Closed kucster closed 2 years ago
Those are tokens set from the dashboard. could you post the search that does not work and then the search that does? might help narrow down how it is working in your environment.
Thank you for your help. It is not so much the search but the issue is the dashboard. I've attached a pic, on the left is the dashboard unmodified and the right is the modified. The modified code is below, I've pretty much just removed the ($exclude_technique$) AND ($exclude_host_fqdn$) references.
`
so I think the input fields are mis-named, The search is expecting exclud_technique and exclude_host_fqdn and I think they are called mitre_technique_id and host_fqdn. Edit the dashboard and then edit those inputs and ensure the Token fields are correct Attached is a screenshot of the exclude host field where the Token field is correctly set. Let me know if those are correct and it is still not working.
Thank you for your continued help, I've looked at the values and I think they are correct, see below
Weird ok, not sure where to look, I cannot re-create the issue. If it works to just remove those token references then go for it.
Will do, thank you for trying
I've been playing with your great app and am stuck as to why to get any query to run I need to remove ($exclude_technique$) AND ($exclude_host_fqdn$). I'm rather new to Splunk but I've tried to review your code and can't quite find the culprit. On my ThreatHunting about page everything shows up as installed. Also when I remove these values everything starts working but I think I will need them as I do need to exclude some items. Thanks for your help Sean