Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- Find Answers
- :
- About HeinzWaescher
HeinzWaescher
Motivator
Member since:
10-22-2013
Thursday
Community Statistics
| Posts | 527 |
| Solutions | 19 |
| Karma Given | 174 |
| Karma Received | 96 |
| Member Since | 10-22-2013 |
Activity Feed
- Got Karma for Timechart - Running Total By Product. 09-21-2023 03:09 PM
- Got Karma for Re: Change Pie Chart Labels. 01-19-2023 12:38 PM
- Posted Re: Enterprise Security Threat Intelligence - Lookup population on Splunk Enterprise Security. 10-13-2022 07:31 AM
- Posted Enterprise Security Threat Intelligence - Lookup population? on Splunk Enterprise Security. 10-13-2022 04:20 AM
- Got Karma for Renaming Reports. 08-25-2022 08:54 PM
- Got Karma for Re: How to rename column values when making a chart. 02-01-2022 02:34 PM
- Got Karma for Re: How to rename column values when making a chart. 11-08-2021 01:58 PM
- Got Karma for How do I extract a field value after a specific string in unstructured data?. 06-10-2021 05:09 PM
- Posted Alert Manager - Save results to KV store or index? on Alerting. 05-24-2021 12:53 AM
- Got Karma for Re: How to rename column values when making a chart. 08-24-2020 05:20 AM
- Got Karma for Re: Change Pie Chart Labels. 08-05-2020 09:00 AM
- Karma Re: How to update apps correctly via the command line? for nickhills. 06-05-2020 12:51 AM
- Got Karma for How to update apps correctly via the command line?. 06-05-2020 12:51 AM
- Karma Re: pass quotes inside of tokens for dashboard for kamlesh_vaghela. 06-05-2020 12:50 AM
- Karma Re: How do you evaluate the difference between 2 multivalue fields? for tiagofbmm. 06-05-2020 12:50 AM
- Karma Re: BOTSv2 capture the flag app does not work properly for arjunpkishore5. 06-05-2020 12:50 AM
- Karma Re: Is it possible to define multiple evals as default for each search? for kamlesh_vaghela. 06-05-2020 12:50 AM
- Karma Re: Is it possible to define multiple evals as default for each search? for adonio. 06-05-2020 12:50 AM
- Karma Re: What is the difference between == and = in SPL ? for richgalloway. 06-05-2020 12:50 AM
- Karma Re: Why are only some indexes listed in the available indexes pane under roles? for lycollicott. 06-05-2020 12:49 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 1 |
10-13-2022
07:31 AM
It looks like disabling and re-enabling the local_email_intel source via the management interface does the trick. But I don't think this should be the way to go 🙂
... View more
10-13-2022
04:20 AM
Hi, I'm starting with ES Threat Intelligence and am wondering, how threat intel data is populated to the KV stores used in the correlation search "Threat Activity Detected".
As a simple example I manually added an entry to local_email_intel (which is of course enabled). Now I'm expecting the email address to appear in the KV store threatintel_by_email, which is used in the threat matching search for email. But threatintel_by_email is still empty, although I waited for a while for background jobs. I can't find the entered email address in the Threat Artifacts dashboard as well.
What is my mistake here? What kind of background job do we need/wait for to make my entry available for threat detection?
Thanks in advance 🙂
... View more
Labels
- Labels:
-
using Enterprise Security
05-24-2021
12:53 AM
Hi, I'm not sure about the effect of the general setting "Save results to KVStore / index". Is there a difference in the functionality/features of the alert handling depending on this setting? Can I just activate one or the other? What if I activate both? Best regards 🙂
... View more
- Tags:
- Alert Manager
- alerts
Labels
- Labels:
-
alert action
02-25-2020
07:05 AM
So the append approach does not work, because the collect command seems to write the event to the index after the whole search finished.
Current workaround is that the first search writes the events to the index=test. This also sets a token to start a second search with random data, just to gain some seconds of time. This second search lives in a hidden panel and triggers another token to finally update the visualizing report for index=test.
... View more
02-25-2020
03:49 AM
Hi,
when I run a dashboard search, I'm writing an event to an index=test with the collect command. When this search is finished, it sets a token which is used to start a second search. This second is visualizing events from the index=test and should show the latest collected event when it runs.
Basically it works, but sometimes the seconds search does not recognize the latest event from index=test. I assume the second search starts to close after the collect command. Is it possible to create some kind of delay between these searches? Or is there another approach to solve this problem?
What I could think of, is to append a random append for internal data after the collect command, and remove this results directly afterwards. Just to create a longer duration of the search, so that the trigger for second search is set some seconds later.
Thanks in advance
... View more
01-29-2020
01:19 AM
Hi,
let's say we have events with _raw data like this:
<XY>aaa,bbbb,priority,high<XY>aaa,bbb,login,failed<XY>aaa,bbb,user,johndoe<XZ>
The events can include a random amount of this pattern.
