Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Are you a member of the Splunk Community?
Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- About cafissimo
cafissimo
Communicator
Member since:
08-02-2010
07-09-2024
Community Statistics
| Posts | 74 |
| Solutions | 3 |
| Karma Given | 8 |
| Karma Received | 26 |
| Member Since | 08-02-2010 |
Activity Feed
- Posted ITSI search head migration from single server to search head cluster on Deployment Architecture. 07-09-2024 03:38 AM
- Posted Re: Selective routing to UDP without indexing on Getting Data In. 06-06-2024 04:55 PM
- Posted Selective routing to UDP without indexing on Getting Data In. 06-06-2024 04:11 PM
- Posted INGEST_EVAL for data coming from HEC at indexer layer on Getting Data In. 02-20-2024 01:46 PM
- Got Karma for Re: How to use subsearch without a field name? (but just with field value). 06-07-2023 09:33 AM
- Karma Re: sourcetype not getting overridden for somesoni2. 06-05-2020 12:49 AM
- Karma Re: What can be done when port 8089 is taken on the forwarder? for maraman_splunk. 06-05-2020 12:49 AM
- Karma Alert Manager - Frequent "no results found" displayed in Alert Results panel for Hector_Ramos. 06-05-2020 12:49 AM
- Got Karma for Re: How to use subsearch without a field name? (but just with field value). 06-05-2020 12:49 AM
- Got Karma for Re: How to use subsearch without a field name? (but just with field value). 06-05-2020 12:49 AM
- Got Karma for Re: How to replace every backslash in an input form token with a double backslash. 06-05-2020 12:49 AM
- Got Karma for Re: How to replace every backslash in an input form token with a double backslash. 06-05-2020 12:49 AM
- Got Karma for Re: How to set up a dashboard that will dynamically choose a search based on time range chosen?. 06-05-2020 12:48 AM
- Got Karma for Trying to find if at least one value of a multivalue field matches another field. 06-05-2020 12:48 AM
- Got Karma for Re: How to pass tokens from prebuilt panels to other panels in the same dashboard?. 06-05-2020 12:48 AM
- Got Karma for Re: How to pass tokens from prebuilt panels to other panels in the same dashboard?. 06-05-2020 12:48 AM
- Got Karma for Re: How to pass tokens from prebuilt panels to other panels in the same dashboard?. 06-05-2020 12:48 AM
- Karma Re: use inputlookup output as fulltext search in outer search for woodcock. 06-05-2020 12:47 AM
- Got Karma for Re: Why am I getting KV store error 'External command based lookup 'MY_KV_LOOKUP' is not available because KV Store initialization has failed'?. 06-05-2020 12:47 AM
- Karma Reg: REST API to change deployment app configuration of Deployment server for ReanaKhan. 06-05-2020 12:46 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
07-09-2024
03:38 AM
Hello, Please I would like to know if there are best practices to migrate a single search head instance with ITSI to a search head cluster. I have a deployer and the ITSI running production search head should become part of the search head cluster, initially as the only existing member. When everything will be up and running I will add other 2 servers. I have read something about Enterprise Security migration related to bundle size limits, for example, but found few things About ITSI. Thank you in advance and warm regards.
... View more
Labels
06-06-2024
04:11 PM
Hello Splunkers, Please I would like to know if it is possible, at indexer layer, given a HEC input source, to route some incoming data (of course based on regex) to a UDP destination without indexing that data. Let's say: sourcetype=hecinput, if it contains word "DEBUG" it should go to UDP destination, all the rest should be indexed as usual. I know that maybe I could use INGEST_EVAL, but I think it supports only _TCP_ROUTING. Thanks in advance.
... View more
- Tags:
- forwarding
- routing
- udp
Labels
02-20-2024
01:46 PM
Hello, Please, in Splunk Enterprise, I would like to know if it is possible to apply an INGEST_EVAL processing at indexer layer for data that is coming to indexer from a HEC (http event collector). Thanks
... View more
- Tags:
- INGEST_EVAL
- ingestion
Labels
09-06-2019
06:08 AM
Hello,
please I would like to know if the following one is a possible/valid Splunk architecture.
Multiste cluster, with sites A, B and C. 200 Forwarders.
site A and B communicating each other and replicating data, receiving logs from forwarders 1 to 100.
site C receiving logs from forwarders 101 to 200 and replicating data only inside the site itself.
Thanks and best regards.
... View more
05-02-2019
01:29 AM
Hello,
please is it possible to distribute a Splunk app, with a scheduled scripted input, to a pool of indexers in a cluster so that only one indexer at a time runs the input? Also, would the scripted input runs on another peer if one peer is down?
From my experience the answer is no...
Thanks.
