About arisat

arisat · ‎09-25-2019

Sure. I have a few pretty huge multi-line events, and it contains both the initial and subsequent search values. It's an SNMP file, so there might be good techniques for reading this that I am unaware of. Here's a sanitized and reduced (for clarity) example: .1.3.6.1.2.1.2.2.1.2.10044 = STRING: "FastEthernet0/12" .1.3.6.1.2.1.2.2.1.2.10045 = STRING: "FastEthernet0/13" .1.3.6.1.2.1.2.2.1.2.10046 = STRING: "FastEthernet0/14" .1.3.6.1.2.1.2.2.1.2.10047 = STRING: "FastEthernet0/15" .1.3.6.1.2.1.2.2.1.2.10048 = STRING: "FastEthernet0/16" .1.3.6.1.2.1.2.2.1.2.10101 = STRING: "GigabitEthernet0/1" .1.3.6.1.2.1.2.2.1.2.10102 = STRING: "GigabitEthernet0/2" .1.3.6.1.2.1.2.2.1.2.10501 = STRING: "Null0" [...] .1.3.6.1.4.1.9.9.23.1.2.1.1.3.10101.1 = INTEGER: 1 .1.3.6.1.4.1.9.9.23.1.2.1.1.4.10101.1 = STRING: " .1.3.6.1.4.1.9.9.23.1.2.1.1.5.10101.1 = STRING: "Cisco IOS Software" .1.3.6.1.4.1.9.9.23.1.2.1.1.6.10101.1 = STRING: "cisco-switch-01.example.com" .1.3.6.1.4.1.9.9.23.1.2.1.1.7.10101.1 = STRING: "GigabitEthernet0/3" .1.3.6.1.4.1.9.9.23.1.2.1.1.8.10101.1 = STRING: "cisco WS-C2950D" So, in this case, I can see from the lower section that this switch is connected to another switch called "cisco-switch-01.example.com". And the OID string tells me that the "reference" is "10101". So what I want to do is go back to the event and search for the ".1.3.6.1.2.1.2.2.1.2.10101"-string because I have found "10101". But I am struggling to do just that. Is there a way to do: | rex field=_raw ".1.3.6.1.2.1.2.2.1.2." + myReference + ".*STRING: \"(?<myInterface>.*\"" Or something similar?

arisat · ‎09-24-2019

Hi, I have a rather large multiline event which I am trying to extract data from. The problem is that the format is along the lines of: key0 = "bob" key1 = "foo" key2 = "bar" bob = blah $value0 blah foo = $value1 blah bar = $value2 blah blah It's all rather annoyingly unstructured and arbitrary, so in order to find the values, I have to first extract the key1, key2 and key3 values, to know where to look for the values. I do this with rex, and it goes well. Then I go searching through the text for the values, again using regex. The problem is that I somehow have to feed the results from the first search into the subsequent regex searches, and at least REX does not seem to like it if I type 'rex field=_raw "somethingsomething" + $key1 + "something" ' Apparently it's static text only, no variables welcome. I did play around with the replace function in eval, but it does not seem to want to look beyond a single line. Any ideas how I can solve this? Best regards, Arild

arisat · ‎04-02-2019

Thank you very much. Seems to work fine for us.

arisat · ‎03-31-2019

Thank you very much! Amazing support 🙂

arisat · ‎03-31-2019

This is a great app, and we use it as a central part of our setup, as it is both easy to use and provides a really useful and intuitive visual presentation. But it's not supported on 7.2. Any chance it will be updated?

arisat · ‎12-15-2017

Nope. Couldn't even figure out if how SSL is handled in the Palo Alto App is being determined by Splunk itself, or the Palo Alto app. So I had no real chance of finding a conf file to set up to include the internal CA. Sometimes free support is worth every penny you pay for it 🙂

arisat · ‎12-07-2017

Alternatively, I am happy to disable SSL verification. I can't find that option in any of the config files, but I may well be missing something. Honestly, any help is much appreciated.

arisat · ‎12-07-2017

I keep getting this error in my Palo Alto App set up to interrogate a Minemeld URL: SSLError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:676) However, when I use openssl commands from the Splunk server to check the certificate of the Minemeld-server, it is fine. We use internal CA certificates in addition to the OS defaults (properly configured in the OS, of course). This leads me to suspect that Splunk or the Palo Alto app does not respect the OS settings. Is there a way to get it to do this, or do I have to start configuring this by hand?

Posts	8
Solutions	0
Karma Given	1
Karma Received	0
Member Since	‎11-01-2017

Online Status	Offline
Date Last Visited	‎06-08-2023 10:33 AM

How to extract from multiline events using regular...

Any chance of 7.2 support?

SSL errors when contacting minemeld URL

Re: How to extract from multiline events using reg...

How to extract from multiline events using regular...

Re: Any chance of 7.2 support?

Re: Any chance of 7.2 support?

Any chance of 7.2 support?

Re: SSL errors when contacting minemeld URL

Re: SSL errors when contacting minemeld URL

SSL errors when contacting minemeld URL