Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About manderson7
manderson7
Contributor
Member since:
02-13-2014
03-27-2023
Community Statistics
| Posts | 109 |
| Solutions | 5 |
| Karma Given | 33 |
| Karma Received | 9 |
| Member Since | 02-13-2014 |
Activity Feed
- Posted Re: Is there an efficient way to do field summary on a large set of source types? on Splunk Enterprise. 03-24-2023 12:55 PM
- Posted Re: Timechart RAM or CPU usage by Linux process on Splunk Search. 11-18-2022 07:00 AM
- Karma Re: How to get "splunk" user to read "root" user-owned files? for esalesapns2. 11-10-2022 05:40 AM
- Posted Re: How to join REST & search results? on Splunk Search. 10-06-2022 07:54 AM
- Karma Re: How to join REST & search results? for jdunlea. 10-06-2022 07:54 AM
- Posted How to join REST & search results? on Splunk Search. 10-06-2022 06:53 AM
- Tagged How to join REST & search results? on Splunk Search. 10-06-2022 06:53 AM
- Posted Re: How can I change input label color? on Dashboards & Visualizations. 10-05-2022 11:36 AM
- Karma Re: How can I change input label color? for kamlesh_vaghela. 10-05-2022 11:35 AM
- Posted How can I change input label color? on Dashboards & Visualizations. 10-05-2022 09:48 AM
- Karma Re: Why is the "Enable summary indexing" option no longer available in 6.6.0? for cygnetix. 08-02-2022 08:22 AM
- Got Karma for Re: Resource/guide sought for ProofPoint TRAP [ThreatResponse] integration with Splunk. 06-06-2022 01:14 PM
- Posted Re: IT Essentials Work with no create entity button on Security. 05-16-2022 04:52 AM
- Posted Where is the IT Essentials Work create entity button? on Security. 04-28-2022 10:10 AM
- Posted Re: Flag when new value is created in field on Security. 03-25-2022 12:38 PM
- Karma Re: Flag when new value is created in field for somesoni2. 03-25-2022 12:14 PM
- Posted Re: Flag when new value is created in field on Security. 03-25-2022 12:05 PM
- Posted How to flag when new value is created in field on Security. 03-25-2022 11:25 AM
- Tagged How to flag when new value is created in field on Security. 03-25-2022 11:25 AM
- Karma Re: Monitor SQLite database file with Splunk DB Connect for tmontney. 03-25-2022 05:37 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
03-24-2023
12:55 PM
I was about to start writing a post trying to figure out what you seem to have figured out. I think I get the gist of your original search, though it seems like you have to repeat it per index? If that's the case, it wouldn't work, as you've got quite a few indexes to search over I'd imagine. I guess my question is, what is <base search> that you have referenced up there?
... View more
11-18-2022
07:00 AM
Back from the dead! Big ask I realize, but did you get any further with this? We're stuck trying to get a better handle on mem utilization of processes, and this is a big step in the right direction.
... View more
10-06-2022
07:54 AM
That helped quite a bit, thanks. The somewhat final search came out to be: | rest /servicesNS/-/-/admin/directory count=0 splunk_server=<splunkserver>
| rename eai:* as *, acl.* as *
| eval updated=strptime(updated,"%Y-%m-%dT%H:%M:%S%Z"), updated=if(isnull(updated),"Never",strftime(updated,"%d %b %Y"))
| sort type
| eval sAMAccountName=lower(owner)
| stats count by title orphaned sAMAccountName sharing type owner updated app disabled
| search orphaned=1
| join sAMAccountName
[| search index=metrics_summary source="LDAP*" source IN("LDAP GROUP USER DIVISION Summary Index Search" "LDAP_GROUP_USER_DIVISION_Summary_Index_Search" lookup_ldap_group_user_division) sAMAccountName=e* OR sAMAccountName=v* NOT sAMAccountName=e-mail* userAccountControl=*ACCOUNTDISABLE*
| eval sAMAccountName=lower(sAMAccountName)
| stats latest(_time) AS latest values(displayName) values(mail) values(distinguishedName) values(department) values(division) latest(userAccountControl) values(manager) by sAMAccountName] I needed to limit the results more in the subsearch. Thanks so much.
... View more
10-06-2022
06:53 AM
I'm really bad when it comes to join searches, though I've been doing this for years.
