Hello, I have multiple values for a field in my search results and they look like the ones below. Can you show me the condition to regex the second value so that it becomes "aks-nodes-15133334-vmss" without the trailing numbers after vmss? At the same time, I would like to maintain value 1 as it is since it doesn't have "vmss" in the trailing name. So, if the value contains vmss, remove the trailing numbers but if there's no vmss in the value, let the value remains at it is. Before 1) aks-agentpool-60893500-2 2) aks-nodes-15133334-vmss000002 After 1) aks-agentpool-60893500-2 2) aks-nodes-15133334-vmss If I do this (?<host>.+\D), it will make item 2 looks like aks-nodes-15133334-vmss but it makes item 1 looks like aks-agentpool-60893500- Thank you for your help. ... View more

I have multiple checkboxes which depending on the selections, it would hide or show different panels. Consider one panel for one checkbox. There's no problem if I were to select only 1 checkbox. But if I were to select multiple checkboxes, it doesnt display the multiple panels.   <input type="checkbox" token="search_option"> <label>Search By</label> <choice value="sports">Sports</choice> <choice value="news">News</choice> <choice value="movies">Movies</choice> <change> <!-- Conditionally set/unset panels based on selections made --> <condition value="sports"> <set token="input_sports">true</set> <unset token="input_news"></unset> <unset token="input_movies"></unset> <set token="output_sports">true</set> <unset token="output_news"></unset> <unset token="output_movies"></unset> </condition> <condition value="news"> <set token="input_news">true</set> <unset token="input_sports"></unset> <unset token="input_movies"></unset> <set token="output_news">true</set> <unset token="output_sports"></unset> <unset token="output_movies"></unset> </condition> <condition value="movies"> <set token="input_movies">true</set> <unset token="input_sports"></unset> <unset token="input_news"></unset> <set token="output_movies">true</set> <unset token="output_news"></unset> <unset token="output_sports"></unset> </condition> <condition match="$search_option$==&quot;sports news movies&quot; OR $search_option$==&quot;sports movies news&quot; OR $search_option$==&quot;news sports movies&quot; OR $search_option$==&quot;news movies sports&quot; OR $search_option$==&quot;movies sports news&quot; OR $search_option$==&quot;movies news sports&quot;"> <set token="input_sports">true</set> <set token="input_news">true</set> <set token="input_movies">true</set> <set token="output_sports">true</set> <set token="output_news">true</set> <set token="output_movies">true</set> </condition>   Specifically,  when I select all 3 boxes (sports, news and movies), it doesn't output the 3 panels. I think it doesn't output because the individual checkbox already has a condition to unset the other panels if only one checkbox is selected. If I remove the unset condition for the individual checkbox,  then it would not remove the other panels if only a particular checkbox is selected. So, how do: 1) If only one checkbox is selected, output only the specific panel 2) If two or more checkboxes are selected, then output the respective checkboxes Thank you. ... View more

Hello everyone, Does anyone know what the above error message means when using the sendemail function? I've googled it but there were no results. Alert email works fine but not sendemail. FYI, this error occurred on Splunk Cloud. I've seen a similar error below in Splunk on-prem (solved by adjusting some roles to the account) but this is a new error that I've encountered.    [map]: command="sendemail", 'rootCAPath' while sending mail to: xxx@gmail.com   It appears that the sendemail function is not configured or installed in this Splunk Cloud instance. Is there any steps that needs to be configured by the admin (sendemail.py, etc)? I supposed the configurations should be the same as in Splunk on-prem? If yes, would appreciate your advice so that I can let my admin know.   Thank you. ... View more

Basically, I'd like to have a ticket created whenever an alert is triggered or when Submit button is pressed. The Remedy platform already has an API for this and I tested a POST request (using Postman) based on the required arguments and a ticket would be created successfully. The alert that I have created works fine (e.g. email sent) but the question is, where and how can I implement that ticketing "arguments" into my Splunk script/alert? I've read about Webhook but not sure how to progress further. Below is a sample of the POST call I made to the Remedy endpoint using Postman.   { "Customer": "na\\johndoe", "Contact": "", "Summary": "Group Removed", "Notes": "The Group ABC.LG was removed from Administrator", "Priority": "High", "Work_Order_Type": "General", "Status": "Assigned", "Service": "Applications - Shared Platforms", "Assignee": "Tom Baker", "Group_Assign": "Analysis and Reporting" }   Any step-by-step guidance would be much appreciated. ... View more

I have a query that produce a sample of the results below. DateTime Namespace Type 18-May-20 sys-uat Compliance 5-May-20 emit-ssg-oss Compliance 5-May-20 sast-prd Vulnerability 5-Jun-20 portal-api Compliance 8-Jun-20 ssc-acc Compliance I would like to count the number Type each Namespace has over a period of time. The end result visualization chart should look like this. This would display the count of each Namespace (grouped by day or month) based on the time picker. For eample, sys-uat has a total 20 count Types for May and 9 count Types for June. This way, I can compare the counts each Namespace has side by side. If I do this, | timechart span=1month count by Namespace  the Namespace is split between the months. I want each Namespace to be displayed side by side. For example, the blue bars should be side by side instead of being split. Is there a way to do this? Thank you. ... View more

