Hi, I used to work on Splunk but stopped 2 years ago and now I'm rusty. Could someone help me with this issue ? I have a firewall log and it has the port/protocol the user access, each one in you field ( dst_port - ex 443, transport - UDP/TCP ) and the service field like 443/tcp. First made a table (with works) to display the most used port/protocol: |top service Now, I'd like to show that table but with the name/description of that protocol. Soo I downloaded IANA' s App and installed. Then I created a automatic Lookup that gets the dst_pot and protocol and outputs it's "Service Name" and "Service Description" fields. When I perform a search (like the above), I can see the new fields on field list. But when I create de table those new fields are always empty. Tried a lot of other variations of commands but none works: |chart count by service | table "Service Name", "Service Description", service, count |top service | table "Service Name", "Service Description", service, count What am I doing wrong here ? Thanks. ... View more

I have a report scheduled to run everyday at 2:00 AM. It basically creates a line chart to show the WEB traffic in Gigabytes. It is working perfectly and the schedule is being running, I can access it through "View Recent" link directly in SPLUNK. The problem is that I embed this same report on a webpage, but the chart that is showing there is outdated by some days. It is not my browser's cache, since I opened the same page on box that has never opened it. How can I force the embed report be the same as shown in SPLUNK ? Thanks. ... View more

Hi, Is it possible to make SPLUNK log me in if I have a certificate plugged on my computer ? ... View more

Hi, I have some logs from my proxy. Inside it, there is a field that indicates the userid (user_id) the user entered when authenticating. I want to generate a report that shows me the top users, but I need to translate the user_id to their real name from our OpenLDAP server. I installed TA-LDAP, tried this, and it works. I put a simple search string to test: user_id="myuserID" | ldap ldap_filter="uid=myuserID" attrs="givenname,sn" and it works, returns a table with the username I want. Now I need to make a search and return a table for all users I have, making stats for them, but I couldn't figure out how to pass the user_id dynamically to the ldap command. For example, I tried to generate all log entries just translating the usernames: user_id="myuserID" | ldap ldap_filter="uid=user_id" attrs="givenname,sn" but internally the ldap command receives: myldap:319 - using ldap_filter : uid=user_id I have already tried the eval to generate a dynamically string, but didn't work. Anything I pass to ldap command is fixed and cannot be changed. I've been thinking if it is possible to make a lookup to do the job, but I also did not manage to figure out how to do it. I know there is a myldap.py command in the bin folder of the plug-in, but how do I convert it to a lookup command? Somebody have some tips to make it work? Thanks a lot ! ... View more

I have a proxy that logs to my SPLUNK and send it an information (userid). With that information I need to search my LDAP server for another information (User Name) and create a new field. The splunk configuration is done, I created a Lookup script to populate SPLUNKs tables. First, I made a simple python script that didn't search my LDAP server, just returning a sample string and it worked. My Problem started when I decided to include the LDAP search part. After implement the python script, I realized that splunk's python does not have LDAP module installed. So I searched and found that it would be very difficult to install that module in splunk's python. So, trying to solve my immediate problem, I wrote another script in SHELL that uses ldapsearch command to get the information from my ldap server and made a wrapper in python so that splunk could call this SHELL script via the commands.getoutput() function. When I execute the command on the commandline, I get no problem (see below), but inside a search in splunk I get a "No such file or directory" files in what should be the User Names on the table. Splunk is not finding the SHELL script inside the python wrapper. I prefer to make everything in python, but if I manage to make the shell wrapper work, It solves my problem while I can try to make the other way work. My script's call function: def search_ldap(client, user): path = '/opt/splunk/etc/apps/my_app/bin/' logger.info("Path: %r", path) cmd = 'nome_' + client.lower() + '.sh ' nome_ldap = commands.getoutput(path + cmd + user) return nome_ldap Runing from command line: # cat /tmp/ldap.csv | /opt/splunk/bin/splunk cmd python /opt/splunk/etc/apps/my_app/bin/nome_shell_wrapper.py parameter1 user_id,nome_usuario thomas,Thomas Ribeiro Error message on splunk's table: sh: /opt/splunk/etc/apps/my_app/bin/nome_parameter1.sh: No such file or directory Thanks ! ... View more

Hello, I have a LDAP server and a proxy that logs the users login-name into splunk. I need to make a lookup that gets the username (field user_id in splunk), searches on my LDAP server and convert then to the realname, adding another field in splunk on a search. I'm trying to make a script for this lookup, but I cannot figure it out how it really works. I've studied the external lookup example (and another one I found on Internet), but it is not clear enough on how it really works to send the results to splunk. Could somebody help me ? Below is a simple code I made (based on external_lookup.py) that supposelly) simply had to get the user_id and set a string ("Usuario Temp") to it. It does not searches on LDAP yet. But I couldn't even make it return the results to SPLUNK. If somebody could point me to a tutorial or a document explaining how are the structures SPLUNK expect, and a class reference it would also be helpful, because official documentation are not clear on how everything works. Thanks in advance. Here is my code: #!/usr/bin/python import sys import csv FIELDS = [ "user_id", "nome_usuario" ] def main(): infile = sys.stdin outfile = sys.stdout entrada = csv.DictReader(infile) header = entrada.fieldnames saida = csv.DictWriter(outfile, fieldnames=entrada.fieldnames) saida.writeheader() ########## for valor_atual in entrada: valor_atual["user_id"] = "Usuario Temp" saida.writerow(valor_atual) main() ... View more

I built a Saved Search and configured a Dashboard to include that Saved Search (below). In a panel of this Dashboard, I configured a report based on this saved search. When I load the Dashboard, the search is started and stops showing NO data and a message below the graphic said that the results were truncated, and No data is shown. Opening in search I get a lot of results in events.... The Saved Search: index=acess_web |eval Gb=bytes_in/1073741824| timechart span=1d sum(Gb) Screenshot: imageshack.com/a/img571/9028/ddaw.png Thanks for any help ... View more

Hello, I have an input that come from one proxy equipment that logs several clients. It is just on big log with all access in it. I configured a LOOKUP table that maps the Subnetwork of a client to its name, based on it's IP address logged, and it works: [clients] default_match = UnknownClient filename = clients.csv match_type = CIDR(subnetwork) max_matches = 1 min_matches = 1 Since my index is getting really huge, I want to split it into smaller indexes. It will make everything easy and faster. So I configured a TRANSFORM clause on transforms.conf and props.conf so that based on a REGEX, it will send to different indexes: [client1] REGEX = -SOME_STRING_IDENTIFIER- DEST_KEY = _MetaData:Index FORMAT = access_client1 [my_logs] TRANSFORMS-clients=access_client1, And it works too. The events comming from client1 goes to index access_client1, client2 goes to access_client2 and so on... The problem is that this REGEX does not recognize all events comming from a client. The best would be if I could lookup the LOOKUP-clients-table and decide based on their IP address (dvc_ip field), exactly as splunk does when searching. Is it possible ? Thanks ... View more