All Posts

Find Answers
Ask questions. Get answers. Find technical product solutions from passionate members of the Splunk community.

All Posts

Hello @ezmo1982, Yes, the exact feature was released in ES 7.2.0 - https://docs.splunk.com/Documentation/ES/7.2.0/RN/Enhancements as a part of https://ideas.splunk.com/ideas/ESSID-I-189     P... See more...
Hello @ezmo1982, Yes, the exact feature was released in ES 7.2.0 - https://docs.splunk.com/Documentation/ES/7.2.0/RN/Enhancements as a part of https://ideas.splunk.com/ideas/ESSID-I-189     Please accept the solution and hit Karma, if this helps!
I am trying to get the count of the hit to the particular api and based on the field called execution-time  I am calculating SLA , Somehow I am able to see the no of requests coming to the api but n... See more...
I am trying to get the count of the hit to the particular api and based on the field called execution-time  I am calculating SLA , Somehow I am able to see the no of requests coming to the api but not able to get the SLA count using below query, Can some one help me where I am doing wrong in the below query,   index=* uri=validate | eval SLA=1000| stats count as total_calls count(eval(execution-time < SLA)) as sla_compliant_count
Small correction: In the result table, rows 4 and 5, ID_C should be "C3" (from table Z).
Hi @Mahmoud, Don't use join: Splunk isn't a relational Database, it's a search engine, use stats BY the common key, something like this: index="main" sourcetype="WinEventLog:Sysmon" lsass SourceIma... See more...
Hi @Mahmoud, Don't use join: Splunk isn't a relational Database, it's a search engine, use stats BY the common key, something like this: index="main" sourcetype="WinEventLog:Sysmon" lsass SourceImage="C:\\Windows\\system32\\rundll32.exe" EventCode IN (10,1) | eval ProcessId=coalesce(SourceProcessId,ProcessId) | stats values(TargetImage) AS TargetImage values(commandLine) AS commandLine BY ProcessId if you want to add an additional condition, e.g. only the ProcessId present in both the EventCodes, you can ann an additional final constrain. index="main" sourcetype="WinEventLog:Sysmon" lsass SourceImage="C:\\Windows\\system32\\rundll32.exe" EventCode IN (10,1) | eval ProcessId=coalesce(SourceProcessId,ProcessId) | stats values(TargetImage) AS TargetImage values(commandLine) AS commandLine dc(EventCode) AS EventCode_count BY ProcessId | where EventCode_count=2 | fields - EventCode_count Ciao. Giuseppe
this is the query, so i'm still a baby in this world (so I'm sorry if there is a dummy mistakes that might drive you crazy when you read this query). However, I'm trying to Join the Source Process Id... See more...
this is the query, so i'm still a baby in this world (so I'm sorry if there is a dummy mistakes that might drive you crazy when you read this query). However, I'm trying to Join the Source Process Id (from event code 10) with the Process Id ( from event code 1) and then print the command line, I tried to use `type=inner` but it gave me nothing which is wired, because when I look for the first query there is result and the same for the inner query.     index="main" sourcetype="WinEventLog:Sysmon" EventCode=10 lsass SourceImage="C:\\Windows\\system32\\rundll32.exe" | join left=L right=R type=left where L.SourceProcessId=R.ProcessId [search EventCode=1 lsass "C:\\Windows\\system32\\rundll32.exe"] | table L.TargetImage, R.ProcessId, R.commandLine  
Hi @RanjithaN99, you don't need to install an UF on the Search Head. Your SH should already send its own logs to the indexers. In this case, you have only to enable the input from your GUI or CLI.... See more...
Hi @RanjithaN99, you don't need to install an UF on the Search Head. Your SH should already send its own logs to the indexers. In this case, you have only to enable the input from your GUI or CLI. Only one attention point: using GUI you probably don't have the indexer in the available indexes list. You can solve this in two ways: you could create an index with the same name on the Search Head, even if the logs will not go in this index but in the one (with the same name)  on the indexer, you could create the input by CLI. Ciao. Giuseppe
Hi Community,  Please help me out, I am trying to monitor a path on the splunk search head in a Splunk enterprise environment. What would be the best practice to implement this? Would it be advisa... See more...
