Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About chrisschum
chrisschum
Path Finder
Member since:
06-09-2017
03-29-2023
Community Statistics
| Posts | 46 |
| Solutions | 0 |
| Karma Given | 6 |
| Karma Received | 4 |
| Member Since | 06-09-2017 |
Activity Feed
- Karma Re: How to use a Lookup File with Multiple Static or Dynamic Values? for yuanliu. 03-29-2023 02:22 AM
- Posted Re: How to use a Lookup File with Multiple Static or Dynamic Values? on Splunk Search. 03-27-2023 05:42 PM
- Tagged How to use a Lookup File with Multiple Static or Dynamic Values? on Splunk Search. 03-24-2023 11:07 AM
- Tagged How to use a Lookup File with Multiple Static or Dynamic Values? on Splunk Search. 03-24-2023 11:07 AM
- Posted How to use a Lookup File with Multiple Static or Dynamic Values? on Splunk Search. 03-24-2023 08:14 AM
- Karma Re: How do I edit a dashboard so that each panel has a different color? for vnravikumar. 06-05-2020 12:50 AM
- Karma Re: Help with Regex - Removing Text from Field for wenthold. 06-05-2020 12:50 AM
- Got Karma for Can you help me with a problem i'm having with my pie chart?. 06-05-2020 12:50 AM
- Got Karma for How do I edit a dashboard so that each panel has a different color?. 06-05-2020 12:50 AM
- Karma Re: Results on one value matching two AND field results for dragonakai. 06-05-2020 12:49 AM
- Karma Re: How can I remove additional field values? for skoelpin. 06-05-2020 12:49 AM
- Karma Re: 6.6 Cloud Support for aivarson_splunk. 06-05-2020 12:49 AM
- Got Karma for Enterprise Security: How can I get the group names I created to populate in the AV logs so an alert can be generated?. 06-05-2020 12:49 AM
- Got Karma for Re: How can I remove additional field values?. 06-05-2020 12:49 AM
- Posted Re: Help with Regex - Removing Text from Field on Splunk Search. 10-30-2019 07:43 AM
- Posted Re: Help with Regex - Removing Text from Field on Splunk Search. 10-30-2019 06:15 AM
- Posted Help with Regex - Removing Text from Field on Splunk Search. 10-30-2019 04:45 AM
- Tagged Help with Regex - Removing Text from Field on Splunk Search. 10-30-2019 04:45 AM
- Posted Re: Omit Token Value from Results on 1 Panel on Splunk Enterprise Security. 08-21-2019 11:26 AM
- Posted Re: Remove Text after Numbers in Field on Splunk Search. 08-21-2019 10:54 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 1 | |||
| 0 | |||
| 0 | |||
| 0 |
03-27-2023
05:42 PM
That worked like a charm! Thank you!
... View more
03-24-2023
08:14 AM
We have a standard configuration for our workstations. Several of the fields are static but some are dynamic (but these have a fixed length). I want to use a lookup table of all the values and apply automatically to a sourcetype. But I'm not sure how I would go about matching the fields/values with a Lookup Definition. The standard is 1=Device Type - Static 1 char 2=Building Code - Static 3 chars 3=Department Code - Static 3 chars 4=Function - Static 1 char 5=Asset Tag - Dynamic 7 chars So a machine may be named LBL1HRSSABC1234 indicating it's a laptop in Building 1 in HR Services that is Shared with an asset tag of ABC1234. How could I use a lookup with these 4 static and 1 dynamic values to populate said values when a search is done on a particular host name. I should mention that I'm confortable creating the lookup and applying it, just not how to get it to match on the criteria above. Thanks in advance!
... View more
Labels
- Labels:
-
lookup
10-30-2019
06:15 AM
Thanks Giuseppe!
I'm actually wanting to get rid of everything after the APSA (or any other 3 to 4 alphanumeric value). The field is actually already extracted as LOC.
So what I get when I run a search is LOC= "3 or 4 character alphanumeric value"< /ParticipantObjectQuery>< /ParticipantObjectIdentification>< /AuditMessage>
What I want the results to be is LOC="3 or 4 character alphanumeric value"
Thanks!
... View more
10-30-2019
04:45 AM
I have a field where results are 'some letter & number combination of 3 or 4 characters' that includes txt on the end I want to remove.
