All Posts

richgalloway · ‎09-14-2023

_time is already in epoch form so it does not need to be (and cannot be) converted using strptime. | eval weeknum=strftime(_time, "%V") | chart dc(Task_num) as Tasks over weeknum by STATUS

dimasfs · ‎09-14-2023

Same issue here

aditsss · ‎09-14-2023

@gcusello Can you please guide me on this .

gemrose · ‎09-14-2023

Hello Team, I need to use the predict command but currently i have only 110 data events therefore to have more data points i am trying to add mock data with only time field which is different. Also...

Hello Team, I need to use the predict command but currently i have only 110 data events therefore to have more data points i am trying to add mock data with only time field which is different. Also in my dataset i have only MonthYear field and data collected from March month of this year. I read about repeat function and dataset literal can we use it in this scenario Quarter Subscription ID Subscription name Azure service Azure region Usage MonthYear Qtr 1 020b3b0c-5b0a-41a1-8cd7-90cbd63e06 SUB-PRD-EDL Azure Data Factory West 9,10E-12 March 2023 Qtr 1 020b3b0c-5b0a-41a1-8cd7-90cbd63e06 SUB-PRD-EDL Azure Data Factory West 0 March 2023 Qtr 1 020b3b0c-5b0a-41a1-8cd7-90cbd63e06 SUB-PRD-EDL Azure Data Factory West 4,40303E-09 March 2023

LearningGuy · ‎09-14-2023

Hello, You said "You should change the permission to app before you do the outputlookup" Do you mean to change the permission to the app, not the CSV file? If so, can you please give me an examp...

Hello, You said "You should change the permission to app before you do the outputlookup" Do you mean to change the permission to the app, not the CSV file? If so, can you please give me an example? Note that I am not the admin Thank you Before outputlookup - no CSV file After outputlookup - CSV file exists - but I cannot change the permission (it's greyed out) /opt/splunk/etc/users/[myuserID]/testapp/lookups/test.csv

avishowman · ‎09-14-2023

I am also facing same issue. did you find any solution?

ITWhisperer · ‎09-14-2023

| eval zip=mvzip(Cluster, Current, Max) | mvexpand zip | eval zip=split(zip, ","), Cluster=mvindex(zip, 0), Current=mvindex(zip, 1), Max=mvindex(zip,2)

gcusello · ‎09-14-2023

Hi @nill, you can download the Universal Forwarder installation package at https://www.splunk.com/en_us/download/universal-forwarder.html then the instruction for installation are at https://docs.s...

Hi @nill, you can download the Universal Forwarder installation package at https://www.splunk.com/en_us/download/universal-forwarder.html then the instruction for installation are at https://docs.splunk.com/Documentation/Forwarder/9.1.1/Forwarder/Installanixuniversalforwarder#Install_the_universal_forwarder_on_Linux Ciao. Giuseppe

ITWhisperer · ‎09-14-2023

Try something like this: | rex max_match=0 "\s+\S+\s+\S+\s+\S+\s+\S+\s+(?<file>OU_\S+)" In future, please paste the text of your event into a code block </> much like I have done with the SPL above...

Try something like this: | rex max_match=0 "\s+\S+\s+\S+\s+\S+\s+\S+\s+(?<file>OU_\S+)" In future, please paste the text of your event into a code block </> much like I have done with the SPL above. This prevents the text from being reformatted and losing spaces and new lines etc.

gcusello · ‎09-14-2023

Hi @danroberts, please try this: | rex "(?<filename>OU_\w*\.\w*" that you can test at https://regex101.com/r/UiiMSA/1 Ciao. Giuseppe

nill · ‎09-14-2023

Hi Team, How do I download and install splunk forwarder on ubuntu 20.04 by downloading a file

bmanikya · ‎09-14-2023

How to split the above table in one line each and wanted to have threshold if the current Block size exceeds Max Block size i.,e (85%) i want to trigger alert

danroberts · ‎09-14-2023

Hello, Can anyone help me to extract the below file name which is OU_..... from the below raw data. 12:04:19.85 14/09/2023 directory="E:\data\Test" ECHO is off. Volume in drive E is Data Vol...

Hello, Can anyone help me to extract the below file name which is OU_..... from the below raw data. 12:04:19.85 14/09/2023 directory="E:\data\Test" ECHO is off. Volume in drive E is Data Volume Serial Number is 7808-CA1B Directory of E:\data\Test 13/09/2023 13:22 <DIR> XXX\xxxx . 13/09/2023 13:22 <DIR> xxx\xxx .. 12/09/2023 09:31 95 xxx\xxx dir_details.bat 13/09/2023 13:41 171 xxx\xxx dir_details_copy.bat 07/09/2023 13:26 0 xxx\xxx edsadsad.txt 07/09/2023 13:26 22 xxx\xxx OU_kljdajdklsajkdl.zip 07/09/2023 13:26 22 xxx\xxx OU_kljdajdklsajkewew.zip 07/09/2023 13:26 22 xxx\xxx OU_kljdajdklsajkewewdsads.zip 6 File(s) 332 bytes 2 Dir(s) 20718067712 bytes free

aditsss · ‎09-14-2023

@gcusello I have selected last 7 days but its showing only 2 with below query index="abc" sourcetype =$Regions$ source="/amex/app/gfp-settlement-raw/logs/gfp-settlement-raw.log" "ReadFileImpl - ...

