About diogofgm

diogofgm · ‎04-29-2024

I wonder if you’re storing the data in the SH somehow. In the SH where you can query the data check the splunk_server field to see where the SH is pulling the data from. If everything was right you would see listed some or all indexers (depending on how well balanced the data is distributed among indexers for the time interval you selected)

diogofgm · ‎04-19-2024

Is this TA hosted somewhere so we could have a better picture of what the complete python code looks like?

diogofgm · ‎04-11-2024

Depending on how you set your authorization, you might end up with different permissions in the roles in each SH (e.g access to indexes). Check you roles to see what are the allowed indexes in each SH for the roles you have.

diogofgm · ‎04-11-2024

Since September 2021, Splunk does not include python 2. so you need to update your code if its not compatible with python 3. https://www.splunk.com/en_us/blog/platform/removing-python-2-from-new-splunk-cloud-and-splunk-enterprise-releases-starting-september-2021.html

diogofgm · ‎12-21-2023

I dont think there is a connector for that purpose. If you want to follow the "develop your own solution" route i would recommend building a connector for SOAR instead of a function in the visual editor. IMO its more flexible on what you can do (e.g. include external libs) and its easily reusable and you can add multiple assets to use in the PBs. Also, the new app wizard makes it easier to get started and you have tons of "examples" if you look in the SOAR connector GitHub account.

diogofgm · ‎12-20-2023

With the splunk_TA_windows you can index logs regarding windows update from the machines where you have a forwarder installed. With that you can check the packages that are installed in each machine. I dont think you can check which patches are missing unless you already have them installed somewhere. With these logs, you can also check for problems with windows update (check splunk lantern).

diogofgm · ‎12-20-2023

Splunk APM is part of the Observability Cloud and is available as a SaaS offering only. https://www.splunk.com/en_us/products/pricing/observability.html

diogofgm · ‎07-20-2023

You can use the grouping you explained with some splunk commands to accomplish that. | windbag | eval group = if(lang="Euro","groupA","groupB") | timechart count by group This is just an example with random data that you can try in your environment . You can change your grouping conditions in the if statement to your field1=your unique value.

diogofgm · ‎07-19-2023

There are multiple was to extract fields: you can use the interactive field extration present in search you can using inline rex command in your search you can use props and transforms conf files

diogofgm · ‎07-19-2023

If you're looking to improve your searches there are few things that you look in order to make you searches more performant. Look at what you are trying to accomplish with your search and make your search as specific as you can. Examples of this include: Selecting the appropriate time range Take advantage of existing fields in your data to filter results as early in your search so splunk get only the necessary data Avoid using NOT as its more performant to use inclusion filters rather than exclusion If you're working in a distributed environment prioritise the use of streaming commands (eval, rex, etc.) before using transforming commands (chart, timechart, etc). this is so a good part of the search runs in the indexers rather than running in the search heads. Check the following links for more tips: https://www.splunk.com/en_us/blog/customers/splunk-clara-fication-search-best-practices.html?locale=en_us https://docs.splunk.com/Documentation/SplunkCloud/latest/Search/Writebettersearches

diogofgm · ‎07-18-2023

Congratulations to everyone that made it.

diogofgm · ‎07-18-2023

You can pipe | search source_address=172.16.50.0/24 to your search I order to filter the results

diogofgm · ‎06-05-2023

You can use id that can be referenced by the css. Check this example dashboard (you can just copy/paste in to a new dashboard 😞 <dashboard version="1.1"> <label>css test</label> <row> <panel> <html> <style> #mycss table tr{ font-size:150% !important; font-weight: bold; width:150px !important; border: 1px solid black !important; text-align: right !important; background-color: #FF00FF !important; } </style></html> </panel> </row> <row> <panel> <table id="mycss"> <search> <query>index=_internal sourcetype IN (splunkd, splunk_python)| timechart span=1h count by sourcetype | table _time splunkd * | fillnull value=0 splunkd splunk_python mongod</query> <earliest>-4h@m</earliest> <latest>now</latest> <sampleRatio>1</sampleRatio> </search> </table> </panel> <panel> <table> <search> <query>index=_internal sourcetype IN (splunkd, splunk_python)| timechart span=1h count by sourcetype | table _time splunkd * | fillnull value=0 splunkd splunk_python mongod</query> <earliest>-4h@m</earliest> <latest>now</latest> <sampleRatio>1</sampleRatio> </search> </table> </panel> </row> </dashboard> Note that I added the mycss id to the css and to one of the tables.

diogofgm · ‎06-05-2023

If you're looking into a time range, and you're using chart over date, the chart won't create the missing dates where both types do not have an event. What you can try to do instead is using a timechart that for the given time range with create the missing dates of the span you select. | eval type=if(user_action="place_order", "AddInOrdersPlaced", "AddInForwardedOrders") | timechart span=1d count by type | fillnull value="0" AddInOrdersPlaced AddInForwardedOrders

diogofgm · ‎06-05-2023

You can create a stanza in props.conf with: [host::<host>] TZ=<TZ>

diogofgm · ‎05-09-2023

Check the roles assigned to the user in question.

