Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About Nextbeat
Nextbeat
Path Finder
Member since:
11-17-2017
02-22-2024
Community Statistics
| Posts | 34 |
| Solutions | 0 |
| Karma Given | 120 |
| Karma Received | 1 |
| Member Since | 11-17-2017 |
Activity Feed
- Tagged Re: Is there a way to keep row data together when using the stats command? on Splunk Search. 02-22-2024 11:58 AM
- Tagged Re: Is there a way to keep row data together when using the stats command? on Splunk Search. 02-22-2024 11:58 AM
- Tagged Re: Is there a way to keep row data together when using the stats command? on Splunk Search. 02-22-2024 11:58 AM
- Posted Re: Is there a way to keep row data together when using the stats command? on Splunk Search. 02-22-2024 11:57 AM
- Karma Re: How to get current GMT time? for to4kawa. 09-13-2023 07:48 AM
- Karma Re: Convert TimeFormat for bojanz. 09-13-2023 07:47 AM
- Karma Re: "In the last 30 Days" VS "Last 30 Days" for yannK. 10-25-2021 11:35 AM
- Karma Re: eval wildcards for lguinn2. 10-21-2021 03:22 PM
- Karma Re: what is the format to use for a date in a search / dashboard for yannK. 10-19-2021 02:17 PM
- Karma Re: How to format _time field in results email? for ziegfried. 10-19-2021 11:43 AM
- Karma Re: How to format _time field in results email? for southeringtonp. 10-19-2021 11:40 AM
- Karma Re: Capitalize the first character of a string value using eval or field format? for scentoni_splunk. 09-28-2021 02:48 PM
- Karma Re: Regex field != expression not matching for gvmorley. 08-30-2021 08:31 AM
- Karma Re: convert time format for kristian_kolb. 04-29-2021 10:35 AM
- Karma Re: Heatmap in Dashboard for sideview. 02-19-2021 05:39 AM
- Karma Re: case: defaulting to "value" rather than NULL for sowings. 12-28-2020 09:45 AM
- Karma Re: How to rotate a table using transpose, remove the first row, and rename the column headers? for acharlieh. 12-25-2020 12:27 PM
- Posted Re: Disable drilldown on specific cell in SimpleResultsTable on Dashboards & Visualizations. 12-01-2020 11:54 PM
- Karma Re: Prevent duplicate IP lookups by verifying it hasn't been used previously for Richfez. 10-13-2020 07:26 AM
- Posted Prevent duplicate IP lookups by verifying it hasn't been used previously on Splunk Search. 10-12-2020 03:35 PM
Topics I've Started
02-22-2024
11:57 AM
When using stats, rather than using values, use list for each field instead: | stats list(FirstName), list(LastName) by Loc
... View more
12-01-2020
11:54 PM
@mgranger1 it didn't work because the specific element needed to be used. I started by clicking on the Select an element in the page to inspect it DevTool (F12) feature and clicked on a _time value. For this example, the element was .table-drilldown>tbody>tr>td:hover { (*Hint* Highlight the field, once the desired hover element appears, right click the field, highlight the element reference, and you'll be able to copy it before disappearing). Hover color To get it to work, I didn't include the whole reference, but only entered td:hover { (notice #test was added and will be explained below). Hover color overwritten You would redo the process for the highlighted element to change the cursor. Highlight cursor Here is what both changes looked like after editing the XML (notice the cursor highlighted on the right): Highlight cursor overwritten The text color was changed to black, and the cursor was set to text. Now that you've seen the element style changes, let's take a look at the code. First I should mention adding a panel ID to prevent unwanted changes to the dashboard. Then use this ID along with the mentioned element above, so under <row><panel><html depends="$hiddenForCSS$"><style> I added #test td:hover {. After that, I added the desired style changes color: #000 and cursor: text. To make sure these modifications would take effect, at the end I added !important; to each of the lines. Finally, I ended the section with } </style></html></panel></row>. XML Code
... View more
10-12-2020
03:35 PM
Our department has created a Splunk integration that performs API lookups against IPQualityScore. One of our searches was augmented with the returned data by adding extra fields for context (fraud_score, recent_abuse, vpn, tor, etc.). Unfortunately, the integration doesn't keep the results, so I used outputlookup to store them. While we have a reasonable amount of API queries, I was trying to figure out a way to check if an IP was previously used, append the results and prevent a duplicate lookup if it was. Otherwise, perform the lookup and append the results. This was the query that was used: index=*_auth sourcetype="azure:aad:signin" userAgent=CBAInPROD riskEventTypes_v2{}=* 8.8.8.8
