Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About Italy1358
Italy1358
Path Finder
Member since:
05-11-2022
08-01-2022
Community Statistics
| Posts | 29 |
| Solutions | 0 |
| Karma Given | 7 |
| Karma Received | 0 |
| Member Since | 05-11-2022 |
Activity Feed
- Posted Help with rex- How do separate this event that came at the same time but different values? on Getting Data In. 08-01-2022 12:03 PM
- Karma Re: regex for gcusello. 07-01-2022 06:37 AM
- Posted Could someone help me with this regex? on Splunk Search. 07-01-2022 06:06 AM
- Posted How to split this string: DF - R - Emails with words (O365) sent to Personal Account (scored) (Data Exfil)? on Splunk Cloud Platform. 06-09-2022 11:37 AM
- Karma Re: Splitting one field into two using regex for gcusello. 06-09-2022 07:06 AM
- Posted How to split one field into two using regex? on All Apps and Add-ons. 06-09-2022 06:24 AM
- Posted Re: Appending rest command on Splunk Search. 06-03-2022 08:40 AM
- Karma Re: Appending rest command for somesoni2. 06-03-2022 08:39 AM
- Posted How to append rest command to my search? on Splunk Search. 06-03-2022 07:28 AM
- Karma Re: Error in my search for somesoni2. 05-27-2022 05:03 AM
- Posted Re: After dropdown selection, how to return to the main panel and update table? on Dashboards & Visualizations. 05-23-2022 12:16 PM
- Posted Re: Error in my search on Splunk Search. 05-23-2022 12:14 PM
- Karma Re: Why is entry time not displaying? for richgalloway. 05-23-2022 11:49 AM
- Posted Why is entry time not displaying? on Splunk Search. 05-23-2022 09:33 AM
- Posted Re: Error in my search on Splunk Search. 05-23-2022 08:59 AM
- Posted Re: Error in my search on Splunk Search. 05-23-2022 06:58 AM
- Posted Re: Error in my search on Splunk Search. 05-23-2022 06:57 AM
- Posted Re: Error in my search on Splunk Search. 05-23-2022 06:28 AM
- Posted Re: Error in my search on Splunk Search. 05-23-2022 06:18 AM
- Posted Why do I have an error in my search? on Splunk Search. 05-23-2022 05:18 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
08-01-2022
12:03 PM
I have an event that came in the same time but have different data values that I need to separate. Example
_time
example A
2022-09-02
dgde746gdhu4 duyheuye4d0
I need this:
_time
example A
2022-09-02
dgde746gdhu4
2022-09-02
duyheuye4d0
... View more
Labels
- Labels:
-
other
07-01-2022
06:06 AM
Can someone help me pull out these data points: cw.pptx;text.html;text.txt I need it to split at the ; mark but have them in their own fields so I can only see the .txt in my search.
... View more
06-09-2022
11:37 AM
Ciao
Could you please help me split this string: DF - R - Emails with words (O365) sent to Personal Account (scored) (Data Exfil) I need the DF - R - Emails with words (O365) sent to personal account (scored)
(data exfil) all to be split into their own fields
... View more
Labels
- Labels:
-
other
06-09-2022
06:24 AM
Hello, I am working on a Splunk query and I need help adjusting my rex command to get two fields that are in one field into their own fields. Example below: index=test sourcetype=test category=test | rex field=user "(?<region>[^\/]+)\/(?<username>[^\w].+)" | fillnull t | sort _time | table _time, username, user, region, sourcetype, result, t | bin span=1d _time | dedup t The user field has: test\test1 and I need it to split that so username=test region=test1
... View more
Labels
- Labels:
-
search
06-03-2022
07:28 AM
I need help to append this rest command to my query. The problem is that the rest command is adding to the first row and I need it to be added to the row that was last entered. | rest /services/authentication/current-context/context | fields + username | search username!=*splunk* | append [ | inputlookup test.csv ] | append [| makeresults | eval user="test", description="test", manager="test", revisit=(now() + 7776000), user_added=now(), token_confirm="$confirm_addition$"] | table username, user, description, user_added, revisit, category, department, description, manager | outputlookup test.csv example: I go to my dashboard and enter user "tom" when I do the rest command should display my username since I entered the user "tom". Now I need to write this to the lookup table so that my name is next to "tom" entry row.
