About izyknows

duncan_ · ‎08-21-2023

Late to this discussion, but posting the answer here for any folks who search this up later. After some testing, I found that the Sankey drilldown tokens use the $row.Field Name$ format: <viz type="sankey_diagram_app.sankey_diagram"> <search> <query>... | stats sum(bytes) as total_bytes count by source target</query> </search> <option name="drilldown">all</option> <drilldown> <set token="form.source_tok">$row.source$</set> <set token="form.target_tok">$row.target$</set> </drilldown> </viz> I don't believe there's a way to distinguish between a click on the source versus the target, so field conditions don't seem to work like they would for a table.

izyknows · ‎11-01-2021

Okay, fixed. It was the permission of the user. For some reason, a domain user who is part of the local admins group did not cut it and made Splunk respond in weird ways in terms of picking up logs. Redeployed UF with Local System and it works. Next time I try it with a non-local account, I'll manage it with gMSA. But for now, it works 🙂 Thank you

izyknows · ‎08-29-2021

I ended up uninstalling my custom created app and using the inbuilt windows one. I modified the inputs.conf of the Windows TA to have my monitoring. However, I still wasn't getting the right extractions. Finally, via the Splunk UI, I went to manage apps and installed the Windows_TA app via the UI. This did the trick, I now see the field extractions.

manjunathmeti · ‎02-21-2021

I am getting proper values (not 0s) in the result_count. Check if your scheduled searches producing results in the Job Manager. Sometimes scheduled searches won't gives results due to incorrect time ranges, permissions to user running them etc.

thambisetty · ‎09-14-2020

| rex field=yourfield "-perm(\s-o)?\s?(-|\+)?(?<permission>[^\s]+)"

richgalloway · ‎06-09-2020

Yes, stats values(foo) removes the duplicate values of field foo. To see the duplicates use list(foo). Coalesce should not be affecting your other fields.

Posts	18
Solutions	2
Karma Given	2
Karma Received	0
Member Since	‎06-02-2020

Online Status	Offline
Date Last Visited	‎11-01-2021 11:47 AM

Not receiving all windows logs from clients

Windows TA App not Extracting properly

Number of events generated by a saved search

Extracting Linux permissions using rex

Matching fields from different indices to return a...

Re: Sankey diagram drilldown to set form tokens?

Re: Not receiving all windows logs from clients

Re: Windows TA App not Extracting properly

Re: Number of events generated by a saved search

Re: Extracting Linux permissions using rex

Re: Matching fields from different indices to retu...