About pvarelab

pvarelab · ‎11-21-2023

Your second approach is what we are trying to do now, and it has worked very well for the most part, but we've run into some issues with file precedence —when using the [default] stanza. I guess we'll keep doing this, since I think, as you do, that it is more manageable to have the small pieces of configuration in their own apps. BTW, we are naming this apps starting with numbers following the example of the 100_app that contains the tls credentials to forward traffic to the cloud. The issue with the Cloud vs. Enterprise is that to deploy to the cloud you need to pass the inspection proccess, and it fails if you have inputs.conf, which for the forwarders you always want. So that's another good reason to have them in separate pieces.

pvarelab · ‎11-17-2023

I have a Splunk Cloud instance where we send logs from servers with the Universal Forwarder installed. All UF are managed by a Deployment Server. My questión is: what are the best practices on howw to organize apps, both Splunkbase downloaded and in-house built and also configuration-only apps, if they are a best practice? Right now we are experimenting with deploying the Splunkbase apps as they are (easier to update them) and deploying the configuration in an extra app named starting with numbers so its configuration takes precedence. But we have run into some issues in the past with this approach.

pvarelab · ‎03-07-2023

To summarize, the solution was a combination of @richgalloway 's proposal of including the line returns in the query: | strcat partialA "/" totalA "V in " partialB "/" totalB "H" label plus some CSS in a row before the row containing the panels: <html> <style> .splunk-status-indicator { white-space: pre; line-height: 100% !important; font-size: 2.5vw !important; } </style> </html>

pvarelab · ‎03-07-2023

Hi, Rich: At the end your original solution worked but combined with a little CSS "magic". I had to add the following snippet to the xml: <html> <style> .splunk-status-indicator { white-space: pre; line-height: 100% !important; font-size: 2.5vw !important; } </style>

pvarelab · ‎03-06-2023

Thanks, Rich: I also had tried that, which had worked for me in other situations, but not in this one.

pvarelab · ‎03-06-2023

Is there a way to create a line break in the label for the Status Indicator visualization. I have the following dashboard: <dashboard version="1.1"> <label>Test dashboard</label> <row> <panel> <viz type="status_indicator_app.status_indicator"> <search> <query>| makeresults | eval partialA=15, totalA=57, partialB=132, totalB=543 | strcat partialA "/" totalA "V in " partialB "/" totalB "H" label | eval icon=if(totalA=0,"check","warning") | eval color=if(totalA=0,"green",if(partialA=0,"orange","red")) | fields label icon color</query> <earliest>-30d@d</earliest> <latest>now</latest> <sampleRatio>1</sampleRatio> </search> <option name="drilldown">none</option> <option name="refresh.display">progressbar</option> <option name="status_indicator_app.status_indicator.colorBy">field_value</option> <option name="status_indicator_app.status_indicator.fillTarget">text</option> <option name="status_indicator_app.status_indicator.fixIcon">warning</option> <option name="status_indicator_app.status_indicator.icon">field_value</option> <option name="status_indicator_app.status_indicator.precision">0</option> <option name="status_indicator_app.status_indicator.showOption">1</option> <option name="status_indicator_app.status_indicator.staticColor">#555</option> <option name="status_indicator_app.status_indicator.useColors">true</option> <option name="status_indicator_app.status_indicator.useThousandSeparator">true</option> </viz> </panel> </row> </dashboard> That displays 15/57V in 132/543H I would like it to display 15/57V in 132/543H I have tried using \n, <br/> and escaped versions of those to no avail. Is there a way to do what Iwant? Thanks!

pvarelab · ‎09-30-2022

1. I also would make sure that you actually have a value for all events for that timestamp. I.e. if your csv includes open tickets do not used closed as timestamp because some event will not have value there. Also, you can use earliest and latest to get a bigger window than the one you are looking for and then use explicit filtering based on the actual date field you want to filter for. 2. There are another two options: a) Even if you are receving events from different TZ they might have agreed in using a standar TZ for all logs, such as GMT. Check that with the owner of the app. b) If you can get separate csv files for each TZ you can apply different TZ when indexing them.

pvarelab · ‎07-08-2022

Beware thet the second parameter for mvfind is a regex, so it should be limited by "^" and "$" if you want the best match.

pvarelab · ‎06-24-2022

We recently upgrade the Add-on for Cisco ASA from versión 3.4.0 to 5.0.0. In versión 3.4.0 KV_MODE was set to Auto and this meant that a lot of informatión from messages from the DAP (734*) was extracted into a named field. I.e. for this log: Jun 24 13:52:39 fwhost %ASA-7-734003: DAP: User username, Addr A.B.C.D: Session Attribute endpoint.anyconnect.publicmacaddress = "aa-bb-cc-dd-ee-ff" a field named endpoint_anyconnect_publicmacaddress was created with value aa-bb-cc-dd-ee-ff. In versión 5.0.0 KV_MODE is none, and they put an extraction in place that creates two different fields: endpoint_attribute_name with value endpoint.anyconnect.publicmacaddress endpoint_value with value aa-bb-cc-dd-ee-ff When looking to just a log this is no problem, but we typically put toghether several logs via the transaction command grouping by user, src, dvc, so all messages from the same connection are grouped. Now we get two multivalued fields with no aparent (ths might be my ignorance speaking) way to match the attribute name with the value. I've tried putting mvlist=true on the transaction command and it seems to help, but all other fields get repeated N times (for all messages that get added in the transaction). Is there a simpler way to be able to match attribute name with the corresponding value after executing transaction with mvlist=false?

pvarelab · ‎06-24-2022

If you have several indexes you maybe can try setting this as: [cisco_asa_index] definition = (index="fw_index_1" OR index="fw_index_2" OR index="fw_index_3") iseval = 0

pvarelab · ‎03-04-2021

It's already visible. Many thanks!

pvarelab · ‎03-03-2021

The "Device Port" and "Port" fields are incorrectly extracted in messages of the CSCOacs_Failed_Attempts kind in the Technology Add-on for Cisco Secure Access Control Server (ACS). I have been able to solve it by adding the following to props.conf: EXTRACT-acs_device_port = ,\s+Device\s+Port=(?<Device_Port>[^,]+) EXTRACT-acs_port = ,\s+Port=(?<Port>[^,]+) Has anyone had the same problem? Any other ideas? @dshpritzCould you see if this fix could be included in a future versión of the App, please? Thanks!

Posts	12
Solutions	1
Karma Given	5
Karma Received	2
Member Since	‎03-25-2020

Online Status	Offline
Date Last Visited	‎11-21-2023 03:40 AM

What are the best practices for creating and distr...

Is there a way to create line break in Status Indi...

How to extract DAP information on the Cisco ASA ad...

"Device Port" and "Port" incorrectly extracted in ...

Re: What are the best practices for creating and d...

What are the best practices for creating and distr...

Re: Line break in Status Indicator visualization

Re: Line break in Status Indicator visualization

Re: Line break in Status Indicator visualization

Is there a way to create line break in Status Indi...

Re: How to change '_time'? _time is by default pic...

Re: Multivalue differences

How to extract DAP information on the Cisco ASA ad...

Re: Best practice when it comes to managing multip...

Re: "Device Port" and "Port" incorrectly extracted...

"Device Port" and "Port" incorrectly extracted in ...

Join the Conversation