About pbryant_splunk

pbryant_splunk · ‎06-10-2019

So just to confirm. The command curl is just a string i.e. the word curl. It could be any word really derived from a field. It would be single word, no spaces.

pbryant_splunk · ‎06-07-2019

I have defined a token "$command$, this happens to be a command name. The command is currently the curl command. I wish to use this token in a dashboard to use the command name as the lookup name. As I wish to return fields, values about a command uniquely. As an example lookup $command$ option as switch This does not work, I get error Error in 'lookup' command: Lookups: Could not construct lookup 'cat, option, as, switch'. See search.log for more details. I suspect this is not possible but wondered if the community if it is possible? Or if anyone can suggest a away to dynamically populate the lookup name based on field values.

pbryant_splunk · ‎01-09-2019

So I am not aware of exactly the method you are asking. The Unix/Linux technical addon will output users with Nologin vs. not. SO the method is there but as scripted input. I work in the Security research team at Splunk. Feel free to drop us a line a research{at}splunk.com as this usecase could interesting to us. Also would love to know other usecases you have for linux systems.

Posts	3
Solutions	0
Karma Given	0
Karma Received	0
Member Since	‎01-30-2018

Online Status	Offline
Date Last Visited	‎06-05-2020 02:04 AM

Using a token to define a lookup name.

Re: Using a token to define a lookup name.

Using a token to define a lookup name.

Re: app or macro to summarize unix user and group ...