Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
All Posts
Find Answers
Ask questions. Get answers. Find technical product solutions from passionate members of the Splunk community.
×
Are you a member of the Splunk Community?
Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- Find Answers
- :
- All Posts
All Posts
03-14-2024
08:04 AM
The x-axis of a chart is usually the first field / column in the result events used for the chart. Check your search query to ensure that the fields are in the correct order.
03-14-2024
08:00 AM
The runanywhere example I shared shows it working. However, this is based on the events that you shared, so if it isn't working for your real data, there is likely to be some discrepancy between your...
See more...
The runanywhere example I shared shows it working. However, this is based on the events that you shared, so if it isn't working for your real data, there is likely to be some discrepancy between your real data and the sample events that you shared. This is why it is important to share accurate representative examples of your data. Check your actual field names and event structure and modify the search accordingly.
03-14-2024
07:43 AM
Thank you for the suggestion. But I have mentioned, The current Splunk has been setup such that it's not letting me to use ./splunk start to accept license. The only way I can start the splunk u...
See more...
Thank you for the suggestion. But I have mentioned, The current Splunk has been setup such that it's not letting me to use ./splunk start to accept license. The only way I can start the splunk using systemctl start Splunkd
03-14-2024
07:42 AM
Currently, we are using the ITSI Module along with the Splunk_TA_snow addon to create incidents on ServiceNow and this is working as expected. We have a new requirement now to create TASKs along w...
See more...
Currently, we are using the ITSI Module along with the Splunk_TA_snow addon to create incidents on ServiceNow and this is working as expected. We have a new requirement now to create TASKs along with the incidents. We went through the scripts of ServiceNow and the documentation and we couldn't find anything that could help us. My questions are 1. do we have this feature within the current scope of the addon? 2. If not, can this be customized?
Labels
- Labels:
-
using Splunk Enterprise
03-14-2024
07:35 AM
Hi Guys, In this case statement i am getting jobType values but i am not getting Status value. I already mentioned the keyword above in the query But why i am not getting . index="mulesoft" applica...
See more...
Hi Guys, In this case statement i am getting jobType values but i am not getting Status value. I already mentioned the keyword above in the query But why i am not getting . index="mulesoft" applicationName="s-concur-api" environment=DEV timestamp ("onDemand Flow for concur Expense Report file with FileID Started" OR "Exchange Rates Scheduler process started" OR "Exchange Rates Process Completed. File successfully sent to Concur")|transaction correlationId| rename timestamp as Timestamp correlationId as CorrelationId tracePoint as TracePoint content.payload.TargetFileName as TargetFileName
| eval JobType=case(like('message',"%onDemand Flow for concur Expense Report file with FileID Started%"),"OnDemand",like('message',"%Exchange Rates Scheduler process started%"),"Scheduled", true() , "Unknown")| eval Status=case(like('message',"Exchange Rates Process Completed. File sucessfully sent to Concur"),"SUCCESS",like('TracePoint',"%EXCEPTION%"),"ERROR") |table JobType Status
Labels
- Labels:
-
alert condition
03-14-2024
07:32 AM
We had PS create a report but, I can't seem to figure out what setting he set to show a time base chart without a time-based command. He didn't use dashboard. The graphic only shows on the re...
See more...
We had PS create a report but, I can't seem to figure out what setting he set to show a time base chart without a time-based command. He didn't use dashboard. The graphic only shows on the report? I want the ability to do similar type of visualization but, I can't figure what setting cause the visual output.
03-14-2024
07:30 AM
How to know if the SDK is initialized or not in react native?
Labels
- Labels:
-
Real User Monitoring
03-14-2024
07:24 AM
Now the Status field is missing. commonId Status Username xxxxxx xxxxxxxxxx
03-14-2024
07:18 AM
1 Karma
Try <query>| loadjob $sid$</query>
03-14-2024
07:15 AM
OK I was missing some capitalisation | makeresults format=json data="[{\"attributes\": {\"type\": \"LoginHistory\", \"url\": \"xxxxx\"}, \"ApiType\": \"xxxxx\", \"ApiVersion\": \"xxxxx\", \"Applicat...
See more...
