All Posts

Find Answers
Ask questions. Get answers. Find technical product solutions from passionate members of the Splunk community.

All Posts

Hello, I am creating a dashboard in Dashboard Studio and wanted to have just 3 timeranges available for a user: Last Month ("-mon@mon" to "@mon") Last to last Month ("-2mon@mon" to "-mon@mon") Mo... See more...
Hello, I am creating a dashboard in Dashboard Studio and wanted to have just 3 timeranges available for a user: Last Month ("-mon@mon" to "@mon") Last to last Month ("-2mon@mon" to "-mon@mon") Month to date ("@mon" to "@d") I think I can get all these options in the default timerange input as well, but I do not want User to select anything other than these 3 options - and this is something I cannot prevent when using default timerange input (or at least I am not sure how do I do that, until and unless I create a separate user role with specific time ranges allowed, may be). so as a work around, I have created a drop down with these 3 token labels and values are set in form of relative_time function, i.e., where tempDt>=relative_time(now(),"-mon@mon") and tempDt<relative_time(now(),"@mon") where tempDt>=relative_time(now(),"@mon") and tempDt<relative_time(now(),"@d") where tempDt>=relative_time(now(),"-2mon@mon") and tempDt<relative_time(now(),"-mon@mon") in the main search (not available on demo dashboard definition shared here) I am using a variable tempDt and then one of the token value will filter data based on this tempDt. index=abc earliest="-2mon@mon" ```there exist a field called tempDt``` $timerange$ All this worked as expected - no issues.  ------------------------------------------------------------------------------------------------------------------------ Now, I also want to display Month Name in Dashboard Header (created using Markdown Text) based on Token Value,  if Last Month then strftime(relative_time(now(),"-mon@mon"),"%b-%Y") if Last to last month then strftime(relative_time(now(),"-2mon@mon"),"%b-%Y") if Month To Date then strftime(relative_time(now(),"@mon"),"%b-%Y") Please see below dashboard source code that I have tried but Markdown text is not populated with the Month Name - when I run the same search outside dashboard, it works ok. { "visualizations": { "viz_q7o2tu52": { "type": "splunk.markdown", "options": { "markdown": "### **Monthly Service Review ($MD Search:result.month$)**" } } }, "dataSources": { "ds_zBQAeHol": { "type": "ds.search", "options": { "enableSmartSources": true, "query": "| makeresults \n| eval temp=case(LIKE($timerange|s$,\"%-2mon@mon%\"),\"-2mon@mon\",LIKE($timerange|s$,\"%-mon@mon%\"),\"-mon@mon\",LIKE($timerange|s$,\"%@d%\"),\"@mon\",true(),\"@d\")\n| eval epoch=relative_time(now(),$temp$)\n| eval month=strftime(epoch,\"%b-%Y\")\n| table month", "queryParameters": { "earliest": "-24h@h", "latest": "now" } }, "name": "MD Search" } }, "defaults": { "dataSources": { "ds.search": { "options": { "queryParameters": { "latest": "$global_time.latest$", "earliest": "$global_time.earliest$" } } } } }, "inputs": { "input_global_trp": { "options": { "items": [ { "label": "Last Month", "value": "where tempDt>=relative_time(now(),\"-mon@mon\") and tempDt<relative_time(now(),\"@mon\")" }, { "label": "Month to Date", "value": "where tempDt>=relative_time(now(),\"@mon\") and tempDt<relative_time(now(),\"@d\")" }, { "label": "Last to last Month", "value": "where tempDt>=relative_time(now(),\"-2mon@mon\") and tempDt<relative_time(now(),\"-mon@mon\")" } ], "defaultValue": "where tempDt>=relative_time(now(),\"-mon@mon\") and tempDt<relative_time(now(),\"@mon\")", "token": "timerange" }, "title": "Time Range", "type": "input.dropdown" } }, "layout": { "type": "absolute", "options": { "width": 1440, "height": 960, "display": "auto" }, "structure": [ { "item": "input_global_trp", "type": "input", "position": { "x": 640, "y": 130, "w": 198, "h": 82 } }, { "item": "viz_q7o2tu52", "type": "block", "position": { "x": 540, "y": 30, "w": 400, "h": 90 } } ], "globalInputs": [] }, "description": "", "title": "MD Markdown Token Test" }   Can you please help how can I achieve this? Thank you. Regards, Madhav
This was my initial search. I cannot compare the two fields "srcdomain = destdomain" because when I intend to use eval my value is output as null. Thanks everyone  
日本語で失礼します。 私はLinuxにUFをインストールし、input.confを以下のように設定しました。 [monitor:///xxxx/] whitelist = xxxx_list_<yyyymmdd>.csv UFを再起動し、Splunk list monitorで対象のファイルが表示されていることを確認しました。 しかし、翌日に上記と同じコマンドでモニター状況を確認したと... See more...
