About DEADBEEF

DEADBEEF · ‎02-19-2024

Yes, I was looking for that where statement. My mistake, I tried using |search which didn't work. Thanks!

DEADBEEF · ‎02-19-2024

I have a timechart that shows the last 30d and with the timechart I also have a trendline showing the sma7. The problem is that on the timechart, the trendline doesn't show anything for days 1-6, which I understand is because there is no data from the previous days for the sma7 to calculate. I thought that the solution could be to change my search for the last 37d and then only timechart days 7-37d (if that makes sense) but can't seem to figure out how to implement that or if that is even a possible solution. Existing search index=palo eventtype=user_logon earliest=-37d@d | bin span=1d _time | timechart count(eval(like(user_auth, "%-Compliant"))) as compliant count as total | eval compliant=round(((compliant/total)*100),2) | trendline sma7(compliant) as compliant7sma | eval compliant7sma=round(compliant7sma,2) | table _time, compliant, compliant7sma

DEADBEEF · ‎02-01-2024

Apologies, this was difficult to try to explain via text. I have a MV field and am iterating through it and using a regex to create multiple capture groups, then create a new field using some those capture groups. That new field is colon separated. Currently, I noticed that within my 3rd capture group, the values within the MV field can sometimes have non-alphanumeric characters which is causing the regex to not match (due to the regex being [\w\s]). So... modify the regex to capture everything! But... what about when the special character is a colon ( : )? In that scenario, it will then add an additional colon in my new colon separated field which will make that entry invalid due to nonconformity to the pattern. I thought, why not just get rid of every non-alphanumeric character that will be in the 3rd capture group before I create the new field so there aren't issues. Which then brought me here as I cannot seem to find a way to do that. Instead, I am now thinking it may be better to simply capture all then clean up the new field instead as that will not be a MV field. Maybe I can use regex and sed to eliminate any special characters in the new field, just need to figure out how to account for the case when that character is a colon. Since its the 3rd capture group, I would need the pattern to have 4 colons before that part of the field and 7 colons after it. cpe:2.3:a:\2:\3:\5:*:*:*:*:*:*:* - \1 - \4

DEADBEEF · ‎02-01-2024

Because I need to create the new field for every entry. If I were to implement that, then it would simply not match that entry and move on, effectively ignoring it. So I'm trying to find a way to clean this portion of the data such that I can capture every entry. Right now I'm only matching on entries that contain [\w\s] but I'm missing a bunch. True, [\X] would ignore less, but I'm trying to ignore none and capture all, but avoid problems by cleaning/manipulating the text before capturing it within the capture group.

DEADBEEF · ‎02-01-2024

Sometimes there are unicode characters (e.g.: \u00e3) and sometimes there are other characters like ', :, #, etc... I don't have an issue with the unicode characters, but occasionally one of the other characters is a colon (:) which breaks the new field as I am building it to be colon separated.

DEADBEEF · ‎02-01-2024

I see that you set the 3rd capture group to simply grab all except ". The problem with that is that sometimes, there is a colon in that field, which you can see I am using replace to colon separate the new field. What I'm trying to do is find a way to remove all non-alphanumeric characters in that "section" of the log before running the eval. Then I could use your solution. I tried extracting that section into a MVfield, then used sed to eliminate all the characters, but wasn't sure how to go further. I could use your solution, but when there is a colon character (:) then it would definitely break the building of the new field. Thought about doing what you suggested and then using lookahead/lookbehinds to count the number of (:) and then sed anything non-alphanumeric [^a-zA-Z0-9] but wasn't sure how to do go about that either.

