Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About ektasiwani
ektasiwani
Communicator
Member since:
02-17-2015
04-20-2021
Community Statistics
| Posts | 72 |
| Solutions | 3 |
| Karma Given | 0 |
| Karma Received | 10 |
| Member Since | 02-17-2015 |
Activity Feed
- Posted Re: Centurion - Threat Hunting Feed Aggregator v1.0.1 on Splunk Enterprise version 7.2.9.1: How to configure proxy setti on All Apps and Add-ons. 04-20-2021 02:51 AM
- Got Karma for Re: Checkpoint opsec lea 4.0 error with Checkpoint R80. 06-05-2020 12:48 AM
- Got Karma for Re: Checkpoint opsec lea 4.0 error with Checkpoint R80. 06-05-2020 12:48 AM
- Got Karma for Re: Checkpoint opsec lea 4.0 error with Checkpoint R80. 06-05-2020 12:48 AM
- Got Karma for Re: Checkpoint opsec lea 4.0 error with Checkpoint R80. 06-05-2020 12:48 AM
- Got Karma for Re: Could not see data in Check Point Analytics App by QOS via syslog. 06-05-2020 12:48 AM
- Got Karma for How to get my python script to trigger through a Splunk search?. 06-05-2020 12:47 AM
- Got Karma for How to change the background color of a scatter or bubble graph in XML?. 06-05-2020 12:47 AM
- Got Karma for How to change the background color of a scatter or bubble graph in XML?. 06-05-2020 12:47 AM
- Got Karma for How to change the background color of a scatter or bubble graph in XML?. 06-05-2020 12:47 AM
- Got Karma for Re: How to grep or awk in splunk?. 06-05-2020 12:47 AM
- Posted Re: How do I use the rex field to extract the last digit from the time value in my sample data? on Splunk Search. 05-28-2020 07:52 AM
- Posted Re: Centurion - Threat Hunting Feed Aggregator v1.0.1 on Splunk Enterprise version 7.2.9.1: How to configure proxy settings? on All Apps and Add-ons. 05-28-2020 07:40 AM
- Posted Re: dynamic single value to track number of completed search queries of dashboard on Dashboards & Visualizations. 03-13-2019 06:19 AM
- Posted Re: dynamic single value to track number of completed search queries of dashboard on Dashboards & Visualizations. 03-13-2019 06:16 AM
- Posted Re: dynamic single value to track number of completed search queries of dashboard on Dashboards & Visualizations. 03-11-2019 11:12 PM
- Posted dynamic single value to track number of completed search queries of dashboard on Dashboards & Visualizations. 03-07-2019 05:11 AM
- Tagged dynamic single value to track number of completed search queries of dashboard on Dashboards & Visualizations. 03-07-2019 05:11 AM
- Posted Re: Configure the Splunk Add-on for Check Point OPSEC LEA on All Apps and Add-ons. 08-15-2018 09:02 PM
- Posted Re: Configure the Splunk Add-on for Check Point OPSEC LEA on All Apps and Add-ons. 08-15-2018 09:59 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
04-20-2021
02:51 AM
@morganfw Thank you so much for your valuable feedback. Please check out the latest version of the app. We have the option to configure proxy settings now using the setup page.
... View more
05-28-2020
07:52 AM
Hi aramakrishnan,
You can also try this regex. \d+ will capture digit and $ (dollar sign) indicates the end of the string.
.. | rex "(?<id>\d+$)" | ..
... View more
05-28-2020
07:40 AM
Hello morganfw,
you can edit "server.conf" file to configure splunkd to work with a proxy.
https://docs.splunk.com/Documentation/Splunk/8.0.3/Admin/ConfigureSplunkforproxy
... View more
03-13-2019
06:19 AM
Hi,
Solved this by using 'progress' tag inside 'search' tag of Dashboard.[https://docs.splunk.com/Documentation/Splunk/7.2.4/Viz/tokens]
<search>
<progress>
<condition match="'job.resultCount' == 0">
<set token="tok1Count">0</set>
</condition>
<condition>
<set token="tok1Count">1</set>
</condition>
</progress>
</search>
... View more
03-13-2019
06:16 AM
Hi,
This is one of the requirement.
... View more
03-11-2019
11:12 PM
Hi Richgalloway,
My use case does not include getting scheduled search.
I have dashboard, and dashboard contain multiple search query. I want to display number showing 'number of search queries completed' from the dashboard
For example if dashboard has 10 search query and at this moment 4 queries gave the output and 6 query still running, 'number of search queries completed' should show 4 as output.
... View more
03-07-2019
05:11 AM
Hi,
I have a dashboard with multiple panels.
Can we create a single value to keep track of completed queries.
Single value should change real time, as the number of completed search queries changes.
Is it possible to have something like this in Splunk dashboard or application.
... View more
08-15-2018
09:02 PM
Hi,
This issue is because OPSEC side started to use sha256 and updated its SDK.
Download file from http://supportcontent.checkpoint.com/file_download?id=50832 and replace $SPLUNK_HOME/etc/apps/Splunk_TA_checkpoint-opseclea/bin/opsec-tools binaries with these new ones.
This solution is mentioned in the link which I shared in my comment:
https://answers.splunk.com/answers/614787/splunk-check-point-lea-opsec-error-fatal-error-gli.html
Check out below link by checkpoint:
https://supportcenter.checkpoint.com/supportcenter/portal?action=portlets.SearchResultMainAction&eventSubmit_doGoviewsolutiondetails=&solutionid=sk130292
... View more
08-15-2018
09:59 AM
Yes. You need to give 777 permission.
