Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About mpatnode
mpatnode
Path Finder
Member since:
07-21-2010
06-05-2020
Community Statistics
| Posts | 18 |
| Solutions | 0 |
| Karma Given | 4 |
| Karma Received | 8 |
| Member Since | 07-21-2010 |
Activity Feed
- Karma Re: How do I make Single Sign On work with mod_proxy for Corey. 06-05-2020 12:45 AM
- Karma Re: Reset SplunkLightForwarder for Genti. 06-05-2020 12:45 AM
- Karma Re: Missing Event details when trying to Extract Fields from an Active Directory event for carasso. 06-05-2020 12:45 AM
- Karma Re: automatic nested field extraction for gkanapathy. 06-05-2020 12:45 AM
- Got Karma for Why does "splunk train cmd classify" say "Parameters must be in the form '-parameter value'. 06-05-2020 12:45 AM
- Got Karma for Missing Event details when trying to Extract Fields from an Active Directory event. 06-05-2020 12:45 AM
- Got Karma for automatic nested field extraction. 06-05-2020 12:45 AM
- Got Karma for Re: Assuming implicit lookup table with filename blah.csv. 06-05-2020 12:45 AM
- Got Karma for Re: Assuming implicit lookup table with filename blah.csv. 06-05-2020 12:45 AM
- Got Karma for Re: Assuming implicit lookup table with filename blah.csv. 06-05-2020 12:45 AM
- Got Karma for Re: How does Active Directory Monitoring Work?. 06-05-2020 12:45 AM
- Got Karma for How do I enable URL links in output. 06-05-2020 12:45 AM
- Posted Use an alert to trigger scripted input on Alerting. 12-02-2010 01:49 AM
- Tagged Use an alert to trigger scripted input on Alerting. 12-02-2010 01:49 AM
- Tagged Use an alert to trigger scripted input on Alerting. 12-02-2010 01:49 AM
- Posted Re: help extending SimpleResultsTable on Dashboards & Visualizations. 11-20-2010 12:42 AM
- Posted Re: How to reload Global savedsearches on Reporting. 11-16-2010 07:37 PM
- Posted Re: How do I enable URL links in output on Dashboards & Visualizations. 11-12-2010 08:28 PM
- Posted help extending SimpleResultsTable on Dashboards & Visualizations. 11-04-2010 06:56 PM
- Tagged help extending SimpleResultsTable on Dashboards & Visualizations. 11-04-2010 06:56 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 1 | |||
| 1 | |||
| 1 |
12-02-2010
01:49 AM
I have an input script which I would like to run based upon the results of another search. Also, I need to send the results of the alert script to the script. The results of the script creates another event which I want to correlate to the trigger event.
Perhaps alerts aren't the right mechanism. Essentially, I'm running a script to gather more information on the event using data in the event as a parameter to the script. Is there a better way to do this?
... View more
11-20-2010
12:42 AM
I answered this here: http://answers.splunk.com/questions/8384/how-do-i-enable-url-links-in-output
... View more
11-12-2010
08:28 PM
So I used a big hammer to simply copy all the SimpleResultsTable files in $SPLUNKHOME/share/splunk/search_mrsparkle/modules/results to URLResultsTable and then added the following code (stolen from here: http://stackoverflow.com/questions/1112012/replace-url-with-a-link-using-regex-in-python)
import re
....
PAT1 = re.compile(r"(^|[\n ])(([\w]+?://[\w#$%&~.-;:=,?@[]+])(/[\w#$%&~/.-;:=,?@[]+])?)", re.IGNORECASE | re.DOTALL)
PAT2 = re.compile(r"#(^|[\n ])(((www|ftp).[\w#$%&~.-;:=,?@[]+])(/[\w#$%&~/.-;:=,?@[]+])?)", re.IGNORECASE | re.DOTALL)
...
An then right before the return of generateResults()
# Convert URLs to links
output = PAT1.sub(r'\1<a href="\2" target="_blank">\2</a>', output)
output = PAT2.sub(r'\1<a href="http:/\2" target="_blank">\2</a>', output)
return output
It sounds like this might be easier to do in application.js, but I'm not sure how to filter the entire output stream from there.
... View more
11-04-2010
06:56 PM
So I'm looking to add live URL links to SimpleResultsTable, and I've decided that the right place to do it is around line 230 or so in the code:
elif fieldValues:
renderedValues = [cgi.escape(x.value) for x in fieldValues[:MAX_MULTI_VALUE_COUNT]]
if len(fieldValues) > MAX_MULTI_VALUE_COUNT:
clipCount = len(fieldValues) - MAX_MULTI_VALUE_COUNT
renderedValues.append(_('[and %d more values]') % clipCount)
# when we have multiValued fields we wrap them each in its own div elements
if (len(renderedValues) > 1) :
multiValueStr = [MULTI_VALUE_WRAPPER % x for x in renderedValues]
output.append('>%s</td>' % "".join(multiValueStr))
# however for single values the extra div is unwanted.
else :
output.append('>%s</td>' % "".join(renderedValues))
My question is that since SimpleResultsTable only has one method, do I get any value of extending it verses just copying it to a new class and just extending AbstractPagedModule? Will the new class (call it URLResultsTable) pick up the SimpleResultsTable js and css files via inheritence from URLResultsTable.conf?
Also, feel free to include an RTFM link. I haven't been able to find much so far.
BTW: If I just embedded HTML in my data feed, would it get filtered out? I sort of hope so for security reasons...
