Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- Find Answers
- :
- About geekf
geekf
Path Finder
Member since:
03-09-2020
09-28-2025
Community Statistics
| Posts | 24 |
| Solutions | 1 |
| Karma Given | 8 |
| Karma Received | 0 |
| Member Since | 03-09-2020 |
Activity Feed
- Posted Splunk History Missing | 9.2.3 on Splunk Enterprise. 09-28-2025 05:38 AM
- Karma Re: Field Extraction index=_internal for dural_yyz. 10-23-2024 11:02 PM
- Posted Re: Field Extraction index=_internal on Splunk Search. 10-23-2024 06:52 AM
- Posted Re: Field Extraction index=_internal on Splunk Search. 10-23-2024 05:45 AM
- Posted Re: Field Extraction index=_internal on Splunk Search. 10-09-2024 06:56 AM
- Posted Field Extraction index=_internal on Splunk Search. 10-09-2024 05:59 AM
- Posted Re: Trying to create a custom alert action, how do I troubleshoot error "unable to find action script for action... on Alerting. 05-25-2023 06:42 AM
- Tagged What could be the reason custom app alert is not working? on Splunk Dev. 05-24-2023 11:33 AM
- Tagged What could be the reason custom app alert is not working? on Splunk Dev. 05-24-2023 11:33 AM
- Tagged What could be the reason custom app alert is not working? on Splunk Dev. 05-24-2023 11:33 AM
- Tagged What could be the reason custom app alert is not working? on Splunk Dev. 05-24-2023 11:32 AM
- Posted What could be the reason custom app alert is not working? on Splunk Dev. 05-24-2023 07:53 AM
- Posted Re: Auto Block IP on Security. 08-31-2022 04:13 AM
- Karma Re: Auto Block IP for johnhuang. 08-31-2022 04:13 AM
- Posted Why are the alert options missing for Splunk App for SOAR Export on Splunk (non ES)? on Splunk SOAR. 07-26-2022 07:12 AM
- Posted Is anyone auto-blocking malicious IPs using the 'Alert Action' or using other methods? on Security. 01-18-2022 09:23 AM
- Tagged Is anyone auto-blocking malicious IPs using the 'Alert Action' or using other methods? on Security. 01-18-2022 09:23 AM
- Tagged Is anyone auto-blocking malicious IPs using the 'Alert Action' or using other methods? on Security. 01-18-2022 09:23 AM
- Tagged Is anyone auto-blocking malicious IPs using the 'Alert Action' or using other methods? on Security. 01-18-2022 09:23 AM
- Posted Re: Duplicate Entries in Table on Splunk Search. 02-11-2021 03:52 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
09-28-2025
05:38 AM
The Splunk search history is not being saved. When I run a search, it remains visible for a few hours, but by the next day the history from the previous day is gone. Currently, the only searches that persist are those from the day we performed the upgrade. If I go to $SPLUNK_HOME/etc/users/youruser/search/history I do see this file, and it has the UI:Dashboard searches. What could be the reason Splunk is not retaining search history beyond the upgrade day?
... View more
Labels
10-23-2024
06:52 AM
We made this change, and it worked fine! Thank you so much for your help.
... View more
10-23-2024
05:45 AM
We use json for Zeek, if we change that setting, will it impact Zeek logs?
... View more
10-09-2024
06:56 AM
Thank you for your response. I am uploading the btool output for splunkd.
... View more
10-09-2024
05:59 AM
I tried to run the Indexing Performance: Instance dashboard but was not getting any data, on exploring the search I found out index=_internal is not doing the field extractions for this data in the log: group=per_host_thruput, ingest_pipe=1, series="splunkserver.local", kbps=8.451, eps=32.903, kb=261.974, ev=1020, avg_age=2.716, max_age=3 If I manually extract the fields using rex I can view it in the search but the dashboard still doesn't show the results. Is there a way to extract these fields for the internal index? Thanks!
... View more
05-25-2023
06:42 AM
I have the same issue but the link you mentioned is no longer working.