... View more
- Tags:
- append
- splunk-search
Labels
- Labels:
-
other
05-23-2022
12:16 PM
I did that but the none panel does not display the newly updated lookup table. I have to click on the refresh symbol to see the added results to the csv table. @etoombs
... View more
05-23-2022
12:14 PM
Here is a sample of my dashboard: @somesoni2 So the user chooses the month for revisit then from todays entry date to the next 3 months or so I want to see if there valid still or not.
... View more
05-23-2022
09:33 AM
When a user is added i need the time to be recorded and displayed in a field called used_added. I created the field name and can see if in the csv table but there is no time per entry.
<query>
| inputlookup USB.csv
| eval user_added = strftime(_time, "%Y-%d-%m %H:%M:%S")
| append [ | makeresults
| eval user="$user_tok$", description="$description_tok$", revisit="$revisit_tok$", Action="$dropdown_tok$" ]
| fields - _time
| table user_added, user_added, user, category, department, description, revisit, status
| lookup lookup_ims user as user OUTPUT category department
| outputlookup USB.csv
</query>
... View more
Labels
- Labels:
-
other
05-23-2022
06:58 AM
These are the columns in the cvs: current_date, user, category, department, description, revisit, duration @somesoni2
... View more
05-23-2022
06:57 AM
User, description, revisit, action The revisit is a dropdown with choices of 1 month, 2 month, 3 month, 4 month, 5 month, and 6 month. @somesoni2
... View more
05-23-2022
06:28 AM
Like this? | eval current_date=strftime(time(),"%Y-%m-%dt%H:%M:%S") | append [ | makeresults | eval 3mon="$3month$"] | eval 3mon=30*24*60*60 | eval relative_time=relative_time(strptime(current_date,"%Y-%m-%dt%H:%M:%S"),"+3mon") | eval duration = if(current_date >= date, "Expired", "Valid") | table current_date, user, category, department, description, revisit, duration @somesoni2
... View more
05-23-2022
06:18 AM
It is for a dashboard, when a user is entered, the month to revisit is selected so I need a way to check when the user is entered against the month selected to say whether the user is active or expired. That is what I am trying to do here. It is for an allow list that I am making using a dashboard. @somesoni2
... View more
05-23-2022
05:18 AM
It says that my eval is malformed, any suggestions?
| inputlookup US.csv
| eval current_date=strftime(time(),"%Y-%m-%dt%H:%M:%S")
| append [ | makeresults
| eval 3month="$3month$"]
| eval 3month=30*24*60*60
| eval relative_time = current_date "+3month"
| eval duration = if(current_date >= date, "Expired", "Valid")
| table current_date, user, category, department, description, revisit, duration
... View more
Labels
- Labels:
-
search job inspector
05-19-2022
06:16 AM
Here is my xml code so far: <form version="1.1" theme="dark"> <init> <set token="none">None</set> <set token="tokTypeInputVisible">Yes</set> <unset token="user_tok"></unset> <unset token="description_tok"></unset> <unset token="revisit_tok"></unset> <unset token="dropdown_tok"></unset> <unset token="add"></unset> <unset token="remove"></unset> <unset token="reauthorize"></unset> </init> <label>USB</label> <fieldset submitButton="false" autoRun="false"> <input type="text" token="user_tok" searchWhenChanged="false"> <label>User</label> <default></default> </input> <input type="text" token="description_tok" searchWhenChanged="false"> <label>Description</label> <default></default> </input> <input type="dropdown" token="revisit_tok" searchWhenChanged="false"> <label>Revisit</label> <choice value="select Month">Select</choice> <choice value="1 month">1 Month</choice> <choice value="2 month">2 Month</choice> <choice value="3 month">3 Month</choice> <choice value="4 month">4 Month</choice> <choice value="5 month">5 Month</choice> <choice value="6 month">6 Month</choice> <change> <condition value="1 month"> <set token="1 month"></set> <unset token="2 month"></unset> <unset token="3 month"></unset> <unset token="4 month"></unset> <unset token="5 month"></unset> <unset token="6 month"></unset> </condition> <condition value="2 month"> <unset token="1 month"></unset> <set token="2 month"></set> <unset token="3 month"></unset> <unset token="4 month"></unset> <unset token="5 month"></unset> <unset token="6 month"></unset> </condition> <condition