All Posts

parthiban · ‎12-14-2023

Hi @gcusello The below code I am getting correct results, Could you please add alert condition in that. index= "XXXXX" "Genesys system is available" | spath input=_raw output=new_field path=res...

Hi @gcusello The below code I am getting correct results, Could you please add alert condition in that. index= "XXXXX" "Genesys system is available" | spath input=_raw output=new_field path=response_details.response_payload.entities{} | mvexpand new_field | fields new_field | spath input=new_field output=serialNumber path=serialNumber | spath input=new_field output=onlineStatus path=onlineStatus | where serialNumber!="" | lookup Genesys_Monitoring.csv serialNumber | where Country="Bangladesh" | stats count by onlineStatus, Country

glc_slash_it · ‎12-14-2023

Hi, Did you made any changes to 'user' or 'power' role? 'Power' inherits some capabilities from 'user', so if you removed/changed some capabilities from 'user', they will also be reflected on 'powe...

Hi, Did you made any changes to 'user' or 'power' role? 'Power' inherits some capabilities from 'user', so if you removed/changed some capabilities from 'user', they will also be reflected on 'power'. ------------ If this was helpful, some karma would be appreciated.

duesser · ‎12-14-2023

Yes for real! That was my first idea. I think for static field length one could use something along this line of thought (does not work as is but should be doable): | makeresults | eval mv_f...

Yes for real! That was my first idea. I think for static field length one could use something along this line of thought (does not work as is but should be doable): | makeresults | eval mv_field=split("a|b|c|d|e|f|aa", "|") | fields ```other fields of interest``` mv_field [| makeresults count=7 | streamstats count | eval temp="mv_field_", fieldname=temp.count | stats values(fieldname) AS fieldname | return $fieldname] | foreach mode=multifield mv_field_* [ eval "<<FIELD>>"=mvindex(mv_field,tonumber(<<MATCHSTR>>),tonumber(<<MATCHSTR>>))] but seing this solution it is more elegant and general

gcusello · ‎12-14-2023

Hi @nithys , you cannot put the case funtion directly in the search, but only in the eval command, in addition there are some errors and the case condition isn't clear, please better describe them. ...

Hi @nithys , you cannot put the case funtion directly in the search, but only in the eval command, in addition there are some errors and the case condition isn't clear, please better describe them. 1) what's the case condition? CASE("latest") AND "id" AND "dynamoDB data retrieved for ids" AND "material" 2) The errors are: case: there a parenthesis after the first value, there's only one condition and there isn't the value to assign if the condition is true, | sort- PST_TIME3, should be sort - PST_TIME3: a space after sort command is missed, you don't need an intermediate table command, what do you want to do with appendcols? in other words, please better describe it. Ciao. Giuseppe

gcusello · ‎12-13-2023

Hi @anandhalagaras1, to compare dates you have to convert them in epochtime and compare using the eval command and strptime function: e.g. to take only events with Timestamp in the period from 202...

Hi @anandhalagaras1, to compare dates you have to convert them in epochtime and compare using the eval command and strptime function: e.g. to take only events with Timestamp in the period from 2023-12-13 00:00:00 to 2023-12-13 23:59:59, yu could run: <your_search> | eval Timestamp=strptime(Timestamp,"%Y-%m-%d %H:%M:%S"), from=strptime("2023-12-13 00:00:00","%Y-%m-%d %H:%M:%S"), to=strptime("2023-12-13 23:59:59"","%Y-%m-%d %H:%M:%S") | where Timestamp>=from AND Timestamp<=to Ciao. Giuseppe

1ueshkil · ‎12-13-2023

@inventsekar Could you please suggest. Yes that app was installed.

gcusello · ‎12-13-2023

Hi @parthiban, logic and syntax of this search is correct, if it doesn't give results, you have to check the data that maybe are different than we supposed creating the search, and I cannot help you...

Hi @parthiban, logic and syntax of this search is correct, if it doesn't give results, you have to check the data that maybe are different than we supposed creating the search, and I cannot help you because I haven't your data. Debug it removing, one by one, the rows and identifying where is the issue: I suppose that's in the field names or in the field values. Ciao. Giuseppe

gcusello · ‎12-13-2023

If you want the list of triggered alerts please try this: index=_audit action=alert_fired ss_app=* | eval ttl=expiration-now() | search ttl>0 | convert ctime(trigger_time) | table trigger_time s...

