Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.lang.javascript > #83572

Download Lookup Editor Splunk

Show all headers | View raw

recently upgraded to the new 4.0.0 version and am seeing a bug w the csvs now. it seems to be adding e and f columns and cannot delete them. which is causing an unwanted column in the actual  inputlookup asdf.csv


I haven't seen that one. But we're seeing other issues with 4.0.0. Edits made via the GUI are not getting saved -- with no error message (in GUI). Same user can edit it via outputlookup, so it's not permissions-related. They were editing via Lookup File Editor prior to the upgrade.



download lookup editor splunk

Download File https://t.co/9GybyF6t7s 






You can enable replication of the lookup backups by using the REST replay feature. To enable this, add the following in restmap.conf (in $SPLUNK_HOME/etc/shcluster/lookup_editor/default/restmap.conf):


This will work on Splunk 6 from (6.3+) and on Splunk 7.1+. However, do not enable this on Splunk 7.0 (7.0 to 7.0.3) because there is a bug in Splunk 7.0 that causes REST replay to crash splunkd.


Directory traversal attacks are prevented by stripping path information from the lookup names. The app also relies on asking Splunk for the canonical path of the lookup file and thus doesn't assume that the user's input is valid. See -lookup-editor/repository/entry/trunk/src/bin/lookup_editor/__init__.py#L185


The app uses Splunk's APIs to edit the lookup files. Splunk sets the file permissions to read & write to the owning user and allows no other access (equivalent to "chmod 600"). The app keeps copies of lookup files (for CSV lookups) which it writes out directly. These are also written with the same permissions (equivalent to "chmod 600"). These files are never written to again.


In Splunk Enterprise versions below 8.1.13, 8.2.10, and 9.0.4, the lookup table uploads let a user upload lookup tables with unnecessary filename extensions. Lookup table file extensions may now only be one of .csv, .csv.gz, .kmz, .kml, .mmdb, or .mmdb.gz. This search provides user activity focus on uploads which aims to help hunt for malicious file uploads.


splunk_unnecessary_file_extensions_allowed_by_lookup_table_uploads_filter is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.


A common use case for lookups is to bring reference data into Splunk. This is covered in the free Splunk Fundamentals 1 course. Lookup tables work as long as there is a matching field in the lookup and your data. This enables you to cross reference your data with any information you like, such as names, known risk levels, or even paths to images hosted in a static directory.






There is no built-in way to edit a lookup file in Splunk. In order to make changes you must manually edit the file and re-upload it to Splunk. The outputlookup command can be used to add new rows, but this comes with some risks and cannot be used to remove data. A better solution is the Lookup Editor app, available on Splunkbase, which is very intuitive and easy to use.


You might need to keep track of when a lookup was last updated. The Splunk REST API allows you to see information on a lookup, such as when it was last updated. We had a recent customer requirement to present results which occurred after a specific lookup file had last been updated. We solved this by using the following rest search alongside a sub-search to filter to the relevant results:


Splunk is matching payment_method_id from our lookup csv file and adding the additional field payment_method_name. This allows us to use the name of the payment method instead of the value when we make our dashboards.


The Splunk lookup command is a wonderful way to enrich your data after it has already been collected. It can help make your searches and dashboards more useful by giving you contextual information. You can also use the powerful CIDR matching functionality to group IP addresses and search based on things like offices or VLANs.


Let's explain a bit of what we're doing here. The Lookup Function will match only if a field in an object called splunk_metrics is present, and contains a member of group. This should evaluate true for all the events we're concerned with.


Next, we selected a lookup file that was already installed in the Knowledge section. This Lookup Function will look inside that file, to match a given row if the value from an event matches the column value.


Lookup Field Name in Event tells Stream which event field to grab the value from. Corresponding Field Name in Lookup tells us what field to map to in the lookup file. With no Output field(s) currently configured, this Lookup Function will return all the rest of the columns from the lookup. (If you want to select a subset of columns, or to rename fields, add rows to the Output field(s) to do the mapping.)


NOTE: The scheduled searches combine this lookup along with analytic stories and checks against existing saved/correlation searches in order to create mitre_all_rule_technique_lookup.csv, which is used within the app.


Important NOTE: If a rule name is already defined, this view does NOT add any mappings to the lookup in order to avoid duplicates. You will see No results found message and will need to edit the lookup table manually.

 35fe9a5643

Back to comp.lang.javascript | Previous | Next | Find similar | Unroll thread

Thread

Download Lookup Editor Splunk Bernice Billy <bernicebilly06@gmail.com> - 2024-01-01 04:41 -0800

csiph-web