... View more
05-24-2023
07:53 AM
I have created a custom app and I get this error in Splunk
Error in 'sendalert' command: Alert action script for action "list_ip" not found.
I am using list_ip in both alert_actions.conf and commands.conf. The Python file is in /bin. What could be the reason for this error?
Here are the file contents
commands.conf
[list_ip]
filename = list.py
command.arg.1 = $results.file$
alert_actions.conf
[list_ip]
label = List IP
description = This action will send IP addresses to a custom webhook
icon_path = icon.png
is_custom = 1
payload_format = json
list.py
#!/usr/bin/env python3
import csv
import json
import requests
import sys
def send_webhook(ip_list):
url = "http://192.168.28.215:8080/list_ips"
headers = {
"Content-Type": "application/json; charset=utf-8"
}
data = {
"ips": ip_list
}
response = requests.post(url, data=json.dumps(data), headers=headers)
print(response.status_code)
def main():
if len(sys.argv) > 1:
results_file = sys.argv[1] # retrieve the results file passed as argument
ip_list = []
with open(results_file, 'r') as file:
reader = csv.DictReader(file)
for row in reader:
ip_list.append(row['ip'])
send_webhook(ip_list)
else:
print("No arguments provided.")
if __name__ == "__main__":
main()
... View more
08-31-2022
04:13 AM
Hey @johnhuang , if that script is something you can share, I would appreciate that.
... View more
07-26-2022
07:12 AM
I installed the Splunk App for SOAR Export app on Splunk, and I can see two alert options in manage alerts, namely 'Run Playbook in SOAR' and 'Send to SOAR'. However, when I go to add an alert action, these two are missing from there.
These options were available when I first installed the app, and then they were gone from the alert.
... View more
Labels
01-18-2022
09:23 AM
Hi,
I was wondering if anyone is auto-blocking malicious IPs using the 'Alert Action' or using any other method. We have Cisco FMC and are thinking of using the REST API to block the IPs. I would appreciate it if anyone has achieved this and can share how you are doing this.
Thanks!
... View more
Labels
- Labels:
-
access control
02-11-2021
03:52 AM
Thank you. dedup _raw didn't work, single quotes for src and dest worked fine.
... View more
02-10-2021
04:15 AM
While using the table for bro conn data, I am getting duplicate data; however, if I use mvdedup, I get all the desired results except the id.orig_h and id.resp_h. If I use mvdedup for these two entries, I get blank values. index=bro_conn
| eval id.orig_h=mvdedup(id.orig_h)
| eval id.resp_h=mvdedup(id.resp_h)
| eval dest_port=mvdedup(dest_port)
| eval resp_ip_bytes=mvdedup(resp_ip_bytes)
| eval orig_ip_bytes=mvdedup(orig_ip_bytes)
| eval conn_state=mvdedup(conn_state)
| eval proto=mvdedup(proto)
| table _time id.orig_h id.resp_h dest_port orig_ip_bytes resp_ip_bytes conn_state Here are the results if I don't use mvdedup: Is there a better way to dedup the results, and if this is the right way, how can I make this work for the src and dest IPs? Thank you!
... View more
01-27-2021
10:27 PM
Thank you! This did the trick. If I may bother you again with one more question, how can I do the avg over a period of days? I tried this query but it didn't seem to work: | bucket _time span=1d
| stats count by _time
... View more
01-27-2021
07:09 AM
Here are both of them: index=main field=value1
| rex field=user "\w+\\\(?<user>.*)"
| eval time=strftime(_time, "%d/%m/%y %H:%M:%S")
| stats earliest(time) as FirstSeen, latest(time) as LastSeen by user
| eval time_dur=(strptime(LastSeen,"%d/%m/%y %H:%M:%S")-strptime(FirstSeen,"%d/%m/%y %H:%M:%S"))
| lookup some_user_lookup user AS user OUTPUT type
| stats avg(time_dur) by type
| eval time_dur=printf("%02d:%02d", floor(time_dur / 3600), (time_dur % 3600) / 60) index=main field=value1
| rex field=user "\w+\\\(?<user>.*)"
| eval time=strftime(_time, "%d/%m/%y %H:%M:%S")
| stats earliest(time) as FirstSeen, latest(time) as LastSeen by user
| eval time_dur=(strptime(LastSeen,"%d/%m/%y %H:%M:%S")-strptime(FirstSeen,"%d/%m/%y %H:%M:%S"))
| lookup some_user_lookup user AS user OUTPUT type
| eval time_dur=printf("%02d:%02d", floor(time_dur / 3600), (time_dur % 3600) / 60)
| table type time_dur
... View more
01-27-2021
06:19 AM
Thank you for promptly responding to my question, I appreciate it. I am attaching both the table and stats results, kindly let me know if there is something wrong here.
