About pwild_splunk

pwild_splunk · ‎09-29-2020

To understand why this doesn't work as you're expecting you have to understand how the collect command works. When you pipe a search result into collect, it dumps the output of the command into a text file on your splunk server, which is then picked up by a monitor input for indexing in the same way as any other input. Just like when configuring a monitor input, you can specify the host field once for the input, you can't set it on an event by event basis. With collect, when you define fields like index=A, sourcetype=B, host=C you are defining them in the same way you would in an inputs.conf. Those fields are applied to the output for processing by Splunk's data pipeline.

pwild_splunk · ‎07-13-2020

Hi, I'm after suggestions on how to best approach this problem. I want to track over time how often I am seeing a mac address (src_mac) as categorised as: first time: never seen before daily: seen once per day for last 14 days weekly: seen at least once per week for last 8 weeks occasionally: seen before but not categorised as the above. I then want to timechart this on a day-by-day basis.

pwild_splunk · ‎04-28-2020

Thanks Brendan, I already had the ingestion index set when I was getting that error. However... I put dummy data in every field and that solved the problem. The only field I didn't have data in was "Ingestion safety max size" which I arbitrarily set to 200 (I assume this is bytes???). This solved the problem. Many thanks!

pwild_splunk · ‎04-28-2020

I'm trying to perform a simple GET action with this add-on but I'm not GETing anywhere. This is being reported in the logs. ERROR sendmodalert - Error in 'sendalert' command: Alert script returned error code 4. Looking through the code this error reports if the CIM app is not installed. Installing the app makes no difference. I'm setting these within the alert Endpoint: http://host.domain.local:5000/command Query string params: cmd=disarm&master_pin=ABCD http method: GET Any suggestions as to what I'm doing wrong?

pwild_splunk · ‎08-15-2019

I'm not wanting to build a dashboard, I wish to enrich the event data so that an investigator can search for a user and find the events associated with that user. The events in Source-B do not include a user field within the data, just a session. Source-A will map a session to a user when the user logs on.

pwild_splunk · ‎08-15-2019

I have two data sources Source A time action src_ip session user - "action" varies between (logon, logoff and relogon) - "session" contains a randomly generated sessionID that is unique and does not appear to be reused - "user" is the userid Source B time session What is the most efficient way of enriching the event data in Source B with the user that matches the session from source A? To give you an idea of the data-set size. source="Source A" | stats values(user) as user by session returns 17,000 odd unique tuples from around a million events and the job completes in under a second. Source B contains over 100 million events. Was thinking of running a regularly scheduled search to maintain a csv of user,session and then setting up a calculated field that performs a lookup (with the expectation that the newest events will not be enriched with a user. Suggestions anyone?

pwild_splunk · ‎10-16-2018

This will work. Remember that the map command, by default, is limited to only 10 sub-search iterations. Use the option maxsearches=10000 or something more appropriate for your data set. Converting the above to your actual search, see below. You probably don't need "_time=$orig_time$," in the eval. index="main" | eval orig_time=_time, orig_raw=_raw | map maxsearches=10000 search="|makeresults=1 |eval _time=$orig_time$, _raw=$orig_raw$ | collect index="scanned_app" sourcetype=X host=$asset_id$"

pwild_splunk · ‎10-15-2018

This may not do what you want. The events in the summary index will contain a host field that is multi-valued, containing the indexed host field as well as the auto-extracted host value. If the purpose of this is to create a dashboard or graph, you may be able to work with the data by removing the first value with something like this. | eval host=mvindex(host,1)

pwild_splunk · ‎10-15-2018

Try this index="main" | eval _raw=_raw.",host=".asset_id | collect index="scanned_app"

pwild_splunk · ‎07-13-2018

I have a complex search query that is quite slow when run over a longer period of time. It populates a dashboard. To improve the dashboard's performance, I'm using a summary index which is supplemented with yesterday's data every night but I also want to include today's data within the dashbaord. To do this, my dashboard has a search like this: Index=mysummary | appendpipe [ search index=mydata earliest=@d ] | table my, fields, here This works fine with the timepicker so long as latest is always now. If I choose something like "Previous week" in the timepicker on the dashboard, I still get today's data appended because of the "@d" in the subsearch. How can I modify the subsearch to only include today's data if today falls within the range of the timepickers time wndow?

pwild_splunk · ‎06-30-2018

Thanks for such a quick response!

pwild_splunk · ‎06-30-2018

I have some events like this. Wifi AP and DEVICE connected to it. A one to many AP to DEVICE relationship exists AP,DEVICE --------------- A1,D1 A3,D2 A3,D3 A3,D4 A4,D5 A5,D6 A5,D7 I need to reformat this data to be like this: tuple,D ----------- 1,A1 1,D1 2,A3 2,D2 3,A3 3,D3 4,A3 4,D4 5,A4 5,D5 6,A5 6,D6 7,A5 7,D7 Is there a cleaner way of doing this than below? search cmd | streamstats count as tuple | eval point="1,2" | makemv delim="," point | mvexpand point | eval D=if(point=1,AD,DEVICE) | table tuple D This is so I can use the Map+ vis to draw lines between these connected devices.

Posts	12
Solutions	0
Karma Given	0
Karma Received	2
Member Since	‎09-19-2017

Online Status	Offline
Date Last Visited	‎03-17-2021 01:31 AM

How to best track the frequency of repeating event...

Can't perform a GET action with this add-on

what is the best way to enrich events from another...

How can I use a dashboard timepicker across two ti...

How can I split similar fields into multiple relat...

Re: changing `host` and persisting the result

How to best track the frequency of repeating event...

Re: Can't perform a GET action with this add-on

Can't perform a GET action with this add-on

Re: what is the best way to enrich events from ano...

what is the best way to enrich events from another...

Re: changing `host` and persisting the result

Re: changing `host` and persisting the result

Re: changing `host` and persisting the result

How can I use a dashboard timepicker across two ti...

Re: How can I split similar fields into multiple r...

How can I split similar fields into multiple relat...