Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About ngwodo
ngwodo
Path Finder
Member since:
09-15-2020
03-09-2023
Community Statistics
| Posts | 59 |
| Solutions | 0 |
| Karma Given | 6 |
| Karma Received | 8 |
| Member Since | 09-15-2020 |
Activity Feed
- Posted Re: How to display details in a single row for a dashboard for an access control system dropdown menu using an inputlook on Splunk Search. 03-08-2023 01:26 AM
- Posted How to display details in a single row for a dashboard for an access control system dropdown menu using an inputlookup? on Splunk Search. 03-07-2023 12:53 PM
- Posted Data Model Authentication sucessful splunk query alerts on Security. 11-15-2021 01:33 PM
- Tagged Data Model Authentication sucessful splunk query alerts on Security. 11-15-2021 01:33 PM
- Posted Mitre Dashboard on Getting Data In. 10-26-2021 02:20 PM
- Tagged Mitre Dashboard on Getting Data In. 10-26-2021 02:20 PM
- Posted Authentication Data model duplication of logs issue from 2 sourcetypes on Splunk Enterprise Security. 10-16-2021 03:11 PM
- Tagged Authentication Data model duplication of logs issue from 2 sourcetypes on Splunk Enterprise Security. 10-16-2021 03:11 PM
- Posted Re: The issue is that we have so many windows authentication failures after creating Authentication Data model on Splunk Dev. 10-13-2021 03:17 PM
- Posted Re: The issue is that we have so many windows authentication failures after creating Authentication Data model on Splunk Dev. 10-13-2021 02:38 PM
- Posted The issue is that we have so many windows authentication failures after creating Authentication Data model on Splunk Dev. 10-12-2021 12:42 PM
- Tagged The issue is that we have so many windows authentication failures after creating Authentication Data model on Splunk Dev. 10-12-2021 12:42 PM
- Posted Duplication of logs between sourcetype:good-audit and good-audit-admin on Splunk Dev. 10-12-2021 09:33 AM
- Tagged Duplication of logs between sourcetype:good-audit and good-audit-admin on Splunk Dev. 10-12-2021 09:33 AM
- Posted Re: I am setting up Authentication datamodel that have Default, insecure and Privileged Authentication on Splunk Enterprise Security. 10-11-2021 10:57 AM
- Posted I am setting up Authentication datamodel that have Default, insecure and Privileged Authentication on Splunk Enterprise Security. 10-11-2021 10:01 AM
- Tagged I am setting up Authentication datamodel that have Default, insecure and Privileged Authentication on Splunk Enterprise Security. 10-11-2021 10:01 AM
- Posted Detailed step-by-step processes to deploy Splunk Apps and Addons using Github from generating SSH keys to the last step on Getting Data In. 05-14-2021 09:52 AM
- Tagged Detailed step-by-step processes to deploy Splunk Apps and Addons using Github from generating SSH keys to the last step on Getting Data In. 05-14-2021 09:52 AM
- Posted Re: How can I get Ansible script to automate installation of splunk universal forwarder on 1000 Linux Red Hat Servers?? on Getting Data In. 05-14-2021 09:38 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
01-31-2024
08:58 AM
got nasty gram for posting links search online for freeload101 github in scripts Splunk_UniversalForwarder_Installer.bash
... View more
03-08-2023
01:26 AM
Thanks for your response. Here is my XML source code for the Dashboard below. I just want to show the details of one line of code when the access control e.g. "AC-1" depending on when the System name compliance status for each year or multiple years is either "high" or "medium" or "low" The source code is: <form version="1.1"> <label>RTM_Automation_030623_Global_David</label> <fieldset submitButton="false"> <input type="dropdown" token="system_tk" searchWhenChanged="true"> <label>System Selection</label> <fieldForLabel>System</fieldForLabel> <fieldForValue>System</fieldForValue> <search> <query>|inputlookup controls_rtm.csv |stats c by "System" |table "System" </query> <earliest>0</earliest> <latest></latest> </search> <choice value="*">All</choice> <default>*</default> </input> <input type="dropdown" token="cl_tk" searchWhenChanged="true"> <label>Control Library Selection</label> <fieldForLabel>Control_Library</fieldForLabel> <fieldForValue>Control_Library</fieldForValue> <search> <query>|inputlookup controls_rtm.csv |search "System"="$system_tk$" |stats c by "Control Library" |table "Control Library" |rename "Control Library" as