Good morning guys, I'm currently working on an analytics dashboard on the app Splunk Enterprise security. The dashboard consists of many modules and panels. For example there are several sections that can only be shown by selecting a radio buttom. The problem is the best practices of the dashboard. The dashboard every time updates internally causing slowdowns. It would be possible to update the dashboard (and therefore the panels) only when i select the radio buttom? Ultimately to make sure that the dashboard does not update in full at each refresh? Thank you all, Xavier ... View more

Hi everyone, I am currently receiving data / logs via my buckes. The following logs have been categorized in the sourcetype following: aws: s3 I would like to create a condition or make sure that certain files in my s3 bucket are stored in another sourcetype and applicate a parsing to line. Example from: index=main sourcetype=aws:s3 To: index=main sourcetype=s3_logs_customer Hi write this in on input.conf but not work: [source::s3://mypath/*_Report_ProdValid_*.csv] REPORT-s3-logs-customer = s3-logs-customer [ s3-logs-customer ] DATETIME_CONFIG=CURRENT SHOULD_LINEMERGE=false LINE_BREAKER=([\r\n]+) NO_BINARY_CHECK=true CHARSET=UTF-8 INDEXED_EXTRACTIONS=csv KV_MODE=none category=Structured description=Comma-separated value format. Set header and other settings in "Delimited Settings" disabled=false pulldown_type=true FIELD_NAMES=id1,id2,id3,id4 FIELD_QUOTE=' FIELD_DELIMITER=,   Could you give me an example of code to insert in the inputs.conf and transform.conf files to achieve my purpose? Thanks a lot ... View more

Hi everyone, I have a specific question for all of you. In Splunk ESS I created a correlation search and a notable for the monitoring Incident Review section. I have set up a specific notable with drilldown to which I pass a field of the CS (Corralation Search)  to perform the specific search and display via the Statistics tab. Corralation Search:   index=* (statusCode=4* OR statusCode=5*) | rename "requestTime" as Time, "statusCode" as Status, "sourceIp" as SourceIp, "httpMethod" as HttpMethod, "endpointRequestId" as "EndpointReqID" | stats values(Status) as Status, values(HttpMethod) as HttpMethod, count by index, SourceIp, EndpointReqID   Notable Drilldown   index=* (statusCode=4* OR statusCode=5*) | search sourceIp="$sourceIp$" | rename "requestTime" as Time, "statusCode" as Status, "sourceIp" as SourceIp, "httpMethod" as HttpMethod, "endpointRequestId" as "EndpointReqID" | stats values(Status) as Status, values(HttpMethod) as HttpMethod, count by index, SourceIp, EndpointReqID   When I open the drilldown from the Notable screen, the following query is returned:   index=* (statusCode=4* OR statusCode=5*) | search sourceIp="$sourceIp$" | rename "requestTime" as Time, "statusCode" as Status, "sourceIp" as SourceIp, "httpMethod" as HttpMethod, "endpointRequestId" as "EndpointReqID" | stats values(Status) as Status, values(HttpMethod) as HttpMethod, count by index, SourceIp, EndpointReqID   Instead of:   index=* (statusCode=4* OR statusCode=5*) | search sourceIp="129.12.x.x" | rename "requestTime" as Time, "statusCode" as Status, "sourceIp" as SourceIp, "httpMethod" as HttpMethod, "endpointRequestId" as "EndpointReqID" | stats values(Status) as Status, values(HttpMethod) as HttpMethod, count by index, SourceIp, EndpointReqID   Why is the $sourceIp$ field not recognized and replaced with the IP address of the CS so that it can perform a specific search? What is the error? Thank you all! ... View more

Hi everyone, I have a specific question for all of you. In Splunk ESS I created a correlation search and a notable for the monitoring Incident Review section. I have set up a specific notable with drilldown to which I pass a field of the CS (Corralation Search)  to perform the specific search and display via the Statistics tab. Corralation Search:   index=* (statusCode=4* OR statusCode=5*) | rename "requestTime" as Time, "statusCode" as Status, "sourceIp" as SourceIp, "httpMethod" as HttpMethod, "endpointRequestId" as "EndpointReqID" | stats values(Status) as Status, values(HttpMethod) as HttpMethod, count by index, SourceIp, EndpointReqID   Notable Drilldown   index=* (statusCode=4* OR statusCode=5*) | search sourceIp="$sourceIp$" | rename "requestTime" as Time, "statusCode" as Status, "sourceIp" as SourceIp, "httpMethod" as HttpMethod, "endpointRequestId" as "EndpointReqID" | stats values(Status) as Status, values(HttpMethod) as HttpMethod, count by index, SourceIp, EndpointReqID   When I open the drilldown from the Notable screen, the following query is returned:   index=* (statusCode=4* OR statusCode=5*) | search sourceIp="$sourceIp$" | rename "requestTime" as Time, "statusCode" as Status, "sourceIp" as SourceIp, "httpMethod" as HttpMethod, "endpointRequestId" as "EndpointReqID" | stats values(Status) as Status, values(HttpMethod) as HttpMethod, count by index, SourceIp, EndpointReqID   Instead of:   index=* (statusCode=4* OR statusCode=5*) | search sourceIp="129.12.x.x" | rename "requestTime" as Time, "statusCode" as Status, "sourceIp" as SourceIp, "httpMethod" as HttpMethod, "endpointRequestId" as "EndpointReqID" | stats values(Status) as Status, values(HttpMethod) as HttpMethod, count by index, SourceIp, EndpointReqID   Why is the $sourceIp$ field not recognized and replaced with the IP address of the CS so that it can perform a specific search? What is the error? Thank you all! ... View more

Hi all, I have Splunk ESS Version: 7.1.3. After updating the GeoLite2-City.mmdb db (last 17/3/20) I noticed that in my query the location is still wrong. Example: index=network eventtype=cisco_vpn_start "AnyConnect parent session started." | where src_ip ="37.161.xx.xxx" | iplocation src_ip | table src_ip, Country src_ip Country 37.161.xx.xxx France However when I running the following command: | makeresults | eval ip="37.161.xx.xxx" | iplocation ip | table Country, ip Country ip Italy 37.161.xx.xxx Why in one case is the correct value returned to me (Italy) while in the first case France appears to me? The behavior is very anomalous to me 😞 Do you have any suggestion or fix for first query? Thanks a lot, Saverio ... View more