I have a base search that produces a lookup that contains a million rows. When doing inputlookup, it displays the number of events correctly. Sample data below. | inputlookup windows.csv _time time host event user 2020-05-20T00:00:01.000+0000 5/20/2020 qatads23 4624 kristin 2020-05-22T00:00:12.000+0000 5/22/2020 sgpads30 4624 john 2020-05-24T00:00:12.000+0000 5/24/2020 sgpads30 4624 alice 2020-05-24T00:00:28.000+0000 5/24/2020 sgpads30 4624 mike 2020-05-24T00:00:33.000+0000 5/24/2020 sgpads30 4624 susan 2020-05-24T00:00:33.000+0000 5/24/2020 sgpads30 4624 lisa   However, when the search is being put into a dashboard, the number of results returned is lesser. I suspect that this is related to a truncate issue.  I noticed the bigger the lookup, the number of results returned reduces more even though the date range selected is the same from the time picker. For example, when I select the date range from May 20th-25th, the number of events returned is 180,000. However, as the lookup file grows, the same date range returns lesser events, maybe around 150,000. Below is the example of the script to get the time format in order for the time picker to work with the time field when searching based on a lookup file. Reference - https://www.splunk.com/en_us/blog/tips-and-tricks/i-cant-make-my-time-range-picker-pick.html | inputlookup windows.csv | eval time=strftime(_time,"%Y-%m-%d") | addinfo | where _time>=info_min_time AND (_time<=info_max_time OR info_max_time="+Infinity") | eval Start_Time=strftime(info_min_time,"%m/%d/%y") | eval Stop_Time=strftime(info_max_time,"%m/%d/%y") | fields _time host event user | search $field1$ $field2$ | sort 0 _time _time time host event user 2020-05-20T00:00:01.000+0000 5/20/2020 qatads23 4624 kristin 2020-05-22T00:00:12.000+0000 5/22/2020 sgpads30 4624 john 2020-05-24T00:00:12.000+0000 5/24/2020 sgpads30 4624 alice 2020-05-24T00:00:33.000+0000 5/24/2020 sgpads30 4624 susan   Noticed that 2 entries (mike and lisa) are missing from the original lookup. One thing to note is that when searching via index, there's no issue on the number of results returned except that it's very slow. Hence, I appended the results into a lookup file and search from that file instead. Theoretically, this should be faster. Below is the same search but querying from the index instead of lookup file. index=windows | fields _time host event user | search $field1$ $field2$ | sort 0 _time Any help would be much appreciated. Thank you. ... View more

I am using a Python script to send data to Splunk via HEC. There's no problem when curling a simple "Hello World". However, I would like to curl search results (json format) obtained via a Python script. Here's how the snippet of the Python script to get the results in json format. The results look like this: {'_id': {'$oid': '5ec4f96e67ac75656af5ea5b'}, 'created_at': '2020-05-10T09:33:33.490855', 'appid_caller': 'fg67k78k-7f44-5c90-a1b6-42gf5jjjj00a', 'input': {'target_host': 'portal-azure.cloud.io', 'target_port': 443}, 'output': {'result': False, 'info': 'Application has failed security checks. Drill down the results [array] to find information.', 'results': [{'category': 'hosting', 'result': False, 'title': 'Insecure use of shared hosting subdomain', 'description': "The application uses shared hosting parent domain. Recommended to use (e.g.: *.abc.com, *.abc.cloud, etc).", 'cwe': 348, 'checks': []}]}} Question is: how do I curl the results (server_info) using HEC? I'm getting an error 400. I'm guessing the problem lies with the 'data' variable where it may not be defined properly. Also, I've tried the endpoints; services/collector and services/collector/event but none worked. When using services/collector/raw endpoint, I did get a response code 200 which indicated successful but jargon data was displayed in Splunk. Below is the post script used. splunk_headers = {'Authorization': 'Splunk f5t34545-xxxxxc-xxxx-xxxx-xxxx-xxxxxxxx'} data = {"sourcetype": "server","event": server_info} response = requests.post('https://server03.na.abc.com:8088/services/collector/event', headers=splunk_headers, data=data, verify=False) Thank you. ... View more

In my Report Table, there were multiple lines of actions performed in the Active Directory. I want to take the value in a Target column and do a wild card search on the Notes column in Ticket Table for any records that match and return the Ticket Number. For example, I want to return the Ticket Number for the Password Reset activity done on Bobby. In this particular case, I need to do a wildcard search on Ticket Table in the Notes column for any words that has "Bobby" in it. The expected end result should be: I am able to return the results if both the columns (Target) in Report Table and (Notes) in Ticket Table are an exact match using the syntax below. But how can I achieve the results if I want to match the columns based on wildcards? Thank you. | inputlookup Report_Table.csv | lookup local=1 Ticket_Table.csv Notes AS Target OUTPUT Ticket_Number ... View more