cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Search instead for 
Did you mean: 
Ask a Question
joock3r
Explorer
Member since: ‎07-27-2022
‎06-10-2024
Community Statistics
Posts 6
Solutions 0
Karma Given 5
Karma Received 1
Member Since ‎07-27-2022
Activity Feed
View All

Re: Dashboard inherited inputs

by in Splunk Search
‎05-26-2024 05:54 AM
‎05-26-2024 05:54 AM
I thought about that but didn't succeed to edit the dynamic options for the Campus value. I tried  | search $site.token$=$campus.token$* When $site.token$ is for Site value and $campus.token$* is for Campus value. ... View more

Dashboard inherited inputs

by in Splunk Search
‎05-26-2024 05:45 AM
‎05-26-2024 05:45 AM
Hey all, I'm building new dashboard that contains 2 multiselect values: Site: USA, Romania, Turkey.... (only countries) Campus: USA1,USA2,Romania1,Romania2.... (contains the country's name and number). I want that when I select country/countires in Site multiselect value I will see only options to select the relevant campuses in Campus multiselect value. How can I create inherited rule that the Campus will inherit from Site value? Thanks. ... View more
Labels

Is there a way to choose the smaller subnet that c...

by in Splunk Search
‎02-14-2023 07:47 AM
‎02-14-2023 07:47 AM
Hi, I have a lookup definition that look like that: When I'm running this search with looking up in this lookup difinition, I'm getting the wider subnet.       index="FW" action=allowed src_ip=10.0.0.1 sourcetype=fw | lookup ipam subnet AS src_ip OUTPUT subnet AS "Source Subnet" | table src_ip "Source Subnet" dest_ip Service Protocol app Rule Device _time | sort 0 -_time       The ipam lookup contains amount of subnets that contatining each other (for example 10.0.0.0/16, 10.0.0.0/24). The results that I'm getting is for the wider subnet, in my example - 10.0.0.0/16. Is there a way to choose the smaller subnet that contains the src_ip? Thanks 🙂   ... View more
Labels

Where can I locate Dashboard Studio search options...

by in Splunk ITSI
‎07-28-2022 02:52 AM
1 Karma
‎07-28-2022 02:52 AM
1 Karma
Hi, I want to transfer my classic dashboard to the dashboard studio and I have some questions regarding that. On the classic dasboard I have several search options that I want to migrate to the new dashboard:   <option name="count">20</option> <option name="dataOverlayMode">none</option> <option name="drilldown">none</option> <option name="percentagesRow">false</option> <option name="refresh.display">progressbar</option> <option name="rowNumbers">false</option> <option name="totalsRow">false</option> <option name="wrap">false</option> <format type="color" field="Action"> <colorPalette type="map">{"allowed":#99ff99,"blocked":#ff4d4d,"dropped":#ff4d4d,"monitor":#ffc44d}</colorPalette> </format>   When I tried to use it in the dashboard studio it didn't work.  Can someone please share with me the options list? I didn't find it on the documentation.  Moreover, the font size of the search's results is quiet huge and I want to reduce it. Which option should I use for that?  Thanks! ... View more
Labels

Re: Unused FW rules

by in Splunk Search
‎07-28-2022 02:38 AM
‎07-28-2022 02:38 AM
@gcusello  Works like a charm. Thanks! ... View more

How to remove unused FW rules?

by in Splunk Search
‎07-27-2022 06:54 AM
‎07-27-2022 06:54 AM
Hi, I have about 100 rules and I want to count the number of logs are related to each rule. When I used "stats count" it counted those rules that have 1 or more logs, but didn't show all the rules with zero hits. I tried to import csv file that contains all the rules and to remove the rows that contains rules with 1 or more hits. Moreover, I tried the suggestion here with no luck: Solved: Using Splunk to Find Unused Firewall Policies - Splunk Community Any suggestion? Thanks 🙂 ... View more
Labels
Contact Me
Online Status
Offline
Date Last Visited
‎06-10-2024 06:26 AM
Karma from
View All
Karma given to