... View more
- Tags:
- custom-module
11-03-2010
08:28 PM
OK. I'll bite. Have a pointer or example of extending one of the existing table modules? I'm also missing the connection from in my panel XML file and the registered module list: http://mysplunk:8000/modules. It seems a table is made from multiple modules?
... View more
11-03-2010
07:39 PM
3 Karma
Thanks. That worked, but I strongly question the value of that error message.
... View more
11-03-2010
05:55 PM
1 Karma
There are some bugs in admon.exe (for instance it only reads 1000 objects at startup). I've reported a couple of them and hopefully they'll be fixed in the next release.
... View more
10-26-2010
07:19 PM
1 Karma
I have a table in which one column is text which may or may not include a URL. (Think like a twitter feed). Is there an easy way to make the URL's clickable or do I need to format the text somehow?
... View more
09-23-2010
05:22 AM
Why do I get this message?
Assuming implicit lookup table with filename sidtodn.csv
It seemed to me that I was fairly explicit about the lookup table:
Here's my search:
sourcetype="WinEventLog:Security" CategoryString="Directory Service Access" Accesses="Create Child"
| rename Additional_Info AS DN
| dedup DN
| join usetime=true earlier=false DN [search sourcetype=activedirectory admonEventType="update" displayName="$CimsUser*" | rename distinguishedName AS DN ]
| lookup sidtodn.csv objectSid as parentLink OUTPUT distinguishedName AS parent
| table parent name uid gid home unix_enabled User
Note, I'm having to join on DN's because GUID and SID output is broken in 4.1.5.
... View more
- Tags:
- lookups
08-19-2010
08:47 PM
This could be done using another (free) product:
Install Splunk on a Linux machine
Install Centrify Express on that same machine.
Join one of the domains
Configure Splunk for PAM authentication.
Now, assuming the domains are in the same forest, or you have cross-forest trust between the domains, users can log into Splunk as windowsloginname@domain.name.
... View more
08-18-2010
01:27 AM
Much better, but now can I do this before the event is stored so the fields look like first class fields in the event? In particular, I want to detect a change to one of the keyword fields, currently diff only shows me the keyword attribute changed.
... View more
08-18-2010
01:05 AM
This was trivial, once I found the right doc
In transforms.conf
[keywords-kv]
SOURCE = keywords
DELIMS = "|", ":"
Then in my search:
sourcetype="ActiveDirectory" keywords | extract keywords-kv
So now, I'd like to do this for all ActiveDirectory objects, and handle it both in keywords or description. It would be nice if I didn't need to add the "extract" pipes.
... View more
08-17-2010
08:22 PM
1 Karma
I'm struggling with trying to extract multiple fields from a multivalue Active Directory attribute. For instance, given the following object:
dcName=w2k3r2.demo.dev
admonEventType=Update
Names:
objectCategory=CN=Service-Connection-Point,CN=Schema,CN=Configuration,DC=demo,DC=dev
...
distinguishedName=CN=bsmith,CN=Users,CN=default,CN=Zones,CN=Centrify,CN=Program Data,DC=demo,DC=dev
objectGUID=cffb0829-0642-134c-2ef1-f03cc696e10b
...
keywords=addr:253|animal:rabbit|color:blue
showInAdvancedViewOnly=TRUE
I still want objectGUID and the other single value attributes parsed, but in this example, I also would like addr, animal and color parsed out as their own key-value pairs (also, I don't want to have to know the keynames apriori). Is there a preprocessing step where I can break the multi-value attributes into separate lines, or do I need to replace the ad-kv "(?<_KEY_1>[\w-]+)=(?<_VAL_1>[^\r\n]*)" tranform with some incredibly gnarly regex?
... View more
08-17-2010
01:34 AM
Well that explains that. I did figure out how to use 'rex' as a work around. The next question is can I do dynamic field name generation the same way Splunk does? Something like this:
sourcetype="ActiveDirectory" keywords=* | rex field=_raw "keywords=(?<_KEY_1>[a-z]):(?<_VALUE_1>[0-9])
... View more
08-16-2010
08:24 PM
Doh! Awsome. Thanks.
... View more
08-16-2010
08:17 PM
1 Karma
I have the following raw AD event which I can see from my search:
08/16/2010 12:55:56.0110
dcName=w2k3r2.demo.dev
admonEventType=Update
Names:
objectCategory=CN=Service-Connection-Point,CN=Schema,CN=Configuration,DC=demo,DC=dev
name=bsmith
displayName=$CimsUserVersion2
distinguishedName=CN=bsmith,CN=Users,CN=default,CN=Zones,CN=Centrify,CN=Program Data,DC=demo,DC=dev
cn=bsmith
Object Details:
objectGUID=cffb0829-0642-134c-2ef1-f03cc696e10b
whenChanged=20100816195556.0Z
whenCreated=20070906020209.0Z
objectClass=top|leaf|connectionPoint|serviceConnectionPoint
Event Details:
uSNChanged=127046
uSNCreated=14129
instanceType=4
Additional Details:
keywords=foo:1111|bar:3333|too:3333
showInAdvancedViewOnly=TRUE
Whenever I try to use the "Extact Fields" UI, the event is truncated after "Event Details" in the "Sample events" frame. What's preventing me from seeing the entire event?
... View more
07-21-2010
12:28 AM
1 Karma
I tried "splunk train sourcetype filename sourcename" and received the same error. Then I found this answer and got the following:
$ /opt/splunk/bin/splunk train cmd classify /home/mike/work/current/tests/last_2k3.log centrifydc
Parameters must be in the form '-parameter value'
So back to the original question, do you pass the train command a sample log file, or something else?
... View more
- Tags:
- sourcetype
- train
