Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About DBattisto
DBattisto
Communicator
Member since:
09-13-2018
10-04-2022
Community Statistics
| Posts | 49 |
| Solutions | 2 |
| Karma Given | 29 |
| Karma Received | 3 |
| Member Since | 09-13-2018 |
Activity Feed
- Posted How to possibly use spath within a tstats query? on Splunk Search. 10-04-2022 06:03 AM
- Posted Re: Is there a feature roadmap available? on Dashboards & Visualizations. 09-14-2022 09:06 AM
- Posted Is there a feature roadmap available? on Dashboards & Visualizations. 09-13-2022 06:14 PM
- Posted "Join" on a lookup not returning everything on Splunk Search. 09-08-2021 12:48 PM
- Got Karma for Re: stats(value) grouping but ignore a specific date/time field. 03-18-2021 09:34 AM
- Karma Re: stats(value) grouping but ignore a specific date/time field for richgalloway. 03-18-2021 09:04 AM
- Posted Re: stats(value) grouping but ignore a specific date/time field on Dashboards & Visualizations. 03-18-2021 09:03 AM
- Karma stats(value) grouping but ignore a specific date/time field for richgalloway. 03-17-2021 08:44 AM
- Posted Re: stats(value) grouping but ignore a specific date/time field on Dashboards & Visualizations. 03-17-2021 06:43 AM
- Posted stats(value) grouping but ignore a specific date/time field on Dashboards & Visualizations. 03-16-2021 03:31 PM
- Tagged stats(value) grouping but ignore a specific date/time field on Dashboards & Visualizations. 03-16-2021 03:31 PM
- Posted Re: Dashboard - Extract DNS Names from Multiple Results and Place into one Column on Common ID on Dashboards & Visualizations. 03-10-2021 01:27 PM
- Posted Dashboard - Extract DNS Names from Multiple Results and Place into one Column on Common ID on Dashboards & Visualizations. 03-10-2021 09:34 AM
- Got Karma for Re: Getting tenable.sc assets lists into splunk with names. 10-22-2020 09:27 PM
- Got Karma for Re: regex in Splunk_TA_juniper not matching logs. 09-03-2020 10:24 PM
- Posted Re: Getting tenable.sc assets lists into splunk with names on All Apps and Add-ons. 08-17-2020 02:12 PM
- Karma Re: Splunk Universal Forwarder Duplicate Logs (Windows) for dkeck. 06-05-2020 12:50 AM
- Karma Re: SplunkWeb will not start after upgrading to Splunk 8.0.0 due to "SyntaxError: invalid syntax" for LukeMurphey. 06-05-2020 12:50 AM
- Karma SplunkWeb will not start after upgrading to Splunk 8.0.0 due to "SyntaxError: invalid syntax" for LukeMurphey. 06-05-2020 12:50 AM
- Karma Re: Transforms to Remove HTML Tags for richgalloway. 06-05-2020 12:50 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
10-04-2022
06:03 AM
Hello,
I have an API call that is bringing in json data to my Splunk environment. When I do a basic query of the index, I can see that every event is properly parsed in the 'list view':
definition: { [-]
knowledgeBases: [ [+]
]
name: xxxxx
published: xxxxx
threatIndicators: Privilege_Escalation
uniqueId: xxxx
}
firstFound: xxxxx
lastFound: xxxxx
status: Active
target: { [+]
}
RiskRating: Medium
RiskScore: 4.58
Solution: Service teams should upgrade the impacted package
}
This data is then being utilized in an accelerated datamodel for a few dashboards.
However, I noticed when using tstats in the queries, a lot of the results were missing.
I then tried troubleshooting the data within the index using 'table' and realized i need to use |spath to get the fields to display correctly in my table. Does anyone have any insight into this, or how to possibly use spath within a tstats query?
... View more
Labels
- Labels:
-
tstats
09-14-2022
09:06 AM
@elizabethl_splu hello, do you have any insight on the request above? Thank you 🙂
... View more
09-13-2022
06:14 PM
Hello,
Is there a feature roadmap available? I'm loving the new dashboard studio for designing some of the projects I'm working on, but sadly find it unusable due to lacking of several main features (export to PDF and old drilldown options).
Thanks!
... View more
Labels
- Labels:
-
Dashboard Studio
-
drilldown
09-08-2021
12:48 PM
Hello! I am troubleshooting a report, and I've cut it all down to the very basics with the following two snippets. Basically, 'join' with a csv is not returning expected results. This dataset between Sept-1 and Sept-2 has about 75,000 unique entries (but the base search with "value=374667" only has about 30!). index="xxx" sourcetype="xxx" value="374667"
timeformat="%Y-%m-%d" earliest="2021-09-01" latest="2021-09-02"
| join value [inputlookup lookup.csv]
| dedup value
| chart count The above query returns 0 (incorrect). index="xxx" sourcetype="xxx" value="374667"
timeformat="%Y-%m-%d" earliest="2021-09-01" latest="2021-09-02"
| dedup value
| chart count The above query returns 1 (expected).