DEADBEEF · ‎01-31-2024

I have a multivalue field and am hoping I can get help to replace all the non-alphanumeric characters within a specific place within each value of the mvfield. I am taking this multivalue field and creating a new field but my regex is simply ignoring entries whenever there is a special character. I have to ignore these characters, so I'm trying to find way to remove those characters before it reaches my eval statement to create the new field. I know the problem is the capture group around the "name" value as it only allows \w and \s. name\x22\x3a(?:\s+)?\x22([\w\s]+)\x22. But I'm not sure how to fix it. I've tried extracting the name field first, using sed to remove the characters, but then don't know how to "re-inject" it back into the mv-field or build my new field but reference the now clean name field. Any ideas??? Sample Data {"bundle": "com.servicenow.blackberry.ful", "name": "ServiceNow Agent\u00ae - BlackBerry", "name_version": "ServiceNow Agent\u00ae - BlackBerry-17.2.0", "sw_uid": "faa5c810a2bd2d5da418d72hd", "version": "17.2.0", "version_raw": "0000000170000000200000000"} {"bundle": "com.penlink.pen", "name": "PenPoint", "name_version": "PenPoint-1.0.1", "sw_uid": "cba7d3601855e050d8new0f34", "version": "1.0.1", "version_raw": "0000000010000000000000001"} SPL to create new field | eval new = if(sourcetype=="custom:data", mvmap(old_field,replace(old_field,"\x7b.*?\x22bundle\x22\x3a\s+\x22((?:net|jp|uk|fr|se|org|com|gov)\x2e(\w+)\x2e.*?)\x22.*?name\x22\x3a(?:\s+)?\x22([\w\s]+)\x22.*?\x22sw_uid\x22\x3a(?:\s+)?\x22(?:([a-fA-F0-9]+)|[\w_:]+)\x22.*?\x22version\x22\x3a(?:\s+)?\x22(.*?)\x22.*$","cpe:2.3:a:\2:\3:\5:*:*:*:*:*:*:* - \1 - \4")),new) This creates one good and one bad entry {"bundle": "com.servicenow.blackberry.ful", "name": "ServiceNow Agent\u00ae - BlackBerry", "name_version": "ServiceNow Agent\u00ae - BlackBerry-17.2.0", "sw_uid": "faa5c810a2bd2d5da418d72hd", "version": "17.2.0", "version_raw": "0000000170000000200000000"} cpe:2.3:a:penlink:PenPoint:1.0.1:*:*:*:*:*:*:* - com.penlink.penpoint - cba7d3601855e050d8new0f34

DEADBEEF · ‎01-20-2023

I actually did look at this, but thought you could only use even, odd, or math patterns. TIL, thank you.

DEADBEEF · ‎01-20-2023

I don't understand css, but it works with and without the body section. Happy that it's working exactly how I wanted, thank you @fredclown My final solution <?xml version="1.0" encoding="UTF-8"?> <dashboard> <label>test_css</label> <row> <panel> <html depends="$stayhidden$"> <style> #myTable1 table thead th:nth-child(2), #myTable1 table thead th:nth-child(3), #myTable1 table thead th:nth-child(4) { font-weight: bold; } </style> </html> </panel> <panel> <table id="myTable1"> <search> <query>index="_internal" |stats count by index source host sourcetype</query> <earliest>-5m@m</earliest> <latest>now</latest> </search> <option name="drilldown">none</option> </table> </panel> </row> </dashboard>

DEADBEEF · ‎01-20-2023

Tried adding the !important; , but nothing. I also setup the same dashboard on a local install of Splunk 8.8 and it also does not seem to work. What version of Splunk do you have it where it is working?

DEADBEEF · ‎01-20-2023

screenshot Using Splunk Cloud 9.0.2208.4 <dashboard> <label>test_css</label> <row> <panel> <html depends="$stayhidden$"> <style> #myTable1 table tbody td[data-cell-index="1"], #myTable1 table tbody td[data-cell-index="2"]{ font-weight: bold; } </style> </html> </panel> <panel> <table id="myTable1"> <search> <query>index="_internal" |stats count by index source host sourcetype</query> <earliest>-5m@m</earliest> <latest>now</latest> </search> <option name="drilldown">none</option> </table> </panel> </row> </dashboard>

DEADBEEF · ‎01-20-2023

Good catch! I removed the comma before the brace but still not working. Not sure what I am doing wrong here.

DEADBEEF · ‎01-19-2023

Hi @ITWhisperer , I tried what you described but I think something might be off. Here's my test dashboard, you should be able to run this: <dashboard> <label>test_css</label> <row> <panel> <html depends="$stayhidden$"> <style> #myTable1 table tbody td[data-cell-index="1"], #myTable1 table tbody td[data-cell-index="2"],{ font-weight: bold; } </style> </html> </panel> <panel> <table id="myTable1"> <search> <query>index="_internal" |stats count by index source host sourcetype</query> <earliest>-5m@m</earliest> <latest>now</latest> </search> <option name="drilldown">none</option> </table> </panel> </row> </dashboard>

DEADBEEF · ‎01-19-2023

I have a dashboard with a table with 6 headers. I would like to bold the text of the second, fourth, and fifth column headers. I searched around but could only find solutions for the first or last column headers (first-child, last-child) but nothing for anything in-between. If bolding isn't an option, I would also be open to simply coloring the background of that column from the default gray to say blue and make the column header text white or something like that. The idea is to make the 2nd, 4th, and 5th column headers visually standout from the remaining in the table. Example table: index second source fourth fifth count

DEADBEEF · ‎05-30-2022

I received this image from support and I would like to create a panel in my dashboard to mimic this information. How would I go about doing that? I was trying with the current query, but am not having luck. index=_introspection data.normalized_pct_cpu=* sourcetype=splunk_resource_usage host=idx* | stats avg(data.normalized_pct_cpu) AS cpu_usage BY host | table host cpu_usage I am using data.normalized_pct_cpu as the docs state that it is Percentage of CPU usage across all cores. 100% is equivalent to all CPU resources on the machine, which seems to be what I want but not sure if that is the best way to go about this.

