Submitted by northben on Thu, 12/03/2015 - 12:32
It took me a while to figure out how to use a Post-Process Search in a Splunk Dashboard, so I thought it would be a good idea to remind my future self how it's done.
This is a Simple XML dashboard. It is essentially the same as the example in my last post. The full source code is attached to this post.
In order to use a Post Process search, only three changes are needed:
Submitted by northben on Thu, 12/03/2015 - 12:14
Since it is so easy to search for data in Splunk, and then create a dashboard in just a couple of clicks, you might be tempted to do just that -- and release your dashboard into production. For some situations, that's absolutely fine. But as your organization becomes more reliant on Splunk dashboards, this approach can become unwieldy. And if there's anything we want, it's wieldy searches!
Submitted by northben on Tue, 12/01/2015 - 09:30
One of the most common scenarios I experience in Splunk is where I need to use data from two different indexes at once—typically in order to build management and reporting dashboards. With my background in developing applications on relational databases, my first attempts at this solution used the "join" command in Splunk. Once I realized that a combination of the "append" and "stats" commands can be a better choice, I started using those more. But today I will show an even better, faster approach!
Submitted by northben on Tue, 11/17/2015 - 10:30
I use Splunk to report on business objects moreso than typical security operation data. For instance, helpdesk tickets rather than firewall logs. I have created various Python scripts to import these business objects from various REST and SQL sources, and I want these import scripts to be idempotent. That is, I want to import helpdesk tickets every day, but no more than once per day, regardless of how many times the import script is called.
Submitted by northben on Fri, 11/06/2015 - 11:26
Well I don't care much for PowerShell, but sometimes it is a necessary evil. I needed to run some PowerShell scripts in parallel, so I wrote a wrapper to do this. Maybe it will help you also.
Features:
- You specify how many jobs to run in parallel
- When one job finishes, another will be started
Note: the Start-Job commandlet takes a few seconds to do its thing.
The repo lives here: https://github.com/northben/PowerShell-Parallel-Job-Runner
Submitted by northben on Thu, 11/05/2015 - 12:08
Normally, I prefer to send CSV or JSON data to Splunk. But sometimes XML can't be avoided. I recently needed to ingest an XML file, and through judicious use of 'MUST_BREAK_AFTER' and 'BREAK_ONLY_BEFORE' in props.conf, I was able to extract the events from the XML file that looked like this:
Submitted by northben on Wed, 11/04/2015 - 13:10
In this short tutorial I will show you how to create a dashboard table with dynamic columns. When the user selects the radio button toggles, the search does NOT run again -- only the display is updated. Demo: https://youtu.be/l-p83je4RgQ
I am including the full source code to the dashboard with this post for your review. But here's the secret sauce:
Submitted by northben on Mon, 10/26/2015 - 12:18
I've been having trouble indexing CSV files. In particular, CSV files from Tripwire. I'll show you the format and how I was able to index the files in Splunk
Node Name,Node Type,Policy,Parent Test Group,Test Name,Description,Element,Result Time,Result State,Actual Value
"192.168.1.1",Linux Server,"My Policy Name","My Test Group","My Test Name","My Test Description","Some Element",10/25/15 2:02 AM,passed,"ELEMENT=foo"
Here's my Props.conf stanza:
Submitted by northben on Sat, 10/03/2015 - 20:25
I needed to prevent a webpage from closing automatically. Turns out this is very easy to do with JavaScript!
Submitted by northben on Wed, 09/02/2015 - 08:53
I've been working with Splunk Enterprise a lot lately (and it's very powerful and easy to use!). In many situations, it is useful to show some metric compared to the same metric a month ago (or some other time period).
One way to accomplish this is with the community-supported Splunk app, Timewrap. I couldn't get Timewrap to output the data as I wanted, so instead here's the approach that I used.
Pages