About cygnetix

cygnetix · ‎05-08-2018

I would personally feel a bit uncomfortable doing this from core Splunk. Have you taken a look at Splunk's recent acquisition https://phantom.us? It's yet another product to deploy and pay for but it'd designed for exactly this type of orchestration task. While I think you could do it in Splunk using a combination of searches and the kvstore, I would worry that it'd be quite complicated and brittle and is getting a little outside of Splunk's core capabilities and intended purpose.

cygnetix · ‎09-18-2017

It's not under "edit schedule". Find your search in "Searches, Reports, and Alerts", click edit and you should see a "Edit Summary Indexing" option in the drop down.

cygnetix · ‎06-29-2017

Hey splunkranger, Try something like this in your props and transforms config files. props.conf: TRANSFORMS-null-dns1= company_com transforms.conf: [company_com] REGEX = (?i:company\.com\.$) DEST_KEY = queue FORMAT = nullQueue

cygnetix · ‎05-07-2017

I was able to resolve this problem by rebooting the server.

cygnetix · ‎03-07-2017

I've send a comment on the documentation page for inputlookup to query whether the statement that inputlookup will work with scripted lookups is correct or not. I suspect it is incorrect.

cygnetix · ‎03-07-2017

I converted my script to work as a search command not long after posting the question. I agree that it looks like a search command or modular input are the way to go, but I believe that Splunk should update their documentation for inputlookup if it's not possible to use scripted lookups with this command (as the documentation currently states).

cygnetix · ‎03-07-2017

Search logs show: 03-08-2017 10:20:03.398 WARN SearchOperator:inputcsv - sid:1488932400.14 The lookup table 'testlookup' is invalid. So it looks like, possibly, it's trying to load my scripted lookup using inputcsv?

cygnetix · ‎03-07-2017

Hi all, Is it possible to use inputlookup to pull a list of information from a scripted lookup? The documentation for inputlookup seems to suggest this is possible: The lookup table can be configured for any lookup type (CSV, external, or KV store)._ But the documentation for transforms.conf where the scripted input is defined states Your external lookup script must take in a partially empty CSV file and output a filled-in CSV file Which implies that it can't be used with a generating command like inputlookup. I'm trying to pull in a CSV from a threat intel feed but in a way that would allow me to do so using a scheduled search rather than a scripted input or modular input. Any thoughts on how best to do this if using a scripted input with inputlook isn't possible?

cygnetix · ‎02-11-2016

Here's some demo code that worked for me. The trick is to use "rejects" to hide the loading panel once the search has completed. Using "depends" for the panel containing the chart does the opposite - shows the panel after the search completes. <dashboard> <label>Test</label> <row> <panel rejects="$hide_progress_panel$"> <html> <p align="center">Loading, please wait...</p> </html> </panel> </row> <row> <panel depends="$hide_progress_panel$"> <chart> <search> <query>index=_internal | timechart count by host</query> <earliest>-4h@m</earliest> <latest>now</latest> <finalized> <set token="hide_progress_panel">true</set> </finalized> </search> <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option> <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option> <option name="charting.axisTitleX.visibility">visible</option> <option name="charting.axisTitleY.visibility">visible</option> <option name="charting.axisTitleY2.visibility">visible</option> <option name="charting.axisX.scale">linear</option> <option name="charting.axisY.scale">linear</option> <option name="charting.axisY2.enabled">0</option> <option name="charting.axisY2.scale">inherit</option> <option name="charting.chart">area</option> <option name="charting.chart.bubbleMaximumSize">50</option> <option name="charting.chart.bubbleMinimumSize">10</option> <option name="charting.chart.bubbleSizeBy">area</option> <option name="charting.chart.nullValueMode">gaps</option> <option name="charting.chart.showDataLabels">none</option> <option name="charting.chart.sliceCollapsingThreshold">0.01</option> <option name="charting.chart.stackMode">default</option> <option name="charting.chart.style">shiny</option> <option name="charting.drilldown">all</option> <option name="charting.layout.splitSeries">0</option> <option name="charting.layout.splitSeries.allowIndependentYRanges">0</option> <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option> <option name="charting.legend.placement">right</option> </chart> </panel> </row> </dashboard>

cygnetix · ‎12-01-2015

That did the trick for me. I expect this is a bug though, I can't see why these proxy settings should influence the behavior of the "Add data" screen.

cygnetix · ‎07-22-2015

Simple, yet effective. Thanks.

cygnetix · ‎06-11-2015

Anyone know if Splunk Stream can log the ciphers negotiated during a TLS handshake? I'm thinking about using it to detect when a LogJam (CVE-2015-4000) attack has occurred. I can't see anything relevant listed for SSL/ TLS in the doco, but I figure it doesn't hurt to ask: http://docs.splunk.com/Documentation/StreamApp/6.2.2/DeployStreamApp/Whattypeofdatadoesthisappcollect

Posts	12
Solutions	0
Karma Given	4
Karma Received	7
Member Since	‎06-11-2015

Online Status	Offline
Date Last Visited	‎06-05-2020 02:03 AM

Using inputlookup with external_cmd

Can the Splunk App for Stream log the ciphers nego...

Re: "Automate" alert actions

Re: Why is the "Enable summary indexing" option no...

Re: Routing events to null queue active directory ...

Re: What would cause a Fatal thread error in threa...

Re: Using inputlookup with external_cmd

Re: Using inputlookup with external_cmd

Re: Using inputlookup with external_cmd

Using inputlookup with external_cmd

Re: Show placeholder text/panel for a Hidden Panel...

Re: Data Uploader - why am i receiving a '('Cannot...

Re: Report hourly max count events per day over a ...

Can the Splunk App for Stream log the ciphers nego...