Hello, I use Microsoft's Visual Studio Code as code locker for my spl, xml, and json Splunk code. Does anyone have  experience running spl code from VSC? I have the Live Server extension installed and enabled. However, it opens into directory listing within Chrome. When I drilldown to the spl file instead of running the code it downloads the file. Thanks and God bless, Genesius ... View more

Hello, The description is not very descriptive. Hopefully, the example and data will be. I have a list of 1500 numbers. I need to calculate the sum in increments of 5 numbers. However, the numbers will overlap (be used more than once). Using this code of only 10 values. | makeresults | fields - _time | eval nums="1,2,3,4,5,6,7,8,9,10" | makemv nums delim="," | eval cnt=0 | foreach nums [| eval nums_set_of_3 = mvindex(nums,cnt,+2) | eval sum_nums_{cnt} = sum(mvindex(nums_set_of_3,cnt,+2)) | eval cnt = cnt + 1]   The first sum (1st value + 2nd value + 3rd value or 1 + 2+ 3) = 6. The second sum (2nd value + 3rd value + 4th value or 2 + 3 + 4) = 9. The third sum would be (3rd value + 4th value + 5th value or 3 + 4 + 5) =12. And so on. The above code only makes it through one pass, the first sum. Thanks and God bless, Genesius ... View more

Hello, I'm trying to find information on how to use Splunk with Visual Studio Code. I have an authentication token on my development instance. I've installed the Visual Studio Code Extension for Splunk on GitHub. I'm lost from here on. What do I enter in the url and webroot fields in the launch.json file? "configurations": [ { "type": "chrome", "request": "launch", "name": "Launch Chrome against localhost", "url": "https://<host name>:8080", "webRoot": "${workspaceFolder}" } ] This opens Splunk in my Chrome browser, but it is an empty search field. I created splnb file in VSC, but when I run it, I receive ERROR: Unauthorized. Thanks in advance for any direction provided. God bless, Genesius ... View more

Hello, Has anyone had issues with the color codes used in your json are not the colors appearing in your visualization?     { "type": "splunk.column", "options": { "legendDisplay": "off", "dataValuesDisplay": "all", "yAxisTitleText": "Volulme (GB)", "xAxisTitleText": "Day", "stackMode": "stacked", "seriesColorsByField": { "over_500_red": "#FF0000", "between_400_and_500_orange": "#FFA500", "between_200_and_400_green": "#008000", "under_200_blue": "#0000FF" } }, "dataSources": { "primary": "ds_search_1" }, "title": "License Usage - Last 14 Days", "showProgressBar": false, "showLastUpdated": false, "context": {} }     Green and blue are not in the chart below. Thanks and God bless, Genesius ... View more

  Hello, Has anyone experienced parsing Windows Event Logs using a KVstore for all of the generic verbiage?  For example - red text (general/static text associated with EventCode number and other values  - this will mostly be the Message/body fields) will be entered into a KVstore; green text (values within the event) will be indexed. In the below example, there are 2,150 characters, of which, 214 characters are dynamic, and need to be indexed. The red(undant) text contains over 1,930 characters.  These are just logon (4624) events. With over 11.5 million logon events per day across our environment, this is ~23 GB. If what I am asking can be/has been accomplished, we could reduce this to 2.3 GB. Thanks and God bless, Genesius   09/11/2023 12:00:00AM LogName=Security EventCode=4624 EventType=0 ComputerName=<computer name> SourceName=Microsoft Windows security auditing. Type=Information RecordNumber=9696969696 Keywords=Audit Success TaskCategory=Logon OpCode=Info Message=An account was successfully logged on.   Subject:                 Security ID:                         NT AUTHORITY\SYSTEM                 Account Name:                 <account name>                 Account Domain:                              <account domain>                 Logon ID:                             0x000   Logon Information:                 Logon Type:                        3                 Restricted Admin Mode:               -                 Virtual Account:                No                 Elevated Token:                 Yes   Impersonation Level:                      Identification   New Logon:                 Security ID:                         <security id>                 Account Name:                 <account name>                 Account Domain:                              <account domain>                 Logon ID:                             0x0000000000                 Linked Logon ID:                               0x0                 Network Account Name:               -                 Network Account Domain:           -                 Logon GUID:                       <login guid>   Process Information:                 Process ID:                          0x000                 Process Name:                   D:\Program Files\Microsoft System Center\Operations Manager\Server\Microsoft.Mom.Sdk.ServiceHost.exe   Network Information:                 Workstation Name:         <workstation name>                 Source Network Address:             -                 Source Port:                        -   Detailed Authentication Information:                 Logon Process:                  <login process>                 Authentication Package: <authentication package>                 Transited Services:           -                 Package Name (NTLM only):        -                 Key Length:                         0   This event is generated when a logon session is created. It is generated on the computer that was accessed.   The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.   The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).   The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.   The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.   The impersonation level field indicates the extent to which a process in the logon session can impersonate.   The authentication information fields provide detailed information about this specific logon request.                 - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.                 - Transited services indicate which intermediate services have participated in this logon request.                 - Package name indicates which sub-protocol was used among the NTLM protocols.                 - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. ... View more

Hello, Any Splunkers who can share ALL of the <option name=""> tags available to use with the missile map viz? On Splunkbase, the author states  Customisation options The following options are available to customise: Lines Default color: The color to use for a line when no "color" field is present in the data (default: #65a637) Weight: The weight to use for a line when no "weight" field is present in the data (default: 1) Map Tile set: The map tiles to use Custom tile set: If you wish to use a tile set not in the preset list (e.g. http://tile.stamen.com/toner/{z}/{x}/{y}.png) Latitude: Starting latitude to load Longitude: Starting longitude to load Zoom: Starting zoom level to load However, there is no sample of the syntax. Thanks in advance for your help. God bless, Genesius ... View more

Hello, I downloaded and installed Splunk Enterprise 9.x on my laptop. I am creating a Studio Dashboard and experiencing an issue with images. I am using a token in the image path to change the image based on a dropdown input. Therefore, the images can't be held in the kvstore. They must remain local to my PC. In my production environment at work, RedHat, this works. The image path - within the DS Configuration Pane - is  /en-US/static/app/search/images Although the path on the Linux server is really etc/apps/search/appserver/static/images Splunk manipulates the path name in some strange way. apps becomes app, static is placed before the search (the app name).   I am using Windows on my laptop, and I can't figure out the correct path for the image URL. The Windows path for these images is C:\Program Files\Splunk\etc\apps\search\appserver\static\images What is Dashboard Studio Splunk-Speak for this path in Windows? Thanks in advance for your help. God bless, Genesius       ... View more

Hello, Why do some dropdowns have a filter box and others don't? Are there options on the <input type="dropdown"...> tag that needs to be set? What other options are available for dropdowns? Thanks and God bless, Genesius ... View more

Hello, Is it possible to create indexed fields on log files uploaded from my PC? The log file is tens of thousands of records. I need to index two of the fields in order to run tstats against them. Running a normal search and extracting these two fields (and others) at search time is not efficient. If these two fields were indexed I could run searches with tstats much, much faster. Thanks in advance and God bless, Genesius ... View more