The text is made up of APSA< /ParticipantObjectQuery>< /ParticipantObjectIdentification>< /AuditMessage>".
So, how do I get rid of everything after the '3 or 4 character' value, which in this case is 'APSA'?
Thanks!
... View more
08-21-2019
11:26 AM
@niketnilay I completely understand, but the thing is the issue wasn't resolved. I just went a different direction with the dashboard. I simply made everyone who uses it (just a handful of people) aware that if they weren't searching an IP, to ignore the panels with IP information. I just worked around it.
Thanks!
... View more
08-21-2019
10:54 AM
It took off the full result field because it has a less than and greater than sign
000000000([less than sign]/ParticipantObjectQuery[greater than sign][less than sign]/ParticipantObjectIdentification[greater than sign][less than sign]/AuditMessage[greater than sign]"
... View more
08-21-2019
10:48 AM
How can I remove everything after the zeroes in a field with results like this '000000000'
Thanks!
... View more
- Tags:
- eval
- rex
- splunk-cloud
08-21-2019
10:44 AM
I apologize it's taken me so long to respond.
Actually, it turns out I don't need to do it this way anymore as the needs change.
Thanks for responding!
... View more
07-25-2019
07:03 AM
I'm have a dashboard with multiple panels, some of which provide hostnames and others that do not (some coming from AD and others coming from routers). I have text search boxes that tie to all the panels and populate data when it's available.
My question is, how do I omit results in a panel that looks at router logs and therefore doesn't have a hostname? Currently, if I do a search from a hostname, the panel running a search on router logs just pulls up all router logs. If someone searches for a hostname, I just want the panel that searches router logs to say 'no results found". All the table results except IP come from an Automatic Lookup populated by a Lookup file.
Below is the dashboard panel search string.
index=__sec_fw sourcetype=cisco:asa host IN ("router1", "router2") src_ip IN (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 128.163.61.0/24, 128.163.59.0/25, 128.163.59.128/25)
| rename src_ip AS IP
| search IP="$ip$"
| table "IP", Location, Location_Additional, Floor, _time
... View more
05-06-2019
07:45 AM
I think that's the ticket niketnilay! It seems to have worked. Thanks!
... View more
05-06-2019
07:38 AM
Thanks woodcock. Unfortunately, I'm not in a position where I can install any apps on our Splunk instance.
... View more
05-03-2019
05:38 AM
<title>Vulnerability Remediation Activity Across All Applications - No Tier - Past 90 Days</title>
<chart>
<search>
<query>index=index_app sourcetype="app:detection" NOT severity IN (low, informational), STATUS IN (FIXED, ACTIVE, NEW, RE-OPENED) NOT Tier IN (0,1,2)
| rename DNS AS Hostname
| eval "NEW" = "NEW" + ";" + "RE-OPENED"
| makemv delim=";" "NEW"
| mvexpand NEW
| timechart span=1mon count(STATUS) by STATUS usenull=f
| fields - "RE-OPENED"</query>
<earliest>-90d@d</earliest>
<latest>-1h</latest>
<sampleRatio>1</sampleRatio>
</search>
<option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
<option name="charting.axisLabelsX.majorLabelStyle.rotation">-45</option>
<option name="charting.axisLabelsY.majorUnit">auto</option>
<option name="charting.axisLabelsY2.majorUnit">100</option>
<option name="charting.axisTitleX.text">Time Period</option>
<option name="charting.axisTitleX.visibility">visible</option>
<option name="charting.axisTitleY.visibility">visible</option>
<option name="charting.axisTitleY2.visibility">visible</option>
<option name="charting.axisX.abbreviation">none</option>
<option name="charting.axisX.scale">linear</option>
<option name="charting.axisY.abbreviation">auto</option>
<option name="charting.axisY.scale">linear</option>
<option name="charting.axisY2.abbreviation">auto</option>
<option name="charting.axisY2.enabled">0</option>
<option name="charting.axisY2.maximumNumber">auto</option>
<option name="charting.axisY2.minimumNumber">auto</option>
<option name="charting.axisY2.scale">linear</option>
<option name="charting.chart">line</option>
<option name="charting.chart.bubbleMaximumSize">50</option>
<option name="charting.chart.bubbleMinimumSize">10</option>
<option name="charting.chart.bubbleSizeBy">area</option>
<option name="charting.chart.nullValueMode">zero</option>
<option name="charting.chart.showDataLabels">all</option>
<option name="charting.chart.sliceCollapsingThreshold">0.01</option>
<option name="charting.chart.stackMode">default</option>
<option name="charting.chart.style">shiny</option>
<option name="charting.drilldown">none</option>
<option name="charting.fieldColors">{FIXED:0x00cc66, ACTIVE:0xff4d4d, NEW:0x1a66ff}</option>
<option name="charting.layout.splitSeries">1</option>
<option name="charting.layout.splitSeries.allowIndependentYRanges">1</option>
<option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
<option name="charting.legend.mode">seriesCompare</option>
<option name="charting.legend.placement">right</option>
<option name="charting.lineWidth">2</option>
<option name="refresh.display">progressbar</option>
<option name="trellis.enabled">0</option>
<option name="trellis.scales.shared">1</option>
<option name="trellis.size">medium</option>
<option name="trellis.splitBy">severity</option>
</chart>
... View more
05-03-2019
05:24 AM
Is there a way to schedule PDF delivery of a dashboard that has specific HTML settings?