Control_Library</query> <earliest>0</earliest> <latest></latest> </search> <choice value="*">All</choice> <default>*</default> </input> <input type="multiselect" token="year_tk" searchWhenChanged="true"> <label>Year OAM Selection</label> <choice value="Year 1 OAM">Year 1</choice> <choice value="Year 2 OAM">Year 2</choice> <choice value="Year 3 OAM">Year 3</choice> <delimiter>|</delimiter> </input> </fieldset> <row> <panel> <html depends="$alwayshideCSSPanel$"> <style> #tableColor table tbody td div.multivalue-subcell[data-mv-index="1"]{ display:none; } </style> </html> <table id="tableColor"> <title>Year Selection and Rating Results</title> <search> <query>|inputlookup controls_rtm.csv |search "System"="$system_tk$" "Control Library"="$cl_tk$" |table [|inputlookup controls_rtm.csv |search "System"="$system_tk$" "Control Library"="$cl_tk$" |fields - "System", "Control Library" |eval yearoam="$year_tk$" |makemv yearoam delim="|" |mvexpand yearoam |eval "FIPS199-Rating"=case('FIPS199-Rating'="H","High",'FIPS199-Rating'="M","Mod",'FIPS199-Rating'="L","Low") |eval yearoam=yearoam." ".'FIPS199-Rating' |table yearoam |eval yearoam="\"".yearoam."\"" |stats values(yearoam) as yearoam delim="," |nomv yearoam |rename yearoam as search], "Compliance Status" |eval color =case('Compliance Status'>=0 AND 'Compliance Status'<25,"LOW",'Compliance Status'>=25 AND 'Compliance Status'<100,"MEDIUM",'Compliance Status'=100,"HIGH") |foreach * [eval <<FIELD>>=mvappend('<<FIELD>>',color)] |fields - color,"Compliance Status"</query> <earliest>0</earliest> <latest></latest> </search> <option name="drilldown">cell</option> <option name="refresh.display">progressbar</option> <format type="color"> <colorPalette type="expression">case (match(value,"LOW"), "#DC4E41",match(value,"MEDIUM"), "#F8BE34",match(value,"HIGH"),"#53A051")</colorPalette> </format> <drilldown> <set token="field_name">$click.name2$</set> <set token="field_value">$click.value2$</set> </drilldown> </table> </panel> </row> <row> <panel depends="$field_name$,$field_value$"> <table> <title>RTM Data Table</title> <search> <query>|inputlookup controls_rtm.csv |table Column* *</query> <earliest>0</earliest> <latest></latest> </search> <option name="drilldown">cell</option> <drilldown> <link target="_blank">/app/CIS_OA/rtm_automation_030623_global_david?form.year_tk=$click.value$</link> </drilldown> </table> </panel> </row> <row> <panel> <table> <title>RTM Test Methods</title> <search> <query>| inputlookup AssetD.csv | table *</query> <earliest>-24h@h</earliest> <latest>now</latest> </search> <option name="drilldown">cell</option> <drilldown> <link target="_blank">/app/CIS_OA/rtm_automation_030623_global_david?form.year_tk=$click.value2$</link> </drilldown> </table> </panel> </row> </form>
... View more
11-15-2021
01:33 PM
Please I need help with a detailed splunk Data accelerated data model authentication query for sucessful login alerts using a | tstats summariesonly=true . The query should have count threshold. The query should cover all products and vendors names used in the environment. It is not only successful login based on windows.
... View more
Labels
- Labels:
-
authentication
10-26-2021
02:20 PM
I have Mitre App for Splunk installed in my Enterprise security. I have the Mitre Dashboard up. I need help to create a repeatable process that will create custom content. I want to bring into the Mitre Dashboard "Detection Catalog" which was created by one of our Engineers. I need help on how I can automate or create a repeatable process of putting this custom data content into the Mitre Dashboard.
... View more
Labels
- Labels:
-
other
10-25-2021
06:38 AM
Hey Guys, I have the same issue, and as you had recommended, I've contacted the support team but they didn't respond. So, please if you @ngwodo have the data labs share it with me. Your help is appreciated.
... View more
10-16-2021
05:05 PM
To find duplicate events, try this query index=azure sourcetype IN ("mscs:kube-good", "mscs:kube-audit-good")
| stats count by _raw
| where count>1 I'm afraid there are no magic queries to answer your other questions. You'll have to analyze the data in each sourcetype and craft queries as you go to work out answers.
... View more
10-13-2021
05:08 PM
Take the constraint from the dataset and run it in a search window. Verify the results are as expected. Modify the query as necessary to get the desired results then update the datamodel.