I'm able to find the list of orphaned searches using:
| rest /servicesNS/-/-/admin/directory count=0 splunk_server=<splunkserver>
| rename eai:* as *, acl.* as *
| eval updated=strptime(updated,"%Y-%m-%dT%H:%M:%S%Z"), updated=if(isnull(updated),"Never",strftime(updated,"%d %b %Y"))
| sort type
| eval sAMAccountName=owner
| stats count by title orphaned sAMAccountName sharing type owner updated app disabled
| search orphaned=1
and we have a summary index containing our LDAP users & managers for those users. Using the following search returns users and their managers:
index=metrics_summary source="LDAP*" source IN("LDAP GROUP USER DIVISION Summary Index Search" "LDAP_GROUP_USER_DIVISION_Summary_Index_Search" lookup_ldap_group_user_division) sAMAccountName=e* OR sAMAccountName=v* |table sAMAccountName displayName mail department division manager
But I haven't been able to join the two searches together to give me the manager name of the user w/ the orphan search. I've tried variations of the following:
| rest /servicesNS/-/-/admin/directory count=0 splunk_server=<splunkserver>
| rename eai:* as *, acl.* as *
| eval updated=strptime(updated,"%Y-%m-%dT%H:%M:%S%Z"), updated=if(isnull(updated),"Never",strftime(updated,"%d %b %Y"))
| sort type
| eval sAMAccountName=owner
| stats count by title orphaned sAMAccountName sharing type owner updated app disabled
| search orphaned=1
| join sAMAccountName type=outer max=0
[|search index=metrics_summary source="LDAP*" source IN("LDAP GROUP USER DIVISION Summary Index Search" "LDAP_GROUP_USER_DIVISION_Summary_Index_Search" lookup_ldap_group_user_division)
| stats latest(_time) AS latest values(displayName) values(mail) values(distinguishedName) values(department) values(division) latest(userAccountControl) values(manager) by sAMAccountName
| rename values(*) AS *, latest(*) AS *]
but this only comes back w/ results from the rest call.
I know I get results using the summary index search. How do I merge these?
Thanks
... View more
- Tags:
- rest
Labels
- Labels:
-
join
10-05-2022
11:36 AM
That did the trick. Thank you.
... View more
10-05-2022
09:48 AM
I know I can change the color of a .panel-title, but I haven't found the code to change the .input-label color.
This works:
<panel id="panel2">
<title>title</title>
<input type="text" token="commentpicker">
<label>Add any additional comments below</label>
<default></default>
</input>
<html>
<style>
#panel2 .dashboard-panel .panel-title {
color: #EC102B;
}
</style>
But this won't
<input type="multiselect" token="newenabledpicker" searchWhenChanged="false" id="input1">
<label>Modify or Disable (REQUIRED)?</label>
<choice value="modify">Modify</choice>
<choice value="disable">Disable</choice>
<delimiter> </delimiter>
</input>
<html>
<style>
#input1 .dashboard-panel .input-label {
color: #EC102B;
}
</style>
</html>
... View more
Labels
- Labels:
-
panel
05-16-2022
04:52 AM
Unfortunately not. I moved on to other work, and this was dropped. It's a shame, because otherwise it's a solid product, but this stopped us moving forward.
... View more
04-28-2022
10:10 AM
We've done a new install of IT Essentials work, and was trying to add entities, but don't have the create entity button. My account has itoa_admin, itoa_analyst, itoa_user roles assigned. I do have a create entity type button, but there are no configured entity types. I have installed the AWS & nix content packs. What am I missing?
... View more
Labels
- Labels:
-
other
03-25-2022
12:38 PM
Thanks for the help so far, this is what I have |relevant rest call
| eval from="rest"
| eval added_on_date=now()
| fields title, search, updated SplunkApp dataSource actions search added_on_date
| rename title AS Title
| append
[| inputlookup append=true correlation_searches_history.csv
| eval from="lookup"
| eval added_on_date=coalesce(added_on_date,0)
]
| stats max(added_on_date) AS added_on_date values(from) as from values(updated) by Title and the search keeps updating the added_on_date in the lookup (when I run outputlookup) to when the search runs. How do I avoid that?
... View more
03-25-2022
12:05 PM
Yep, overthinking. Thank you. In addition, how would I go about creating a "add on date" field to the lookup once the new search is added to it. Basically, I'd like to get the dates added for new correlation searches from this time forward in said lookup.
... View more
03-25-2022
11:25 AM
I'm really overthinking this, but am lost.
I need to show when new correlation searches are introduced into the environment. I have a lookup with the current correlation searches, along w/ relevant data, and last time updated. How do I compare current rest call results with the lookup and show the most recently created searches?