value="3 month"> <unset token="1 month"></unset> <unset token="2 month"></unset> <set token="3 month"></set> <unset token="4 month"></unset> <unset token="5 month"></unset> <unset token="6 month"></unset> </condition> <condition value="4 month"> <unset token="1 month"></unset> <unset token="2 month"></unset> <unset token="3 month"></unset> <set token="4 month"></set> <unset token="5 month"></unset> <unset token="6 month"></unset> </condition> <condition value="5 month"> <unset token="1 month"></unset> <unset token="2 month"></unset> <unset token="3 month"></unset> <unset token="4 month"></unset> <set token="5 month"></set> <unset token="6 month"></unset> </condition> <condition value="6 month"> <unset token="1 month"></unset> <unset token="2 month"></unset> <unset token="3 month"></unset> <unset token="4 month"></unset> <unset token="5 month"></unset> <set token="6 month"></set> </condition> </change> </input> <input type="dropdown" token="dropdown_tok" depends="$tokTypeInputVisible$"> <label>Action</label> <choice value="none">None</choice> <choice value="add">Add</choice> <choice value="remove">Remove</choice> <choice value="reauthorize">Reauthorize</choice> <change> <condition value="none"> <set token="none"></set> <unset token="add"></unset> <unset token="remove"></unset> <unset token="reauthorize"></unset> </condition> <condition value="add"> <set token="add"></set> <unset token="remove"></unset> <unset token="reauthorize"></unset> <unset token="none"></unset> </condition> <condition value="remove"> <unset token="add"></unset> <set token="remove"></set> <unset token="reauthorize"></unset> <unset token="none"></unset> </condition> <condition value="reauthorize"> <unset token="add"></unset> <unset token="none"></unset> <unset token="remove"></unset> </condition> </change> <default>none</default> </input> </fieldset> <row> <panel depends="$none"> <title>USb_BAU</title> <table> <search> <query> | inputlookup USB.csv | table _time, user, category, department, description, revisit, status | lookup lookup user as user OUTPUT category department </query> <earliest>-24h@h</earliest> <latest>now</latest> </search> <option name="drilldown">none</option> <option name="refresh.display">progressbar</option> </table> </panel> <panel depends="$add$"> <title>Add User</title> <table> <search> <query> | inputlookup USB.csv | append [ | makeresults | eval user="$user_tok$", description="$description_tok$", revisit="$revisit_tok$", Action="$dropdown_tok$"] | table _time, user, category, department, description, revisit, status | lookup lookup user as user OUTPUT category department | outputlookup USB.csv</query> <earliest>-24h@h</earliest> <latest>now</latest> <done> <unset token="add"></unset> <unset token="remove"></unset> <unset token="reauthorize"></unset> </done> </search> <option name="drilldown">cell</option> <option name="refresh.display">progressbar</option> </table> </panel> <panel depends="$remove$"> <title>Remove User</title> <table> <search> <query>| inputlookup USB.csv | where user != "$user_tok$" | table _time, user, category, department, description, revisit, status | outputlookup USB.csv </query> <earliest>-24h@h</earliest> <latest>now</latest> <done> <unset token="remove"></unset> </done> </search> <option name="drilldown">none</option> <option name="refresh.display">progressbar</option> </table> </panel> <panel depends="$revisit_tok$"> <title>Revisit User</title> <table> <search> <query> | inputlookup USB.csv | eval 1 month="$1 month$", 2 month="$2 month$", 3 month="$3 month$", 4 month="$4 month$", 5 month="$5 month$", 6 month="$6 month$" | eval status = IF((now() < 1 month), "Expired","Valid") | table _time, user, category, department, description, revisit, status | outputlookup USB.csv </query> <earliest>-24h@h</earliest> <latest>now</latest> </search> <option name="drilldown">none</option> <option name="refresh.display">progressbar</option> </table> </panel> </row> </form> basically I am trying to figure out when a user is being added to the lookup table and you click on add, I need to check the date they were added to the month selection and if it is past the month they selected then that user is inactive and there is a reauthorize option to reactivate them on the lookup table.
