@dude49, You would need a field or value that gives you the hire/ start date and then format and eval the value to look for the last 30 days. Something like the below: |eval StartDay=strftime(hire_date, "%d")
|eval curDay=strftime(now(),"%d")
|eval window =(curDay - StarttDay)
|where (window < 30) Reference: https://docs.splunk.com/Documentation/SCS/current/SearchReference/DateandTimeFunctions
... View more
@YJ , In Splunk UBA version 5.3.0, all Log4j related jars in the OS packages have either been removed or replaced by Reload4j besides the following. https://docs.splunk.com/Documentation/UBA/5.3.0/ReleaseNotes/RemoveLog4j If you are below version 5.3.0 I would update.
... View more
Red Hat 8.10 or 9.2 are not support as of yet, however you can try an install based on the older kernel version "4.18.0-477.27.1.el8_8.x86_64" that is supported. I have had some luck before by using the older kernel with an updated system but know that its not supported. **There may be some bugs that haven't been tested yet by doing this but it will allow you to install.
... View more
There is an option to export as file and you can export as CSV. This is onwe option if you have local access to th PST or inbox.
In Outlook 2016,
--> File
--> Open& Export
--> Import/Export
--> Export to file
--> Comma Serparated Values
... View more
In my recent case,
i just used the simpe evals and took when they entered work to when they left work,so (last - first).
|eval time=strftime(_time,"%c"), date=strftime(_time,"%x")
|streamstats earliest(_time) as "first" latest(_time) as "last" by date
|eval total=(last-first)
|eval hours=round(toatl/3600/2
|stats max(hours) by date "Full Name"
... View more
Sorry, I meant to go back and add a link for it.
easiest is to "npm install mongodb-rest" (https://www.npmjs.com/package/mongodb-rest)
Then here are some good step by step write up's for creating the rest instance in Node.js so you can pull down the different conditions. Check out the list of references with these three you should be able to figure most of it out to create your own.
References:
https://www.npmjs.com/package/mongodb-rest
https://getstream.io/blog/building-rest-api-node-js-restify-mongodb/
https://docs.mongodb.com/ecosystem/tools/http-interfaces/
... View more
Can I clarify that you typed in the pass4SymmKey and not copied from the Master? As the Master will encrypt the password after initial setup and you would not be able to just copy it over.
... View more
For my MongoDB I created a REST Interface and created the access token. This allowed me to use the Rest-TA and pull the specific indexes from the MongoDB. It will come into Splunk as JSON and will parse out fairly easily to search through.
... View more