About jg91

jg91

Try this one index=<index> [inputlookup lookup_table | search NAME = "Toronto" | table ID]

jg91

I think we should use table instead of fields.

jg91

This dashboard (Traffic Search Dashboard) is accessible in Network Domain of Splunk Enterprise Security app. You can also create a similar dashboard with these inputs and use tokens to modify your search.

jg91

Hi, I’m trying to enhance the functionality of the "Acknowledge" button in an Splunk IT Service Intelligence episode. When I click on it, I want it to not only change the status to "In Progress" and assign the episode to me, but also trigger an action such as sending an email or creating a ticket in a ticketing system I’m aware that automatic action rules can be set in aggregation policies, but I want these actions to occur specifically when I manually click the "Acknowledge" button. Is there a way to achieve this? Thanks!

jg91

So there is no way to customize these letters/abbreviations?

jg91

Hi everyone, I’m trying to visualize the network traffic of an interface in Splunk using an area chart. However, the Y-axis scale is currently displaying as K, M, B (for thousand, million, billion), but I would like it to show K, M, G, T (for kilobytes, megabytes, gigabytes, terabytes). Is there a way to adjust this? Thanks!

jg91 · ‎12-16-2022

Is it possible to configure heavy forwarders to send data to two tcpout groups (A,B) (outputs.conf) and don't block on group B failure? We want to send all data to group A, and a subset of data (specific sourcetypes) to group B, but group B is in a remote location and our link to that location is not fully stable and we don't want to event loss in group A on link failures or group B failures. [tcpout] [tcpout:groupA] server=indexerA1_ip:9997,indexerA2_ip:9997 [tcpout:groupB] server=indexerB_ip:9997

jg91 · ‎09-19-2022

Hi, in a Linux server, a UF is configured to monitor a log directory, and it stops sending data to the indexer after about 2 minutes. When I restart the UF from the deployment server, it will start sending data and then stop sending. Other inputs configuration like running scripts are working fine, and there is no error or warning in the _internal index about this host. Do you have any idea about this problem?

jg91 · ‎05-30-2022

Isn't there any option ?

jg91 · ‎05-11-2022

Hello, I wanna download MS Exchange app but it's not available via https://splunkbase.splunk.com/app/1660 Where can I find version 4.0.4 of this app ?

jg91 · ‎12-06-2021

Is there any solution to protect UF from stopping or uninstalling by users on endpoints? For example, most Antivirus agents are password protected and on uninstallation, users must provide the password, I'm looking for this kind of solution. Thank you.

jg91 · ‎09-11-2021

I want to anonymize one sourcetype before routing it to 3rd party system with Syslog. what is the proper config for props, transforms, and outputs config files? When is use SEDCMD in props.conf, all events (for me and 3rd party system) will be anonymized, and when I use REGEX in transforms.conf for anonymizing, I can't route events to another system at the same transform stanza because FORMAT field should be used with _raw value.

jg91 · ‎05-06-2021

Hello, We want to call a REST API endpoint as the action for an alert and also wish to send some parts of the search result with this API call. Do you have any suggestions?

jg91 · ‎03-13-2021

Hi, Yes, but I want to find a way to forward MC Missing Forwarders Alerts to ES as a Notable Event, not creating a new Correlation search.

jg91 · ‎03-13-2021

Hi, is there any solution to create a notable event for missing forwarders? Now missing forwarders generate an alert on Monitoring Console, which runs on a separate Splunk instance than ES.

jg91 · ‎03-13-2021

My events are firewall events with src, dest, and actions fields, and a firewall log event with allowed action is the connection between two nodes. My events: A -> target (raw event: src=A dest=target action=allow) B -> A (raw event: src=B dest=A action=allow) C -> B (raw event: src=C dest=B action=allow) D -> B (raw event: src=D dest=B action=allow) A -> C (raw event: src=A dest=C action=allow) C -> D (raw event: src=C dest=D action=allow) My goal is to find A, B, C, D nodes (all nodes that have a route/connection to the target node) with a recursive query.

jg91 · ‎03-13-2021

Hello, I want to search for all src hosts that connect to a specific destination with or without intermediary hopes. I want to use a recursive query on the core firewall logs and its dest and src fields to find all sources. Would you please help me with this query?

jg91 · ‎03-09-2021

How can I find users who stopped a service? I have tried [WinHostMon://service] and [WinEventLog://System] But the first option lists the status of services and for second option log doesn't have a User field.

jg91 · ‎09-20-2020

Hello friends, We have Splunk ES and we stored our data in different indexes (OS logs, Network logs, ...) I have a question about correlation searches. Some correlation searches didn't use Data Models and just used simple search commands, how I can change these correlation rules to use our indexes? at first, is it needed to change anything? My second question is which permission or user will ES use to run Correlation Searches? I mean I have to grant access to our indexes to which Roles/Users? thanks.

jg91 · ‎08-23-2020

I Have the same problem, did you solved it?

jg91 · ‎08-23-2020

I have the same problem with MonitorNoHandle for dns.log. Did you solved it?

jg91 · ‎07-19-2020

Hi, yes I saw these documents, with these configs we can blacklist some sort of events, for example, we can nullQueue (or Drop) events with specific field values or strings, but I don't want to drop the event, I want to delete some fields or parts of the event before indexing, like summarization.

jg91 · ‎07-19-2020

so there is no restriction to use the same license for the HF and All Indexers (in both clusters) and simply I can use just one of those license masters, is it right?

jg91 · ‎07-19-2020

Hello, we want to filter some fields of receiving events before indexing for the license saving, for example, in a firewall traffic log we want to delete the country field in the event and index the remaining fields or parts of the event. How we can do that? Can we do that with Heavy Forwarder? We don't want to drop any events, we just want to delete some parts of events before indexing.

jg91 · ‎07-19-2020

Hello, we Have 2 separate Splunk indexer clusters with 2 separate licenses for each one, can we forward data to both of them from one Heavy Forwarder? what license we should use on the HF?

Posts	39
Solutions	1
Karma Given	5
Karma Received	2
Member Since	‎11-22-2019

Online Status	Offline
Date Last Visited	Thursday

How to Trigger Email or Ticket Creation on Episode...

How to Change Y-Axis Scale to K, M, G, T?

Configure forwarding data to two tcpout groups wit...

Why does Splunk UF stop sending data a few minutes...

How to download Splunk App for MS Echange?

Protecting UF from stopping and Uninstallation

how to anonymize and route specific events

Alert Action to call a Rest API

create notable event for missing forwarders

Recursive query with unlimited depth

Re: Using a lookup table in a base search

Re: Using a lookup table in a base search

Re: Traffic Search function

How to Trigger Email or Ticket Creation on Episode...

Re: How to Change Y-Axis Scale to K, M, G, T?

How to Change Y-Axis Scale to K, M, G, T?

Configure forwarding data to two tcpout groups wit...

Why does Splunk UF stop sending data a few minutes...

Re: How to download Splunk App for MS Echange?

How to download Splunk App for MS Echange?

Protecting UF from stopping and Uninstallation

how to anonymize and route specific events

Alert Action to call a Rest API

Re: create notable event for missing forwarders

create notable event for missing forwarders

Re: Recursive query with unlimited depth

Recursive query with unlimited depth

How to find users who stopped a windows service

ES Correlation Search index configuration

Re: Troubleshoot a MonitorNoHandle input

Re: Microsoft DNS Debug and monitorNoHandle

Re: How to avoid indexing of some fields or parts ...

Re: Forwarding events to 2 separate splunk indexer...

How to avoid indexing of some fields or parts of e...

Forwarding events to 2 separate splunk indexers cl...