If you want the list of triggered alerts please try this: index=_audit action=alert_fired ss_app=* | eval ttl=expiration-now() | search ttl>0 | convert ctime(trigger_time) | table trigger_time ss_name severity | rename trigger_time as "Alert Time" ss_name as "Alert Name" severity as "Severity" if instead tu want the list of alerts in your environment, you could use: |rest/servicesNS/-/-/saved/searches | search alert.track=1 | fields title description search disabled triggered_alert_count actions action.script.filename alert.severity cron_schedule Ciao. Giuseppe

yuanliu · ‎12-13-2023

Found the way around it. Have to pipe "|fields metrics.data{}.name metrics.data{}.status". I don't know why I need to do that also, but apparently it works now. Actually splunkernator and I unco...

Found the way around it. Have to pipe "|fields metrics.data{}.name metrics.data{}.status". I don't know why I need to do that also, but apparently it works now. Actually splunkernator and I uncovered the root cause a few days ago in Do you lose any information between Chain Searches in Dashboards? It's intricate, but everyone using Dashboard Studio should be aware until DS releases a fix. You didn't illustrate under which conditions your original code failed. But based on splunkernator and my findings, I speculate that you had | spath output=metrics path=metrics in main search, but |rename metrics.data{}.name as name, metrics.data{}.status as status in chain search. Is this correct? Then, your workaround is to add | fields metrics.data{}.name metrics.data{}.status into main search. If you add this to subsearch, nothing will change. You would still have a broken panel. Meanwhile, are you sure you want a multivalue field name?

suvi6789 · ‎12-13-2023

Many thanks for the update. I will verify and get back to you

AL3Z · ‎12-13-2023

hello, Could anyone assist me in creating a correlation search to detect triggered alerts across all searches. This will enable us to monitor counts and automatically notify us if any situation esca...

hello, Could anyone assist me in creating a correlation search to detect triggered alerts across all searches. This will enable us to monitor counts and automatically notify us if any situation escalates beyond control. Thanks

anandhalagaras1 · ‎12-13-2023

Hi All, Need a help to write a query based on the field "Timestamp" which is different from "_time" value. Sample Event in XML Format: Email: xyz@gmail.com RoleName: User RowKey: 123456 Timesta...

Hi All, Need a help to write a query based on the field "Timestamp" which is different from "_time" value. Sample Event in XML Format: Email: xyz@gmail.com RoleName: User RowKey: 123456 Timestamp: 2023-12-13T23:56:18.200016+00:00 UserId: mno UserName: acho This is one of the sample event in xml format and there is a specific field as "Timestamp" in the event and this "Timestamp" field is completely different from _time value. Hence I want to pull only the "Timestamp" value for a particular day might be yesterday 2023-12-13 i.e. from 2023-12-13 00:00:00 to 2023-12-13 23:59:59 So how can I write the query for the same. index=abc host=xyz sourcetype=xxx

nithys · ‎12-13-2023

PST_TIME4 objectType version republishType publish nspConsumerList snsPublishedCount dataNotFoundIdsCount 2023-17-11 01:50:35 material latest id NSP ALL 3 1 2023-20-11 02:55:12 materia...

PST_TIME4 objectType version republishType publish nspConsumerList snsPublishedCount dataNotFoundIdsCount 2023-17-11 01:50:35 material latest id NSP ALL 3 1 2023-20-11 02:55:12 material latest id NSP ALL 3 1 2023-16-11 09:18:14 material latest id NSP ALL 3 1 2023-12-12 05:03:37 material latest id ALL ALL 1 2

nithys · ‎12-13-2023

Hi Team,I am using a query which has same index and source but fetch two results based on the search and combine to a single table..now i want to display the result along with the timestamp it appear...