| rename authenticationDetails{}.succeeded as loginStatus,authenticationDetails{}.authenticationMethod as mfaAuthMethod,authenticationDetails{}.authenticationMethodDetail as mfaAuthDetail,status.additionalDetails as mfaResult,status.failureReason as failureReason,location.city as city,location.state as state,location.countryOrRegion as country,ipAddress as SourceIP,location as Location,userAgent as UserAgent,appDisplayName as Application,riskState as RiskState,riskEventTypes_v2{} as RiskEventType,riskLevelAggregated as RiskLevel,riskLevelDuringSignIn as SignInRisk,conditionalAccessStatus as Status
| eval mfaAuthDetail=if(mfaAuthDetail="","-",mfaAuthDetail),city=if(city=="","N/A",city),state=if(state=="","N/A",state),country=if(country=="","N/A",country),Location=city.", ".state.", ".country,User=if(isnull(userDisplayName),userPrincipalName,userDisplayName)
| fillnull value="-"
| stats count by User,SourceIP,Location,Application,UserAgent,RiskEventType,RiskState,RiskLevel,SignInRisk,Status
| fields - count
| lookup ipqs clientip as SourceIP
| outputlookup append=true override_if_empty=false ipqs.csv
| rename bot_status as Bot,city as City,country_code as Country,fraud_score as Fraud_Score,latitude as LAT,longitude as LONG,mobile as Mobile,proxy as Proxy,recent_abuse as Abuse,success as Success,tor as TOR,vpn as VPN
| table User,SourceIP,Location,Application,UserAgent,RiskEventType,RiskState,RiskLevel,SignInRisk,Status,
Bot,City,Country,Fraud_Score,LAT,LONG,Mobile,Proxy,Abuse,Success,TOR,VPN
| sort 0 User
... View more
Labels
- Labels:
-
lookup
09-02-2020
01:02 PM
For each visualization (table, chart, single, etc.), you'll need to add that code.
... View more
09-02-2020
12:58 PM
To get it to work, I had to add an unset condition along with a set conditional so that when it did find events, the table would appear: <table depends="$show_panel$">
<search>
<query></query>
<progress>
<condition match="'job.resultCount'==0">
<unset token="show_panel">true</unset>
</condition>
<condition>
<set token="show_panel"></set>
</condition>
</progress>
</search>
</table>
... View more
04-14-2020
09:39 AM
Thanks for reminding me that Sed can do this, but was originally curious about the eval way.
... View more
09-28-2019
08:08 AM
Here's a snippet of what I captured and used for the code:
Here's a screenshot of what it looks like before and after:
... View more
09-28-2019
08:01 AM
You only see the hover code if you place the mouse above the desired field and don't click on it. I had to use the screenshot key to capture the code. Here's another example:
<dashboard theme="dark">
<label>Test</label>
<row>
<panel>
<title>Test</title>
<table>
<search>
<query>sourcetype="WinEventLog:Security" | table _time ComputerName Account_Name EventCode</query>
<earliest>0</earliest>
<sampleRatio>1</sampleRatio>
</search>
<option name="count">100</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">all</option>
<drilldown>
<!--Disables the click function for the defined field, which directs to the search results-->
<condition field="ComputerName"></condition>
</drilldown>
<option name="percentagesRow">false</option>
<option name="rowNumbers">false</option>
<option name="totalsRow">false</option>
<option name="wrap">true</option>
</table>
</panel>
<panel>
/* Add a dependency so that it won't be displayed in the dashboard */
<html depends="$hiddenForCSS$">
<style>
td.string.highlighted:hover {
/* Change from blue (#006ea) to black */
color: #000 !important;
/* Remove underline effect whenever mouse hovers above field */
text-decoration: none !important;
/* Change cursor effect from pointer to text */
cursor: text !important;
}
</style>
</html>
</panel>
</row>
</dashboard>
... View more
10-10-2018
07:18 AM
Sorry replying to an old post. Use the following:
<table>
<search>
<query></query>
</search>
<option name="drilldown">all</option>
<drilldown>
<!--Disables the action that brings up the search results for the whole table-->
<condition value="unused"></condition>
</drilldown>
</table>
Now you can define specific click functions without worrying about the default action. Just make sure that you place any other conditions above this one.