... View more
09-05-2018
05:26 AM
3 Karma
Hello,
try this, it should work fine:
index=* [|inputlookup usernames.csv | fields user | rename user AS query ]
You could also take a look at this doc page:
http://docs.splunk.com/Documentation/Splunk/latest/Search/Changetheformatofsubsearchresults
Regards,
Luca.
... View more
06-07-2018
02:23 AM
Hello,
please I would like to know if and how is possible to define/create a user that has only the capability to navigate through the Splunk Distributed Management Console, without the possibility to make any changes.
The user should not be able to do anything else, other than viewing DMC dashboards: he should be like a "read only" admin.
Thanks in advance and kind regards.
... View more
05-11-2018
08:04 AM
This is my solution
1) create a pre built panel for every color you need to use for your backgrounds. I assume one per app.
2) Add at the end of every form/dashboard the pre built panel of the color you want to use.
Here it is an example of a prebuilt panel:
<panel>
<html>
<style>
div[data-view="views/shared/appbar/Master"] {
background-color: green;
}
div[data-role="underline"] {
background-color:red;
}
</style>
</html>
</panel>
If you are running your search head on linux (or you have "sed" command on windows) you can also then create a linux sed script that automatically changes the closing line of form/dashboard (that is "</form>" or "</dashboard>") with the prebuilt panel content and the closing line again.
This is a sample linux "sed" script:
/\<\/form>/{i\
<!-- INSERTED THIS BELOW LAST ROW AND BEFORE FORM\/DASHBOARD CLOSING TAG -->\
<row>\
<panel>\
<html>\
<style>\
div\[data-view="views\/shared\/appbar\/Master"\] \{\
background-color: green;\
\}\
div\[data-role="underline"\] \{\
background-color:red;\
\}\
<\/style>\
<\/html>\
<\/panel>\
<\/row>\
<\/form>
d
};
/<\/dashboard>/{i\
<!-- INSERTED THIS BELOW LAST ROW AND BEFORE FORM\/DASHBOARD CLOSING TAG -->\
<row>\
<panel>\
<html>\
<style>\
div\[data-view="views\/shared\/appbar\/Master"\] \{\
background-color: green;\
\}\
div\[data-role="underline"\] \{\
background-color:red;\
\}\
<\/style>\
<\/html>\
<\/panel>\
<\/row>\
<\/dashboard>
d
}
To use this script:
sed -E -i <dashboard_name>.xml -f <sed_script_name> <dashboard_name>.xml
Also, you could run this script recursively, maybe with a "find . -name ...", on all your local dashboard directories, but that could be a little risky, so first take a backup of everything.
Changes are made on original files!
Best regards.
... View more
05-02-2018
08:05 AM
Hello,
I am installing Splunk PCI app 3.5.0 on an environment that is made of a Search Head and two indexers (not clustered).
Should I forward all data from Search Head to the indexers (as best practices say) or should I let the Search Head index something?
Thanks in advance and kind regards.
... View more
04-24-2018
05:38 AM
Here it is a working complete example with the extraction of "field1"
| makeresults count=2
| streamstats count
| eval _raw=case(count==1,"<37> 1 2018-04-23T08:08:08Z E876876876 SECURE AUDIT 0 <secure audit error> [cdkncdckne dckmdkcmd]",count==2,"<37> 1 2018-04-23T08:08:08Z E876876876 auth 0 <login> [kdnckn rrgrr]
<37> 1 2018-04-23T08:08:08Z E876876876 auth 0 <login> [kdnckn rrgrr]")
| rex field=_raw "<\d+>\s+\d+\s+(?:[^\s]+\s){2}(?P<field1>[^\s]+(?:\s+\w+)*)\s\d+\s+<"
... View more
04-23-2018
07:38 AM
Try this regex:
(?:[^\s]+\s){2}(?P[^\s]+(?:\s\w+)?)\s\d+\s+<
Test it here:
https://regex101.com/r/biHi9a/1
Best regards
... View more
03-05-2018
07:12 AM
Hello,
while trying to send messages to Splunk HTTP event collector through javascript inside a web page, I sometimes get this erro:
readyState 0, status 0, statusText error
It seems, but I am not sure, that this error is related to the volume of HTTP POSTS that are concurrently made.
Is there any kind of limit to HTTP POSTS that a single HEC is able to handle at a time?
If yes, what is this limit? I cannot find a sizing guide for HECV, other than what is suggested in this page " http://dev.splunk.com/view/event-collector/SP-CAAAE73 ", but there are no clues about volumes.
Thanks in advance.
... View more
11-29-2017
06:57 AM
Yes, I know it and I agree with you, but I should change some correlation searches in Splunk App for PCI Compliance.
Other than this I'll have to check next days if indexing volume is not increasing too much.
