About pavanae

wangyu · ‎05-05-2024

Hello, has the problem been solved? If so, could you share how it was solved?

PZ · ‎11-22-2023

that's exactly what I was after! thanks mate

youngsuh · ‎05-30-2023

how do you validate that the setting is working? do you use BTOOL?

gcusello · ‎05-12-2023

Hi @pavanae , good for you, see next time! Ciao and happy splunking Giuseppe P.S.: Karma Points are appreciated by all the contributors 😉

rut · ‎05-05-2023

Hi @pavanae, Maybe the following will work for you. It uses rex/sed to locate the placement location, and inserts a placeholder (#LINK#, but you can replace this with what you deem "safe" in this context). After that an eval command replaces that placeholder with the needed value: | rex field=Details mode=sed "s/(Product\s1:-\s[^\n]+)(\n)/\1\n#LINK#\n/" | eval Details=replace(Details, "#LINK#", link) I'm not sure if you can do this in an single rex line (maybe something like $link or ${link}), I can't find anything about it in the documentation.

pavanae · ‎05-05-2023

I have a Splunk search outputs result as follows. Details link Product Details : Product 1:- ABC123 Product 2:- DEF456 abcd_website Now how do I combine both the fields into 1 as follows Details link Product Details : Product 1:- ABC123 link:- abcd_website Product 2:- DEF456 abcd_website The below eval condition giving me the result as follows | eval Details = Details + link Details link Product Details : Product 1:- ABC123 Product 2:- DEF456 link:- abcd_website abcd_website I do not want to add that link at the end. but wanted that somewhere in the middle after a specific field. Also, I do not want to touch or edit the Details field although thats an easy way but it comes from a macro and which used by many searches. I am looking for an alternate way, so that I can update the Details for a specific search?

richgalloway · ‎05-03-2023

Use the strptime function to convert the time into epoch form then use strftime to convert the epoch into the desired result. | eval foo = strftime(strptime(foo, "%Y-%m-%dT%H:%M:%S%Z"), "%Y-%m-%d %H:%M:%S")

richgalloway · ‎02-18-2023

I've seen lots of backslashes in savedsearches.conf. The only special use for them is as a line continuation character and that's only when \ is the last character on a line. Have you tried putting that query in the config file?

yeahnah · ‎02-12-2023

You're right. This should extract the filename correctly... | makeresults | eval folder_path="\Device\XYZ\Users\user_A\AppData\program\Send to OneNote.lnk" | rex field=folder_path "Users\\\(?<username>[^\\\]+).*\\\(?<file_destination>.*)"

richgalloway · ‎02-08-2023

Have you tried escaping the backslashes? The \ character is used for escaping so to specify a \ you must escape it. `get_All_CrowdstrikeEDR` event_simpleName=FileCreateInfo os="Win" TargetFileName="*\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\*"

pavanae · ‎09-19-2022

Hello, I have installed a Eventgen App from Splunk base to our Heavy forwarder. The following are the details SA-EVENTGEN Version :- 7.2.1 Splunk Version :- 8.1.1 After installation. I am seeing the follow error messages related to the eventgen ERROR ExecProcessor - message from "/cs/splunk/forwarder/bin/python3.7 /cs/splunk/forwarder/etc/apps/SA-Eventgen/bin/eventgen.py" SyntaxError: Missing parentheses in call to 'print'. Did you mean print('\n\nCaught kill, exiting...')? ERROR ExecProcessor - message from "/cs/splunk/forwarder/bin/python3.7 /cs/splunk/forwarder/etc/apps/SA-Eventgen/bin/eventgen.py" ERROR ExecProcessor - message from "/cs/splunk/forwarder/bin/python3.7 /cs/splunk/forwarder/etc/apps/SA-Eventgen/bin/eventgen.py" print '\n\nCaught kill, exiting...' ERROR ExecProcessor - message from "/cs/splunk/forwarder/bin/python3.7 /cs/splunk/forwarder/etc/apps/SA-Eventgen/bin/eventgen.py" File "/cs/splunk/forwarder/etc/apps/SA-Eventgen/bin/eventgen.py", line 113 Does anyone face the similar issue with SA-Eventgen? Looks like the Python version in Eventgen is no compatible or having some issues. Any idea on how to troubleshoot or resolve these issues?

vnravikumar · ‎08-09-2022

ITWhisperer · ‎07-12-2022

| rex field=description "Last event received from [^:]+: (?<description_time>\d+\-\d+\-\d+\s\d+:\d+)" | where _time-strptime(description_time,"%Y-%d-%m %H:%M") > 60*60*24

bowesmana · ‎04-10-2022

An alternative to embedding newlines into the eval, you can do it with mvappend, e.g. | eval body = mvappend("Sample Example :-","HOST INFORMATION: ", "Source Network Address: ".src, "Source Network Hostname: ". srcdns_hostname, "END ") Note that this results in a different field compared to @richgalloway solution - that form will give you a single value field with embedded newlines, whereas mvappend gives you a multi-value field with each line a separate value of the field.

