About rkeq0515

rkeq0515 · ‎07-29-2022

I am attempting to convert most of my xml to javascript in my dashboards. I have several single values that I can click on and show that specific data in the table. For example, one particular single value is Blacklisted. When I click on the numeric value, it shows details of files, md5, sha256, dates, etc that have been tagged as blacklisted. In XML my token is set as follows: <set token="tkblacklist">blacklist IN (t)</set> I filter on "true." The token is used in my table, and I get a list of blacklisted entities. ... | search $tkblacklist$ Screenshot below is a sample of the current dashboard functionality. When I try to do this in javascript, I am confused how to apply the token using the SingleView and pass the token to the TableView. I have done a lot of reading, watching videos, and trial and error, but I can't seem to get this right. Most of the examples are for text inputs, dropdowns, and muti-select features. My test.js file require([ 'underscore', 'backbone', 'splunkjs/mvc', 'splunkjs/mvc/searchmanager', 'splunkjs/mvc/postprocessmanager', 'splunkjs/mvc/singleview', 'splunkjs/mvc/tableview', 'splunkjs/mvc/simplexml/ready!' ], function(_, Backbone, mvc, SearchManager, PostProcessManager, SingleView, TableView) { var baseSearch = new SearchManager({ id: "baseSearch", preview: true, cache: false, search: "| tstats count values(modproc.process) AS process from datamodel=dmname.modproc where nodename=modproc by modproc.blacklist modproc.process modproc.md5" // Blacklisted var blacklistProcesses = new PostProcessManager({ id: "blacklistProcesses", managerid: "baseSearch", search: "| rename modproc.* AS * | search blacklist IN (\"t\") | stats count" }); new SingleView({ id: "blacklistProcesses_Dashboard", managerid: "blacklistProcesses", height: "50", el: $("#blacklistProc") }).render(); // Get your div var my_div = $("#blacklistProc"); // Respond to clicks my_div.on("click", function(e) { var tokens = mvc.Components.get("submitted"); tokens.set("mytoken", "| search blacklist IN (\"t\")"); }); // Process Table View var tableProcesses = new PostProcessManager({ id: "tableProcesses", managerid: "baseSearch", search: "| rename modproc.* AS * | $mytoken$" }, {tokens: true}); new TableView({ id: "tblProcess", managerid: "tableProcesses", pageSize: "50", el: $("#tableProc") }).render(); }); My XML <dashboard script="test.js" stylesheet="test.css" theme="dark"> <label>Test Javascript Dashboard</label> <row> <panel> <html> <h3 class="MainHeading"> Blacklisted </h3> <div id="blacklistProc"/> </html> </panel> </row> <row> <panel> <title>My Table</title> <html> <div id="tableProc"/> </html> </panel> </row> </dashboard> I have also tried to use drilldown in the SingleView, but that just opens the Search window. Thanks

rkeq0515 · ‎07-26-2022

Thank you! The 4 back slashes worked. I was focused on the colon since 2 back slashes were working. However, I see that it wasn't providing the correct data.

rkeq0515 · ‎07-26-2022

I am trying to use a colon ( : ) in my js file; however, I do not see results when I use the colon. I verified that the command works with the colon when I run it within a Search window. I also have it working without the colon in the js file. I just can't seem to use the colon in the js file. The following code in my js file does not work. ... | search (path IN (\"*:\\windows\\*\")) | stats count The following code in my js file works. ... | search (path IN (\"*\\windows\\*\")) | stats count I tried to escape it like I did the double-quotes, but that did not work. Is there a way to use the colon in the js file? Thanks

rkeq0515 · ‎10-15-2021

I am trying to use AWS Cognito to authenticate to a Splunk dashboard using SAML. There is a lot of information on configuring Cognito with other vendors, but not a lot of information on how to do this with Splunk. I have been trying to piece together settings from various documents I found during my research, but I don't know a lot about SAML. I downloaded the Splunk Metadata file and uploaded it in Cognito, but I get an error stating "We were unable to create identity provider: No IDPSSODescriptor found in metadata for protocol urn:oasis:names:tc:SAML:2.0:protocol and entity id splunkEntityId ." I didn't see any IDPSSODescriptor in the uploaded file, which leads me to believe this may be incompatible. My Splunk SAML setting is as follows: [saml] entityId = urn:amazon:cognito:sp:<my cognito pool id> fqdn = testdashboardlb-79456348.us-east-1.elb.amazonaws.com <-- This is my load balancer idpSLOUrl = https://testdashboard.auth.us-east-1.amazoncognito.com/saml2/logout idpSSOUrl = https://testdashboard.auth.us-east-1.amazoncognito.com/saml2/idpresponse inboundDigestMethod = SHA1;SHA256;SHA384;SHA512 inboundSignatureAlgorithm = RSA-SHA1;RSA-SHA256;RSA-SHA384;RSA-SHA512 issuerId = urn:amazon:cognito:sp:my cognito pool id> lockRoleToFullDN = true redirectAfterLogoutToUrl = testdash.xxxxxxxxx.com redirectPort = 443 replicateCertificates = false signAuthnRequest = false signatureAlgorithm = RSA-SHA1 signedAssertion = true sloBinding = HTTP-POST ssoBinding = HTTP-POST [authentication] authSettings = saml authType = SAML I can authenticate and enter my MFA token. After that, I receive an error "Required String parameter 'SAMLResponse' is not present." Any help is appreciated.

