Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About mdelwaide
mdelwaide
Path Finder
Member since:
12-20-2016
11-30-2021
Community Statistics
| Posts | 11 |
| Solutions | 2 |
| Karma Given | 1 |
| Karma Received | 1 |
| Member Since | 12-20-2016 |
Activity Feed
- Karma Re: Why are some expected events missing when applying a filter in our search? for somesoni2. 06-05-2020 12:48 AM
- Got Karma for Re: Timeline - Custom Visualization: How do I resolve error "Failed to load source for Timeline visualization"?. 06-05-2020 12:48 AM
- Posted Re: Can you help me create a dashboard based on a number of Windows events? on Getting Data In. 10-25-2018 01:24 PM
- Posted Re: How can I append a second chart drill down to an existing input? on Dashboards & Visualizations. 04-06-2017 05:25 AM
- Posted Re: How can I append a second chart drill down to an existing input? on Dashboards & Visualizations. 04-04-2017 07:14 AM
- Posted Re: How to edit my configurations to encode French special characters (é à ê è)? on Getting Data In. 02-27-2017 01:07 PM
- Posted Re: Timeline - Custom Visualization: How do I resolve error "Failed to load source for Timeline visualization"? on All Apps and Add-ons. 02-07-2017 01:05 PM
- Posted Re: Why are some expected events missing when applying a filter in our search? on Splunk Search. 02-06-2017 02:19 PM
- Posted Re: Why are some expected events missing when applying a filter in our search? on Splunk Search. 02-06-2017 02:16 PM
- Posted Re: Why are some expected events missing when applying a filter in our search? on Splunk Search. 12-20-2016 12:49 PM
- Posted Re: Why are some expected events missing when applying a filter in our search? on Splunk Search. 12-20-2016 12:41 PM
- Posted Re: Why are some expected events missing when applying a filter in our search? on Splunk Search. 12-20-2016 12:34 PM
- Posted Why are some expected events missing when applying a filter in our search? on Splunk Search. 12-20-2016 11:59 AM
- Tagged Why are some expected events missing when applying a filter in our search? on Splunk Search. 12-20-2016 11:59 AM
- Tagged Why are some expected events missing when applying a filter in our search? on Splunk Search. 12-20-2016 11:59 AM
- Tagged Why are some expected events missing when applying a filter in our search? on Splunk Search. 12-20-2016 11:59 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 |
10-25-2018
01:24 PM
Have you tried extracting the Security IDs by creating a new field representing the parent? We had the same problem, users wanted to have a distinct field for each Security IDs and we used an extract in Props.conf to do it
[WinEventLog:Security]
EXTRACT-SUBJECT_SUB_Extract = Subject\s?:\s+Security ID:\s*(?P<Subject_Security_ID>(.*?))\s*Account Name:\s*(?P<Subject_Account_Name>(.*?))\s*Account Domain:\s*(?P<Subject_Account_Domain>.*?)\s*Logon ID:\s*(?P<Subject_Logon_ID>\S*?)
EXTRACT-GROUP_SUB_Extract = Group\s?:\s+Security ID:\s*(?P<Group_Security_ID>(.*?))\s*Group Name:\s*(?P<Group_Group_Name>(.*?))\s*Group Domain:\s*(?P<Group_Group_Domain>(\S*?))\s
EXTRACT-NEWLOGON_SUB_Extract = New Logon:\s+Security ID:\s*(?P<NLogon_Security_ID>(.*?))\s*Account Name:\s*(?P<NLogon_Account_Name>(.*?))\s*Account Domain:\s*(?P<NLogon_Account_Domain>(\S*?))\s+Logon ID:\s*(?P<NLogon_Logon_ID>\S*?)\s
M.
... View more
04-06-2017
05:25 AM
Hi Andrew,
It seems it's something you can't do out of the box, but I was able to populate a multiselect dropdown with tokens. But it's not possible to automatically populate the multiselect box with those value.
Although I found a javascript that allows you to automatically select the first value of your multiselect, maybe with a bit of coding you'll be able to arrange the code to automatically set all the available value to be selected.
