv lookup