... View more
01-27-2021
06:00 AM
If I use | table it works fine, if I use | stats avg(time_dur) it doesn't show the right values.
... View more
01-27-2021
01:04 AM
I am still unable to run avg In your search, if I do | stats avg(time_dur_str2) I don't see any results, isn't it still a string?
... View more
01-26-2021
12:59 PM
I am trying to get the average of a time difference by using | stats avg(time_dur) by type and since I am using this search | eval time_dur=tostring(strptime(LastSeen,"%d/%m/%y %H:%M:%S")-strptime(FirstSeen,"%d/%m/%y %H:%M:%S"),"duration") I think the data is coming in a string, and because of that, I am not getting any results. If I use eval time_dur=(strptime(LastSeen,"%d/%m/%y %H:%M:%S")-strptime(FirstSeen,"%d/%m/%y %H:%M:%S")) and then do the eval I get the results; however, it comes up in some number. I would like to get the difference in HH:MM.
... View more
12-09-2020
11:17 AM
Hi @gcusello Thank you for your prompt response. I am getting results with this search: index=main (EventCode=4769) OR Logon_Type!=3 I managed to solve it by using NOT instead of !=. index=main (EventCode=4634 OR EventCode=4624 OR EventCode=4769) Logon_Type!=3 The above search is not giving me the results; however, if I use this search, it works fine: index=main (EventCode=4634 OR EventCode=4624 OR EventCode=4769) NOT Logon_Type=3 Here is what was causing this issue: If you search with the != expression, every event that has a value in the field, where that value does not match the value you specify, is returned. Events that do not have a value in the field are not included in the results. If you search with the NOT operator, every event is returned except the events that contain the value you specify. This includes events that do not have a value in the field. https://docs.splunk.com/Documentation/Splunk/8.1.0/Search/NOTexpressions Thank you!
... View more
12-09-2020
05:26 AM
When I am running this search I am not getting the results for EventType=4769: index=main (EventCode=4634 OR EventCode=4624 OR EventCode=4769) Logon_Type!=3 If I run the search index=main (EventCode=4769) OR Logon_Type!=3 I get the results for 4769. What can I do with the first search to include the results for 4769? Thanks in advance!
... View more
Labels
- Labels:
-
search job inspector
12-02-2020
10:21 AM
I am running a search with a corn expression "0 10-18/2 * * *". This translates to "At minute 0 past every 2nd hour from 10 through 18.” I want to run this job every time with "9 AM to Now", and there isn't an option under "Time Range". I would appreciate if someone can help me achieve this.
... View more
Labels
- Labels:
-
alert action
-
alert condition
-
cron
-
email
04-28-2020
05:28 AM
I am running a query to find the list of users that received an email from a particular email address. This is working fine until I try to get more details by using Inputlookup. I want to use Inputlookup to get more details about the users like their department, location, etc which can only be done through that. I need to pass the results from the search to get the other details. The search lists all the userids since I strip out the domain by using the regex.
Here is my query:
sourcettype=sendmail to=*
[ search sourcetype=sendmail from=email@gmail.com
| fields qid]
| rex field=orig_recipient "(?[^@]+)"
| dedup orig_recipient
| inputlookup append=t identity_lookup_expanded where * identity=$orig_recipient$]
| table orig_recipient dept email some other fields
Any help would be appreciated!
... View more
