About goncalocoelho

goncalocoelho · ‎05-09-2023

Hi, the problem is in Line Breaker LINE_BREAKER=([\r\n]+)\w+\s\d{1,2},\s\d{4}

goncalocoelho · ‎05-09-2023

Hi, If Tracking_Method doesn't exist, I would write this: (...) | stats count values(Tracking_Method) by entity IP QID Port Last_Detected If you put it in the "by clause", it may not present all the desired results. I believe that the stats offer a slight better performance than dedup. But you can test both options and check the job inspector for time and inspected events vs return events.

goncalocoelho · ‎01-09-2023

Hi, Have you tried btool command with grep? Something like this... splunk btool --debug indexes list | grep -A 10 "[cisco]" -A flag will show you N lines after the string your are looking for --- If this reply helps you, Karma would be appreciated.

goncalocoelho · ‎01-03-2023

If vector doesn't exist, and you are creating it based on source, then try this: | eval vector = if(isnull(temp), "<null or something else>", temp) --- If this reply helps you, Karma would be appreciated.

goncalocoelho · ‎01-03-2023

Hi, No need to do anything there. Splunk will assume the new license when the old one expires. When the old one expires, probably will be better to remove it or Splunk will give you some warnings about expired licenses. There is no problem about that, you'll just receive unwanted warning messages. --- If this reply helps you, Karma would be appreciated.

goncalocoelho · ‎01-03-2023

Hi, Do you know for sure if the source field exists in 100% of the events? Sometimes concatenating fields fails because one of the fields doesn't exist on all events. Try this: | eval vector = if(isnull(temp), vector, vector.temp) Also try to concatenate using the "." instead of "+" | eval vector = vector.temp --- If this reply helps you, Karma would be appreciated.

goncalocoelho · ‎01-03-2023

If I understood correctly... If the field "domain" exists in lookup "lu_cisco_umbrella_top_1_million", then it will me mapped/outputed to "cisco_umbrella_domain" (like you have in your example). But you will still have the initial domain field from your events, before splunk executes the both lookup commands. Also, instead of this line: | search cisco_umbrella_domain=no_matches AND majestic_domain=no_matches I would write something like: | where isnull(cisco_umbrella_domain) AND isnull(majestic_domain)

goncalocoelho · ‎06-29-2022

Thanks for your reply @phanTom, that seems a very good approach! I'll try that and share my findings here for everyone

goncalocoelho · ‎06-21-2022

Hi All, is it possible to retrieve the (splunk soar) instance details inside a playbook? For instance when sending an email, I want to be able to tell if the playbook ran in dev or prod environment. Is there a list of all the global environment variables? Thanks in advance

goncalocoelho · ‎07-16-2021

Hi @thetech thanks for your reply! (I misspelled the title, its is supposed to be "...maxHotSpanSecs of 1day". Sorry about that...) Yes I'm aware of the several ways in which the buckets roll from hot to warm. And that is what's puzzling me... My current config is this. (I have a cluster of 2 Indexers) [my_index] coldPath = volume:primary/my_index/colddb homePath = volume:primary/my_index/db thawedPath = $SPLUNK_DB/my_index/thaweddb maxHotSpanSecs = 86400 maxHotIdleSecs = 86400 When I run a | dbinspect I get the following results, which indicates that there is one bucket (on each IDX) that still hasn't rolled

goncalocoelho · ‎07-12-2021

Hi all, I have specific situation where I need to roll buckets form hot to warm on a daily basis, for an index with very low volume of aprox. 20-30MB each day. The problem is that the config maxHotSpanSecs = 86400 is not being respected, and but the buckets remain in hot state. I tried also several combinations with maxHotBuckets=2 or auto, but nothing changes. Can someone help? When does Splunk decide to create new hot buckets? Is it possible that the input volume is so low (in comparison with the default maxDataSize of 750MB) that Splunk won't enforce the maxHotSpanSecs of 1 day?

goncalocoelho · ‎06-24-2021

Cool! It's awesome to see all these products starting to bundle up in the cloud. Can't wait to get the chance to try them!

goncalocoelho · ‎10-22-2019

I had the same problem and found that if I restart the SH, the index data is visible again. Don't know why though or if it will happen again 😞

Posts	13
Solutions	3
Karma Given	8
Karma Received	7
Member Since	‎02-14-2019

Online Status	Offline
Date Last Visited	‎05-26-2023 10:28 AM

SOAR: Is it possible to retrieve the (splunk soar)...

Splunk not respecting maxHotSpanSecs of 1day

Re: How to fix issue with parsing events (log file...

Re: Which version of dedup is better?

Re: How to restrict btool stanzas without wildcard...

Re: How to add values from a split to an existing ...

Re: Splunk Enterprise Term License renewal

Re: How to add values from a split to an existing ...

Re: trying to understand lookup output renaming

Re: SOAR: Instance environment variables

SOAR: Is it possible to retrieve the (splunk soar)...

Re: Splunk not respecting maxHotSpanSecs of 1day

Splunk not respecting maxHotSpanSecs of 1day

Re: Splunk Security Cloud Makes Security Offerings...

Re: Summary Index Not Updating