I'm working on a chart which will map a baseline of existing data. The search I am currently using is as follows. sourcetype=pan_threat severity!=informational | eventstats count as totalcount | eval threshold=(totalcount/25) | timechart span=1h count, first(threshold) as "Maximum Threshold" That works great for getting the average charting. I now also want to take the Standard Deviation of the timechart of the count, and map that as well. Anyone have any idea how to do that? I've tried a second eventstats, which throws me back some very weird standard deviations on the data itself. ... View more

This has been giving me headaches for a long time now, and it's pretty simple. So, for reference, this search works as intended. sourcetype="pan_threat" (severity="high" OR "critical") | timechart count, first(threshold) as "Maximum Threshold" by date | eval threshold=200 It charts the amount of hits over time, with the threshold of "200" also charted as its own line (as seen in the replicated graph below). _time count threshold 1 2:00 17 200 2 2:30 19 200 3 3:00 14 200 etc, etc... Not a problem. Now, I want to dynamically create the threshold value. The only way I know to calculate a sum of a field is the stats command. So what I'm trying is: sourcetype=pan_threat severity!=informational | stats count as hits by severity | stats sum(hits) as threshold | timechart count, first(threshold) as "Maximum Threshold" by date ...That should theoretically throw back the same kind of thing, where instead of "Maximum Threshold" being 200, "Maximum Threshold" is the sum of the count. It's not, at all. In fact, it's throwing back "No Results Found", even though it shows 4,949 matching events. Now, when I remove the timechart section, and search sourcetype=pan_threat severity!=informational | stats count as hits by severity | stats sum(hits) as total_count It gives me a very simple table with the data I want, something like the following. Total Count 1 4949 Also the following search throws back two fields, and it's properly setting "ts" to "threshold", as can be seen in the graph I've tried to replicate below it. sourcetype=pan_threat severity!=informational | stats count as hits by severity | stats sum(hits) as total_count | eval totalcount=total_count threshold ts 1 4949 4949 I just want to chart the value of ts, just like I did when I had it setting to a raw number above. Anyone have any idea how to do this? ... View more

I'm trying to do something a little wonky here, so please bear with me. The code below is the logical flow of what I'm trying to accomplish. However I know for a fact it won't work. Can you give me some insight? ... | eval threshold=(outlier action=rm param=10 (stdev(count))) Basically I'm trying to create a field, "threshold", which calculates the standard deviation of my results, removing any outliers prior to calculating the standard deviation. (Basically, I don't want that one result of 7,000 skewing my standard deviation upwards when normally it would have been, say, 10). ... View more

I'm trying to set up a dashboard panel to automatically alert me every time the number of critical or high threat hits goes over a pre-determined baseline. Right now I have that manually calculated, but I can go through and tweak that later. So, what I've got so far: sourcetype="pan_threat" (severity="high" OR "critical") | timechart span=1h count by date | eval Baseline=1240 | stats first(Baseline) as Baseline I expected this to chart the normal graph of count by date that I've been using, then append a line at the value of Baseline for each day. Instead, I get this. Baseline 1 1240 Any thoughts on why it's not working? ... View more

Hey guys. So I need to display a dashboard panel with a single line, the total count of all hits from the Palo Altos that are either High or Critical. First, I pull out the criteria. sourcetype="pan_threat" (severity="high" OR "critical") Now, when I timechart that (timechart count by dst_ip), it throws a few lines at me. So far so good. However, when I do the following: sourcetype="pan_threat" (severity="high" OR "critical") | timechart sum(count) by dst_ip It throws me back 0 results. Using eval fails in an even more spectacular way. sourcetype="pan_threat" (severity="high" OR "critical") | eval total=sum(count) | timechart total by dst_ip Error in 'eval' command: The 'sum' function is unsupported or undefined. I'll fully admit I'm confused. Logically, all I want it to do is add count per hour, and plot that number on the graph, moving onto the next one. If I can type it in one sentence here, it shouldn't be that hard to do. What am I missing? ... View more

I'm trying to turn Splunk into my own custom IDS based on the data dumping in from Palo Alto. Right now I have a search that throws back a timechart of the top internal IPs... sourcetype="pan_threat" log_subtype="spyware" (severity="high" OR "critical") | eval frp_ip=if(dst_zone="trust", dst_ip, src_ip) | timechart count by frp_ip useother=f That works fantastically. Shows me the top 10 IPs throwing high or critical threat traffic. However, I want to correlate a baseline into it using the trendline command. However, I can't figure out how / where to throw the trendline command to get the desired effect of the trendline overlaying the existing chart. I also don't know how to throw the "period" field, as I don't know what the integer represents. (Seconds? Minutes? Something completely different that won't automatically correlate with time? Can I just throw a command in there for it to find the search window and automatically use that?) However, even when using the following code, it doesn't change my chart at all (threw 5 in there for testing purposes). sourcetype="pan_threat" log_subtype="spyware" (severity="high" OR "critical") | eval frp_ip=if(dst_zone="trust", dst_ip, src_ip) | timechart count by frp_ip useother=f | trendline sma5(count) Anyone familiar with this usage that can give me a little advice? I'm far from a RegEx Guru, but if building this IDS myself without XML Edit access has taught me anything, it's the inner workings of RegEx. -Travis ... View more

I'm looking to create a visualization, much like you see in the Splunk for Palo Alto Networks app. The visualization seems pretty simple to me. It would be a block of text, with the following information. Total Amount of Bandwith Used Top Site: [Data Amount] Top User: [Data Amount] Top Application: [Data Amount] Devices Passing Traffic: [Number] I can make all the searches themselves, no problem. However, how would I go about creating a visualization that just displays the current number values in text that's not a table? ... View more

I'm using the Google Maps App for Splunk. When attempting to use the geoip command, it only appears to actually show a small fraction of a percentage (around .0008%) of IPs as having geographical information. sourcetype="pan_*" | geoip src_ip resolve_hostnames=true It's searched 188,826 records (all of which contain the src_ip field in standard X.X.X.X format), however it's only stating that there are "166 results with location information ( 16 distinct locations ) over all time". Using free online tools, I get a better hit ratio than this. Can anyone help me out? I'm guessing I'm doing something wrong with my RegEx. -Travis ... View more

Just need help getting our company's Panorama logs into the free download of Splunk on my machine. Need to use it as a test case. Thanks, Travis Fitzgerald ... View more