diogofgm · ‎04-05-2023

Just place a text input in the dashboard and use normal dashboard tokens. Then you can make your search something like this: | mycustomcommand path=$path_token$

diogofgm · ‎04-03-2023

How are you indexing the data? UF with a monitor stanza in the syslog server? If that's te case the logs would be there. If not, do you have some rules that might change or discard the logs you are looking for? If, as I believe given the %Port_Security, you are running cisco devices use this: https://splunkbase.splunk.com/app/1467 The final source type should not be syslog but something like cisco:ios. Avoid using syslog as a final source type since the logs will be different fro device to device and it will make a mess to build proper extractions since they will apply to everything with math source type.

diogofgm · ‎04-03-2023

It seems that you might have some hidden characters in your original data. Open the file with e.g. VS Code and enable the the render control characters in the settings to check if there are hidden characters there.

diogofgm · ‎04-03-2023

Check the splunk dev portal. Its has some examples on custom commands. https://dev.splunk.com/enterprise/docs/devtools/customsearchcommands/ Also Splunk's git has some other examples for custom commands here: https://github.com/splunk/splunk-app-examples/blob/master/custom_search_commands/python/generatingsearchcommands_app/bin/generatingcsc.py In this example you can replace the count with a path to do something along the lines of: | mycustomcommand path="D:/Temp/temp.txt"

diogofgm · ‎04-03-2023

Hi Matheo Can you post the mongod.log and splunkd.log? As a side note, you should read the docs before upgrading Splunk. https://docs.splunk.com/Documentation/Splunk/9.0.4/Installation/HowtoupgradeSplunk v8.0.x should be upgraded to v8.1.x or V8.2.x before going to v9.0.x

diogofgm · ‎04-03-2023

Have you tried to index the xml version of those event?

diogofgm · ‎04-03-2023

Depending what you are trying to see I would say you could use either a sankey or a parallel coordinates custom viz. Sankey https://splunkbase.splunk.com/app/3112 Parallel Coordinates https://splunkbase.splunk.com/app/3137

diogofgm · ‎03-07-2023

There are no issues with either approaches. Depending on what data you are indexing you would probably need to have UFs/HFs on-prem to collect and forward data to you azure instances. Either way, since you are moving splunk to a new platform I would suggest you to take a look at Splunk's validated architectures for the best architecture that fists your org needs. With just 1 indexer you run the risk of having downtime on search and indexing in case of maintenance. https://www.splunk.com/pdfs/technical-briefs/splunk-validated-architectures.pdf

diogofgm · ‎03-07-2023

You use an account that has admin privileges. Usually you create one during the installation. Older versions used to have a default account (user:admin and pass:changeme) nowadays you just create one. If you forgot you can use these solutions to reset the password: https://community.splunk.com/t5/Security/How-to-Reset-the-Admin-password/m-p/10622

Posts	487
Solutions	53
Karma Given	139
Karma Received	146
Member Since	‎2014-09-22

Online Status	Offline
Date Last Visited	3 weeks ago

Using MLTK to advice optimal resource usage

Getting info from Splunkbase

How to extract an event timestamp where seconds an...

Splunk 7.0.0 and OSX High Sierra APFS

Is it possible to use Splunk DB Connect to search ...

Savvius for Splunk Dashboards and TA Savvius (nix ...

Monitoring of Java Virtual Machines with JMX: Why ...

get SNMP data from hosts listed in csv file

How to complete correlation of data contained in 2...

Re: Splunk Enterprise Security SH Does not see dat...

Re: Upgrade Readiness App

Re: Splunk Enterprise Security SH Does not see dat...

Re: Upgrade Readiness App

Re: sending a tcp packet as splunk soar action

Re: I want to validate patch work done on windows ...

Re: Download splunk apm on premises

Re: Group events by specific field and generate ti...

Re: How to use field extractions?

Re: How to optimize search performance?

Re: Congrats to the newest cohort of SplunkTrust m...

Re: How to filter data in an input lookup table?

Re: How to make a css script affect only specific...

Re: How can I resolve Return 0 for "No Results Fou...

Re: Logs delay due to timezone difference in the U...

Re: User not getting data

Re: How to create a custom generating search comma...

Re: Why is Splunk missing logs?

Re: CSV index renaming the first field to some ran...

Re: How to create a custom generating search comma...

Re: Error uploading from 8.0.X to 9.0.X in Linux w...

Re: WinEvenLog for Security EventCode IN (4768) m...

Re: Visualization

Re: Best practices to migrate Splunk from prim to...

Re: Getting Expired License message and says to lo...