日本語で失礼します。 私はLinuxにUFをインストールし、input.confを以下のように設定しました。 [monitor:///xxxx/] whitelist = xxxx_list_<yyyymmdd>.csv UFを再起動し、Splunk list monitorで対象のファイルが表示されていることを確認しました。 しかし、翌日に上記と同じコマンドでモニター状況を確認したところ、新しく作成されたファイル(xxxx_list_20241212.csv)が表示されませんでした。 こちら解決方法ご存知の方、 ご教示いただけますでしょうか
Somewhere I read/interpreted that you only wanted those from XYZ.csv and discard the ABC.csv-only ones.  To preserve all, use the following. | inputlookup ABC.csv | eval lookup="ABC.csv" | fields F... See more...
Somewhere I read/interpreted that you only wanted those from XYZ.csv and discard the ABC.csv-only ones.  To preserve all, use the following. | inputlookup ABC.csv | eval lookup="ABC.csv" | fields Firewall_Name lookup | append [ | inputlookup XYZ.csv | eval lookup="XYZ.csv" | rename Firewall_Hostname AS Firewall_Name | fields Firewall_Name lookup ] | stats values(lookup) as lookup by Firewall_Name | eval lookup = if(mvcount(lookup) > 1, mvjoin(lookup, " + "), lookup . " only") | stats count values(Firewall_Name) as Firewall by lookup | eval Firewall = if(lookup == "ABC.csv + XYZ.csv", null(), lookup)  
Have a look at the Splunk Monitoring console  
With the splunk_TA_windows you can index logs regarding windows update from the machines where you have a forwarder installed. With that you can check the packages that are installed in each machine.... See more...
With the splunk_TA_windows you can index logs regarding windows update from the machines where you have a forwarder installed. With that you can check the packages that are installed in each machine. I dont think you can check which patches are missing unless you already have them installed somewhere. With these logs, you can also check for problems with windows update (check splunk lantern).
I would like to be able to see the daily traffic flow rate of Splunk Enterprise on my dashboard. Ideally, I would like to be able to see the traffic flow per forwarder, but at the very least I would... See more...
I would like to be able to see the daily traffic flow rate of Splunk Enterprise on my dashboard. Ideally, I would like to be able to see the traffic flow per forwarder, but at the very least I would like to see the overall traffic flow. Is this possible?
Splunk APM is part of the Observability Cloud and is available as a SaaS offering only. https://www.splunk.com/en_us/products/pricing/observability.html
The query I provided was an example that must be customized for your environment.  At the very least, the index name "foo" must be changed to the name of the index that holds the event data.  The fie... See more...
The query I provided was an example that must be customized for your environment.  At the very least, the index name "foo" must be changed to the name of the index that holds the event data.  The field names also may need to be changed.  Look at the events to see what is available to you.
Oh okay I just assumed it was a Splunk lookup. So if you are indexing the data from a CSV then you can probably do something like this (assuming field extractions are in place) index=<index> sou... See more...
Oh okay I just assumed it was a Splunk lookup. So if you are indexing the data from a CSV then you can probably do something like this (assuming field extractions are in place) index=<index> sourcetype=<sourcetype> | table [ | makeresults | fields - _time | eval ID=[ | search index=<index> sourcetype=<sourcetype> | stats latest(ID) as ID | return $ID ], field_list_id_zero="NAME,STATUS,DATE,ACTION", field_list_id_positive="DATE-Changed,ID,NAME,DATE_DOWN,ACTION", final_field_list=if( 'ID'==0, 'field_list_id_zero', 'field_list_id_positive' ) | fields + final_field_list | return $final_field_list ]   where <index> and <sourcetype> is where your CSV is being indexed.
dtbur;rows3 Wow, fast reply. Thanks. The ID gets set when the csv file is written. I have a python program that queries a MySQL database, and writes a "0" as ID if no results are returned from the q... See more...
dtbur;rows3 Wow, fast reply. Thanks. The ID gets set when the csv file is written. I have a python program that queries a MySQL database, and writes a "0" as ID if no results are returned from the query. If there is data returned, the ID is taken from query results (i.e ID=34, etc). The csv file is on a remote server. I use the Splunk Universal Forwarder to send the file to splunk. Is there a way to get this file set as an "input lookup" or does the "input lookupo" required the file to be local to the Splunk server? Thanks for quick help. EWHolz
Not sure exactly how your ID value is being derived in this situation but you may be able to utilize a subsearch holding you list of fields for each scenario and then set up an eval if() function to ... See more...
