About goji

goji · ‎06-08-2023

There are two selection "enable to risk index" and "enable to test index" from Content Management view, but these two option is dis-highlighted from default. It seems does not work properly. I think this function is that we can select each of correlation search, and then I can set to risk index but we can not do it them. Is it possible to select multiple correlation searches and enable the risk index all at once?

goji · ‎08-22-2022

Hi, @gcusello , Yes, I agree. I gonna certainly try to post to Splunk Idea as well since this is about ES functionality. Well, I don't know if I can do it, but I will try this one. Chao!!

goji · ‎08-21-2022

@gcusello Thank you for telling me your opinion! There are two reasons. The first reason is that the ES content management web interface does not allow data source selection; you can specify data sources in SSE, but not in ES. So after selecting data sources in SSE, I have to enable them visually one by one in the ES content management web interface. Its like a copy/past, copy/past copy/past, This feels like a waste of time. So I am thinking of creating a script that simply extracts default/savedsearch.conf for each Apps and let them specify the data source using rest, and save only the necessary ones in local/savedsearch.conf for each App. But when I changed savedsearch.conf in the CLI, it didn't reflect the change, which is why I asked this question. Debug/reflesh didn't work, so if I need to reboot, that's what I'm going to do. The second is from a backup/recovery perspective. I want to manage multiple generations of each policy set. And if necessary, I want to easily restore what I have saved in the CLI. I understand that we can still do backups to the Apps we have created, but I am fed up with the large number of Apps that will be created if we manage them frequently. Also, I only intend to set diabled=1/0 for local/savedsearch. I don't set anything else, so I don't think there are any configuration issues. Ciao

goji · ‎08-16-2022

Hi, There are many app and correlation searches in each app in Enterprise Security. I understand that I can enable/disable correlation search using ES Web Interface, but I want to manage using CLI about enabling/disabling correlation search. I mean, I just want to change many rules and many apps to "disabled = 0" or "disabled =1" in savedsearch.conf using CLI(like shell). I already tried the below test after savedsearch.conf from CLI access to : https://ip:8000/en-US/debug/refresh access to : https://ip:8000/en-US/_bump However, the disable/enable changes are not reflected when I look at the web for purpose of checking. Does anyone know how to make changes to ES correlation rules(savedsearch.conf) in the CLI and update searches without rebooting Splunk?

goji · ‎08-10-2018

nittala_surya, This data was a bit old, so I could read it by increasing the value of MAX_DAYS_AGO. Thank you!!!

goji · ‎08-10-2018

I use "&" instead of "?" in front of year, but it doesn't work.

goji · ‎08-04-2018

This is my data from with html tags. This is just single line. 03/<tr class="mtx" style="text-align:right;"><td style="white-space:nowrap"><div class="a_print"><a href="hourly_s1.php?prec_no=44&block_no=47662&year=1980&month=03&day=1&view=p1">1</a></div></td><td class="data_0_0">997.3</td><td class="data_0_0">1001.6</td><td class="data_0_0">13.5</td><td class="data_0_0">5.5</td><td class="data_0_0">1.5</td><td class="data_0_0">9.1</td><td class="data_0_0">14.2</td><td class="data_0_0">4.5</td><td class="data_0_0"> 59</td><td class="data_0_0"> 40</td><td class="data_0_0">6.5</td><td class="data_0_0">13.6</td><td class="data_0_0" style="text-align:center">–k–k¼</td><td class="data_0_0">24.6</td><td class="data_0_0" style="text-align:center">–k</td><td class="data_0_0">--</td><td class="data_0_0">--</td><td class="data_0_0">--</td><td class="data_0_0" style="text-align:left">‰J</td><td class="data_0_0" style="text-align:left">~ ‚È‚µ</td></tr> The time of this data consists of three pieces of information: year=, month=, and date=. So, I just use custom DATETIME_CONFIG to ingest the data but it doesn't work. This is my created .xml file. <datetime> <define name="test" extract="year, month, day"> <text><![CDATA[(?year\=(\d{4})&month\=(\d{2})&day\=(\d{1,2})]]></text> </define> <timePatterns> <use name="test"/> </timePatterns> <datePatterns> <use name="test"/> </datePatterns> </datetime> I think there is no grammatical error because there was no error at splunk restarted. How do I index one _time field from three separated time data at index time? Thank you,

goji · ‎04-04-2017

Thank you somesoni2! This is perfect answer!!