... View more
10-10-2018
06:14 AM
1 Karma
First use the answer above to disable a column's field:
<table>
<search>
<query></query>
</search>
<option name="drilldown">all</option>
<drilldown>
<!--Disables the click function for the defined field, which directs to the search results-->
<condition field="<column_name>"></condition>
</drilldown>
</table>
Then use HTML/CSS code to remove the style.
Before modifying the style within the SimpleXML editor for the dashboard (Edit > Edit Source XML):
1. Disable the field by using the example above.
2. Right click on a disabled field value.
3. Click on Inspect/Inspect Element (this should bring up the style for that field) and this should open up Developer Tools.
4. Click on the field that you are inspecting and this should bring up the CSS code that needs to be modified (if you didn't disable the field in step 1, you may be redirected to the search results).
5. Under Rules/Styles you should see something similar to (notice the word hover😞
.element1 .element2:hover {
color: #3863a0;
text-decoration: underline;
cursor: pointer;
}
6. Note the elements that are listed because you are going to use them.
7. Add HTML/CSS code to remove the style using the information from step 6.
Here's an example to remove the links for time from a list display table:
<panel>
/* Add a dependency so that it won't be displayed in the dashboard */
<html depends="$hiddenForCSS$">
<style>
.shared-eventsviewer .formated-time:hover {
/* Change from blue (#3863a0) to black */
color: #000 !important;
/* Remove underline effect whenever mouse hovers above field */
text-decoration: none !important;
/* Change cursor effect from pointer to text */
cursor: text !important;
}
</style>
</html>
</panel>
View this answer for making a global change that'll affect every dashboard:
https://answers.splunk.com/answers/330361/how-to-apply-custom-css-to-a-dashboard.html
... View more
09-10-2018
12:34 AM
Definitely better to define things that can't be controlled directly without accessing the backend.
... View more
06-02-2018
10:01 PM
Thanks for the help @jeffland
... View more
06-02-2018
09:58 PM
Thanks for the explanation!
... View more
05-29-2018
04:25 AM
I accepted your answer because there was no way to get my solution to work without the URLs being encoded. I hard-coded a table for the click functions and created a user definable post search panel below that. That way, users can still view the raw events, have click functions, and still have the option for running stats, creating a table, etc. Why is there a period between "ipinfo.io/" and $click.value2$? Also, why does the second click.value2 have no dollar signs, but quotes?
... View more
05-24-2018
06:23 AM
Thanks for the solution, but users would mostly view the events without adding tables or regex. I could hard code a solution, but the focus is more towards quick views. It's supposed to be a threat hunting panel to identify malicious events and pivot to other surrounding events that are related. I'm just adding features to help automate the process. Also, I'm using Splunk 6.3.1, so $token|n$ would not work. Finally, I currently don't have permissions to add JavaScript.
... View more
05-24-2018
05:51 AM
You can easily assign different targets to a single event if there are tokenized fields to work off of. This niche case seems harder because it requires assigning different click.value2 targets to raw events with undefined fields. It didn't matter if there were other conditions to follow. The target would always direct to the first link associated with the click.value2 based on previous trials. Maybe you can answer a semi-related question. Why does a query that was assigned through a text input process searches differently than actually running it within the search app? While searching through the search app, there are default fields that could be used as targets, but they are missing when trying to query off a text input.
... View more
05-24-2018
05:15 AM
The solution I posted below has sample raw data, but it didn't use regex. An event can have values for both VirusTotal and IPInfo.
... View more
05-24-2018
05:09 AM
I was able to get around this by creating an input that set a token based on conditional values.
<input type="dropdown" token="url" searchWhenChanged="false">
<label>Select URL Direction</label>
<choice value="hash">VirusTotal</choice>
<choice value="ip">IPInfo</choice>
<default>hash</default>
<change>
<condition value="hash">
<set token="url">virustotal.com/en/search/?query=</set>
</condition>
<condition value="ip">
<set token="url">ipinfo.io/</set>
</condition>
</change>
</input>
The input aided in changing the drilldown link, but had to prefix it with https:// or else Splunk would throw an error.