Is it possible to create an automatic field extraction to get:
priority = high
login = failed
user = johndoe
So position 3 of the pattern should set the fieldname while position 4 sets the value.
Thankd in advance
... View more
01-24-2020
06:23 AM
Thanks a lot!
... View more
01-24-2020
02:38 AM
1 Karma
Hi all,
I was wondering how to update Splunk apps correctly while keeping necessary edited configs and own files.
For single instances the documentation says:
./splunk install app -update 1 -auth username:password
So this will update an app in ./etc/apps only with new defaults? Will it keep my changes? What does -update 1 do in this command?
How to proceed if I want to update an App that is deployed by a Deployment Server or Cluster Master (so stored in deployment-pps or master-apps)
Thanks in advance
... View more
11-19-2019
06:04 AM
Thanks a lot. I never used == and never ran into problems, that's why I was wondering.
So in the end it is more a cosmetical thing to use ==.
... View more
11-19-2019
05:39 AM
Hi,
I've seen it several times but don't know the difference and when to use == instead of = .
Like in these samples from the docs:
| eval description=case(status == 200, "OK", status ==404, "Not found", status == 500, "Internal Server Error")
| eval action=if(action=="view",...)
Thanks in advance
... View more
- Tags:
- splunk-enterprise
10-31-2019
11:19 PM
Scoreboards are working fine on my side.
I used the ctf_questions & answers as well an they provided these 52 questions which seems to be only small part of the contest.
... View more
10-29-2019
06:56 AM
Thanks for that, the welcome page works now.
Do you have 52 questions as well? The numbering looks a bit weird, it is from 1 to 509
... View more
10-23-2019
12:04 AM
I thought about using macros. But I would like have a solution that the user don't have to use actively.
It should be done by default for a defined role.
... View more
10-22-2019
11:45 PM
Hi,
I would like to know whether it is possible to perform something like this per default for each and every search in the background:
| eval _raw=split(_raw, user)
| eval user_hash=sha256(user)
| eval _raw=mvjoin(_raw, user_hash)
Thanks in advance
... View more
10-22-2019
06:11 AM
Hi,
I'm trying to get the BOTSv2 dataset and scoreboard working with these documents:
https://github.com/splunk/botsv2
https://github.com/splunk/SA-ctf_scoreboard
Some of the apps are not available with the recommended versions. But that is not the main problem.
The dataset seems to work fine and question access is enabled.
I would expect that users can take part by opening the "Capture the flag" app. When I try to do this, I'm directed to .../app/SA-ctf_scoreboard/botsv4_welcome , but the page is not found.
What am I doing wrong?
Thanks in advance
... View more
- Tags:
- splunk-enterprise
10-21-2019
01:03 AM
Could you explain why this is not working in fast mode?
... View more
03-04-2019
11:28 PM
Works pretty fine! Thanks
... View more
03-01-2019
05:40 AM
Hi,
Let's say we have 2 multivalue fields
Field1={a,b,c,d}
Field2={a,b,c,d,e}
Is it possible to evaluate the difference between these fields and display the additional value of Field2? So that Field3={e}
Best regards,
Heinz
... View more
02-25-2019
12:46 AM
That points me to the right direction, thanks 🙂
... View more
02-24-2019
11:34 PM
1 Karma
Hi,
I would like to extract a new field from unstructured data. FX does not help for 100%, so I would like to use regex instead.
Is it possible to extract a string that appears after a specific word? For example, I always want to extract the string that appears after the word testlog:
Sample events (the value for my new fieldA should always be the string after testlog):
1551079647 the testlog 13000 entered the system
1551079652 this is a testlog for fieldextraction
Result of the field extraction:
fieldA=13000
fieldA=for
Thanks in advance
Heinz
... View more
08-22-2018
01:42 AM
Hi,
I have a Choropleth Map for this search:
....
| iplocation Ip, City
| stats count by Country
| geom geo_countries featureIdField=Country
Is it possible to create such a map by City?
Thanks in advance
... View more
07-20-2018
06:45 AM
Let's say your field is "eventName", try something like
| autoregress eventName
| eval consecutiveEvent=if(eventName_p1=eventName, 1, 0)
| streamstats current=t count(eval(consecutiveEvent=0)) AS eventGroup
| stats values(eventName) AS eventName, count BY eventGroup
... View more
07-03-2018
02:37 AM
Hi,
is there a function to create the MD5 hash of a value?
Cheers
Heinz
... View more
- Tags:
- md5
- splunk-enterprise
05-08-2018
06:56 AM
Have you tried out to use restricted search terms from access controls -> roles for your users?
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
Thursday
|
Karma given to