Thanks.
... View more
11-29-2017
06:36 AM
I was thinking about writing a python or AWK program to optimize the REGEX, but it's not that simple in my scenario.
I am working in a PCI environment and the customer prefers to index "more" data than needed.
For the time being I have ended up writing a short REGEX that keeps all users beginning with "X" followed by 6 chars.
I was just wondering if anyone has ever faced a similar situation.
Thank you.
... View more
11-29-2017
06:33 AM
I have tried whitelisting @ forwarder side for Windows Event Codes (the most typical are 4624, 4625, 4634, ...) but never tried with a so big list and since I am working in a production environment with Domain Controllers I cannot make such test.
I need a proven solution.
Thank you.
... View more
11-29-2017
06:14 AM
Hello,
I would like to filter, at the indexers, events coming from WinEventLog:Security to keep only certain users .
The problem is that the list of users is really huge and contains, more or less, 1200 entries. The customer I am working for has set up a REGEX with 1199 pipes(!) for 1200 entries.
A little sample of what is inside the transforms.conf file is:
REGEX = (?i)(A111111)|(A111112)|(A111118)... and so on with 1199 pipes
The final result is that the indexers (2 with 12 cores and 12 GB of RAM) become unresponsive, there is huge indexing lag and a lot of broken pipe connections from Windows Universal Forwarders.
How can I keep, in a better way, only those users' events?
Thanks in advance.
... View more
10-04-2017
01:59 AM
Thank you very much Damien!
... View more
10-04-2017
01:02 AM
Maybe I have found myself the answer in this post:
https://answers.splunk.com/answers/334524/accessing-response-handler-arguments-from-response-1.html
... View more
10-04-2017
12:55 AM
Hello,
I have developed a custom response handler class for TA.rest modular input and I would like to pass a custom parameter to it.
I know this is possible, by setting custom parameters in the input configuration page (key1=value, key2=value).
What I can't figure out is how I can access these parameters in my custom class.
class customHandler:
def __init__(self,**args):
pass
def __call__(self, response_object,raw_response_output,response_type,req_args,endpoint):
if response_type == "json":
output = json.loads(raw_response_output)
for record in output["logins"]:
print_xml_stream(json.dumps(record))
else:
print_xml_stream(raw_response_output)
Any help would be appreciated.
Thanks in advance.
... View more
09-21-2017
02:51 PM
1 Karma
I have found out a way to get what I want: it's done with custom JS code.
This is the form:
<form script="token_modify_mae.js">
<label>test1</label>
<fieldset>
<input type="text" token="mytoken">
<label>field1</label>
</input>
</fieldset>
<row>
<html>
<p>Value1: $mytoken$</p>
<p>Value2: $mymodtoken$</p>
</html>
</row>
</form>
and this is the JS code:
require([
"splunkjs/mvc",
"splunkjs/mvc/simplexml/ready!"
], function(mvc) {
var defaultTokenModel = mvc.Components.get("default");
defaultTokenModel.on("change:mytoken", function(formQuery, mytoken) {
alert("change it!");
var tokenValue = defaultTokenModel.get("mytoken");
newtoken = tokenValue.replace(/\\/g, "\\\\");
defaultTokenModel.set('mymodtoken', newtoken);
});
});
... View more
09-21-2017
07:04 AM
I am sorry, but it works in a weird way.
At first run of the form, if I put "\" in field1 nothing happens and field2 is shown as "$field2$".
If I add another "\" in field1 ("\") and submit again, the field2 value appears as "\\".
By the way, what I need is to repeat each "\" character.
For example:
\NAS\disc1\disc2 should become "\\NAS\disc1\disc2"
Maybe I should use javascript?
I am running splunk 6.5.3
... View more
09-21-2017
06:29 AM
1 Karma
@DMohn: please, could you please provide me the complete form you used? Mine hangs on "waiting for input", even if I put test2 in my search query.
Thanks.
... View more
09-21-2017
05:38 AM
Progetto="$progetto$|s", with an initial value of "" for progetto field gives no results.
Also tried with value "\NAS" and still get no results.
(Obviously there are a lot of records in the index that have "\NAS" at the beginning of the field).
... View more
09-21-2017
05:07 AM
Hello,
please I would like to know how I can replace a single "\" backslash with a double "\" backslash in a form input (simple xml) before submitting it.
I have tried with this code, but it does not work with splunk 6.5.x
<input type="text" token="progetto">
<label>Progetto (raddoppiare i "\")</label>
<default>*</default>
<initialValue>*</initialValue>
<change>
<eval token="progetto">replace('progetto',"\\\","\\\\\\")</eval>
</change>
</input>
Thanks in advance.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
07-09-2024
01:57 PM
|
Karma given to