@gcusello I have selected last 7 days but its showing only 2 with below query index="abc" sourcetype =$Regions$ source="/amex/app/gfp-settlement-raw/logs/gfp-settlement-raw.log" "ReadFileImpl - ebnc event balanced successfully" | eval True=if(searchmatch("ebnc event balanced successfully"),"✔",""), EBNCStatus="ebnc event balanced successfully", Day=strftime(_time,"%Y-%m-%d") | dedup EBNCStatus Day | table EBNCStatus True Day

pck1983 · ‎09-14-2023

I got the following errors in my Splunk Error Logs: Failed to find Event Log with channel name=Applications and Services Logs/Microsoft/Windows/Sysmon/Operational Init failed, unable to subscribe t...

I got the following errors in my Splunk Error Logs: Failed to find Event Log with channel name=Applications and Services Logs/Microsoft/Windows/Sysmon/Operational Init failed, unable to subscribe to Windows Event Log channel Microsoft-Windows-Sysmon/Operational: errorCode=5

gcusello · ‎09-14-2023

Hi @love0sxy, how did you configure the deploymentclient.conf file in your UFs? if this file in in a custom Add-On deployed using the Deployment Server, you can modify this file in the app to deplo...

Hi @love0sxy, how did you configure the deploymentclient.conf file in your UFs? if this file in in a custom Add-On deployed using the Deployment Server, you can modify this file in the app to deploy and the new addressing is deployed to all the UFs. If instead you configured it using the CLI command and the deploymentclient.conf file is in $SPLUNK_HOME/etc/system/local, there isn't any automatic way to change the DS addressing. In this case, you could deploy an add-on containing this file using the old DS and run a remote script that deletes the old deploymentclient.conf file and restarts Splunk. Ciao. Giuseppe

love0sxy · ‎09-14-2023

Hello, guys I want change my universal forward for new deployment_server,how to use Current deployment server。 I am currently pushing the app for universal forwarder， but can‘t change deployment_server

gcusello · ‎09-14-2023

Hi @aditsss, as I said, if you use a fixed (for all events) value for EBNCStatus, you'll have always only one value in this field, so when you'll dedup for this field, you'll always have one value! ...

Hi @aditsss, as I said, if you use a fixed (for all events) value for EBNCStatus, you'll have always only one value in this field, so when you'll dedup for this field, you'll always have one value! try to delete the dedup row and see what happens. You could try to dedup for the EBNCStatus field and another field (e.g. day), something like this: index="abc" sourcetype =$Regions$ source="/amex/app/gfp-settlement-raw/logs/gfp-settlement-raw.log" "ReadFileImpl - ebnc event balanced successfully" | eval True=if(searchmatch("ebnc event balanced successfully"),"✔",""), EBNCStatus="ebnc event balanced successfully", Day=strftime(_time,"%Y-%m-%d") | dedup EBNCStatus Day | table EBNCStatus True Day Ciao. Giuseppe

aditsss · ‎09-14-2023

@gcusello Currently when I am doing dedup and selecting last 7 days its showing only event. I want when I select last 7 days it should show 7 times that message. when I select last 30 days it...

@gcusello Currently when I am doing dedup and selecting last 7 days its showing only event. I want when I select last 7 days it should show 7 times that message. when I select last 30 days it should 30 times that message. Can you help me with this.

isoutamo · ‎09-14-2023

Hi here is link to old post for your replication issue https://community.splunk.com/t5/Splunk-Search/Large-lookup-caused-the-bundle-replication-to-fail-What-are-my/m-p/194594 there are some more if ...

Hi here is link to old post for your replication issue https://community.splunk.com/t5/Splunk-Search/Large-lookup-caused-the-bundle-replication-to-fail-What-are-my/m-p/194594 there are some more if you need. Can you describe your SHC environment, so we can better understand your issue (OS, versions, size, apps, lookups etc.)? r. Ismo

All Posts

All Posts

Re: How to get the calender week from the date?

Re: Moment.js not available in splunk 9.1.x+

Re: How to limit instance according to drop down value selected for date filter

How to replicate the data to use the predict command?

Re: How to outputlookup csv with permission?

Re: Moment.js not available in splunk 9.1.x+

Re: Extracting fields from HTML event

Re: Splunk

Re: Help - Extract file name from the below raw data

Re: Help - Extract file name from the below raw data

How do I download and install splunk forwarder on ubuntu 20.04 by downloading a file?

Re: Extracting fields from HTML event

How to extract file name from the below raw data?

Re: How to limit instance according to drop down value selected for date filter

Re: Importing sysmon logs into Splunk

Re: universal forwarder change deployment server use deployment

universal forwarder change deployment server use deployment

Re: How to limit instance according to drop down value selected for date filter

Re: How to limit instance according to drop down value selected for date filter

Re: Replication error- Splunk cluster

All Posts

Are you a member of the Splunk Community?

All Posts