Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About jchapell
jchapell
Explorer
Member since:
11-02-2016
09-24-2021
Community Statistics
| Posts | 11 |
| Solutions | 0 |
| Karma Given | 1 |
| Karma Received | 2 |
| Member Since | 11-02-2016 |
Activity Feed
- Karma Re: Splunk Mobile Beta for davebo1896. 06-05-2020 12:50 AM
- Got Karma for Splunk Mobile Beta. 06-05-2020 12:50 AM
- Got Karma for Re: Splunk Mobile Beta. 06-05-2020 12:50 AM
- Posted Re: finding systems from a CSV that are not reporting into Splunk on Getting Data In. 03-04-2019 05:52 AM
- Posted finding systems from a CSV that are not reporting into Splunk on Getting Data In. 02-20-2019 10:11 AM
- Tagged finding systems from a CSV that are not reporting into Splunk on Getting Data In. 02-20-2019 10:11 AM
- Tagged finding systems from a CSV that are not reporting into Splunk on Getting Data In. 02-20-2019 10:11 AM
- Tagged finding systems from a CSV that are not reporting into Splunk on Getting Data In. 02-20-2019 10:11 AM
- Posted Re: Splunk Mobile Beta on All Apps and Add-ons. 01-07-2019 12:52 PM
- Posted Re: Splunk Mobile Beta on All Apps and Add-ons. 01-04-2019 04:44 AM
- Posted Re: Splunk Mobile Beta on All Apps and Add-ons. 01-04-2019 04:38 AM
- Posted Splunk Mobile Beta on All Apps and Add-ons. 01-03-2019 12:12 PM
- Tagged Splunk Mobile Beta on All Apps and Add-ons. 01-03-2019 12:12 PM
- Posted Re: Error regarding Checkpoint OPSEC LEA on Splunk Enterprise Security. 10-17-2018 03:41 PM
- Posted Could you help me with the following error in the Splunk Add-on for Tenable?: "not connecting to my scanner" on All Apps and Add-ons. 10-17-2018 09:51 AM
- Tagged Could you help me with the following error in the Splunk Add-on for Tenable?: "not connecting to my scanner" on All Apps and Add-ons. 10-17-2018 09:51 AM
- Tagged Could you help me with the following error in the Splunk Add-on for Tenable?: "not connecting to my scanner" on All Apps and Add-ons. 10-17-2018 09:51 AM
- Tagged Could you help me with the following error in the Splunk Add-on for Tenable?: "not connecting to my scanner" on All Apps and Add-ons. 10-17-2018 09:51 AM
- Tagged Could you help me with the following error in the Splunk Add-on for Tenable?: "not connecting to my scanner" on All Apps and Add-ons. 10-17-2018 09:51 AM
- Posted Re: Is it possible to use the dbxquery command to get list of assets and a standard Splunk search to find last log entries for each? on All Apps and Add-ons. 06-20-2017 11:32 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 1 | |||
| 0 | |||
| 0 |
03-04-2019
05:52 AM
I've tried both of these and get different results, but still pulling up systems that can be verified as having written events to splunk. I know I can't be the only one trying to leverage our assets.csv to find hosts not writing events.
... View more
02-20-2019
10:11 AM
I have a search that I am working on and running into problems.
Currently, I have a CSV generated that contains all of our hosts and their statuses on our network — in use, expired, disposed, etc. I am trying to search on "in use" status and find the first/last time they reported into Splunk.
Well, I thought it was working great with the search I had, but there are systems showing up as not reporting in a number of days, yet host=foo yields results that are current. Below is my search:
| metadata type=hosts
| lookup assets.csv "short_names" as host Output "asset_state" as Reason
| where Reason="In Use"
| dedup host firstTime recentTime lastTime
| eval diff= (now()-recentTime)/86400
| convert ctime(firstTime) timeformat="%Y-%m-%d %H:%M:%S"
| convert ctime(lastTime) timeformat="%Y-%m-%d %H:%M:%S"
| convert ctime(recentTime) timeformat="%Y-%m-%d %H:%M:%S"
| where diff > 3.0
| eval now= now()
| convert ctime(now) timeformat="%Y-%m-%d %H:%M:%S"
| sort - diff
| table host Reason diff recentTime firstTime
... View more
01-07-2019
12:52 PM
I've installed what i was pointed to via the email. Still does not work.