... View more
Labels
- Labels:
-
lookup
05-18-2022
11:34 AM
I have four fields, User Description, Revisit, and Action. The User and Descriotion are text fields while revisit and action are dropdown values. Revisit: 1 month, 2 month, 3 month, 4 month, 5 month, 6 month. Action: add, remove, reauthorize When a user is added I need to record the time and check it against the revisit month that was chosen so that if it is past the revisit month then the user is inactive. This will be written to the usb.csv lookup table. @somesoni2
... View more
05-18-2022
08:13 AM
Need to compare between the date that the user was entered in the lookup table to the revisit month selected.
add panel:
<panel depends="$add$">
<title>Add User</title>
<table>
<search>
<query>
| inputlookup USB.csv
| append [ | makeresults
| eval user="$user_tok$", description="$description_tok$", revisit="$revisit_tok$", Action="$dropdown_tok$"]
| eval today=strftime(
| table _time, user, category, department, description, revisit
| lookup lookup_im user as user OUTPUT category department
| outputlookup USB.csv</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
<done>
<unset token="add"></unset>
</done>
</search>
<option name="drilldown">none</option>
<option name="refresh.display">progressbar</option>
</table>
</panel>
reauthorize panel:
<panel depends="$reauthorize$">
<title>Reauthorize User</title>
<table>
<search>
<query>
| inputlookup USB.csv
</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
</search>
<option name="drilldown">none</option>
<option name="refresh.display">progressbar</option>
</table>
</panel>
... View more
Labels
- Labels:
-
other
05-18-2022
05:26 AM
I have four panels: none, add, remove, reauthorize. When a user's information is added to the textbox and the add dropdown is selected it is written to a lookup table. If the remove is selected then that instance of that user is removed from the csv table. The none panel just displays the current table with the entries. I need to make it so that when add or remove is selected then it goes back to the none panel and shows the updated table. <row> <panel depends="$none"> <title>USb</title> <table> <search> <query> | inputlookup USB.csv </query> <earliest>-24h@h</earliest> <latest>now</latest> </search> <option name="drilldown">none</option> <option name="refresh.display">progressbar</option> </table> </panel> <panel depends="$add$"> <title>Add User</title> <table> <search> <query>| inputlookup USB.csv | append [ | makeresults | eval user="$user_tok$", description="$description_tok$", revisit="$revisit_tok$", Action="$dropdown_tok$"] | eval keep_time=_time | table _time, keep_time, user, category, department, description, revisit | eval _time=keep_time | outputlookup USB.csv</query> <earliest>-24h@h</earliest> <latest>now</latest> <done> <unset token="add"></unset> </done> </search> <option name="drilldown">none</option> <option name="refresh.display">progressbar</option> </table> </panel> <panel depends="$remove$"> <title>Remove User</title> <table> <search> <query>| inputlookup USB.csv | where user != "$user_tok$" | eval keep_time=_time | table _time, keep_time, user, category, description, revisit | eval _time=keep_time | outputlookup USB.csv </query> <earliest>-24h@h</earliest> <latest>now</latest> <done> <unset token="remove"></unset> </done> </search> <option name="drilldown">none</option> <option name="refresh.display">progressbar</option> </table> </panel> <panel depends="$reauthorize$"> <title>Reauthorize User</title> <table> <search> <query>|inputlookup USB.csv</query> <earliest>-24h@h</earliest> <latest>now</latest> </search> <option name="drilldown">none</option> <option name="refresh.display">progressbar</option> </table> </panel> </row>
... View more
- Tags:
- table
05-17-2022
08:52 AM
Hey @somesoni2 yes, I am looking to add category and department field only for the new user selected and output this to the USB.csv. Could you provide an example of what you mean? I am a new user to Splunk.
... View more
05-17-2022
08:32 AM
I am trying to pull two fields from the lookup_ims lookup table and depending on the user entered I want to populate the category and department fields and place it in the USB.csv.