... View more
03-18-2021
09:03 AM
1 Karma
Hey @richgalloway, thanks for the responses. Still not what I'm looking for so I decided to go another way: I created a job that runs after the vulnerability scans that queries all of the QID's and puts them into a lookup file. I initially ran the job manually, but now when it runs on schedule, there is a subsearch to only append the QID's not currently in the lookup. Looks something like this: %base search% NOT [|inputlookup firstfound.csv | fields + QID]
| eval firstdisce=strptime(FIRST_FOUND_DATETIME, "%Y-%m-%d")
| eval firstdisc=strftime(firstdisce, "%Y-%m-%d")
| sort firstdisc
| dedup QID
| eval firstdiscev=firstdisce
| table QID, signature, firstdisc, firstdisce, firstdiscev
| rename firstdisc as firstdiscsv
| outputlookup firstfound.csv append=true There are a couple extra fields in there (firstdisce, firstdisev), but they're needed in other dashboards... Thanks again 🙂
... View more
03-17-2021
06:43 AM
Thank you @richgalloway, that's a good start. But I still need to group all of the DNS names impacted by that QID on the 'oldest' date in that column associated with that QID. Can this be done?
... View more
03-16-2021
03:31 PM
Hello- I'm trying to create a report that groups DNS name with Identification Number (QID) from a vulnerability report. I'm using |stats value(dns) which works well enough, but the problem is a column 'first discovered' may have 3-4 values depending on the instance being scanned: DNS QID First Discovered SLA Status Server-1 Server-2 Server-3 Q-3333 1-1-2021 Overdue Server-4 Server-5 Q-3333 2-1-2021 OK The problem though, is that I need Servers 4-5 to appear with Servers 1-3 under the '1-1-21' date due to SLA requirements (it doesn't matter if a vulnerability when the QID was discovered on a specific device, we're only concerned with it's first detection). Ideally it'd look like this: DNS QID First Discovered SLA Status Server-1 Server-2 Server-3 Server-4 Server-5 Q-3333 1-1-2021 Overdue Here's relevant parts of my query: %base search%
| stats values(DNS) as DNSf BY QID, POAM_ID, Controls, signature, DIAGNOSIS, dvc, OS, firstdisc, duedate, PATCHABLE Thanks!
... View more
- Tags:
- stats
Labels
- Labels:
-
chart
03-10-2021
01:27 PM
Been using Splunk nearly full-time for four years, and I'm mad that after all of this time, there's always some fairly basic query I have never used. Thank you so much!
... View more
03-10-2021
09:34 AM
Hello- I'm trying to create a vulnerability scan summary. The scan is executed against individual devices, and each discovery of a vulnerability is brought into Splunk as an individual result. For example, if 10 servers all have the same vulnerability (We'll say ID="10"), is there a way to extract the DNS name from that finding, and place it into a summary column? What I have...3 results, 3 different DNS names with the same vulnerability: 1. dns="i-adfkldslkjkljsdf", vID="10"
2. dns="i-adfkldslkjkljsgg", vID="10"
3. dns="i-adfkldslkjkljsyy", vID="10" What I'd like to see...a summary table that features all of those DNS names in a single field joined on that vID. vID="10" vDesc="RCE for Adobe" Assets=""i-adfkldslkjkljsyy","i-adfkldslkjkljsdf","i-adfkldslkjkljsgg"" I think this would be done using a subquery, but for the life of me can't figure it out. Appreciate any assistance you may be able to provide. Thanks!
... View more
08-17-2020
02:12 PM
1 Karma
Having similar issue. With Security Center, Splunk would collect scan data by scan group (if I had a scan that scanned all Netgear devices under the scan 'Netgear Scan', Splunk would collect all of that scan data and have a field for the scan name). I tried contacting Tenable about it, and they were extremely unhelpful. They only told me that the way Splunk communicates with the Tenable.sc application has changed. The case # was 01012618 if anyone wants to call and ask about it. Here's some of their responses: "I checked with the Integrations team for you. Since the new integration is based on the Vulnerability Analysis API rather than munching actual scan results, the information on what scan a given vuln came from isn't available. Unfortunately, there's no way to have that included. The information available is essentially whatever you can see in the Vulnerability Analysis area of Tenable.sc, which is based on cumulative vuln data in the repositories rather than the individual scan results."
... View more
- Tags:
- similar
05-08-2020
08:57 AM
I know this has been marked as solved, but if anyone else finds themselves here...I have recently rebuilt a Splunk searchhead VM and decided to copy over the $splunk/etc/ file to the new VM to minimize downtime. I was receiving this error and had to go to 'settings>distributed search' and reauthenticate to the indexer.
... View more
04-23-2020
05:31 PM
Hey Matthew, would you be willing to share a few more details about how you manage this? I'm researching ways to take /var/log/aide/aide.log and use that to create a dashboard of new files from directories we care about. Did you have to set up custom props.conf or was it fairly straight forward? Do you do this manually or does hvyfwd/rsyslog take care of the forwarding for you?
... View more
02-13-2020
06:48 AM
Great answer. I had a similar issue with the Splunk_App_for_nix.
... View more
02-12-2020
01:50 PM
Thanks for the response!