OK I was missing some capitalisation | makeresults format=json data="[{\"attributes\": {\"type\": \"LoginHistory\", \"url\": \"xxxxx\"}, \"ApiType\": \"xxxxx\", \"ApiVersion\": \"xxxxx\", \"Application\": \"xxxxx\", \"Browser\": \"xxxxx\", \"ClientVersion\": \"\", \"Id\": \"xxxxx\", \"LoginTime\": \"xxxxx\", \"LoginType\": \"xxxxx\", \"LoginUrl\": \"xxxxx\", \"LoginGeoId\": \"xxxxx\", \"xxxxx\": {\"attributes\": {\"type\": \"xxxxx\", \"url\": \"xxxxx\"}, \"City\": \"xxxxx\", \"Latitude\": \"xxxxx\", \"Longitude\": \"xxxxx\"}, \"Platform\": \"xxxxx\", \"SourceIp\": \"xxx.xxx.xxx.xxx\", \"Status\": \"xxxxx\", \"UserId\": \"xxxxx\", \"UserAccountId\": \"xxxxx\"},{\"attributes\": {\"type\": \"User\", \"url\": \"xxxxx\"}, \"LastModifiedDate\": \"xxxxx\", \"City\": \"xxxxx\", \"Country\": \"xxxxx\", \"FirstName\": \"xxxxx\", \"Id\": \"xxxxx\", \"IsActive\": \"xxxxx\", \"LastLoginDate\": \"xxxxx\", \"LastName\": \"xxxxx\", \"Latitude\": \"xxxxx\", \"Longitude\": \"xxxxx\", \"MobilePhone\": \"xxxxx\", \"Name\": \"xxxxx\", \"PostalCode\": \"xxxxx\", \"State\": \"xxxxx\", \"Username\": \"xxxxx\", \"UserRoleId\": \"xxxxx\", \"UserType\": \"xxxxx\", \"Email\": \"xxxxx\", \"CompanyName\": \"xxxxx\", \"ProfileId\": \"xxxxx\", \"Profile\": {\"attributes\": {\"type\": \"Profile\", \"url\": \"xxxxx\"}, \"PermissionsApiEnabled\": \"xxxxx\", \"PermissionsModifyAllData\": \"xxxxx\", \"PermissionsViewSetup\": \"xxxxx\"}, \"UserAccountId\": \"xxxxx\"}]"
| streamstats count as sourcetype
| eval sourcetype="sourcetype".sourcetype
| eval commonId = if(sourcetype = "sourcetype1", UserId, Id)
| stats values(Status) as Status values(Username) as Username by commonId
03-14-2024
07:04 AM
This is not valid JSON - please supply event in valid format
03-14-2024
06:53 AM
{"attributes": {"type": "User", "url": "xxxxx"}, "LastModifiedDate": "xxxxx", "City": xxxxx, "Country": xxxxx, "FirstName": "xxxxx", "Id": "xxxxx", "IsActive": xxxxx, "LastLoginDate": "xxxxx", "LastN...
See more...
{"attributes": {"type": "User", "url": "xxxxx"}, "LastModifiedDate": "xxxxx", "City": xxxxx, "Country": xxxxx, "FirstName": "xxxxx", "Id": "xxxxx", "IsActive": xxxxx, "LastLoginDate": "xxxxx", "LastName": "xxxxx", "Latitude": xxxxx, "Longitude": xxxxx, "MobilePhone": xxxxx, "Name": "xxxxx", "PostalCode": xxxxx, "State": xxxxx, "Username": "xxxxx", "UserRoleId": xxxxx, "UserType": "xxxxx", "Email": "xxxxx", "CompanyName": xxxxx, "ProfileId": "xxxxx", "Profile": {"attributes": {"type": "Profile", "url": "xxxxx"}, "PermissionsApiEnabled": xxxxx, "PermissionsModifyAllData": xxxxx, "PermissionsViewSetup": xxxxx}, "UserAccountId": "xxxxx"}
{"attributes": {"type": "LoginHistory", "url": "xxxxx"}, "ApiType": xxxxx, "ApiVersion": "xxxxx", "Application": "xxxxx", "Browser": "xxxxx", "ClientVersion": "", "Id": "xxxxx", "LoginTime": "xxxxx", "LoginType": "xxxxx", "LoginUrl": "xxxxx", "LoginGeoId": "xxxxx", "xxxxx": {"attributes": {"type": "xxxxx", "url": "xxxxx"}, "City": "xxxxx", "Latitude": xxxxx, "Longitude": xxxxx}, "Platform": "xxxxx", "SourceIp": "xxx.xxx.xxx.xxx", "Status": "xxxxx", "UserId": "xxxxx", "UserAccountId": "xxxxx"}
03-14-2024
06:51 AM
<row>
<panel depends="$tok_tab_1$">
<table>
<title>Alerts Fired</title>
<search>
<query> index=_audit action=alert_fired
| rename ss_name AS Alert
| stats latest...