bowesmana · ‎04-06-2022

Note that field_X will then be a multi-value field with 9 values

PickleRick · ‎03-31-2022

@gcuselloAs a side note - with simple searches, splunk can sometimes optimize the search in some obvious cases. So search | search a=b will get optimized to search a=b But of course I wuldn't rely on it and writing efficient searches is a good practice that should be followed.

ermanoj21yadav · ‎03-07-2022

What if I want to plot it on a graph on timechart like how many sessionIds had more than 1 hosts over a specific period of time

VatsalJagani · ‎02-09-2022

Update the token for host filter to "host_temp". Use similar <change> for host input and use <condition> and with <eval> check if the value contains * (wildcard) or not. If it does not contain a wildcard set a new token "host". If it contains wildcard unset the token "host".

PickleRick · ‎11-18-2021

Divide and conquer. First, test your simple conditions and check whether they match on they own. Then you can build a complex one. Maybe you're not matching on like() because it's not at the beginning of a string. Maybe the field you're comparing is a string, not a number...

somesoni2 · ‎10-21-2021

If you're trying to do wildcard match when you do a lookup (running "| lookup" command), then you can follow this to setup wildcard match: https://community.splunk.com/t5/Splunk-Search/Can-we-use-wildcard-characters-in-a-lookup-table/m-p/94513 If not, then you should add more details like how you're using the lookup, what output you get now and what is want to see as the output.

richgalloway · ‎09-03-2021

rex can do that for you. | rex "(?<A>\S+)\s(?<A>\S+)\s(?<B>\S+)\s(?<C>\S+)\s(?<E>\S+)\s(?<F>\S+)\s(?<G>\S+)\s(?<H>\S+)\s" It would be better if you could have the CSV file created as a true comma-separated value file. Then Splunk would separate the fields automatically.

richgalloway · ‎07-12-2021

The second regex should work, but if you want to be more specific, try this | rex "\d+\s\[A-Z]\d{6}+\s\\\"(?<fieldName>[^\\\"]+)"

pavanae · ‎01-05-2021

Can I use Web Terminal for Splunk (CLI) App in splunk to back fill summary indexes? If so, what could be the sample command to backfill using CLI?

gcusello · ‎08-12-2020

Hi @pavanae, you cannot hide the "All" button, but if the users can see only the dashboards granted to them, in other words if they haven't the grants on other dashboards they cannot see them. You have to work on the users' roles not on the buttons. Ciao. Giuseppe

woodcock · ‎03-24-2020

You cannot; you must use something else like like or match or searchmatch like this: ... | eval Project=if(match(app, "^abc_"), "XYZ", "ZXT")

Posts	381
Solutions	3
Karma Given	47
Karma Received	21
Member Since	‎06-10-2015

Online Status	Offline
Date Last Visited	‎05-21-2023 05:23 PM

How to split a field into two different fields usi...

How to combine 2 fields into 1 in Splunk in an alt...

How to combine 2 fields into 1 in Splunk in an alt...

Splunk time format conversions?

How to manually save a saved search which contains...

How to extract some fields from an existing field ...

Can't I use backslashes in Splunk searches?

Fix Python Compatibility issues with Eventgen?

Extract a field from a field in splunk?

How to convert the time and calculate the differen...

Re: Why am I getting the error"Unable to distribut...

Re: How to add a line break to the eval condition?

Re: How to apply replicationblacklist for a partic...

Re: how to split a field into 2 different fields u...

Re: How to combine 2 fields into 1 in Splunk in an...

How to combine 2 fields into 1 in Splunk in an alt...

Re: Splunk time format conversions?

Re: How to manually save a saved search which cont...

Re: How to extract some fields from an existing fi...

Re: Can't I use backslashes in Splunk searches?

Fix Python Compatibility issues with Eventgen?

Re: Extract a field from a field in splunk?

Re: How to convert the time and calculate the diff...

Re: how to convert a field value of single line to...

Re: How to split single line field value into mult...

Re: How to search a splunk search result?

Re: How search and list the same session ID's occu...

Re: How to restrict a dashboard panel to stop exec...

Re: Eval command with like condition with greater ...

Re: using wild card in a lookup column?

Re: How to split a single line which contains mult...

Re: How to extract a field(X) in splunk where it c...

Can I use Web Terminal for Splunk (CLI) App in spl...

Re: how to hide "ALL" from selecting in dashboards...

Re: how to use a wild card in if condition in eval...

Join the Conversation