I run heavy forwarder on top of my syslog server and it is actively monitoring the device directories. This was recommended to me as best practice a few years back. It works wonderfully, it just takes a while to start again after restarting the heavy forwarder.
I've monitored the syslog file of a device using tail -f and see that it's being updated instantly. If I look in splunkd.log after a restart, it takes 15-20 minutes to go through and say that it's going to begin monitoring all of the directories specified. My file hierarchy is as follows:
DeviceType/DeviceName/date.log
example: CiscoSwitch/Switch69/20200212.log
... View more
02-12-2020
07:56 AM
Hello-
My current setup:
Device Syslog --> Syslog Server w/ Splunk HvyFwd --> Splunk Indexer
When I restart my Heavy Forwarder server or Splunkd, it takes up to 30 minutes to begin forwarding syslogs to the indexer. Is this due to the number of devices and folders stored within the syslog server, and is there a way to speed this process up?
Thanks,
... View more
10-15-2019
12:08 PM
Thanks, I figured this out shortly after posting that it'd be easiest for implementing it this way, and for a specific field:
index=index1
| rex mode=sed field=FieldName3 "s/(<.*?>)//g"
| table FieldName1, FieldName2, FieldName3
The only think to watch out for is if someone puts text between '<>', it'll be omitted from the text. Doesn't look like that'll impact this application here.
... View more
10-15-2019
08:37 AM
Hello-
I'm importing data from a SQL database that includes HTML tags. Here is an example:
NoteText="This is my first sentence. This is <strong>bold test</strong></br>
<p>Second Line</p>
<p> </p>
<p>new line</p>
I'm looking for a way to utilize transforms and props OR regex in the search to remove any HTML tags and just display the data as such. I've used these methods for removing XML tags, but those were symmetrical and structured, I'm not familiar with how to do it for random tags throughout.
Thanks!
... View more
06-04-2019
03:43 PM
Hello all-
Just got handed a requirement to upgrade the jdk version I'm using for dbconnect to jdk_8u211. I am working in my lab environment and am encountering an error that says:
No suitable driver found for jdbc:sqlserver://xx.xx.xx.xx:xxxx;...
Sounds like it's a compatibility problem between the JDK version on my heavy forwarder and the driver installed on the SQL server itself but I haven't been able to locate a compatibility matrix.
Would anyone know if upgrading the driver on the SQL server would fix this issue?
Thanks!
... View more
04-03-2019
12:29 PM
This did not resolve my issue. It only set the time back to last month. Thank you for the suggestion though.
... View more
04-03-2019
05:22 AM
Hello, I created a series of dashboards that will automatically update when data from a monthly scan is ingested. In this scenario, I have a scan that runs on the 18th of every month and automatically gets sent to Splunk shortly after the scan concludes. In this case, the scan typically finishes between 0330 and 0500. I have the "Advanced" time range configured as follows:
@mon17+3h - @mon17+6h
The issue I'm running into is that by the time the first of the month rolls around, all information on that dashboard resets because it now views the '@mon' as the current month, and there is obviously no data for 18 days into the future.
Is there a better way to configure my search ranges that someone could suggest? I appreciate any and all assistance. Thank you!
... View more
03-18-2019
11:22 AM
I don't know what to make of this, but I solved it by renaming the '/default/inputs.conf' as '/default/inputs.conf.old' and restarted Splunk on the UF. I then ran btool and verified that my '/local/inputs.conf' file is now being acknowledged via:
splunk btool inputs list --debug
I then had to go back to the deployment server and make the change to send out to the clients. I know that modifying stuff in defaults is not recommended, and will get overwritten with the next app update. I have left a note for myself or a future admin to take note of this workaround until I can figure out what has actually happened.
Thank you to NickHillscpl for talking me through this and helping point me in the right direction.
... View more
03-18-2019
11:19 AM
Yikes. I don't know what to make of this. Basically renamed the '/default/inputs.conf' as '/default/inputs.conf.old' and restarted Splunk on the UF. I then ran btool and verified that my '/local/inputs.conf' file is now being acknowledged via:
`splunk btool inputs list --debug'
... View more
03-18-2019
09:51 AM
Yeah, the app deployed through my deployment server. The inputs.conf is located in deployment-apps/appname/local/ on the deployment server. I can also verify that the app has deployed to the UF's.
I'm going to try copy+pasting the inputs.conf to a different app on a UF to see if the problem is within the app (which is where this conversation is leading me to believe, thank you!).
... View more
03-18-2019
08:10 AM
I'm running btool from the Universal Forwarder, which is on the endpoint device. I'm expecting to see the inputs file from the Windows_TA input that's loaded on the UF (as I do in my lab setting). So it's currently forwarding whatever was in defaults/inputs.conf and not local/inputs.conf
... View more
03-18-2019
06:50 AM
Hey! Thank you for the response.
I don't think that's my issue. It was basically a 1:1 copy from the test environment, minus the change of the index name.
When I do the btool output, nothing from my local/inputs.conf file appears, but all of the default/inputs.conf file does.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
10-04-2022
10:45 AM
|