See more...
<row>
<panel depends="$tok_tab_1$">
<table>
<title>Alerts Fired</title>
<search>
<query> index=_audit action=alert_fired
| rename ss_name AS Alert
| stats latest(_time) AS "Event_Time" sparkline AS "Alerts Per Day" count AS "Times Fired"
first(sid) AS sid by Alert
| eval Event_Time=strftime(Event_Time,"%m/%d/%y %I:%M:%S %P")
| rename Event_Time AS "Last Fired"
| sort -"Times Fired"
</query>
<earliest>$time.earliest$</earliest>
<latest>$time.latest$</latest>
</search>
<fields>Alert, "Last Fired", "Times Fired", "Alerts Per Day"</fields>
<option name="count">10</option>
<option name="dataOverlayMode">heatmap</option>
<option name="drilldown">cell</option>
<option name="rowNumbers">false</option>
<option name="wrap">true</option>
<drilldown>
<set token="sid">$row.sid$</set>
<unset token="tok_tab_1"></unset>
<set token="tok_tab_2">active</set>
<set token="tok_display_dd"></set>
<set token="Alert">$row.Alert$</set>
<link target="_blank">search?sid=$row.sid$</link>
</drilldown>
</table>
</panel>
</row>
<row>
<panel depends="$tok_tab_2$">
<table>
<title>$Alert$</title>
<search>
<query>| search?sid=$sid$</query>
<earliest>$earliest$</earliest>
<latest>$latest$</latest>
</search>
<option name="drilldown">none</option>
<option name="refresh.display">progressbar</option>
</table>
</panel>
</row> In the code above the below line works correctly opening a new search tab with the Alert search query. <link target="_blank">search?sid=$row.sid$</link> I would like to know how to have this same functionality, but within a token so I can keep it on the same page within another table.
03-14-2024
06:45 AM
Please share the raw source (not formatted) version of your events
03-14-2024
06:37 AM
Returns empty username field commonId Status Username xxxxxxxxx Success
03-14-2024
06:32 AM
Assuming these fields have already been extracted, try something like this | eval commonId = if(sourcetype = "sourcetype1", UserId, id)
| stats values(Status) as Status values(Username) as Username ...
See more...
Assuming these fields have already been extracted, try something like this | eval commonId = if(sourcetype = "sourcetype1", UserId, id)
| stats values(Status) as Status values(Username) as Username by commonId
03-14-2024
06:22 AM
sourcetype1: { [-] ApiType: xxxxx ApiVersion: xxxxx Application: xxxxx Browser: xxxxx ClientVersion: xxxxx Id: xxxxx LoginGeo: {[+] } LoginGeoId: xxxxx LoginTime: xxxx-xx-xx xx:xx:xx Logi...
See more...
sourcetype1: { [-] ApiType: xxxxx ApiVersion: xxxxx Application: xxxxx Browser: xxxxx ClientVersion: xxxxx Id: xxxxx LoginGeo: {[+] } LoginGeoId: xxxxx LoginTime: xxxx-xx-xx xx:xx:xx LoginType: xxxxx LoginUrl: xxxxx Platform: xxxxx SourceIp: xxxxx Status: xxxxx UserAccountId: xxxxx UserId: xxxxx attributes: { [+] } } sourcetype2: { [-] City: xxxxx CompanyName: xxxxx Country: xxxxx Email: xxxxx FirstName: xxxxx Id: xxxxx IsActive: xxxxx LastLoginDate: xxxx-xx-xx xx:xx:xx LastModifiedDate: xxxx-xx-xx xx:xx:xx LastName: xxxxx Latitude: xxxxx Longitude: xxxxx MobilePhone: xxxxx Name: xxxxx PostalCode: xxxxx Profile: { [+] } ProfileId: xxxxx State: xxxxx UserAccountId: xxxxx UserRoleId: xxxxx UserType: xxxxx Username: xxxxx attributes: { [+] } }
03-14-2024
06:14 AM
Please provide sample (anonymised) events for your two sourcetypes, preferably in a code block </>
03-14-2024
06:10 AM
Hi @richgalloway Good Day!! How to fix the vulnerabilities in Splunk? Please guide me with some example. Thanks
03-14-2024
06:04 AM
thanks @richgalloway with that change, around 5 million logs were ingested in couple of mins.
