About ruman_splunk

ruman_splunk · ‎04-09-2023

Yes, you're right. Splunk does not monitor the audit logs with a file input. Instead Splunk sends audit events directly to the ingest queue. This can be disabled in audit.conf. Please see https://docs.splunk.com/Documentation/Splunk/latest/Admin/Auditconf for details.

ruman_splunk · ‎10-05-2022

wiki.splunk.com was removed. too much old info, no one managing it. you can still grab the old page from wayback: https://web.archive.org/web/20201202100505/https://wiki.splunk.com/Where_do_I_configure_my_Splunk_settings%3F

ruman_splunk · ‎04-07-2022

When you create the [syslog:Myroutingrsa] stanza, all data is sent to that group. In order to avoid default sending data to that group, you could try something like [syslog] defaultGroup = bogusGroup where bogusGroup does not exist. this is analogous to the tcp routing instructions here: https://docs.splunk.com/Documentation/Splunk/latest/Forwarding/Routeandfilterdatad#Index_one_input_locally_and_then_forward_the_remaining_inputs Since the defaultGroup is set to the non-existent group "noforward" (meaning that there is no defaultGroup), the forwarder only forwards data that has been routed to explicit target groups in inputs.conf. It drops all other data.

ruman_splunk · ‎01-12-2022

appending action.lookup allows for appending. action.populate_lookup does not. specifying a target lookup action.lookup requires a filename (relative to the current app). action.populate_lookup allows you to specify a transforms stanza or path for the lookup, and allows you to update a lookup in some other app or in etc/system/lookups. limits action.lookup has a 50K row limit. action.populate_lookup does not have a limit. scheduling action.populate_lookup has additional scheduling options run_on_startup and run_n_times. See also: https://community.splunk.com/t5/Splunk-Search/quot-outputlookup-quot-vs-quot-action-populate-lookup-quot/m-p/38565 So, you can't use savedsearches.conf to configure a lookup action if you need to append more than 50K results - must use outputlookup in this case.

ruman_splunk · ‎01-12-2022

https://docs.splunk.com/Documentation/Splunk/latest/admin/savedsearchesconf mentions two lookup-generating actions: action.lookup and action.populate_lookup. Some of the differences are clear, though not explicitly listed, in the docs. What's the complete set of differences? When should I use one or the other and when do I have to use outputlookup? action.lookup = <boolean> * Specifies whether the lookup action is enabled for this search. * Default: false action.lookup.filename = <lookup filename> action.lookup.append = <boolean> and action.populate_lookup = <boolean> * Specifies whether the lookup population action is enabled for this search. * Default: false action.populate_lookup.dest = <string> run_on_startup = <boolean> run_n_times = <unsigned integer>

ruman_splunk · ‎10-05-2020

Solution is here! https://community.splunk.com/t5/Dashboards-Visualizations/How-do-I-populate-a-multiselect-input-box-with-drilldowns-in/m-p/307373#M19580 Thanks @niketn !

ruman_splunk · ‎09-15-2020

This is a bug, since 6.6.0 apparently. I've tagged it to get included in docs known issues. SPL-173061.

ruman_splunk · ‎05-28-2020

I needed both KV_MODE and AUTO_KV_JSON, thanks @woodcock!

ruman_splunk · ‎05-28-2020

Do an EXTRACT in props.conf that completely ignores the fact that it's JSON 🙂 e.g. [foo] EXTRACT-PatchState = "PatchState: \"(?<PatchState>[^\"]+)\","

ruman_splunk · ‎01-14-2020

I got clarification from engineering: If your searches are EXACTLY the same. Including time range (meaning that if you do not have exact time range this is super rare.) Then it will reuse. Basically if you run a search wait 1 second then run it again we do not reuse. If you have normal time ranges from like latest=now earliest=-5m it will not reuse but if instead you were doing. earliest=-2d@d latest=-1d@d then it can end up reusing.

ruman_splunk · ‎01-14-2020

I'm pretty sure this is not the case. You're probably seeing the effect of the OS caching tsidx files. Or, if you're on Splunk Cloud, you're seeing the effect of buckets in s3 getting localized to the search peers on the first search, so the second search doesn't need to copy buckets from s3.

ruman_splunk · ‎12-05-2019

Please see https://answers.splunk.com/answers/770718/cloud-snowflake-db-connect-integration.html#answer-779992. I've got it working with DB Connect 3.1.3 and Splunk 7.0.8 after following the answer there.

ruman_splunk · ‎09-09-2019

But this is not quite true. A report can have actions. I think @kmaron's response is correct - a saved search is an alert if it has a trigger condition.

ruman_splunk · ‎07-12-2019

I've discovered two workarounds for this: More generically: create the input in JS using the webframework. You can set a default with multiple values programatically in JS. require([ "splunkjs/mvc/searchmanager", "splunkjs/mvc/multidropdownview", "splunkjs/mvc/simplexml/ready!" ], function( SearchManager, MultiDropdownView ) { var foo = new MultiDropdownView({ id: "foo", choices: [ {label:"One", value: "1"}, {label:"Two", value: "2"}, {label:"Three", value: "3"}], el: $("#foo") }).render(); foo.settings.set("default", [1, 2]); }); If (as I do) you have two sets of default options that you're choosing between, create two inputs in SimpleXML identical except for the (inline) default values and show only one of them depending on which set of defaults should be shown.