Hi Community,  Please help me out, I am trying to monitor a path on the splunk search head in a Splunk enterprise environment. What would be the best practice to implement this? Would it be advisable to install a UF on the search head server ? If not, what are the other ways by which we can monitor a path on the splunk search head server.   Thanks,
If you wanna manipulate the raw log event I'm pretty sure you have to do it with props & transforms or a data stream solution. As far as I know no otel processor supports the mentioned fluentd funct... See more...
If you wanna manipulate the raw log event I'm pretty sure you have to do it with props & transforms or a data stream solution. As far as I know no otel processor supports the mentioned fluentd functionality. 
We need to update the threshold of a KPI, the KPI is used by 100+ services and some of these services have the thresholding unlinked from the Service Template. Is there a macro or saved search tha... See more...
We need to update the threshold of a KPI, the KPI is used by 100+ services and some of these services have the thresholding unlinked from the Service Template. Is there a macro or saved search that we can use to do a bulk update of the KPI threshold settings?  this is for the Services which thresholding is already unlinked to the Service Template to avoid manually opening each service to edit the KPI thresholds.  TIA. 
Hi @marnall , the solution depends on two factors: 1) the type of server: if it's a Linux Server, you can use a syslog or (as @marnall sais, an HEC. If Windows is a little more difficoult because... See more...
Hi @marnall , the solution depends on two factors: 1) the type of server: if it's a Linux Server, you can use a syslog or (as @marnall sais, an HEC. If Windows is a little more difficoult because you cannot use syslog; you could use WMI, even if I don't like it. 2) the type of logs you have to ingest (operative system, application)? If application, maybe it has a sislog sending monitoring feature and you can use it. Ciao. Giuseppe
Hey all, Tech stack: Next.js 13 (pages router) I've been following the guide https://docs.appdynamics.com/display/GOVAPM234/Add+Custom+User+Data+to+a+Page+Browser+Snapshot to set custom attribute... See more...
Hey all, Tech stack: Next.js 13 (pages router) I've been following the guide https://docs.appdynamics.com/display/GOVAPM234/Add+Custom+User+Data+to+a+Page+Browser+Snapshot to set custom attributes.   On the initial page I load the AppDynamics script provided below window['adrum-start-time'] = new Date().getTime() ;((config) => { config.appKey = 'XXX' config.adrumExtUrlHttp = 'http://cdn.appdynamics.com' config.adrumExtUrlHttps = 'https://cdn.appdynamics.com' config.beaconUrlHttp = 'http://syd-col.eum-appdynamics.com' config.beaconUrlHttps = 'https://syd-col.eum-appdynamics.com' config.useHTTPSAlways = true config.xd = { enable: true } config.resTiming = { bufSize: 200, clearResTimingOnBeaconSend: true } config.maxUrlLength = 512; config.userEventInfo = { PageView: getAppDynamicsUserInfo(), VPageView: getAppDynamicsUserInfo(), } })(window['adrum-config'] || (window['adrum-config'] = {})) getAppDynamicsUserInfo is a function attached to window and will return the attribute sessionId always and if available, another attribute called customerId. On the initial page load, the sessionId is sent and viewable on AppDynamics Analyze view. When I get to the page where the customerId is available, it is not sent to AppDynamics.  If I inspect window["adrum-config"] or use ADRUM.conf.userConf, I can see both sessionId and customerId. In the above script I've tried just setting PageView and just setting VPageView.  In terms of methods of loading the above script, I've used the Next.js Script component and tried the following: Load the above as an external script file on different pages (different react components) Load the above in different versions of the same script file (different names) on different pages Added the above script into a React component and loaded the component on different pages I've also tried to use the AJAX method to intercept http calls. It intercepts the http call but does not result in sending the user data to AppDynamics.  In addition to trying to set it via config.userInfo as above, I've tried to use the following options as well.  (function (info) { info.PageView = getAppDynamicsUserInfo info.VPageView = getAppDynamicsUserInfo })(config.userEventInfo || (config.userEventInfo = {})) (function (info) { info.PageView = getAppDynamicsUserInfo() info.VPageView = getAppDynamicsUserInfo() })(config.userEventInfo || (config.userEventInfo = {})) ​ Any help is appreciated, thank you  
Many thanks for your suggestion, we have not tried this federated search as of now, let us give it a try and see if it works. 