rkeq0515 · ‎09-07-2021

I never got the SQS to work as I had to move forward. I ended up going with a direct read from the S3 bucket and object, which seemed to work pretty well so far. Here is a sample input.conf entry. [aws_s3://testtype] aws_account = s3accountname bucket_name = testbucket character_set = auto ct_blacklist = ^$ host_name = s3.amazonaws.com index = testindex initial_scan_datetime = 2020-03-01T15:43:47Z interval = 30 is_secure = True key_name = csvdata1/ max_items = 100000 max_retries = 3 polling_interval = 60 recursion_depth = -1 sourcetype = aws:s3:testsrctype

rkeq0515 · ‎09-07-2021

I have a table where the first four columns includes an icon. I want to have word wrap disabled. When I disable word wrap my icons disappear from a table. I can't seem to figure out what's going on with this. I tried expanding the table rows (width and height) to see if the icons were hiding, but that does not seem to be the case. Screenshot of icons with word wrap enabled: Screenshot of icons disappearing with word wrap disabled (preferred configuration): Here is the code I am using: icons.js require([ 'underscore', 'jquery', 'splunkjs/mvc', 'splunkjs/mvc/tableview', 'splunkjs/mvc/simplexml/ready!' ], function(_, $, mvc, TableView) { var CustomRangeRenderer = TableView.BaseCellRenderer.extend({ canRender: function(cell) { /* return cell.field; */ return _(['Column1','Column2','Column3','Column4']).contains(cell.field); }, render: function($td, cell) { var value = cell.value; if(value=="col1data" ) { $td.html("<div class='col1data'> </div>") } else if(value=="col2data") { $td.html("<div class='col2data'> </div>") } else if(value=="col3data") { $td.html("<div class='col3data'> </div>") } else if(value=="col4data") { $td.html("<div class='col4data'> </div>") } } }); var sh = mvc.Components.get("table1"); if(typeof(sh)!="undefined") { sh.getVisualization(function(tableView) { // Add custom cell renderer and force re-render tableView.table.addCellRenderer(new CustomRangeRenderer()); tableView.table.render(); }); } }); icons.css #table1 .col1data { background-image: url('/static/app/testapp/images/col1.png') !important; background-repeat: no-repeat !important; background-size: 20px 20px; !important; background-position: center; !important; /* background-color: coral; !important; */ } #table1 .col2data { background-image: url('/static/app/testapp/images/col2.png') !important; background-repeat: no-repeat !important; background-size: 20px 20px; !important; background-position: center; !important; } #table1 .col3data { background-image: url('/static/app/testapp/images/col3.png') !important; background-repeat: no-repeat !important; background-size: 20px 20px; !important; background-position: center; !important; } #table1 .col4data { background-image: url('/static/app/testapp/images/col4.png') !important; background-repeat: no-repeat !important; background-size: 20px 20px; !important; background-position: center; !important; }

rkeq0515 · ‎02-23-2021

I am curious of the purpose of the percent sign at the end of the token variable? width:$width_change$%

