Hi all, I have used an app to generate a document that according to this log went succesfull. Is there a way to allow user to download such file from Splunk system in easy way? (not using ftp client etc.) File was generated using this app: https://splunkbase.splunk.com/app/1263/#/details. Thanks ... View more

Hi all,  I have got this SPL to perform what I was looking for but want to know if there is any more elegant way of achieving the same, possibly using just one stats command: index=index_1 | stats count(App) AS ACNT by Department | stats sum(ACNT) as "Application Count" by Department | sort Department | appendcols [search index=index_1 | dedup App | stats list(App) as Applications by Department | sort Department] | appendcols [search index=index_1 | dedup Developer | stats count(Developer) as "Developer Count" by Department | sort Department] | rename Department as Department | table Department "Application Count" Applications "Developer Count" Expected output in attach Thanks   ... View more

Hi,  all I've seen similar use-cases on forum but haven't found any that applies here So, I've got a panel that lists and compares data with domain whitelist with option to add it. Idea is to refresh panel values and remove domain from list once it has been  added to the whitelist. Now, it works in scenario where only one domain is added or  all domain are added with refreshing page in between but it does not work if I was about to  click and add domains one by one with no page refresh. Can anyone help? Thanks <form> <label>The Test Panel</label> <fieldset submitButton="false"> <input type="time" token="field1"> <label></label> <default> <earliest>-72h@h</earliest> <latest>now</latest> </default> </input> <input type="dropdown" token="input_white_domain_for_add"> <label>input_white_domain_for_add</label> <search> <query>| inputlookup wlist_domain.csv | eval domain="$add_domain$" | dedup domain | fields domain | outputlookup append=t wlist_domain.csv</query> <earliest>0</earliest> <latest></latest> </search> </input> <input type="text" token="value1" depends="$hidden$"> <label>value1</label> <default>rename comment as run</default> </input> </fieldset> <row> <panel> <table> <search> <query> | inputlookup domain_list.csv | stats count by domain | sort -count | search NOT [| inputlookup wlist_domain.csv | dedup domain | table domain] | eval ADD_TO_WLIST="add_to_whitelist" | rename domain As Domain | table Domain count ADD_TO_WLIST | $value1$</query> <earliest>$field1.earliest$</earliest> <latest>$field1.latest$</latest> </search> <option name="drilldown">cell</option> <option name="refresh.display">progressbar</option> <drilldown> <condition field="ADD_TO_WLIST"> <eval token="add_domain">$row.Domain$</eval> <set token="value1">rename comment as run1</set> </condition> </drilldown> </table> </panel> </row> </form> ... View more

Hi all,  In this example I want to use existing field Request64 from index index_new and decode it on ingest-time to produce RequestD base64 decoded field in same index. Can you please suggest if following config is valid for this operation: $ inputs.conf [monitor:///$SPLUNK_DB/index_new/db] index=index_new sourcetype= ST_NEW_DATA $ cat props.conf [ST_NEW_DATA] TRANSFORMS-b64 = Request_t $ transforms.conf [Request_t] INGEST_EVAL = RequestD=base64 field=Request64 action=decode mode=replace suppress_error=True $ fields.conf [RequestD] INDEXED = True This is macro to decode data: https://splunkbase.splunk.com/app/1922/#/details This is dump of index metadata to find monitor path: | rest /services/data/indexes coldPath $SPLUNK_DB/index_new/colddb coldPath_expanded /opt/org/splunk_data/splunk/index_new/colddb homePath $SPLUNK_DB/index_new/db homePath_expanded /opt/org/splunk_data/splunk/index_new/db id https://127.0.0.1:8089/servicesNS/nobody/search/data/indexes/index_new summaryHomePath_expanded /opt/org/splunk_data/splunk/index_new/summary thawedPath $SPLUNK_DB/index_new/thaweddb tstatsHomePath_expanded /opt/org/splunk_data/splunk/index_new/datamodel_summary ... View more

Hi all I am using following SPL to loop through HTTP Request data in order to extract fields and values and I have 2 issues marked in bold. Streamstats custom count  for 25 does not work and Splunk does not work well with renaming values inside normal and curly brackets / here market with *. Can anybody help please? Sample Data: Method:::GET###URI:::favicon.ico ###HTTP Version:::1.1###Host:::s.noname.com###X-Real-IP:::12.12.5.1###X-Forwarded-For:::12.9.5.221###X-Forwarded-Proto:::https###X-Forwarded-Port:::443###X-Forwarded-Host:::s.noname.com###User-Agent:::Mozilla/5.0 (Linux; Android 10; ) AppleWebKit/531.36 (KHTML, like Gecko) Chrome/12.0.3904.102 nonameBrowser/10.1.0.300 Mobile Safari/531.36###Accept:::image/webp,image/apng,image/*,*/*;q=0.2###Sec-Fetch-Site:::same-origin###Sec-Fetch-Mode:::no-cors###Referer:::https://s.noname.com/app/home###Accept-Encoding:::gzip, deflate###Accept-Language:::tr-TR,tr;q=0.9,en-US;q=0.2,en;q=0.1###Cookie:::NEW_nonameSearch_s__noname_com=1f3e090555524aecc1ce912; NEWts_nonameSearch_s_cloud_noname_com=152224319; HW_refts_nonameSearch_s_cloud_noname_com=1522243515550; APP_LANG=tr-tr; APP_REGION=te; IO_ts__s_cloud_noname_com=15933020425; NEWvc_nonameSearch_s_cloud_noname_com=5; IO_viewts_nonameSearch_s_cloud_noname_com=159143313### SPL: | streamstats count(25) AS n | eval n = n-1 | eval f=split(RequestContent, "###") | eval f{n}=mvindex(f, {n})  /* | eval fs=split(f{n},":::") /* | eval f{n}V= trim(mvindex(fs, 1)) | eval f{n}H= mvindex(fs, 0) | eval {f{n}H} = f{n}V /* ... View more

Hi all,  I am using this plugin in order to extract the info from User Agent: uas_lookup SPL looks like this: "mysearch.. | rename User-Agent as http_user_agent | lookup uas_lookup http_user_agent" Error that I am getting is: Script execution failed for external search command '/opt/splunk/etc/apps/TA-uas_parser/bin/uas_lookup.py'. Anybody knows how to fix this? Thanks ... View more