Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About erdalcan
erdalcan
New Member
Member since:
03-15-2017
06-05-2020
Community Statistics
| Posts | 8 |
| Solutions | 0 |
| Karma Given | 0 |
| Karma Received | 0 |
| Member Since | 03-15-2017 |
Activity Feed
- Posted Re: How to search for 5 failed logins followed by 1 successful login from one user to find brute force attacks? on Splunk Search. 05-17-2017 02:47 AM
- Posted Re: How to search for 5 failed logins followed by 1 successful login from one user to find brute force attacks? on Splunk Search. 05-08-2017 11:01 PM
- Posted Re: Lookup csv file, match codes and add field on Splunk Search. 04-24-2017 06:28 AM
- Posted Lookup csv file, match codes and add field on Splunk Search. 04-24-2017 05:51 AM
- Tagged Lookup csv file, match codes and add field on Splunk Search. 04-24-2017 05:51 AM
- Posted Create several links on dashboard and click on click of a submitbutton on Dashboards & Visualizations. 04-11-2017 06:11 AM
- Tagged Create several links on dashboard and click on click of a submitbutton on Dashboards & Visualizations. 04-11-2017 06:11 AM
- Posted Re: create buttons on page and link to dashboards on Dashboards & Visualizations. 04-11-2017 04:48 AM
- Posted create buttons on page and link to dashboards on Dashboards & Visualizations. 04-11-2017 03:16 AM
- Tagged create buttons on page and link to dashboards on Dashboards & Visualizations. 04-11-2017 03:16 AM
- Posted add a new navigation menu to an app and link it to a certain dashboard on All Apps and Add-ons. 04-10-2017 02:13 PM
- Tagged add a new navigation menu to an app and link it to a certain dashboard on All Apps and Add-ons. 04-10-2017 02:13 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
05-17-2017
02:47 AM
I have already added a time field (10 minutes), but it seems this query searches in the given timeframe and looks for the total failed and one successful event, without taking the time sequence in which order they came.
for example, I run the query and see users who have logged in this sequence:
1. failure
2. success
3. failure
4. failure
5. failure
6. failure
The query should only look for the first 5 failed loggings followed by a successful, but
it looks in total of loggings within a timeframe
wonder if this is easy to do with the enterprise security app, there you do have brute force queries but none of them contain the successful brute force attacks
... View more
05-08-2017
11:01 PM
That does seem to work, but it doesn't take the time sequence in consideration , how can I order the events in order of time? I first want to see 5 failed loggings followed by a successful login, and not 6 total loggings where there is a successful login in between somewhere
... View more
04-24-2017
06:28 AM
I get this eroror
Error in 'inputlookup' command: Invalid argument: 'EventCode'
did double check if the collum Event Code is parsed correctly from the CSV file and it is
... View more
04-24-2017
05:51 AM
I have a csv file containing 2 rows: EventCode and Message Summary
Have added the CSV as a lookup file and I can also read the CSV from splunk (| inputlookup filename.csv)
these are windows events,
I want to compare the windows event id's from Splunk and match them with the csv file and add the field "message summary"
the "message summary" give a short description of the event ID
... View more
- Tags:
- splunk-enterprise
04-11-2017
06:11 AM
USers need to see couple of servers on the dashboard , select and submit to the appropriate dashboard
I have found the xml code , but this is for searches, how can we modify the searches with a link to a dashboard?
<form>
<fieldset submitButton="true">
<input type="radio" token="choice">
<choice value="| stats count | eval search = "search 1"">Search 1</choice>
<choice value="| stats count | eval search = "search 2"">Search 2</choice>
<choice value="| stats count | eval search = "search 3"">Search 3</choice>
</input>
</fieldset>
<row>
<table>
<searchString>$choice$</searchString>
</table>
</row>
</form>
... View more
- Tags:
- splunk-enterprise
04-11-2017
04:48 AM
hello Martin, thx for your reply
I see what you mean, but we want to see the information with buttons instead of a pull down menu,
because with pull down , you don't see the list
... View more
04-11-2017
03:16 AM
I have several dashboards ready with queries
would it be possible to create couple of buttons and when clicking, it would open the appropriate dashboard?
so for example, I open splunk and see several buttons, one for each server, when clicking on the server, I get the dashboard of the server
hope you know what I mean 🙂
... View more
- Tags:
- splunk-enterprise
04-10-2017
02:13 PM
I have created a new app and want to to add a new navigation menu to open a certain dashboard
Went to: Manager > User interface > Navigation menus
and added this line:
<collection label="Dashboards">
<view name="mydashboard" />
</collection>
<collection label="Search views">
<view name="mysearchview" />
<a href="http://google.com">Google</a>
</collection>
how ever, this only creates the "search views" menu and a link to google.com
would it be possible to change the menu to open a certain dashboard?
Or even open a blank dashboard which I could edit and put all the information ?
The reason is that I have one big dashboard and need to filter out the information.
Was thinking of originally to create buttons to servers and their dashboards, but that isnt possible.
Adding menu's for the servers seems a good solution. User can just click on the menu and will get the dashboard for the server.
... View more
- Tags:
- splunk-enterprise
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:03 AM
|