goji · ‎03-29-2017

The date are all number field, such as cluster, field_1, field_2, field_3, field_4, field_5 1 3 56 6 767 8 1 56 6 5432 5 7 2 6 65 987 356 6767 2 65 56 4321 4 56 3 3 5656 65 56456 56 I'd like to calculate min/max/avg/stdev of each line. I understand that can stats min() max() avg() stdev() by xxxx, but stats returned like min(field_1) max(field_2) avg(field_3) ..... as new column. But, I want display min/max/avg/stdev on each line just like tableau or excel pivot table function. For example, new_field, field_1, field_2, field_3, field_4, field_5, min 3 6 6 5 7 max 30 31 2,719 386 8 avg 30 31 2,719 386 8 stdev 37.47 35.35 3836.76 538.81 0.707 I mean, stats can calculate in parallel but I want to calculate it vertically. Anyone have any idea? If I could, I'd like to group by cluster number with min/max/avg. Thanks,

goji · ‎02-01-2017

自己解決しました。 | eval a1=ltrim(link,"https?://") で、URLから、http://または、https://を削除します。そして、ドリルダウンパネルを利用して、 <drilldown> <condition field="a1"> <link>http://$click.value2|n$</link> </condition> <condition field="link"> <link>http://www.google.com/#q=$click.value2$</link> </condition> </drilldown> で渡すとa1をクリックすると実リンクに飛び、linkをクリックすると、workflowアクションのように、URLををGoogleの引数に渡し、検索結果を表示することができました。Dashboardサンプル集が参考になりました。httpでも、httpsでもいけます。以上でございます。

goji · ‎01-30-2017

Webアクセスのデータの中にURL Link情報（例えばreferer)データの中に、例えば、www.splunk.comという文字があったとします。ダッシュボード内に、table refererというデータを表示することで、このURL一覧が表示できますが、このrefererをクリックすることで、splunkの検索ではなく、実際の外部リンクに直接アクセスすることは可能でしょうか？補足：workflowアクションでは、$!referer$で実現できることはできましたが、ダッシュボードから直接リンクをクリックしてアクセスしたいと考えております。よろしくお願いいたします。

goji · ‎06-20-2016

props.confのEXTRACTは、フィールド抽出の際に利用されます。マニュアルとしましては、http://docs.splunk.com/images/a/a0/Splunk-6.3.0-ja_JP-Data.pdfになりますが、ちょっとわかりづらいです。これは実際には正規表現の世界になります。^ \w \s \d + ? の意味については外部サイトになりますが、こちらを参照されるのも方法かと思います。http://homepage2.nifty.com/jr-kun/hidemaru_qa/4_regulr.html#BASIC。　実際にはこの正規表現を利用して、キャプチャという機能を利用してフィールド名を定義して、フィールドを決めています。上記の例ではキャプチャの際のフィールド名の定義がありませんが、キャプチャは, (?P ) 内に囲まれたものになります。このにフィールド名を定義しますが、キャプチャ内の正規表現にマッチした文字列が値となります。例えば、実際のデータが、 NETWORK の場合、フィールド名にaccessvector 値にNETWORKを取りたいとします。この場合は、EXTRACT-accessvector = (?P[^<]+) となります。前の文字、はキャプチャの前にヒットする文字です。(?P<フィールド名>実際の値 ) がキャプチャになります。フィールド名は< >で囲まれたものです。そのあとの [^<] は、”<”でない文字列があり、その後の"+"で"<"ではない文字が続くまで文字を取得するという意味になります。

Posts	12
Solutions	1
Karma Given	0
Karma Received	2
Member Since	‎03-28-2016

Online Status	Offline
Date Last Visited	3 weeks ago

What is the "enable to risk index" and "enable to ...

Is it possible to enable correlated search in ES b...

How do I index one _time field from separated diff...

How to calculate min/max/avg/stdev by each line

外部リンクをクリックし、外部リンクに直接ジャンプすることは可能でしょうか？

What is the "enable to risk index" and "enable to ...

Re: Is it possible to enable correlated search in ...

Re: Is it possible to enable correlated search in ...

Is it possible to enable correlated search in ES b...

Re: How do I index one _time field from separated ...

Re: How do I index one _time field from separated ...

How do I index one _time field from separated diff...

Re: How to calculate min/max/avg/stdev by each lin...

How to calculate min/max/avg/stdev by each line

Re: 外部リンクをクリックし、外部リンクに直接ジャンプすることは可能でしょうか？

外部リンクをクリックし、外部リンクに直接ジャンプすることは可能でしょうか？

Re: props.conf を編集してフィールド抽出する方法について