About adent

adent · ‎10-30-2024

The stream app can save pcaps using the configure packet stream. I was able to get packets saved using just IPs. Now I want to search for content based on some snort rules. For ascii content I am trying to create new target using the field: content/contains by just putting in an ascii word. For hex values, there are no instructions. Do I use escape characters \x01\x02...., |01 02 ...| or a regular expression? Is there an example.

adent · ‎11-17-2023

The answer is in the planning dept basement behind a locked door with the sign "beware of the leper". seriesColorsByField object n/a Specify the colors used for specific pie slice labels. For example: {"April": "#008000", "May": "#FFA500 Much of the pie documentation does not have the current option. I found it once on the splunk documentation for dashboard studio pie chart but could not find it again. I then searched for "splunk pie chart options dashboard studio code" and found the following url: https://docs.splunk.com/Documentation/Splunk/9.1.1/DashStudio/objOptRef

adent · ‎10-19-2023

I am trying to get individual values and add a summary row with the minimum value. In this case I have 3 times and want the output to have all three times and create a minimum time row (labelname=min). event _time a 10:00 b 11:00 c 10:30 min 10:00

adent · ‎11-17-2022

found one solution is to do the fillnull before the subsearch. #337963

adent · ‎11-17-2022

I am trying to add a field to a search using a lookup table. However, my key field is sometimes blank and I get an error the lookup table does not exist or is not available. ... search with an output field of user | lookup userList.csv id as user OUTPUT title There are a few lines rows where id is blank and I do not have permissions to edit the table.

adent · ‎10-18-2022

The MV IP is in the lookup table. The original search returns a single IP value. The solution above about creating a new lookup table sounds easiest.

adent · ‎10-18-2022

I am trying to add fields from a lookup table. However, the matching field is a multivalue field. I need to expand the matching field but do not know how to group the lookup command with a multivalue command lookup file assest.csv: ip, host 10.10.1.1|10.100.1.1|10.10.200.1, srv1 10.10.1.2|10.100.1.2|10.10.200.2, srv2 original search that returns an IP value | [lookup assets.csv ip OUTPUT host |makemv delim="|" ip] does not work

Posts	7
Solutions	0
Karma Given	1
Karma Received	1
Member Since	‎10-18-2022

Online Status	Offline
Date Last Visited	‎10-30-2024 05:25 PM

Configure Packet stream target hex values

Summary row listing minimum value

How to to add a field to a search using a lookup t...

Why does lookup have matching multivalue field?

Configure Packet stream target hex values

Re: Modify pie chart colors in dashboard studio

Summary row listing minimum value

Re: Lookup table with blank key value

How to to add a field to a search using a lookup t...

Re: lookup has matching multivalue field

Why does lookup have matching multivalue field?