All Posts

MG · ‎09-19-2023

|tstats latest(_time) as latestTime where index=* by index | eval latestTime=strftime(latestTime,"%Y/%m/%d %H:%M:%S") | eval status=if(strftime(latestTime, "%Y/%m/%d") != strftime(now(), "%Y/%m/%d"...

|tstats latest(_time) as latestTime where index=* by index | eval latestTime=strftime(latestTime,"%Y/%m/%d %H:%M:%S") | eval status=if(strftime(latestTime, "%Y/%m/%d") != strftime(now(), "%Y/%m/%d"), "not updated", "updated") i'm using this query to find the index which is not indexed till today..For all the indexes i'm getting updated, eventhough there are indexes which are not updated a week.

Abhineet · ‎09-19-2023

Thanks rich... It helps and solve my problem...

richgalloway · ‎09-19-2023

Please share the [tos_access] props.conf stanza from both the Enterprise and Cloud installations. Is it possible the data goes through a heavy forwarder before reach Splunk Enterprise and by redirec...

Please share the [tos_access] props.conf stanza from both the Enterprise and Cloud installations. Is it possible the data goes through a heavy forwarder before reach Splunk Enterprise and by redirecting the EC2 instance to Splunk Cloud the HF is skipped and any transforms done by it are not applied?

ravir_jbp · ‎09-19-2023

@ITWhisperer IT worked !!! thank you so much

gcusello · ‎09-19-2023

Hi @MScottFoley , good for you, see next time! Ciao and happy splunking Giuseppe P.S.: Karma Points are appreciated by all the contributors

MScottFoley · ‎09-19-2023

That is perfect. I see now why it was not working before.

richgalloway · ‎09-19-2023

There is a REST endpoint that returns all fired alerts (/servicesNS/-/-/alerts/fired), but it doesn't say when the alert fired. You have to query each alert separately to get that. Another way is t...

There is a REST endpoint that returns all fired alerts (/servicesNS/-/-/alerts/fired), but it doesn't say when the alert fired. You have to query each alert separately to get that. Another way is to search the scheduler log like this index=_internal sourcetype=scheduler thread_id="AlertNotifier*" NOT alert_actions IN ("summary_index" "") app=FSS earliest=-30d

Henrik_Juul · ‎09-19-2023

I have created an Information Point which basically works so now I also want to create a metric based on the return value.- Only thing is that the return value is a Boolean so how do I cast it to an ...

I have created an Information Point which basically works so now I also want to create a metric based on the return value.- Only thing is that the return value is a Boolean so how do I cast it to an Integer (with a Getter Chain I suppose)?

gcusello · ‎09-19-2023

Hi @aditsss, can you confirm that the values in the field EBNCStatus always starts with "ebnc"? if yes, please try this: index="abc" sourcetype =$Regions$ source="/amex/app/gfp-settlement-raw/logs...

Hi @aditsss, can you confirm that the values in the field EBNCStatus always starts with "ebnc"? if yes, please try this: index="abc" sourcetype =$Regions$ source="/amex/app/gfp-settlement-raw/logs/gfp-settlement-raw.log" "ReadFileImpl - ebnc event balanced successfully" | eval True=if(searchmatch("ebnc event balanced successfully"),"✔","") | eval EBNCStatus="ebnc event balanced successfully",Day=strftime(_time,"%Y-%m-%d")| dedup EBNCStatus Day | search EBNCStatus="ebnc*" | table EBNCStatus True Day Ciao. Giuseppe

twellinghurst · ‎09-19-2023

We are migrating our syslog server to Splunk Connect 4 Syslog running on a RHEL server inside a Docker container. The syslog messages are being forwarded to Splunk, however, SC4S is stripping the dom...

We are migrating our syslog server to Splunk Connect 4 Syslog running on a RHEL server inside a Docker container. The syslog messages are being forwarded to Splunk, however, SC4S is stripping the domain name off of the device names, causing issues with interfaces that are sending log messages. For example, the host - "hostname.contoso.com", will have the host= hostname, while the hostname "lo0.hostname.contoso.com.", will have the host = lo0. It appears SC4S is doing some sort of split on the first period (.) in the hostname and only keeping the first item in the array. Is it possible to tell SC4S to use the FQDN as the hostname? We are using reverse DNS on the SC4S instance - ie. SC4S_USE_REVERSE_DNS=yes Any help is much appreciated!!

genesiusj · ‎09-19-2023

Hello, Has anyone had issues with the color codes used in your json are not the colors appearing in your visualization? { "type": "splunk.column", "options": { "legendDisp...