<query>
| inputlookup USB.csv
| lookup_ims t fields category, Department
| append [ | makeresults
| eval user="$user_tok$", description="$description_tok$", revisit="$revisit_tok$", Action="$dropdown_tok$"]
| eval _time=now()
| table _time, user, category, department, description, revisit
| outputlookup USB.csv
</query>
... View more
Labels
- Labels:
-
lookup
05-17-2022
08:27 AM
Thank You!!! that did work.
... View more
05-16-2022
03:18 PM
I have created a dashboard that allows you to enter a user and their information then write all of it to a lookup table. I need to help adjusting the search queries so that when you select add it writes the user to the lookup table and when you select remove it removes any instance where the users name is found in the lookup table. Here is my xml so far:
<panel depends="$add$">
<title>Add User</title>
<table>
<search>
<query>| inputlookup usb.csv | append [ | makeresults | eval user="$user_tok$", email="$email_tok$", description="$description_tok$", revisit="$revisit_tok$", Action="$dropdown_tok$" | fields - _time ] | table user, email, description, revisit | outputlookup usb.csv</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
</search>
<option name="drilldown">none</option>
<option name="refresh.display">progressbar</option>
</table>
</panel>
<panel depends="$remove$">
<title>Remove User</title>
<table>
<search>
<query>| inputlookup usb.csv
| where user != ""
| table user, email, description, revisit
| outputlookup usb.csv
</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
</search>
<option name="drilldown">none</option>
<option name="refresh.display">progressbar</option>
</table>
</panel>
... View more
- Tags:
- dashboard
- user-lookup
05-16-2022
05:27 AM
I am trying to create a dashboard for an allowlist. Basically the user should be able to fill in the required fields and select whether to add, remove, or reauthorize the user and update the lookup table. This is what I have so far:
<form version="1.1" theme="dark">
<label>USB BAU Allowlist</label>
<description>This is a dashboard that will allow you to add and remove users to a usb allowlist with a BAU activity.</description>
<fieldset submitButton="true" autoRun="false">
<input type="text" token="user_tok" searchWhenChanged="false">
<label>User</label>
<default></default>
</input>
<input type="text" token="email_tok" searchWhenChanged="false">
<label>Email</label>
<default></default>
</input>
<input type="text" token="description_tok" searchWhenChanged="false">
<label>Description</label>
<default></default>
</input>
<input type="dropdown" token="revisit_tok" searchWhenChanged="false">
<label>Revisit</label>
<choice value="select">Select</choice>
<choice value="1 month">1 Month</choice>
<choice value="2 month">2 Month</choice>
<choice value="3 month">3 Month</choice>
<choice value="4 month">4 Month</choice>
<choice value="5 month">5 Month</choice>
<choice value="6 month">6 Month</choice>
</input>
<input type="dropdown" token="dropdown_tok" searchWhenChanged="false">
<label>Action</label>
<choice value="add">Add</choice>
<choice value="remove">Remove</choice>
<choice value="reauthorize">Reauthorize</choice>
<search>
<query>
</query>
</search>
</input>
</fieldset>
<row>
<panel>
<title>blah Lookup Table</title>
<table>
<title>blah Lookup</title>
<search>
<query>| inputlookup blah.csv | append [ | makeresults | eval user="$user_tok$", email="$email_tok$", description="$description_tok$", revisit="$revisit_tok$", Action="$dropdown_tok$" | fields - _time ] | table user, email, description, revisit | outputlookup blah.csv</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
</search>
<option name="drilldown">none</option>
<option name="refresh.display">progressbar</option>
</table>
</panel>
</row>
</form>
... View more
05-11-2022
09:21 AM
<input type="dropdown" token="dropdown_tok" searchWhenChanged="false"> <label>Action</label> <choice value="add">Add</choice> <choice value="remove">Remove</choice> <choice value="reauthorize">Reauthorize</choice> <search> <query> </query> </search> </input> </fieldset> <row> <panel> <title>USB BAU Lookup Table</title> Am I able to add the query right under the dropdown query area? <table> </form> @ITWhisperer
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
08-01-2022
05:04 PM
|
