About PTC_

PTC_ · ‎03-28-2024

I have been using this script to update many of our lookups/datasets but it's no longer working, giving the following error when downloading the file: "status 403, reason: Forbidden" It was working last week but it suddenly stop. The user I'm using is the owner of these lookups/datasets and no permissions were changed. The Splunk instance is currently having a issue with a expired certificate, could it be because of that? Or something else?

PTC_ · ‎03-28-2024

Was the issue fixed? I'm having the exactly same issue and weeks ago it was working fine. No change was done to the lookup/dataset permissions and the user I'm using to access is the owner of the lookup. Could this be related to a splunk certificate being expired? or something else?

PTC_ · ‎03-08-2023

I did the inverse and it worked for my case: | eval Report_Update = coalesce(strftime(now(),"%d/%m/%Y %H:%M:%S"),Report_Update) Thank you!

PTC_ · ‎03-08-2023

Is not updating the null fields with this command. Any idea of what I could be doing wrong?

PTC_ · ‎03-07-2023

I have created a Report with a Query that updates a list of NAMES on CSV file. If the NAMES field have empty strings or null values, the Query will try to get the NAME from another field and add it to NAMES. Something like this: NAMES ADDED_ON_INDEX REPORT_UPDATE_DATE Sara 01/03/2023 00:00:00 06/03/2023 17:28:17 John 01/02/2023 00:00:00 06/03/2023 17:28:17 Peter 01/01/2023 00:00:00 06/03/2023 17:28:17 Oliver 01/03/2023 00:00:00 06/03/2023 17:28:17 I want to achieve the following: NAMES ADDED_ON_INDEX REPORT_UPDATE_DATE Sara 01/03/2023 00:00:00 06/03/2023 17:28:17 John 01/02/2023 00:00:00 06/03/2023 17:28:17 Peter 01/01/2023 00:00:00 06/03/2023 17:28:17 Matt 22/01/2023 00:00:00 07/03/2023 18:33:09 Oliver 01/03/2023 00:00:00 06/03/2023 17:28:17 I want the Report to register the date ONLY when new values date and to NOT replace current dates, so I can keep track of when the NAMES were added by the Report. I tried the following line but it doesn't do what I want. It always replace with the time the Report ran: | eval Report_Update = strftime(now(),"%d/%m/%Y %H:%M:%S") And "_time" gives me the date of when it was added to the index. Is there a specific way to register this info?

PTC_ · ‎03-05-2023

Maybe I didn't explain it well but anyway I don't wish to obtain those results. Dunno how can I explain it better but I used this command and it works for what I need to do: | eval FIELD1= mvjoin(FIELD1,FIELD2)

PTC_ · ‎03-05-2023

Let's say both fields look like this: FIELD1 FIELD2 INFO2 INFO3 INFO1 INFO4 I want to append, for example, INFO2 and INFO3 to the blank spaces in FIELD1 and the command does that. However, since "INFO1" fails the condition, it will be replaced with empty string, which I don't want to. The end result will look like this: FIELD1 FIELD2 INFO2 INFO2 INFO3 INFO3 INFO4 In the end, I only want to fill FIELD1 blank spaces with FIELD2 information.

PTC_ · ‎03-05-2023

Hello, I want to append the results from one field to another, however, I only want to fill the null and blank spaces of the field. For this I tried the following: | eval FIELD2= if(isnull(FIELD1) OR FIELD1="",mvappend(FIELD2,FIELD1),"") What happens is that it will substitute the filled slots from FIELD2 with "", so it doesn't do what I need. Is there any solution for this?

PTC_ · ‎03-02-2023

Hello, (I will use fictional data to give examples) I'm trying to use regex to extract data from one field to another, but Splunk doesn't find the data I want in this specific field. The field I want to extract data (let's call it DATA_FIELD) looks something like: SMBv2 guid=111111-b111-1111-1111-11111aaaa11 time=2023-02-27 15:17:35 domain=DOMAINNAME version=12.1.11111 ntlm-ver=15 domain=DOMAINNAME name=HOSTNAME domain-dns=DOMAINDNS name-dns=NAMEDNS I want to extract "name=HOSTNAME" from this field to another one (HOSTNAME_FIELD) I suspect my Regex parameters are not working with Splunk, even though I tested them all in regex101 . Example: | rex field=DATA_FIELD "HOSTNAME_FIELD: name=(?<name>\S*(?))\s" I tried many forms of regex, such as: name.(?<=[=])\S*(?:\s)? .name=(?<=[=])\S*(?) name=(?<name>\S*(?))\s None of them worked in Splunk but they work in regex101. Is this problem on the regex formula itself on Splunk? Or is it problem with the sintax? What's the best way to extract this data?

Posts	10
Solutions	1
Karma Given	1
Karma Received	2
Member Since	‎03-02-2023

Online Status	Offline
Date Last Visited	‎03-28-2024 10:10 AM

Downloading/Updating lookup files via connector re...

How to log date when report/query adds new values?

Mvappend or Mvjoin only to fill blank spaces?

Extract data from one field ot another using Regex

Downloading/Updating lookup files via connector re...

Re: Downloading lookup files via API returning 403...

Re: Log Date when Report/Query adds new values

Re: Log Date when Report/Query adds new values

How to log date when report/query adds new values?

Re: Mvappend or Mvjoin only to fill blank spaces

Re: Mvappend or Mvjoin only to fill blank spaces

Mvappend or Mvjoin only to fill blank spaces?

Extract data from one field ot another using Regex