Hi Team,I am using a query which has same index and source but fetch two results based on the search and combine to a single table..now i want to display the result along with the timestamp it appears in ascending order index=index1 source=source1 CASE("latest") AND "id" AND "dynamoDB data retrieved for ids" AND "material"| eval PST=_time-28800 | eval PST_TIME3=strftime(PST, "%Y-%d-%m %H:%M:%S") | spath output=dataNotFoundIdsCount path=dataNotFoundIdsCount | stats values(*) as * by _raw | table dataNotFoundIdsCount, PST_TIME3 | sort- PST_TIME3| appendcols [search index=index1 source=source1 CASE("latest") AND "id" AND "sns published count" AND "material"| eval PST=_time-28800 | eval PST_TIME4=strftime(PST, "%Y-%d-%m %H:%M:%S") | spath snsPublishedCount output=snsPublishedCount |spath output=republishType path=republishType| spath output=version path=republishInput.version| spath output=publish path=republishInput.publish| spath output=nspConsumerList path=republishInput.nspConsumerList{} | spath output=objectType path=republishInput.objectType | stats values(*) as * by _raw | table snsPublishedCount,republishType,version,publish, nspConsumerList,objectType,PST_TIME4 | sort- PST_TIME4 ] |table PST_TIME4 objectType version republishType publish nspConsumerList snsPublishedCount dataNotFoundIdsCount

bowesmana · ‎12-13-2023

I think you can match() on an MV field directly, e.g. | eval test=if(match(city, "(?i)bangalore|hyderbad|chennai"), 1, 0)

bowesmana · ‎12-13-2023

Check out the docs for foreach https://docs.splunk.com/Documentation/Splunk/9.1.1/SearchReference/foreach The <<FIELD>> template is replaced with the value of the field being iterated through. In y...

Check out the docs for foreach https://docs.splunk.com/Documentation/Splunk/9.1.1/SearchReference/foreach The <<FIELD>> template is replaced with the value of the field being iterated through. In your context, it is the value of the row* field being evaluated.

tharun_santosh · ‎12-13-2023

Hello Ryan, I understood that I have posted another questions for the same problem, I am trying to contact Bangalore India, AppD sales no response from their side. Could you please suggest any con...

Hello Ryan, I understood that I have posted another questions for the same problem, I am trying to contact Bangalore India, AppD sales no response from their side. Could you please suggest any contact Email Id of technical support team so that we will discuss whether the issue is with our configurations or there are any limitations in pro trial version. We are running our applications in EKS cluster but in trial version documentation it has given that we can access all the services for 15-days. But all the configurations are made according to the documents, After in dashboard the data's are not reflecting, Could you please suggest work around for this problem. thanks, tharun

Siddharthnegi · ‎12-13-2023

just a small question what will come in <<FIELD>> ?

Poojitha · ‎12-13-2023

Thanks @bowesmana - mvmap so it iterates like a for loop and checks. What if I want to do multiple checks. Example, I want to check for different regions. mvcount(Region)>1, mvmap(Region, if(matc...

Thanks @bowesmana - mvmap so it iterates like a for loop and checks. What if I want to do multiple checks. Example, I want to check for different regions. mvcount(Region)>1, mvmap(Region, if(match(Region, "(?i)bangalore"), "Bangalore", null()) Here it iterates and checks for banglore. What if I want to check for Singapore , USA , China and so on. ? Its becoming quite challenging, please help me Example : Test_loc_method2 is the output I want from Region (mv field) Region Test_loc_method2 sh Bangalore Test Chennai Hyderbad Bangalore test China 1 India China Loc USA 2 London USA

Rajkumar_Varma1 · ‎12-13-2023

Hello @Ryan.Paredez , The query was how i can get license usage report by email on a daily or weekly basis. I didn't seen any option like the same . If emailing report not possible, any other ways...

Hello @Ryan.Paredez , The query was how i can get license usage report by email on a daily or weekly basis. I didn't seen any option like the same . If emailing report not possible, any other ways we can download the report (Eg: Using API) Thanks, Raj

All Posts

All Posts

Re: Creating alert for if device went offline and recovery status.

Re: Why does user with "power" role only see the "Search" option in the navigation menu and nothing

Re: Expand multivalue field into individual fields WITHOUT mvexpand

Re: tuning the query

Re: How To Write a Search query for the Timestamp field which is different from _time value

Re: MITRE usecases

Re: Creating alert for if device went offline and recovery status.

Re: Search for Alert Monitoring.

Re: Rename works in search but not in Dashboard Studio

Re: Query - How to check failed % > X

Search for Alert Monitoring.

How To Write a Search query for the Timestamp field which is different from _time value

Re: tuning the query

tuning the query

Re: Using wildcard in mvfind

Re: splunk

Re: No data Avaliable in dashboard

Re: splunk

Re: Using wildcard in mvfind

Re: Daily License Report

All Posts

Are you a member of the Splunk Community?

All Posts