Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About sddunne
sddunne
Explorer
Member since:
06-19-2020
06-13-2022
Community Statistics
| Posts | 8 |
| Solutions | 0 |
| Karma Given | 0 |
| Karma Received | 1 |
| Member Since | 06-19-2020 |
Activity Feed
- Posted Re: display a dashboard without login on Dashboards & Visualizations. 06-13-2022 09:20 AM
- Posted Re: display a dashboard without login on Dashboards & Visualizations. 06-10-2022 02:54 AM
- Posted Re: How to extract JSON with key name specified as a key on Splunk Search. 03-22-2022 04:18 AM
- Posted How to extract JSON with key name specified as a key? on Splunk Search. 03-18-2022 09:18 AM
- Got Karma for Re: Can we setup alerts using REST API, with action to send a POST request at a webhook?. 07-15-2021 07:54 PM
- Posted Re: Can we setup alerts using REST API, with action to send a POST request at a webhook? on Alerting. 07-14-2020 09:28 AM
- Posted Re: Can we setup alerts using REST API, with action to send a POST request at a webhook? on Alerting. 07-13-2020 06:20 AM
- Posted Re: Can we setup alerts using REST API, with action to send a POST request at a webhook? on Alerting. 07-02-2020 07:24 AM
- Posted Re: Can we setup alerts using REST API, with action to send a POST request at a webhook? on Alerting. 06-19-2020 09:32 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 |
06-13-2022
09:20 AM
Wow, thanks, that's amazing! Next step for me is to request insecurelogin get enabled! Thanks v much! Sean.
... View more
06-10-2022
02:54 AM
Hey - that's a neat workaround, we are doing something very similar with DataDog to add a layer of security to the public dashboards by enabling the IP whitelist feature and then whitelisting NGINX. I'm keen to try your solution for Splunk Dashboards and wondered if you would be willing to share an example of the NGINX config you are using to do this? Many thanks, Sean.
... View more
03-22-2022
04:18 AM
Brilliant, thanks so much everone for your responses! I went with; | spath path=custom_fields{1} | rename _raw AS temp | rename custom_fields{1} AS _raw | spath | rename temp AS _raw | table alertrule, value in the end which gave me exactly what i needed. Thanks again!!
... View more
03-18-2022
09:18 AM
Hi all,
I have a JSON payload that contains as 'custom_fields' section that is made up of a set of title:keyname and value:value.
This is because the tool has varying formats of key/value pairs that it outputs.
Per the screenshot, i'm trying to figure out a way to extract any values where the key is title:Mode but can't for the life of me work out how to do it.
The Mode key will have 1 of 2 values (Monitored or Remediated) and wanting to show this in a table that includes other values from the overall json packet (e.g. _time, description etc.)
Any ideas would be greatly appreciated as spent several hours trying!
... View more
- Tags:
- json
Labels
- Labels:
-
field extraction
-
table
Hi @harsmarvania57 , I found the problem, it was generating them as reports and so they were not showing up in the console in the 'alerts' section. Do you know what i need to set on the report to make it show up as an alert? Sean.
... View more
07-13-2020
06:20 AM
Hey @harsmarvania57 , it's an alert. I'm trying to programatically create alerts with a webhook action. When we onboard a new service, we set up a dedicated index and would like to be able to deploy our standard set of alerts as part of the onboarding process (we currently set up all the alerts manually in the console). Many thanks, Sean.
... View more
07-02-2020
07:24 AM
Hey @harsmarvania57 , I tried to use this (against our splunk cloud instance) and i get an error saying; curl -k -u<removedforsecurity>:<removedforsecurity> https://<removedforsecurity>.splunkcloud.com:8089/servicesNS/cmpapi/search/saved/searches/seantest-CreateAccessKey -d actions=webhook -d action.webhook.param.url="https://your.server.com/api/v1/webhook" <?xml version="1.0" encoding="UTF-8"?> <response> <messages> <msg type="ERROR">Argument "action.webhook.param.url" is not supported by this handler.</msg> </messages> </response> No matter what i try i get the unsupported error. This is on a Splunk Cloud instance. Is this accurate or is there another way of creating an alert with a webhook action? Many thanks!
... View more
06-19-2020
09:32 AM
HI there, i tried to use this and i get an error saying; curl -k -u<removedforsecurity>:<removedforsecurity> https://<removedforsecurity>.splunkcloud.com:8089/servicesNS/cmpapi/search/saved/searches/seantest-CreateAccessKey -d actions=webhook -d action.webhook.param.url="https://your.server.com/api/v1/webhook" <?xml version="1.0" encoding="UTF-8"?> <response> <messages> <msg type="ERROR">Argument "action.webhook.param.url" is not supported by this handler.</msg> </messages> </response> No matter what i try i get the unsupported error. This is on a Splunk Cloud instance. Is this accurate or is there another way of creating an alert with a webhook action? Many thanks!
... View more
