×

Are you a member of the Splunk Community?

Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Ask a Question
nathanluke1986
Engager
Member since: ‎09-14-2022
‎09-08-2023
Community Statistics
Posts 5
Solutions 0
Karma Given 1
Karma Received 0
Member Since ‎09-14-2022
Activity Feed
View All

Drilldown conditions to URL

by in Splunk Enterprise
‎09-08-2023 02:08 AM
‎09-08-2023 02:08 AM
Hello, I am trying to drilldown in a dashboard to a URL that checks malicious IP's and Domains. Issue I am having is the URL for IP search and Domain search is different. All IOC's are in the same field called "threat_match_value" but there is another field in log called "threat_key" which specifies if it is a IP or Domain. Is it possible to add a condition like: If threat_key=Domain drill down to Domain URL but the click.value be the "threat_match_value".   Don't really want to separate into 2 panels   Thanks, ... View more
Labels

Splunk ES add an "assign to me" link as a field or...

by in Splunk Enterprise
‎06-16-2023 05:28 AM
‎06-16-2023 05:28 AM
Hi, I am trying to add an "assign to me" link as a field or button for each alarm that would automatically assign alarms to the user when clicked.  Example: Currently need to select alarm, click edit and click "assign to me" link and submit   I want to reuse that link and add it as an alarm field or button on the Incident Review page so analysts simply have to click to assign. This would drastically improve SLA times for us.   Thanks ... View more

Re: group same events in timeline until event chan...

by in Splunk Enterprise
‎12-12-2022 05:56 AM
‎12-12-2022 05:56 AM
Sorry if this has confused you.   What I want a timeline of the events but grouped if they same signature but only up to the point where the signature value changes in the time line. so if there are 20 successful logins then a failure then 3 successful I would like it to show: successful login (count 20) failure (count 1) successful (count 3) |table firsttime signature count.   The issue I am having is there could be pages of successful logins before another event of interest occurs.   I want to tidy up the time line to make it easily readable   ... View more

How to group same events in timeline until event c...

by in Splunk Enterprise
‎12-12-2022 05:05 AM
‎12-12-2022 05:05 AM
Hi I would like to group events in a timeline as a count until a different event occurs   Example:   So basically achieve the following: A user account was locked out   (count 13) A process has exited (count 1) A new process has been created (count 1) Permissions on an object were changed (count 2) A process has exited (count 1) And so on ......     ... View more

How to list chosen fields in one field?

by in Splunk Search
‎09-14-2022 06:09 AM
‎09-14-2022 06:09 AM
Hello, I am trying to list fields I have selected into a single field to display in a dashboard. Currently trying   | eval Details = mvappend('src', 'dest')  but this only lists the values what I am trying to achieve is listing field name and value for example. src=192.168.0.1 dest=192.168.0.2 etc  etc   any help appreciated. thanks     ... View more
Labels
Contact Me
Online Status
Offline
Date Last Visited
‎09-08-2023 08:27 AM
Karma given to
View All