If giving permission will not solve your issue please follow steps mentioned in below link.
https://answers.splunk.com/answers/614787/splunk-check-point-lea-opsec-error-fatal-error-gli.html
... View more
07-26-2018
12:17 AM
Hi,
I was facing the same issue. I solved this by giving proper permission to "$SPLUK_HOME/etc/apps/Splunk_TA_checkpoint-opseclea/" folder. Make sure your application folder is having proper permission and should have "$SPLUK_HOME/etc/apps/Splunk_TA_checkpoint-opseclea/local/" folder.
... View more
02-20-2018
12:11 AM
Hi,
I am using Checkpoint opsec lea to fetch checkpoint logs and the number of logs which I will get is very high.
How can I tell Splunk to not index all ICMP logs and DNS logs coming from Splunk LEA Add-on (Checkpoint)
... View more
10-13-2017
04:46 AM
Hi splunk24,
Please check this link:
http://qostechnology.in/blog/integrate-splunk-with-checkpoint-managementlog-server/
... View more
08-20-2017
10:58 PM
1 Karma
Hi Kovalkovds,
Please check your "sourcetype" filter in Check Point analytics app by QOS.
It should by qos_syslog not opsec. By default sourcetype filter will be selected to "opsec" type.
... View more
10-23-2016
09:05 PM
4 Karma
Hi,
I solved this error by myself, may be it helps other.
I had two different version of Checkpoint opsec lea installed on my splunk.
I uninstalled older version and removed the folder, now i am not getting above error.
Thanks
... View more
10-14-2016
11:24 PM
Hi,
I am using Checkpoint OPSEC LEA 4.0
On running search i am getting this error message.
Error 'Could not find all of the specified destination fields in the lookup table.' for conf 'opsec:anti_malware' and lookup table 'checkpoint_vendor_info_lookup'.
Error 'Could not find all of the specified destination fields in the lookup table.' for conf 'opsec:anti_virus' and lookup table 'checkpoint_vendor_info_lookup'.
Error 'Could not find all of the specified destination fields in the lookup table.' for conf 'opsec:audit' and lookup table 'checkpoint_vendor_info_lookup'.
Error 'Could not find all of the specified destination fields in the lookup table.' for conf 'opsec:smartdefense' and lookup table 'checkpoint_vendor_info_lookup'.
Error 'Could not find all of the specified destination fields in the lookup table.' for conf 'opsec:threat_emulation' and lookup table 'checkpoint_vendor_info_lookup'.
Error 'Could not find all of the specified destination fields in the lookup table.' for conf 'opsec:vpn' and lookup table 'checkpoint_vendor_info_lookup'.
Error 'Could not find all of the specified lookup fields in the lookup table.' for conf 'opsec:audit' and lookup table 'checkpoint_audit_action_lookup'.
How can i solve this. And why i am getting this error.
Thanks
... View more
- Tags:
- checkpoint
- error
- lea
07-31-2016
11:25 PM
Hi ,
I found solution.
I gave global permission to macros.conf file separately in "metadata/local.meta" and replaced:
.. | eval Severity= 'calc_score(score=fieldname)'
with
.. | eval Severity=`calc_score(score=fieldname)`
and it started working.
Hope this helps others.
... View more
07-31-2016
11:24 PM
Hi aljohnson ,
Yes search works fine without macro.
... View more
07-30-2016
05:57 AM
Hi,
In my search, I need to call a macro with the eval command, but I am getting error "bad request".
My macros.conf file is inside an app and I have given that app global permission.
[calc_score]
definition = case( $score$=40,"pass", $score$=70,"average", $score$=90,"good")
args = score
I am trying to call this macro using JavaScript SDK search:
.. | eval Severity=`calc_score(score=fieldname)`
I tried adding search before macro name, but no use, something like this :
.. | eval Severity=search `calc_score(score=fieldname)
Is this the wrong way to call macros using the JavaScript SDK?
Any help is appreciated.
Thanks
... View more
06-03-2016
04:08 AM
Hi ,
I have an external app where I am fetching data from Splunk and displaying a graph using the JavaScript SDK. Now I need to store some data (not file), like elements of an array.
I don't want to use any other database. Can I store array elements directly on Splunk (not file) using JavaScript SDK? I don't have this data stored on any file as its being created on the fly.
Thanks!
... View more
05-26-2016
07:03 AM
Hi
I am creating an app outside splunk web.
I am using splunk sdk for javascript to get datafrom splunk.
I want to create third party graph(d3 graph) using that data. Is there any document or example showing same.
Thanks
... View more
05-09-2016
01:46 AM
Hi brandonf,
Tracker logs will not be touched by this add on. One can see tracker logs just like before.
Thanks
... View more
04-15-2016
01:10 AM
Hi Splunkers,
I am using Splunk 6.3.x and my requirement is to customize default "No result found" message and "N/A" message of single value element.
I checked similar questions here, but no use.
Is there any way to customize these messages through css or through a Splunk search? I want to show "0" in place of "N/A" for single value element.
Thanks
Ekta
... View more
01-13-2016
03:33 AM
Hi,
This will add background color to whole panel.
I want to change color of area between x-axis and y-axis.
Kind of axis color, area where you can see graph result.
Kind of heat map.
Thanks
... View more
12-18-2015
11:16 PM
Thanks for reply
... View more
12-18-2015
05:49 AM
Hi,
In my app, if I am not using eventgen, do I still need to create an eventgen.conf file?
If yes what I should include in this file?
My app is using another add-on to process incoming logs.
What I understood is if you are using eventgen to create sample logs, then you need an eventgen.conf file.
Any help is appreciated.
Thanks
... View more
- Tags:
- eventgen