My issue is that when I try and schedule PDF delivery of a Dashboard, when I schedule it, the search is converted to simply '| noop'
If I try and create a new report with the data, it automatically creates a Bar Chart based (not the Line Chart I want) based on the search and also doesn't use the specific colors I want to use.
The search is below.
Thanks!!!
... View more
05-01-2019
07:42 AM
That worked like a champ! Thank you!!!
... View more
04-30-2019
07:17 AM
1 Karma
I've tried the property but it still shows the color across all panels (I assume this is because of the h2 property set).
Also, what are the dashboard-panel options, i.e. h2, h3, etc?
Below is an example.
Thanks!
.dashboard-panel h2{
background:#3366ff !important;
color:white !important;
text-align: center !important;
font-weight: bold !important;
border-top-right-radius: 15px;
border-top-left-radius: 15px;
... View more
11-19-2018
06:16 AM
This worked! Thank you very much!
... View more
11-19-2018
06:16 AM
Thanks! I tried making that change but it didn't work for me. It still rearranged the colors on some of them.
... View more
11-15-2018
12:08 PM
It shows the name for the slice of the pie and the percentage that slice represents. But doesn't show how many events make up that percentage,
Thanks!
... View more
11-15-2018
10:11 AM
Clarifying
{CRITICAL:0Xff4d4d, HIGH:0xffff66, MEDIUM:ox00cc66}
is an
... View more
11-15-2018
10:09 AM
1 Karma
So I'm having a strange issue that I'm hoping someone can help me with.
I have a pie chart with two goals:
1. Show the total number of Critical, High and Medium events (in each slice of the pie)
2. Keep the colors the same for Critical, High and Medium no matter what the result total of each (i.e. no matter which one has more events, the colors stay the same)
The search below (with relevant option) — This works great with the colors but does not show the total number in each slice.
index=Foo NOT severity IN (low, informational) STATUS=active DNS=Foo*
| transaction signature
| stats count by severity
| eval severity= upper(severity)
| fields severity, count
{CRITICAL:0Xff4d4d, HIGH:ffff66, MEDIUM:00cc66}
The search below fixes the number problem and shows the number total for each slice. However, the colors don't work at all. It's like it completely ignores my color selections
| transaction signature
| stats count by severity
| eval severity= upper(severity)
| eval severity = count + " " + severity
| fields severity, count
{CRITICAL:0Xff4d4d, HIGH:ffff66, MEDIUM:00cc66}
Any ideas on how to get both to work
Thanks!
... View more
08-09-2018
05:16 AM
Thanks! But I want to keep the log data, just extract the data between the double quotes.
... View more
08-09-2018
05:15 AM
Thanks! That works. I have one followup question. In the "this is the only data I want" how do I make it so that data can be anything alphanumeric. So anything between the double quotes can be any data?
Thanks!
... View more
08-08-2018
01:16 PM
How can you only extract data from a _raw log where the data I want is separated with double quotes? So it's "this is the only data I want"
Thanks!
... View more
- Tags:
- field-extraction
08-06-2018
12:09 PM
Okay, I think that got it. Thanks!
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
03-29-2023
05:42 AM
|