DEADBEEF · ‎01-14-2022

Ahh okay. Is this because the IP address has minor breakers so if you don't use format then it doesn't work as expected? Just curious as I never had to use it before (but was never matching against IP's).

DEADBEEF · ‎01-14-2022

That was the fix! What about the format command resolved this?

DEADBEEF · ‎01-14-2022

I have a list of IP addresses in a lookup table that are network scanners. I am trying to build a search that excludes the IP addresses in this lookup table, but for some reason my search keeps including IP address values that are clearly present in the lookup. I tried putting the quotes around the IP addresses ("1.2.3.4"), tried without quotes (1.2.3.4) but nothing works. The raw data does not have quotes. After having tried enough combinations, I am hoping someone can help me. Eventually, I'll be adding the remaining IP's to the lookup table via OUTPUTLOOKUP append=true but until I can get this working... I'm stuck. index=foo sourcetype=bar NOT [| inputlookup network_scanners | table IpAddress] | dedup IpAddress | table IpAddress

DEADBEEF · ‎10-29-2021

@somesoni2 you've helped me many times over the years. Thank you for being a part of this community. The answer worked like a charm. I'm going to keep that eval trick in my pocket!

DEADBEEF · ‎10-29-2021

I have two charts that work as expected when separate, but I'm having a hard time combining them into one chart as they have different search criteria (but from the same index/source) so search2 ends up being wrong when using the criteria from search 1. I tried combining using the chart overlays but I couldn't get it to work. Any pointers would be very much appreciated! search 1 - last 30 days index=foo source=bar criticality=high state=open | bin _time span=1d | stats count AS warnings by _time search 2 - last 30 days index=foo source=bar | bin _time span=1d | stats dc(accountId) AS Accounts by _time

DEADBEEF · ‎02-04-2021

My deployment server sits behind a load balancer. What I have noticed is that on the DS under Forwarder Management (Clients tab), all my UFs phoning home now appear with the same IP address (they have unique client names, host name, instance name). Is there a macro or something on the back end that I can update to display the true IP address of each system phoning home? The true source IP is showing in in metrics.log so I'd like to modify the existing SPL to use the IP from metrics rather than wherever it's getting it from.

DEADBEEF · ‎08-29-2020

Thank you very much for all the suggestions and troubleshooting. After getting the test script to work but mine failing, I concluded that the issue was with my script. Breaking it down to the bare minimum commands to replicate the functionality in my script AND running it with the splunk binary (rather than just from the command line as the splunk user) I realized that Splunk was experiencing some problems. In my original script, I use the curl command but was using the silent flag (-s) so the errors themselves were being hidden from stdout. Now testing it at its bare minimum, I saw Splunk throwing errors because it was unable to access (or couldn't find for some reason) the SSL CA cert path. There were 2 solutions to this, either use the -k switch in my curl command, or provide the full path using --cacert. I tested both and they both work but ended up using solution 2. Testing using the splunk binary /opt/splunk/bin/splunk cmd ./json.sh Solution 1: (-k) non-ssl cert validation curl -sgk "https://api.website.com/rest_endpoint" -X GET -u "user:api_token" -H 'Accept: application/json' Solution 2: Provide the path to standard certs curl -sg --cacert /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem "https://api.website.com/rest_endpoint" -X GET -u "user:api_token" -H 'Accept: application/json'

DEADBEEF · ‎08-29-2020

Your example did work for me so I guess maybe it's my script. I adjusted my .conf regardless but still nothing. No idea what the issue may be. ---REVISED --- inputs.conf [script://$SPLUNK_HOME/etc/apps/TA-HackerOne/bin/hacker_one_pull.sh] disabled = false index = test interval = 180.0 sourcetype = h1:json props.conf [h1:json] DATETIME_CONFIG=CURRENT INDEXED_EXTRACTIONS=json KV_MODE=none LINE_BREAKER=([\r\n]+) data sample -bash-4.2$ pwd /opt/splunk/etc/apps/TA-HackerOne/bin -bash-4.2$ ./hacker_one_pull.sh { "id": "49", "type": "report", "attributes": { "name": "Lorem Ipsum", "description": "Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua.", "external_id": "aaa-123", "created_at": "2018-02-27T16:48:23.308Z" } } { "id": "20", "type": "report", "attributes": { "name": "Finibus Bonorum", "description": "Sed ut perspiciatis unde omnis iste natus error sit voluptatem accusantium.", "external_id": "aaa-726", "created_at": "2019-09-11T08:26:14.625Z" } } -bash-4.2$ This shows up in _internal (but only once, never again) 08-29-2020 20:01:04.689 +0000 INFO ExecProcessor - New scheduled exec process: /opt/splunk/etc/apps/TA-HackerOne/bin/hacker_one_pull.sh