That was bad workaround way to force enable tty when launch splunkforwarder. Why it has the istty rescrition on itself. Can't we manage forwarder within other program manager like supervisor which co... See more...
That was bad workaround way to force enable tty when launch splunkforwarder. Why it has the istty rescrition on itself. Can't we manage forwarder within other program manager like supervisor which couldn't have tty env
That was rediculous to resctriction ternimal tty to start Splunkforwarder. If that how could the splunkforwarder process been contrulled under program manager like supervisor? tty: true is a work ag... See more...
That was rediculous to resctriction ternimal tty to start Splunkforwarder. If that how could the splunkforwarder process been contrulled under program manager like supervisor? tty: true is a work aground way but not a good solution
The above values didn't work for me for some reason, When I used for example: SYSTEM,(?:[^,]*,){18}([^,]*) ....it worked - (same REGEX as yours, but with the suffix after the "}" being different)
Two custom functions contains huge codes maintained by two different teams
If it's a single line per event then the standard line breaker ([\r\n]+) should work fine. What settings are you using now and how are they failing you? This Splunk Lantern article may shed some li... See more...
If it's a single line per event then the standard line breaker ([\r\n]+) should work fine. What settings are you using now and how are they failing you? This Splunk Lantern article may shed some light on the process: https://lantern.splunk.com/Splunk_Platform/Product_Tips/Data_Management/Configuring_new_source_types
If your problem is resolved, then please click the "Accept as Solution" button to help future readers.
Hi Paul, That was what I was suspecting, the service account permission to access the Servicenow. The only problem i have is getting the other team(Servicenow) to provide info for my troubleshooti... See more...
Hi Paul, That was what I was suspecting, the service account permission to access the Servicenow. The only problem i have is getting the other team(Servicenow) to provide info for my troubleshooting as they are denying that it is their end with issue. I was thinking since the service account is an AD account, there will surely be a security group assign to the service account . I have actually point out that the service account did not have any grouping assigned to it thus there could be a possibility that the servicenow account does not have the permission to access the Servicenow.  There were actually similar issues where we found that some AD users security group were missing after an issue happened. I will try to go through this path and check on the permission again.. Thanks for the advice.
from the below query,  i am running for 2 to 3 and posted the output and ran again same query from 3 to 4 and posted the output. i want a query where i can compare pervious hour(2 to 3 data) with (3... See more...
from the below query,  i am running for 2 to 3 and posted the output and ran again same query from 3 to 4 and posted the output. i want a query where i can compare pervious hour(2 to 3 data) with (3 to 4) data  and i want to calculate the difference percentage  |mstats sum(transaction) as Trans where index=host-metrics service=login application IN(app1, app2, app3, app4) span=1h by application output: 02:00 to 03:00 hours data _time application Trans 2022-01-22 02:00 app1 3456.000000 2022-01-22 02:00 app2 5632.000000 2022-01-22 02:00 app3 5643.000000 2022-01-22 02:00 app4 16543.00000   03:00 to 04:00 hours data output: _time application Trans 2022-01-22 03:00 app1 8753.000000 2022-01-22 03:00 app2 342.000000 2022-01-22 03:00 app3 87653.000000 2022-01-22 03:00 app4 8912.00000