rkeq0515 · ‎02-23-2021

Thanks for this. I took your suggestion and modified to fit what I wanted. This seems to work for me. <form> <label>hide_panel_width</label> <init> <set token="width_change">100</set> <set token="Viz">0</set> <set token="panel1">0</set> </init> <fieldset submitButton="false"> </fieldset> <row> <panel depends="$alwaysHidePanel$"> <html> <style> #Table1{ width:$width_change$% !important; } #Panel1{ width:$panel1$% !important; } </style> </html> </panel> </row> <row> <panel id="Table1"> <chart> <search> <query>| tstats count where index=_internal by _time span=1h</query> <earliest>-24h@h</earliest> <latest>now</latest> <sampleRatio>1</sampleRatio> </search> <option name="charting.chart">column</option> <option name="charting.chart.stackMode">default</option> <option name="charting.chart.style">shiny</option> <option name="charting.drilldown">all</option> <drilldown> <set token="tkbar">$click.value$</set> <set token="pane1">15</set> <set token="width_change">85</set> </drilldown> </chart> </panel> <panel id="Panel1" depends="$tkbar$"> <input type="checkbox" token="tokacct2" searchWhenChanged="true"> <label></label> <change> <unset token="tkbar"></unset> <unset token="form.tokacct2"></unset> <set token="pane1">0</set> <set token="width_change">100</set> </change> <choice value="hide">Hide Details <change> </change> </choice> </input> <single> <search> <query>| tstats count where index=_internal by _time span=1h sourcetype | rare 1 sourcetype $tkbar$</query> <earliest>$earliest$</earliest> <latest>$latest$</latest> </search> <option name="refresh.display">progressbar</option> </single> </panel> </row> </form>

rkeq0515 · ‎02-22-2021

I am trying to configure two panels in a single row where one panel is 85% and the other is 15%. I already have the style set up to accomplish the following: I would like to hide the right panel and have it appear when I click a bar on the right. That would mean the bar graph would start across the entire row then slide to the right to reveal the right panel at 15%. I have tried multiple configuration but cant seem to get it to work properly. When I click on the bar graph it seems to split the row at 50% however, the it does show the table at 15%. The code I am working with is below. I have tried different combinations of the id tags but still cannot get it to work. Style <style> #Table1{ width:15% !important; } #Panel1{ width:85% !important; } </style> Table and Code to Hide the Panel on the Right <panel id="Table1" depends="$tkacct$"> <input id="Table2" type="checkbox" token="tokacct1" searchWhenChanged="true"> <label></label> <change> <unset token="tkacct"></unset> <unset token="form.tokacct1"></unset> </change> <choice value="hide">Hide Details</choice> <delimiter> </delimiter> </input> <table> <title>Table 1 Title</title> <search> <query>SPLUNK QUERY</query> ... ... Thanks

rkeq0515 · ‎02-03-2021

I have been using the AWS Add-On to pull data from S3 into Splunk. It's been working well for internal use. I now have been tasked to provide data to an external source. The external source should only have access to the data that they need. The S3 looks similar to this. bucketname dataset1/dashboard dataset2/dashboard <--- External source should only access this data dataset3/dashboard I created AWS keys specifically for this external source. I want to set my permissions so the external source only has access to dataset2 without viewing data from dataset1 and dataset3. The problem is Splunk requires the ListBucket permission to index the data. I have attempted to use a condition statement to lock this down to the specific folder. However, when I use the permissions below, Splunk cannot grab the data. If I remove the condition statement the data is processed into Splunk but I can now see the contents of dataset1 and dataset3. { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "s3:ListBuckets" ], "Resource": [ "arn:aws:s3:::bucketname" ], "Condition": { "StringLike": { "s3:prefix": [ "dataset2/", "dataset2/dashboard/*" ] } } }, { "Sid": "AllowUsersToAccessFolder2Only", "Effect": "Allow", "Action": [ "s3:GetObject*", "s3:PutObject*" ], "Resource": [ "arn:aws:s3:::bucketname/dataset2/dashboard/*" ] } ] } My solution for now is to create another bucket specifically for this external source and reroute the data to that bucket. I want to avoid this if possible.

rkeq0515 · ‎02-03-2021

This seems to be working for me now. For each textbox input, I used a condition and change tag. Each input text box would need the code seen below. The example below is for the filename input. You would this block of code for each text box with the respective token name. <input type="text" token="sfilename"> <label>Search By Filename</label> <change> <condition match="len($value$)>0"> <set token="defaulttoken">defaulttoken</set> <eval token="sfilename">case($sfilename$ == $sfilename$, $sfilename$)</eval> <eval token="smd5">case($smd5$ == $smd5$, $smd5$)</eval> <eval token="sdestip">case($sdestip$ == $sdestip$, $sdestip$)</eval> <eval token="sdestport">case($sdestport$ == $sdestport$, $sdestport$)</eval> </condition> <condition len($sprocess$)=0 AND len($smd5$)=0 AND len($destip$)=0 AND len($destport$)=0> <set token="defaulttoken">*</set> </condition> </change> <default></default> </input> Then each query you want to search would contain the following: ... filename IN ($sfilename$) OR md5 IN ($smd5$) OR path IN ($sdestip$) OR target IN ($sdestport$) OR ($defaulttoken$) ... I also set a value for the defaulttoken as * when the page loads. <init> <set token="defaulttoken">*</set> </init>

rkeq0515 · ‎09-03-2020

I tried that early on. That wont help. That means I am listing everything from all fields. If I change destport to 22, I will still get everything.