Regards
M.
https://gist.github.com/hobbes3/7c52b67c1de5ba4d9dfe
<form>
<label>test</label>
<fieldset submitButton="false">
<input type="dropdown" token="value1">
<label>field1</label>
<choice value="Test">Test</choice>
<choice value="Test1">Test1</choice>
</input>
<input type="dropdown" token="value2">
<label>field2</label>
<choice value="Test2">Test2</choice>
<choice value="Test3">Test3</choice>
</input>
<input type="multiselect" token="field1" searchWhenChanged="true">
<search>
<query>| makeresults | eval Title="$value1$,$value2$" | makemv delim="," Title | mvexpand Title | appendcols [| makeresults | eval Value = "$value1$,$value2$" | makemv delim="," Value | mvexpand Value] | fields Title,Value</query>
</search>
<fieldForLabel>Title</fieldForLabel>
<fieldForValue>Value</fieldForValue>
</input>
</fieldset>
<row>
<panel>
<html>
$value1$
</html>
</panel>
</row>
<row>
<panel>
<html>
$value2$
</html>
</panel>
</row>
</form>
... View more
04-04-2017
07:14 AM
Hi Andrew,
Have you tried a background search to merge both token value? I did a small test on my local Splunk and it seems to be working.
<form>
<label>test</label>
<search>
<query>| makeresults | eval merge="$value1$,$value2$"</query>
<preview>
<set token="valuemerge">$result.merge$</set>
</preview>
</search>
<fieldset submitButton="false">
<input type="dropdown" token="value1">
<label>field1</label>
<choice value="Test">Test</choice>
<choice value="Test1">Test1</choice>
</input>
<input type="dropdown" token="value2">
<label>field2</label>
<choice value="Test2">Test2</choice>
<choice value="Test3">Test3</choice>
</input>
</fieldset>
<row>
<panel>
<html>
$value1$
</html>
</panel>
</row>
<row>
<panel>
<html>
$value2$
</html>
</panel>
</row>
<row>
<panel>
<html>
$valuemerge$
</html>
</panel>
</row>
</form>
I've simulated both of your input with static dropdown, when both are set, the 3rd value (merge) is calculated.
Also when you change on of the inputs, the 3rd field is recalculated
Hope this will help you
Regards
M.
... View more
02-27-2017
01:07 PM
Have you tried this encoding in your props.conf ?
[SOURCETYPE]
CHARSET=CP1252
... View more
02-07-2017
01:05 PM
1 Karma
Hi Duraij,
I had the same problem today with this App. Here is the steps I did to resolve it.
We are running 6.4.2, btw.
I made sure to install the Timeline App with the version 1.0.1. To do so, in the drop down next to the release notes box, make sure to select 1.0.1 and click the download button.
Next, install the app on your Splunk Search head, and restart your Splunk
Clear your browser cache
Try accessing your Timeline App, you should see a visualization demo. If it's still not working, try to access your Search Head with an In-Private Browser session
Hope it helps
M.
... View more
02-06-2017
02:19 PM
Thanks somesoni2 for your help, your last fix helped us out with our problem.
Steps:
On our SH and Indexers we deployed a TA with a fields.conf file with this stanza :
[application]
INDEXED = true
(Reference: https://answers.splunk.com/answers/389567/why-is-a-search-for-fields-added-with-meta-in-inpu.html)
Restarted and the problem was gone.
Thanks again
M.
... View more
02-06-2017
02:16 PM
Hi, sorry for the late reply. It fixed our problem. I'll add an answer to the question with your fix. Thanks for your help
... View more
12-20-2016
12:49 PM
I've got only 3's
... View more
12-20-2016
12:41 PM
No, showing only 10 Events
... View more
12-20-2016
12:34 PM
index=grc application=*IAM
yes (Only IAM)
index=grc | regex application="IAM"
We get all events (IAM and IAM:IWSS)
index=grc application!=IAM:IWSS
yes
... View more
12-20-2016
11:59 AM
We recently onboarded some applications' logs, and at our client request, we had to put a custom field to have the application name in the fields. Since those weren’t in the log file, we hard-coded the application name in the log with a “_meta” field in the inputs.conf stanza. Since each application has its own stanza, it was easy.
One of the analysts discovered this week that some events were discarded when a filter was applied for a certain application. We were able to reproduce the problem at a smaller scale.
Here the picture shows that there are 11 events for IAM, if we apply the filter for that application...
This is only a 5 minutes window, at a "All Time" time range it's more than 10K events that goes missing
Here is our Inputs.conf for that application
[monitor://D:\APPLogs\IAM\IAM.log]
index = grc
sourcetype = GRC:APP
alwaysOpenFile = 1
disabled = false
_meta = application::IAM
... View more