... View more
01-04-2019
04:44 AM
1 Karma
I have Splunk Mobile(Beta) v 1.0(129) installed from TestFlight and Splunk Cloude Gateway (beta) (AKA Spacebridge) Cloud Gateway Version: 1.0.0+263 installed on my search head
... View more
01-04-2019
04:38 AM
I have Splunk Mobile(Beta) v 1.0(129) installed from TestFlight and Splunk Cloude Gateway (beta) (AKA Spacebridge) Cloud Gateway Version: 1.0.0+263 installed on my search head
... View more
01-03-2019
12:12 PM
1 Karma
I have the app on my sandbox (test splunk) instance, and the app on my phone, what needs to be configured/opened to allow device registration? There is no documentation. Or is the splunk mobile only good if you use splunk in the cloud?
... View more
- Tags:
- Splunk Cloud Gateway
10-17-2018
03:41 PM
@gjanders is right, you will need the libraries installed, configuring on the heavy forwarder is the desired method, and as for working with r70, if you can find an older version of the app, it may work. I would personally look into upgrading my checkpoint instances to r80.10. I just moved ours from r77.30 to r80.10 and couldn't be happier with them after working out some kinks.
... View more
10-17-2018
09:51 AM
Could you help me with the error listed below?
2018-10-17 11:27:56,673 ERROR pid=7409 tid=MainThread file=nessus_rest_client.py:request:100 | Failed to connect https://x.x.x.x:8834/scans, reason=Traceback (most recent call last):
File "/opt/splunk/etc/apps/Splunk_TA_nessus/bin/nessus_rest_client.py", line 80, in request
headers=headers)
File "/opt/splunk/etc/apps/Splunk_TA_nessus/bin/splunktalib/httplib2/__init__.py", line 1593, in request
(response, content) = self._request(conn, authority, uri, request_uri, method, body, headers, redirections, cachekey)
File "/opt/splunk/etc/apps/Splunk_TA_nessus/bin/splunktalib/httplib2/__init__.py", line 1335, in _request
(response, content) = self._conn_request(conn, request_uri, method, body, headers)
File "/opt/splunk/etc/apps/Splunk_TA_nessus/bin/splunktalib/httplib2/__init__.py", line 1257, in _conn_request
conn.connect()
File "/opt/splunk/etc/apps/Splunk_TA_nessus/bin/splunktalib/httplib2/__init__.py", line 1018, in connect
sock.connect((self.host, self.port))
File "/opt/splunk/lib/python2.7/socket.py", line 228, in meth
return getattr(self._sock,name)(*args)
timeout: timed out
... View more
06-20-2017
11:32 AM
@woodcock
that worked with a little tweaking, but worked. Now, my search when I start filtering out hosts by specific statuses, I get several systems that do not appear in my lookup. What would be the easiest way to filter those? Here is my current query:
| metadata type=hosts
| lookup sdp_lookup1.csv "Asset Name" as host Output "Asset State" as Reason
| eval Reason = if(isnull(Reason) OR Reason="", "Status?", Reason)
| convert ctime(recentTime) as Latest_Time ctime(firstTime) as First_Time
| eval gap = (now() - recentTime) / 86400
| where gap > 1.0
| eval Days_of_Missing_Logs = round(gap,0)
| sort Reason, 0 - Days_of_Missing_Logs
| where Reason != "In Use" AND Reason != "In Store"
| table host Reason Days_of_Missing_Logs Latest_Time First_Time
I'm "assuming" adding from sdp_lookup1.csv on the |eval gap = (now() - recentTime)/86400 so that it reads | eval from sdp_lookup1.csv gap = (now() - recentTime) / 86400
... View more
06-14-2017
12:30 PM
yes, I know there are a lot of joins in there....it's the main query I am using for several panels in a dashboard for now, until I get just what I need and make it "pretty"
... View more
06-14-2017
12:29 PM
I am using a dbxquery to pull my assets(hosts) and a few other details from ManageEngine's SQL database for ServiceDeskPlus and would like to then use those results to match up the latest log entry from each host. Is it possible? My dbxquery works great, but nothing has worked in regards to leveraging those results to find the latest log from each host.