DEADBEEF · ‎08-29-2020

inputs.conf [script://$SPLUNK_HOME/etc/apps/TA-HackerOne/bin/hacker_one_pull.sh] index = main interval = 180.0 sourcetype = h1:json source = api_hackerone disabled = false # send_index_as_argument_for_path = false props.conf (NOTE: CURRENT time is the intended and desired behavior) [h1:json] CHARSET=UTF-8 DATETIME_CONFIG=CURRENT INDEXED_EXTRACTIONS=json KV_MODE=none SHOULD_LINEMERGE=false category=Structured description=HackerOne JSON data via REST API disabled=false pulldown_type=true LINE_BREAKER=([\r\n]+) Sample data (NOTE: attributes.created_at is not the desired timestamp for _time, hence using CURRENT) -bash-4.2$ pwd /opt/splunk/etc/apps/TA-HackerOne/bin -bash-4.2$ ./hacker_one_pull.sh { "id": "49", "type": "report", "attributes": { "name": "Lorem Ipsum", "description": "Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua.", "external_id": "aaa-123", "created_at": "2018-02-27T16:48:23.308Z" } } { "id": "20", "type": "report", "attributes": { "name": "Finibus Bonorum", "description": "Sed ut perspiciatis unde omnis iste natus error sit voluptatem accusantium.", "external_id": "aaa-726", "created_at": "2019-09-11T08:26:14.625Z" } } -bash-4.2$

DEADBEEF · ‎08-28-2020

I was reviewing the docs on inputs because I am not getting data in right now and came across that under the scripted inputs section: send_index_as_argument_for_path = <boolean> * Whether or not to pass the index as an argument when specified for stanzas that begin with 'script://' * When this setting is "true", the script passes the argument as '-index <index name>'. * To avoid passing the index as a command line argument, set this to "false". * Default: true. Anyway, it's commented out now and restarted splunk. This shows up in _internal (and has been on every restart in my troubleshooting) but still no data is coming in. I ran the script manually to ensure it is working (as the splunk user) and JSON data is printing to screen so I know it does work. 08-29-2020 05:37:09.605 +0000 INFO ExecProcessor - New scheduled exec process: /opt/splunk/etc/apps/TA-HackerOne/bin/hacker_one_pull.sh

Posts	36
Solutions	1
Karma Given	14
Karma Received	1
Member Since	‎06-09-2020

Online Status	Offline
Date Last Visited	‎02-19-2024 04:23 PM

Restricting timechart to smaller set of days than ...

Replace non-alphanumeric characters in a multivalu...

How to bold specific column headers in a table?

How to Graph CPU usage of indexers over time?

How to match on value NOT in lookup table

How to combine two charts into one?

All systems showing same IP Addresses in Forwarder...

Configuring outputs.conf for an "all in one" box

How to determine where a savedsearch is being used...

How to custom sort by column headers

Re: Restricting timechart to smaller set of days t...

Restricting timechart to smaller set of days than ...

Re: Replace non-alphanumeric characters in a multi...

Re: Replace non-alphanumeric characters in a multi...

Re: Replace non-alphanumeric characters in a multi...

Re: Replace non-alphanumeric characters in a multi...

Replace non-alphanumeric characters in a multivalu...

Re: How to bold specific column headers in a table...

Re: How to bold specific column headers in a table...

Re: How to bold specific column headers in a table...

Re: How to bold specific column headers in a table...

Re: How to bold specific column headers in a table...

Re: How to bold specific column headers in a table...

How to bold specific column headers in a table?

How to Graph CPU usage of indexers over time?

Re: How to match on value NOT in lookup table

Re: How to match on value NOT in lookup table

How to match on value NOT in lookup table

Re: How to combine two charts into one?

How to combine two charts into one?

All systems showing same IP Addresses in Forwarder...

Re: Configuring outputs.conf for an "all in one" b...

Re: Configuring outputs.conf for an "all in one" b...

Re: Configuring outputs.conf for an "all in one" b...

Re: Configuring outputs.conf for an "all in one" b...