<drilldown target="blank">
<condition>
<set token="test">$url|u$$click.value2$</set>
<link>https://$test|u$</link>
</condition>
</drilldown>
This solution works, but the links get URL encoded. Tried adding < ! [ CDATA [ ] ] > and using the token filter $token_name|u$, but neither worked. The anonymized sample data looks like this:
5/23/18 7:39:58.966 AM 1306043181.135030 JcL2rzS48o0Wmb08a 10.000.31.45 16.001.57.000 QNAswt1Y3tPbDg4X0 HTTP 0 MD5,YIR0 text/html - 0.000000 T F 303 303 0 0 F - 26101e1x451k0p1o19nrd0l2500321uc z66444o02e12h53235r25j1u6xmzz028230cb062 - - - -
5/23/18 7:39:58.965 AM 1306043181.454101 QNAswt1Y3tPbDg4X0 16.001.57.000 08750 10.000.31.45 70 1 GET 52.001.121.00 / - 1.1 TxmYQJ/7.41.0 aundrea/7.11.0 HscAWU/3.4.10 dong/1.2.8 lavera/1.31 marilee/2.3 0 303 404 Not Found - - (empty) - - - - - - JcL2rzS48o0Wmb08a - text/html
5/23/18 7:39:58.615 AM 1306043181.404021 Eo20Hm2gm0xW6uFKZe 16.001.57.000 16450 10.000.31.45 70 1 HEAD 52.001.121.00 / - 1.1 TxmYQJ/7.41.0 aundrea/7.11.0 HscAWU/3.4.10 dong/1.2.8 lavera/1.31 marilee/2.3 0 0 404 Not Found - - (empty) - - - - - - - - -
VirusTotal's click.value2 would consume the hash 26101e1x451k0p1o19nrd0l2500321uc and direct to https://virustotal.com%252fen%252fsearch%252f%253fquery%253d26101e1x451k0p1o19nrd0l2500321uc/ rather than virustotal.com/en/search/?query=26101e1x451k0p1o19nrd0l2500321uc
IPInfo's click.value2 would ingest the external IP address 52.001.121.00 and direct to https://ipinfo.io%252f52.001.121.00/ rather than ipinfo.io/52.001.121.00
If I can fix the URL encoding issue, then I would also add a click.value2 for URLs. It would direct to another link I had in mind.
... View more
05-22-2018
09:33 PM
I have a post processing text input so that users can create tables, but they will probably want a quick view of the raw events. I already created a dashboard with tables of our most used indices. I may share them with this dashboard, but I'm trying to keep this one more focused. Unfortunately, I don't have access to add JavaScript. If only we could use JS within the XML.
... View more
05-22-2018
10:01 AM
Using Splunk 6.3.1. I noticed that click.value2 only works with one link whenever the same field is used (_raw in this case). I tried the following:
<drilldown target="blank">
<condition value="[[:alnum:]]({32}?|{40}?|{56}?">
<link>https://www.virustotal.com/en/search/?query=$click.value2$</link>
</condition>
<condition value="\d+?\.\d+?\.\d+?\.\d+?">
<link>https://ipinfo.io/$click.value2$></link>
</condition>
</drilldown>
Is there any way to get around this? I could use the same link for hashes and IPs, but I would like to use different URLs if possible. Ideally, I would like there to be different URLs for searching hashes, IPs, and URLs. This is for a threat hunting dashboard that won't utilize predefined tables. I'm trying to add features to help automate hunting.
... View more
05-10-2018
05:50 AM
I think you meant chown, but setting permissions for /IndexedData worked for me.
... View more
04-30-2018
03:37 AM
I was able to install Splunk through WSL several times successfully. The last installation yielded a similar error. If you receive an "unusable filesystem" error or similar, try the following:
$ echo -e "\nOPTIMISTIC_ABOUT_FILE_LOCKING = 1" >> /opt/splunk/etc/splunk-launch.conf"
This answer was from @naisanza and had the following warning:
Proceed with caution, and at your own risk. Irrevocable data loss can still occur. We have already had one report in this thread of problems that have occurred after enabling this setting.
... View more
04-27-2018
09:06 AM
Thanks for the update! I would've thought the wildcard would've covered all the bases.
... View more
04-27-2018
07:01 AM
Thanks for the solution! Since I had _time as part of the table, I had to add an eval statement to wipe its value. The suggested code wiped all of the fields except _time for some reason. I used the following code:
<search> | appendpipe [| head 1 | foreach * [eval <<FIELD>>=""] | eval _time=""] | append [<search>]
This allowed me to separate results for the initial search from the appended search.
... View more