Any help would be appreciated.
... View more
Labels
- Labels:
-
audit
01-11-2022
06:12 AM
We have a heavy forwarder running some Add-ons, and one of them (SNow) is eating up all the memory. We have workload management enabled on our search head clusters for cpu/memory management, but wanted to see if it's possible to restrict mem/cpu usage for ingest on the HF using WM. If that's a possibility, where would I edit settings to update the configurations accordingly?
... View more
- Tags:
- Workload Management
Labels
- Labels:
-
heavy forwarder
-
modular input
12-28-2021
06:49 AM
We've gotten a search to work that shows the delta between the number of messages in an inbox for a period of time: <basesearch>
| bin _time span=5m
| stats max(Items) AS Max by _time
| delta Max as Delta
| fields _time Delta
| where Delta>=10 But I want to do this based on multiple inboxes, and delta is merging the inboxes together, so the values of each inbox are interfering with each other. <basesearch multiple mailboxes>
| bin _time span=5m
| stats max(Items) AS Max by _time User
| delta Max as Delta
| fields _time Delta User returns: _time User Max Delta 09:15 user1 103 09:15 user2 251 148 09:15 user3 17 -234 and I want the users to be treated as individual accounts, not merged with each other. I assume I need to use streamstats for this, but so far I've been unable to work out how.
... View more
08-20-2021
10:18 AM
Thanks Rich. Sounds like I need to create a lookup table w/ a list of known hosts , and search against that?
... View more
08-20-2021
08:52 AM
We're trying to gather a list of servers, both linux and windows that are missing specific software packages. It's easy enough to get the list of servers that has the software installed. search software IN ("CrowdStrike") I was hoping I could search against the software package, like search NOT software in ("CrowdStrike") but that still displays hosts with Crowdstrike installed, just not that particular event showing that Crowdstrike is indeed installed. I thought of making an eval |eval cs_win_installed=if(match(software, "CrowdStrike"),1,0) and then searching for 0 or 1 depending on what I care about, but can I do that with all the software that I'm searching on? Running that eval for multiple pieces of software | eval cs_lin_is_installed=if(match(software, "falcon-sensor"),1,0)
| eval cs_win_is_installed=if(match(software, "CrowdStrike Windows Sensor"),1,0)
| eval q_is_installed=if(match(software, "Qualys*"),1,0)
| eval f_is_installed=if(match(software, "SecureConnector*"),1,0) only returns with the event showing that 1 piece of software on the machine. Am I overthinking this? How should I go about displaying hosts with missing software? Thanks much.
... View more
Labels
- Labels:
-
search
06-29-2020
07:22 AM
Working a bunch with the Trackme app and it's showing a lot of promise. I finally got the right MLTK and Python applications installed, hopefully that will help some of the issues I'm having. When I modify a data source, choosing "auto lagging" comes back with unexpected results. In particular, I have a data source that only ingests M-F, between 9am and 5pm. The auto percentile lag of this data source for 7-30 days at 1-3 seconds. How would I go about getting a longer average lag time for this source? In addition, how can I tell trackme to not show an alert state on the same sourcetype on a monday morning, since it hasn't gotten any events since the friday before? I don't want to set the lag time as too high as that will interfere w/ monitoring during weekdays. Thanks for your help.
... View more
- Tags:
- TrackMe
Labels
- Labels:
-
administration
05-19-2020
06:29 AM
Thanks very much Chris. Accepted!
... View more
05-15-2020
12:57 PM
Loving this viz and the Number Display viz. However, I'm having a problem getting drilldowns to work.
If I set the drilldown to Link to Search, on clicking a value, it runs the basic search and selects the value clicked on. I haven't been able to create a working token to send to a search on the same dashboard.
There's a setting in General / Click action : set tokens to $sunburst_viz_{field}$ and I've assigned that to a form.field_name , but on clicking the field value in the Sunburst, the search will search on the literal variable set in the token.
How is the drilldown supposed to work with Sunburst and Number Display?
Thank you!
... View more
03-04-2020
07:13 AM
This is the final props & transforms that finally worked, thanks again for all your help
Transforms:
[version1_fields]
REGEX = \<Attribute name=\"([^\"]+)\"\>(.*?)\<\/Attribute\>
FORMAT=$1::$2
[v1_ownername]
SOURCE_KEY = Owners_Name
REGEX = \<Value\>(?<Owner>.*?)\<\/Value\>
MV_ADD = true
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
03-27-2023
01:21 PM
|
Karma from
Karma given to
