From 2c8af81586db3d715853d7894625683c0ae8153d Mon Sep 17 00:00:00 2001 From: mjfernez Date: Mon, 22 Jul 2024 23:46:12 -0400 Subject: Make pandoc use main.css --- .../i-found-out-splunk-macros-are-awesome.html | 170 +++------------------ 1 file changed, 20 insertions(+), 150 deletions(-) (limited to 'tutorials/splunk/i-found-out-splunk-macros-are-awesome.html') diff --git a/tutorials/splunk/i-found-out-splunk-macros-are-awesome.html b/tutorials/splunk/i-found-out-splunk-macros-are-awesome.html index 10e8567..d1ea507 100644 --- a/tutorials/splunk/i-found-out-splunk-macros-are-awesome.html +++ b/tutorials/splunk/i-found-out-splunk-macros-are-awesome.html @@ -6,154 +6,23 @@ i-found-out-splunk-macros-are-awesome +

Macros are for more than just canned searches.

@@ -173,13 +42,14 @@ time. That report might look something like this:

I can easily review that lookup like so:

| inputlookup vpn_users.csv

My boss might be happy that I'm keeping an eye on things, but what's -the historical picture? How do I know what's a red flag and what isn't? -What I might do is combine all of the days reports into one each day, -and then compare each today. But in the original report logic, this gets -overwritten every 12 hours. You could just append forever, but then -you're not looking at just twelve hours, unless you add a time -constraint to your search. How do I get to a daily report without -interrupting the reports already running?

+the historical picture? How do I know what's a red flag and what +isn't?

+

What I might do is combine all of the days' reports into one each +day, and then compare each one to today's. But in the original report +logic, this gets overwritten every 12 hours. You could just append +forever, but then you're not looking at just twelve hours, unless you +add a time constraint to your search. How do I get to a daily report +without interrupting the reports already running?

One way to do it is to create a second combined report unique to that day, for example 'vpn_users-2022_11_17.csv'. The way you insert that text is with a macro, defined for the current date. For this particular -- cgit v1.2.3