I understood why it happened. Thank you a lot ... View more

in my csv file, I have this to check *\.sh test   tried your suggestion, but I the comment_remark wasn't added to the events, I had a lot of events run .sh file   ... View more

This is the input   <fieldset submitButton="false"> <input type="time" token="allDashboard_time_tok" searchWhenChanged="true"> <label>Time's Range</label> <default> <earliest>-24h@h</earliest> <latest>now</latest> </default> </input> <input type="dropdown" token="ruleID_tok" searchWhenChanged="true"> <label>Rule's ID</label> <choice value="*">Any</choice> <fieldForLabel>RuleID</fieldForLabel> <fieldForValue>RuleID</fieldForValue> <search base="Base"> <query>fields RuleID | top 0 RuleID | sort + RuleID</query> </search> <default>*</default> <initialValue>*</initialValue> <change> <condition label="Any"> <set token="flag_1">0</set> </condition> <condition> <set token="flag_1">1</set> <set token="showDetails">true</set> </condition> </change> </input> <input type="dropdown" token="ruleDescription_tok" searchWhenChanged="true"> <label>Rule's Description</label> <choice value="*">Any</choice> <default>*</default> <initialValue>*</initialValue> <fieldForLabel>RuleDescription</fieldForLabel> <fieldForValue>RuleDescription</fieldForValue> <search base="Base"> <query>fields RuleDescription | top 0 RuleDescription | sort + RuleDescription</query> </search> <change> <condition label="Any"> <set token="flag_2">0</set> </condition> <condition> <set token="flag_2">1</set> <set token="showDetails">true</set> </condition> </change> </input> <input type="dropdown" token="ruleLevel_tok" searchWhenChanged="true"> <label>Rule's Level</label> <choice value="*">Any</choice> <default>*</default> <initialValue>*</initialValue> <fieldForLabel>RuleLevel</fieldForLabel> <fieldForValue>RuleLevel</fieldForValue> <search base="Base"> <query>fields RuleLevel | top 0 RuleLevel | sort + RuleLevel</query> </search> <change> <condition label="Any"> <set token="flag_3">0</set> </condition> <condition> <set token="flag_3">1</set> <set token="showDetails">true</set> </condition> </change> </input> </fieldset>   ... View more

Thank you, I'll think about that ... View more

Yeah, I think it's the problem. It's in dashboard, with realtime search and a drilldown which to change the token then this dashboard can run. But my token will not change when it's running. So in my mind now, maybe about the realtime search. ... View more

Okay, tks for your replying. I'll try to figure it out. ... View more

Checked it, not work hehe. Do you have another solutions? ... View more

I don't know how to detail my issue. Like you search this in 5min:   | eval RespondSize=round(('RespondSize'/1024)/1024,2) | search SrcIP="$ipDownloadDetail$" | stats sum(RespondSize) as Size by DstIP | sort 5 -Size | ipinfo DstIP | table DstIP, org, hostname, country, Size   And when it had run for 2-3 mins, the top 5 will be set, and when it run to the final, the top 5 will be changed. So when top 5 are set at first time, they will call the API with 5 requests, and when it run to the final stage, another 5 requests will be made ... View more

Did you try fillnull before stats sum command? ... View more

the table command was put after "ipinfo" commands, so I think it's totally fine. And yes, I got just 5 row in the table, but the request was made to Ipinfo API is more than 5. Depends on how many DestIP user surfed. ... View more

Ah, you can think about Splunk will do sort 5 ips, but the event will be indexed one by one follow the time of its. And in that moment, the top 5 is the top, but 5s later, the top 5 will be changed, so it will do10 requests instead of 5 request at the final ... View more

Or you can try this: baseSearch | rex field=_raw "\suserId\=(?<userId>.*?)\s\," ... View more

Thank you, because it's  streaming command, so i need to but things back to the result. And I found the way 😄 thanks. ... View more

One more question, I just want to out the value of fields, then send it. So which command should i create? (Streaming, Generating, Transforming or something else). Because I'm using Streaming and it return error: TypeError at "/opt/splunk/etc/apps/testCommand/bin/splunklib/searchcommands/internals.py", line 573 : 'NoneType' object is not iterable   This is my command: from __future__ import absolute_import, division, print_function, unicode_literals import os,sys import time from splunklib.searchcommands import dispatch, StreamingCommand, Configuration, Option, validators import requests @Configuration() class GenerateTextCommand(StreamingCommand): def stream(self,records): for record in records: fields = self.fieldnames i = record[fields[0]] botURL = "https://api.telegram.org/botTOKEN/sendMessage?chat_id=CHAT_ID&text="+str(i) r = requests.get(botURL) dispatch(GenerateTextCommand, sys.argv, sys.stdin, sys.stdout, __name__) ... View more

Hi, How about a have an csv file, the forwarder should break into multilines, but it didn't. What should i write props.conf CSV looklike in 1 event: G2nS32m2gEaFZUrh,UDP,2294,64021328,447952334,511973662,1652264015 xNeJ2gTvj9wAl5Hi,UDP,2294,15902274,180739240,196641514,1652263847   Maybe:  LINE_BREAKER = \\n([\r\n]+) Does it right?  ... View more

It didn't work, but I tried with    <row depends="$showDownloadDetail$"> <panel> <table depends="$ipDownload$"> <title>Top Host Download from $ipDownload$</title> <search> <query>index=... | search SrcIP="$ipDownload$" | stats sum(DownSize) as Download by DstIP Client AppProtocol | sort 10 -Size | table DstIP, Client, AppProtocol, Download </query> <earliest>$early$</earliest> <latest>$late$</latest> <sampleRatio>1</sampleRatio> </search> </table> </panel>   So it worked perfectly. And we can remove the <eval> in drilldown, then call the token directly from <done>. By the way, i don't know how to find something like <done> tag, could you send me some docs about this. ... View more

Sure. Here it is Panel1 <panel> <chart> <title>Top Traffic - Download</title> <search> <query>index=... | fields SrcIP, DownSize | chart sum(DownSize) as Download by SrcIP | sort 10 -Download</query> <earliest>$TimeOfTraffic.earliest$</earliest> <latest>$TimeOfTraffic.latest$</latest> <sampleRatio>1</sampleRatio> </search> <drilldown> <set token="showDownloadDetail">true</set> <set token="ipDownload">$click.value$</set> </drilldown> </chart> </panel> Panel2 <row depends="$showDownloadDetail$"> <panel> <table depends="$ipDownload$"> <title>Top Host Download from $ipDownload$</title> <search> <query>index=... | search SrcIP="$ipDownload$" | stats sum(DownSize) as Download by DstIP Client AppProtocol | sort 10 -Size | table DstIP, Client, AppProtocol, Download </query> <earliest>$TimeOfTraffic.earliest$</earliest> <latest>$TimeOfTraffic.latest$</latest> <sampleRatio>1</sampleRatio> </search> </table> </panel> ... View more

I mean when i finished panel1. I click a value on that, then the panel2 will search for that value. In this case is $ipDownload$ , but it search with another time. The output is quite difference. panel1 took 10mins to finish, so when panel2 start, it’s 10mins later. Any suggestions please.. Thanks for reading my stupid grammar. 🥲 ... View more