About dwibedi03

dwibedi03 · ‎05-06-2021

I am working on configuring the TAXXI Feeds. My Post argument is as below: collection="curated-ragw" earliest="-7d" key=$user:redacted,realm:redacted$ However, it is not working. The below error shows up: TaxiiHandlerException: Exception when polling TAXII feed: Message Type: Status_Message Message ID: 8492898524872483651; In Response To: 0 Status Type: BAD_MESSAGE Message: The access to CTIX has been blocked because incorrect credentials were provided. Please contact Support team. I have checked the username and password added in the credential management is correct. Can someone help me with how to configure this? I can only access UI to configure these feeds.

tscroggins · ‎02-22-2021

The union of the two searches is simply the base search: index=abc dest="xyz.com" uri_path="access.html" http_method=POST | stats count by _time src

FelixLeh · ‎01-21-2021

ah ok I see I misread your question! Well then it surely is weird the token is set to result.. The only other idea I have is the fact that the drilldown always picks the value/fieldname of the leftmost field in the table you click.. so maybe your port field isn't the leftmost field? If so you could use $click.name2$ which always picks the exact fieldname of the one you clicked..

dwibedi03 · ‎12-28-2020

Hi Splunkers, Happy Holidays!!!. I am trying to create a dashboard on Log Volume Monitoring. I am using ML Toolkit and need help with my search. | tstats count WHERE index=index_name BY index _time span=1h | eval date=strftime(_time,"%m/%d/%Y") | lookup Paid_Holidays.csv holiday_date as date OUTPUT is_holiday | eval day_of_week = strftime(_time,"%A") | where NOT (day_of_week="Saturday" OR day_of_week="Sunday") | where NOT is_holiday=1 | `forecastviz(245, 240, "count", 93)` | eval isOutlier = if(prediction!="" AND 'count' != "" AND ('count' < 'lower95(prediction)' OR 'count' > 'upper95(prediction)'), 1, 0) | where isOutlier=1 | eval today = relative_time(now(),"-1h@h") | where isOutlier=1 AND _time >= today | where count < 'lower95(prediction)' | fields - isOutlier The highlighted and underlined part is where I am having issue. I need to alert only when the count is less than the predicted in the next hour as well. The current scenario alerts frequently and I need to constrict it so it alerts only when the count is less continuously for the next hour as well. Can someone help me with my query?

bowesmana · ‎12-16-2020

@dwibedi03 You have a lookup file, says ips.csv and then you create a lookup definition (which is an abstraction layer on top of the lookup file). Connect it to the actual file itself and then set the Src_ip field to be a CIDR type field like this then just use the lookup definition in the lookup command, not the file itself, so base search | lookup ips Src_ip as src_ip output Src_ip as ipFound ... so this assumes your event field is src_ip and the CSV file has a column called Src_ip. After this executes, you will have a new field ipFound if the IP exists in the CIDR range of one of the ranges, or null if not. You can then do this | where isnull(ipFound) to see if it was NOT found

richgalloway · ‎10-30-2020

Searching a huge log will almost always take a huge amount of time. Using a datamodel will help, but only if the datamodel is accelerated. There are some basic steps you can take to speed up the search. Start by qualifying the search. Reading everything in index xyz probably is not necessary so specify the data you want, either by source, sourcetype, or some other field. Use the fields command to reduce the number of fields Splunk has to keep track of. Filter your data. Once you've read events from the index, eliminate those that don't apply to your report. Consider running the report several times over smaller time ranges (1 per quarter, perhaps). This may not be feasible for all reports.

ITWhisperer · ‎10-06-2020

<change> <set token="panellabel">$label$</set> <set token="panelindex">$value$</set> </change> </input> <chart> <title>Log Volume for $weekday$ - $panellabel$</title> <search> <query>| tstats count WHERE index=$panelindex$ BY index _time span=1d | trendline sma2(count) AS trend</query>

dwibedi03 · ‎08-06-2020

Yes, i got to make it work. However it is not accounting for all the commands. I will improvise. Thanks.

ololdach · ‎05-15-2020

Hi, there is not enough information in your post to really help you solve this. I assume, that your error lies in the way that you "copy" the data. Please make sure that the sourcetype is defined on both systems (props.conf) and that your inputs.conf specification on dev assigns the right sourcetpye to your datasource. Lacking details, I assume that you import the data "cooked" as csv. Please be aware that the dev system might behave differently as the internal fields might be missing and either need to be copied explicitly or re-assigned (_raw, _time, index, source, sourcetype, eventtype ...) Hope it helps Oliver

dwibedi03 · ‎04-03-2020

I was doing count and it was giving a sum of whole day

dwibedi03 · ‎03-31-2020

| tstats values(Web.user_bunit) as user_bunit values(Web.src_bunit) as src_bunit values(Web.src) as src_ip values(Web.http_referrer) as http_referrer values(Web.url) as URL values(Web.category) as category values(Web.url_extension) as url_extension1 from datamodel=Web where Web.http_method=GET AND (Web.url_extension="php" OR Web.url_extension="html" OR Web.url_extension="js") by _time Web.user here, _time truncates the seconds in the query. I tried using strftime to show seconds it didnt work.

Posts	19
Solutions	0
Karma Given	3
Karma Received	0
Member Since	‎03-31-2020

Online Status	Offline
Date Last Visited	‎05-06-2021 05:07 PM

Configure FS-ISAC TAXXI Feeds in Splunk ES

How to combine two queries into one?

Single Value Drilldown not working

Log Volume Monitoring

Match mix of CIDR Ips and IPv4 Ips from a lookup t...

Create a table metrices

dynamic dropdown field for label and field for lab...

Split unix commands

Data disappearing and getting error when selecting...

How to get the count of the last 30 days, for a 15...

Configure FS-ISAC TAXXI Feeds in Splunk ES

Re: How to combine two queries into one?

Re: Single Value Drilldown not working

Log Volume Monitoring

Re: Match mix of CIDR Ips and IPv4 Ips from a look...

Re: Create a table metrices

Re: dynamic dropdown field for label and field for...

Re: Split unix commands

Re: Data disappearing and getting error when selec...

Re: How to get the count of the last 30 days, for ...

Re: Using Web datamodel _time doesnt show seconds....