My current query is:
| dbxquery query="SELECT MAX(\"resource\".\"RESOURCENAME\") AS \"Asset Name\", MAX(\"resource\".\"ASSETTAG\") AS \"Asset Tag\", MAX(\"barcodes\".\"BARCODE\") AS \"Barcode\", MAX(\"product\".\"COMPONENTNAME\") AS \"Product\", MAX(\"productType\".\"COMPONENTTYPENAME\") AS \"Product Type\", MAX(\"aao\".\"NAME\") AS \"Vendor Name\", MAX(\"state\".\"DISPLAYSTATE\") AS \"Asset State\", MAX(\"rtype\".\"TYPE\") AS \"Asset Type\", MAX(\"rCategory\".\"CATEGORY\") AS \"Asset Category\", MAX(\"resource\".\"SERIALNO\") AS \"Serial Number\", MAX(\"aaaUser\".\"FIRST_NAME\") AS \"User\", MAX(\"resFields\".\"UDF_CHAR6\") AS \"Physical or Virtual\", MAX(\"resFields\".\"UDF_CHAR7\") AS \"Alternative Name\" FROM \"Resources\" \"resource\" LEFT JOIN \"ComponentDefinition\" \"product\" ON \"resource\".\"COMPONENTID\"=\"product\".\"COMPONENTID\" LEFT JOIN \"ComponentType\" \"productType\" ON \"product\".\"COMPONENTTYPEID\"=\"productType\".\"COMPONENTTYPEID\" LEFT JOIN \"ResourceType\" \"rtype\" ON \"productType\".\"RESOURCETYPEID\"=\"rtype\".\"RESOURCETYPEID\" LEFT JOIN \"ResourceCategory\" \"rCategory\" ON \"productType\".\"RESOURCECATEGORYID\"=\"rCategory\".\"RESOURCECATEGORYID\" LEFT JOIN \"VendorDefinition\" \"resourceVendor\" ON \"resource\".\"VENDORID\"=\"resourceVendor\".\"VENDORID\" LEFT JOIN \"SDOrganization\" \"aao\" ON \"resourceVendor\".\"VENDORID\"=\"aao\".\"ORG_ID\" LEFT JOIN \"ResourceState\" \"state\" ON \"resource\".\"RESOURCESTATEID\"=\"state\".\"RESOURCESTATEID\" LEFT JOIN \"ResourceOwner\" \"rOwner\" ON \"resource\".\"RESOURCEID\"=\"rOwner\".\"RESOURCEID\" LEFT JOIN \"ResourceAssociation\" \"rToAsset\" ON \"rOwner\".\"RESOURCEOWNERID\"=\"rToAsset\".\"RESOURCEOWNERID\" LEFT JOIN \"SDUser\" \"sdUser\" ON \"rOwner\".\"USERID\"=\"sdUser\".\"USERID\" LEFT JOIN \"AaaUser\" \"aaaUser\" ON \"sdUser\".\"USERID\"=\"aaaUser\".\"USER_ID\" LEFT JOIN \"Resource_Fields\" \"resFields\" ON \"resource\".\"RESOURCEID\"=\"resFields\".\"RESOURCEID\" LEFT JOIN \"Barcodes\" \"barcodes\" ON \"resource\".\"BARCODEID\"=\"barcodes\".\"BARCODEID\" GROUP BY \"resource\".\"RESOURCEID\"" connection="sdp_read_sql"
| dedup "Asset Name"
| sort "Asset State","Asset Type","Physical or Virtual","Product Type"
| table "Asset Name","Asset State","Asset Type","Physical or Virtual","Product Type"
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
09-24-2021
01:22 PM
|