Hello, Has anyone had issues with the color codes used in your json are not the colors appearing in your visualization? { "type": "splunk.column", "options": { "legendDisplay": "off", "dataValuesDisplay": "all", "yAxisTitleText": "Volulme (GB)", "xAxisTitleText": "Day", "stackMode": "stacked", "seriesColorsByField": { "over_500_red": "#FF0000", "between_400_and_500_orange": "#FFA500", "between_200_and_400_green": "#008000", "under_200_blue": "#0000FF" } }, "dataSources": { "primary": "ds_search_1" }, "title": "License Usage - Last 14 Days", "showProgressBar": false, "showLastUpdated": false, "context": {} } Green and blue are not in the chart below. Thanks and God bless, Genesius

aditsss · ‎09-19-2023

@gcusello Can you guide me with this query how can I use it index="abc" sourcetype =$Regions$ source="/amex/app/gfp-settlement-raw/logs/gfp-settlement-raw.log" "ReadFileImpl - ebnc event balanced ...

@gcusello Can you guide me with this query how can I use it index="abc" sourcetype =$Regions$ source="/amex/app/gfp-settlement-raw/logs/gfp-settlement-raw.log" "ReadFileImpl - ebnc event balanced successfully" | eval True=if(searchmatch("ebnc event balanced successfully"),"✔","") | eval EBNCStatus="ebnc event balanced successfully",Day=strftime(_time,"%Y-%m-%d")| dedup EBNCStatus Day|search EBNCStatus=* | table EBNCStatus True Day

richgalloway · ‎09-19-2023

I'm not sure how to handle that case, but perhaps someone else will have an idea.

gcusello · ‎09-19-2023

Hi @man03359, only for confirmation: you need to filter the main search using two fields from a lookup (src_ip and Device), is it correct? if this is your requirement, you have to use a subsearch w...

Hi @man03359, only for confirmation: you need to filter the main search using two fields from a lookup (src_ip and Device), is it correct? if this is your requirement, you have to use a subsearch with inputlookup: index="idx-network-firewall" (sourcetype="fgt_traffic" OR sourcetype="fortigate_traffic") [ | inputlookup Stores_Inventory | fields src_ip Device ] | stats latest(_time) values(srcname) as src latest(app) as app by src_ip Ciao. Giuseppe

man03359 · ‎09-19-2023

Hi @gcusello , What I am trying to do it create search query that finds src_ip when the field values of two fields, src and device matches with the below output. src field values I am getting from ...

Hi @gcusello , What I am trying to do it create search query that finds src_ip when the field values of two fields, src and device matches with the below output. src field values I am getting from -- index="idx-network-firewall" (sourcetype="fgt_traffic" OR sourcetype="fortigate_traffic") | stats latest(_time) values(srcname) as src latest(app) as app by src_ip and device field value I am getting from lookup - | lookup Stores_Inventory src_ip OUTPUT Device | table src_ip Device src app hope this is clear!

RahulMisra · ‎09-19-2023

Always with that String

ITWhisperer · ‎09-19-2023

Does it always start with "awswaf:managed"? Or is there some other way to recognise the part you want displayed?

RahulMisra · ‎09-19-2023

not always the last

GaetanVP · ‎09-19-2023

Hello Splunkers, I have a index-time field extraction question, here is my raw log : wheel:x:10:user1,user2,user3 I would like to use props.conf and transforms.conf to extract the users props....

Hello Splunkers, I have a index-time field extraction question, here is my raw log : wheel:x:10:user1,user2,user3 I would like to use props.conf and transforms.conf to extract the users props.conf : [mysourcetype] LINE_BREAKER = ([\r\n]+) NO_BINARY_CHECK = true SHOULD_LINEMERGE = false TRANSFORMS-users = get-users transforms.conf : [get-users] REGEX = (\d:|,)(?<user>\w+) FORMAT = users::$1 With my current config, I will only be able to extract the first match of my regex who is here the user1. How could I extract and store each user value ? Thanks for your time, GaetanVP

ITWhisperer · ‎09-19-2023

Typo on my part (updated my response to use uri instead of url)

All Posts

All Posts

Re: index that missed ingesting

Re: splunk app alert trigger report

Re: Splunk Cloud not stripping syslog headers

Re: Need timechart for top responsetime URL

Re: How to automatically change a field value from lookup table?

Re: How to automatically change a field value from lookup table?

Re: splunk app alert trigger report

Getter Chain, Cast from Bool to Int?

Re: How to limit instance according to drop down value selected for date filter

Why is Splunk Connect for Syslog (SC4S) removing domain name?

How to correct colors in Dashboard Studio?

Re: How to limit instance according to drop down value selected for date filter

Re: Splunk query with condition verification

Re: create a search query that finds a field value (eg A) that have mismatched field value(B) and field value (C)

Re: create a search query that finds a field value (eg A) that have mismatched field value(B) and field value (C)

Re: Filter Table Output

Re: Filter Table Output

Re: Filter Table Output

How to extract Index time in multiple regex match?

Re: Need timechart for top responsetime URL

All Posts

Are you a member of the Splunk Community?

All Posts