ruman_splunk · ‎07-11-2019

I'm interested here in setting the default value from a token, not setting the options themselves, but thank you!

ruman_splunk · ‎07-11-2019

This didn't work for me, but this did: | eval [ | rest splunk_server=local /services/server/info | return host ]

ruman_splunk · ‎07-10-2019

It feels like there's something that the UI does when there's an inline default, that gets skipped when the default comes from a token (maybe because the token gets set after the multiselect input initializes) In which case, I'm looking for some way to kick the input so that it reprocesses the default. I wonder if instead of setting a default, I want to fire an event when the token is set, and update the value of the multiselect, but there doesn't seem to be any way to do that that I can figure out...

ruman_splunk · ‎07-10-2019

Hi! I have a dashboard with a multiselect input. Let's pretend it has 3 choices <input type="multiselect" token="foo"> <label>bar</label> <choice value="1">One</choice> <choice value="2">Two</choice> <choice value="3">Three</choice> If I set a default with multiple values, the UI is very pretty <default>1,2</default>  But if I set a token that contains the same string and use that as the default, the UI shows values instead of labels, which is ugly! <init><set token="foo_default">1,2</set></init> ... <default>$foo_default$</default>  How do I get the multiselect UI to render labels when I am supplying multiple default values with a token? Setting depends="$foo_default$" on the input does not help. Setting a single default value with a token works as expected.

ruman_splunk · ‎01-22-2019

It is impossible to pass fields to eval macros. Macro expansion happens before the search is parsed. At macro expansion time, there are no fields! Let alone values assigned to fields. The search has not happened yet. To work around this, replace the eval macro with a regular macro that generates an eval.

ruman_splunk · ‎04-27-2018

Thanks Dal! This allows me to upgoat my own answer XD

ruman_splunk · ‎11-10-2017

Yeah, I agree with Rich, and suspect that "yes this is possible, no this is not supported". I'm also curious what issues you're having with insert/update into Mongo, tell us more about your installation and where things are breaking down.

ruman_splunk · ‎08-09-2017

No objections from Splunk OSS Council if you'd like to maintain a forked repository of the current version.

ruman_splunk · ‎08-08-2017

The source is currently stored in an internal Splunk repository. The app is community supported. So, sadly, that means there's no repo to make a PR against and no individual or team at Splunk to send contributions to. It looks like it's Apache licensed: https://splunkbase.splunk.com/app/1438/ -> https://www.apache.org/licenses/LICENSE-2.0 IANAL, but per section 4 on redistribution, it seems like you should be able create a public repository with the code from the current app and then start forking if you'd like to maintain a fork. I'll bring this up with the Splunk open source council and see what they think.

ruman_splunk · ‎02-14-2017

https://github.com/splunk/ponydocs/blob/master/INSTALL.md should have step-by-step instructions for getting ponydocs working (but YMMV, it's not at all as easy as it should be). There's also a ponydocs chat room in Slack (https://splunk-usergroups.slack.com/, request an account at http://splunk402.com/chat/) that might be able to provide interactive support.

ruman_splunk · ‎08-04-2016

https://en.wikipedia.org/wiki/Metasyntactic_variable#English

Posts	32
Solutions	4
Karma Given	23
Karma Received	25
Member Since	‎09-18-2015

Online Status	Offline
Date Last Visited	‎04-10-2023 03:12 AM

What is the difference between action.lookup and a...

How do I make a multiselect dashboard input pretty...

Re: disabling audittrial logs in splunk

Re: Where do I configure my various Splunk setting...

Re: Forward events to both our indexers and a sysl...

Re: What is the difference between action.lookup a...

What is the difference between action.lookup and a...

Re: How do I make a multiselect dashboard input pr...

Re: Issue while updating Splunk custom command per...

Re: Duplicate Extracted Fields (ingest through HEC...

Re: How to extract key value pairs from JSON with ...

Re: My Search Is Faster the Second and "X" times I...

Re: My Search Is Faster the Second and "X" times I...

Re: Does DB_Connect work with Snowflake?

Re: What is the difference between alert and repor...

Re: How do I make a multiselect dashboard input pr...

Re: How do I make a multiselect dashboard input pr...

Re: eval a new field base on a search result

Re: How do I make a multiselect dashboard input pr...

How do I make a multiselect dashboard input pretty...

Re: How to string compare field values in an eval ...

Re: Insert a heading between rows and customise it...

Re: Change Splunk mongodb to use wiredtiger storag...

Re: Where is the source for this app?

Re: Where is the source for this app?

Re: Is Ponydocs still the documentation platform f...

Re: How to handle simple JSON array with spath