Not sure exactly how your ID value is being derived in this situation but you may be able to utilize a subsearch holding you list of fields for each scenario and then set up an eval if() function to determine which to use based on the value in the ID field. Then with a return command you can return that conditional field list back into the parent search after a fields command. Something like this.   | inputlookup <lookup> | fields [ | makeresults | fields - _time | eval ``` Not sure how the ID is being derived but there should be a variety of ways to get it here ``` ``` From lookup method ``` ``` ID=[ | inputlookup <lookup> | stats max(ID) as ID | return $ID ] ``` ``` From token method ``` ``` ID=$ID_token$ ``` ``` This is hardcoded for a POC ``` ID=1, field_list_id_zero="NAME,STATUS,DATE,ACTION", field_list_id_positive="DATE-Changed,ID,NAME,DATE_DOWN,ACTION", final_field_list=if( 'ID'==0, 'field_list_id_zero', 'field_list_id_positive' ) | fields + final_field_list | return $final_field_list ]     Sample output when ID=0 Sample output when ID>0  
Hello All, I have a search question. I have a csv file that returnds data. the ID field if there is no data - I want to have a table which shows 4 columns: NAME,STATUS,DATE,ACTION. These come from ... See more...
Hello All, I have a search question. I have a csv file that returnds data. the ID field if there is no data - I want to have a table which shows 4 columns: NAME,STATUS,DATE,ACTION. These come from the csv file header line. If the ID >0 I want to show these columns: DATE-Changed,ID,NAME,DATE_DOWN,ACTION. I have not yet seen how I might do this. What I need, in a sense, it two searches, one when ID=0, and one when ID>0. Any suggestions?   Thanks, EWHOLZ
What is the question?
Hi @Krishanu.Maity, I will be sending you a private message via the Community where I'll be asking you for some information. 
Hello, Thank you so much. The event IDs listed are all regarding changes to the system. This report would be the "report that shows Changes to System Sec Config events". Regarding all logs, we have ... See more...
Hello, Thank you so much. The event IDs listed are all regarding changes to the system. This report would be the "report that shows Changes to System Sec Config events". Regarding all logs, we have identified the specific ones.  I am running the query you suggested but it's not giving any results. No error messages. Thanks again! index=foo eventid IN (4727, 4728, 4729, 4730, 4731, 4732, 4733, 4734, 4735, 4736, 4737, 4740, 4754, 4755, 4756, 4757, 4758, 4759, 4783, 4784, 4785, 4786, 4787, 4788, 4789, 4791, 631)  | fields user, action, subject, ProcessName | stats min(_time) as FirstEvent max(_time) as LastEvent count by user, _time, action, subject, ProcessName AND NOT User IN (list_of_users ) AND User_Impacted != (AD_Group) | where NOT (match(Host_Impacted, "sc") OR match(Host_Impacted, "sd") OR match(Host_Impacted, "^sc.+") OR match(Host_Impacted, "^sd.+")) | table User, _time, EventID, Group, Host, Host_Impacted, Login, VendorMsgID, Domain Impacted) | stats values(*) as * by User
This XML file does not appear to have any style information associated with it. The document tree is shown below. <response> <messages> <msg type="ERROR">Unauthorized</msg> </messages> </response>
Hi, I am trying to use otel collector with appD controller and I am unable to get the access key from the button. Nothing happens when i click the generate access key button. It waits for 30 sec to ... See more...
Hi, I am trying to use otel collector with appD controller and I am unable to get the access key from the button. Nothing happens when i click the generate access key button. It waits for 30 sec to get the key but nothing appears in the UI. Can you pls help? Thanks, Krishanu
Hi probably you have copy paste error with file name as those don’t match? You could check if uf has read that file by splunk list inputstatus r. Ismo 
Hi it’s probably same, but (at least in there) if you have lot of those in conf files then those could minimally slow down the execution time as those conf files load every time when you are execute... See more...
Hi it’s probably same, but (at least in there) if you have lot of those in conf files then those could minimally slow down the execution time as those conf files load every time when you are executed a query. But unless you haven’t thousands of those it probably don’t mark anything. r. Ismo