rkeq0515 · ‎09-03-2020

I have a dashboard built that views today's events for processes running on systems. To focus on a single event, I have several text box inputs across the top that serve as a "Quick Search" capability. The tokens from these text box inputs are included in various charts and tables to change the values when the text is typed into the boxes. An example of the text box inputs are process name, destip, dest port, and md5. I am having an issue using getting the splunk boolean expression right to search for one or more values from the text inputs. A sample of my text box inputs are as follows: Search Filename Search MD5 Search Dest IP Search Dest Port * MD5 DestIP DestPort Currently, my default values are shown in the screenshot. I use * for the Filename which shows all data, but I want this and all other text box inputs to be optional. All other default values are basically place holders. The goal is to be able to view all data, then type in one or more values in any of the type box inputs to view the alerts with the typed value. This is a snippet of a command that is used. ..... | (process IN ($sfilename$) OR md5 IN ($smd5$) OR destinationip IN ($sdestip$) OR destinationport IN ($sdestport$) ) AND $alertstoview$ | table process, md5, destinationip, destinationport For example, if I have the following as my list of alerts: Filename MD5 DestIP DestPort abc.exe eec9859394abcdef1234567fedca 12.22.22.22 8080 xyz.exe ade98dbc77abcdef1234567fb32a 22.22.22.23 80 fff.exe fbc9859394abcdef123456bce32a 32.22.22.24 443 bbb.exe ebc9859394abcdef1234567fedca 42.22.22.25 80 ddd.exe ad59859394abcdec77abcdebbbbb 52.22.22.26 22 And I only want to see destport 22 AND filename fff.exe, I should get: Filename MD5 DestIP DestPort fff.exe fbc9859394abcdef123456bce32a 32.22.22.24 443 ddd.exe ad59859394abcdec77abcdebbbbb 52.22.22.26 22

rkeq0515 · ‎05-22-2020

Is there a way to display events in a table when the same value appears multiple times with other values? I am looking for user accounts that appear on two or more systems. The following is a list of records: field1 | field2 | field3 sys1 | user1 | somevalue1 <<-- Want to grab this row sys2 | user2 | somevalue2 sys2 | user2 | somevalue3 sys2 | user2 | somevalue4 sys2 | user1 | somevalue2 <<-- Want to grab this row I have been trying different queries based off of the follow but I cant seem to get the correct syntax. I can get a count on field 1 and/or field 2, but I am not able to pull just those events listed above and the attributes accompanying (field3, field4, etc.) the events. 1. index="myindex" 2. | stats count by field1 field2 3. | where count > 1 4. | table count field1 field2 field3 5. | sort - count

rkeq0515 · ‎03-11-2020

This is what worked for me after a few adjustments. | table systemname, domain, os | stats values(domain) as domain values(os) as os by systemname

rkeq0515 · ‎03-10-2020

rkeq0515 · ‎03-05-2020

My ultimate goal is to process csv files directly from an S3 bucket/prefix for splunk to index. I have the Splunk Add-on for Amazon Web Services installed and was attempting to create a new input Custom Data Type using SQS-Based S3. I have a bucket created and I have an SQS created. As I am filling out the AWS Input Configuration info, everything is good until I select the SQS Queue Name. I can see the SQS queue that I created, but when I select it the "Save" button turns grey and I cannot save the configuration. Also, I can no longer select the drop down for the SQS Queue Name as my mouse turns to a red circle with a line through it. I have not been able to figure this out. Any help would be appreciated.

Posts	17
Solutions	1
Karma Given	1
Karma Received	1
Member Since	‎03-05-2020

Online Status	Offline
Date Last Visited	‎07-30-2022 12:06 AM

Splunk Web Framework Javascript SingleView Tokens:...

Why is Colon Character in JS not working?

AWS Cognito Configuration using SAML

Icons Disappear From A Table While Word Wrap Is Di...

Configure the Width of a Hidden Panel

AWS Add-On Permissions S3 Generic

Using Multiple Text Box Input For Searching

How to display events in table format when same va...

Dedup when some fileds are empty

Splunk Add-on for Amazon Web Services - Custom Dat...