... View more
10-12-2021
11:38 AM
Try like this For requirement 1 (index=A sourcetype=A) OR (index=B sourcetype=B)
| stats dc(sourcetype) as stCount by Category Enviroment
| where stCount=2 For requirement 2 (index=A sourcetype=A) OR (index=B sourcetype=B)
| stats dc(sourcetype) as stCount by Category Enviroment
| where stCount!=2
... View more
10-11-2021
11:32 AM
The EVAL and FIELDALIAS settings would like something like this. Put them in the appropriate props.conf file. [mysourcetype]
EVAL-vendor_product = "Microsoft Windows"
FIELDALIAS-src_ip = src_ip=src_ip_address Once a CIM field is defined it is available for use in all parts of a datamodel. To tag the data, create an eventtype that extracts what the datamodel is looking for then add the appropriate tag to that eventtype.
... View more
05-14-2021
09:52 AM
Please I need detailed step-by-step processes on how I can deploy splunk apps and addons from the github(gitlab server) to doing it on the splunk deployment linux server(backend) and updating the changes in github. I know I should first log into gitlab and generate SSH keys and that this SSH keys is copied to our splunk deployment server(backend) in the command line. Please give me the detailed step-by-step process to accomplish this task.
... View more
- Tags:
- github
Labels
- Labels:
-
other
01-09-2021
03:58 AM
> base_ad_metric>0 This filters out the other Metric_IDs. Remove it.
... View more
01-07-2021
04:06 PM
Please I need help with my splunk query below. My query below is only showing just one security metric based on my comparison. I have about 160 security metrics total but only seeing just one. Please I need your help with a splunk query that will show all the 160 security metrics based on my comparison below: index=security source=base_ad_metric_test_v3 earliest=-1y base_ad_metric>0 | stats avg(base_ad_metric) AS avg stdev(base_ad_metric) AS stdev min(base_ad_metric) AS min max(base_ad_metric) AS max latest(base_ad_metric) AS latest_count BY Metric_ID | eval min_thres=5000, max_thres=7500 | eval is_above_thres=if(latest_count>max_thres, 1, 0) | eval is_below_thres=if(latest_count<min_thres, 1, 0) | eval data_item_volatility=case(is_above_thres==1, "High", is_below_thres==1, "Low", true(), "normal") | lookup free_metrics.csv Metric_ID output Data_Item_volatility AS spreadsheet_Data_Item_volatility Operating_System_Metric_Calculation AS spreadsheet_Operating_System_Metric_Calculation Metric_Name AS spreadsheet_Metric_Name Please see below for the result of the security metric and explanation. The result is showing just one security metric right now. Our data source is from Active directory through AD managewise and is fed into splunk. The csv file is coming from external source in excel spreadsheet. The problem is that the excel spreadsheet has about 150 security metrics and my result is only showing just one metric. I need help with splunk query that will go through all the 150 metrics and do the comparison as seen from the above query and give me the result. Please see the result below: Metric ID avg stdev min max latest_count data_item_volatility is_above_thres is_below_thres 1 6145.32 330.95 4854 7319 5934 normal 0 0 max_thres min_thres spreadsheet_data_item_volatility spreadsheet_Metric_Name 7500 5000 Low Total # of GFE hardware assets spreadsheet_Operating_System_Metric_Calculation 5855
... View more
- Tags:
- Search report
Labels
- Labels:
-
saved search
12-30-2020
06:26 AM
The Splunk query did not run. I am just giving you an update.
... View more
12-29-2020
09:09 PM
| eval Metric_ID="1" >The splunk query below is only showing just one line of Metric_ID which starts at 1. of course. >all the 68 lines I don't have any information here.
... View more
12-28-2020
07:17 AM
Thanks. That was part of the answer. The splunk query I was looking for is: index=security sourcetype="Computers" "Computer Status"=Enabled earliest=-12mon@mon | timechart span=1day count | timechart span=1month earliest(count) AS count | stats avg(count) max(count) min(count)
... View more
12-02-2020
02:14 PM
Thanks. I had already figure it out. Thanks again for your help.
... View more
09-27-2020
07:15 PM
Thanks the starter pack works. I am working on building on it since I have more broader requirements.
... View more
09-22-2020
06:51 AM
I also created 2 Alerts in Splunk web to send me an email based on the threshold of 24 hours and 10 minutes. Is that the correct way of doing it? Please let me know.
... View more
- Tags:
- alerts
09-22-2020
06:41 AM
Thanks. I believe the color is now working. I will keep you updated.
... View more
09-17-2020
08:35 AM
Please can you tell how I can make changes from gitlab server to track changes for a Splunk configuration file: savedsearches.conf for an invalid email sender? Please I need the step by step process on how to do it. We need to do it from gitlab not from splunk web.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
03-09-2023
12:42 AM
|
