All Topics

priya1926 · ‎12-20-2021

Hi, I am trying this cmd index="wineventlog" host IN (*) EventCode=6006 OR EventCode="6005" Type=Information | transaction host startswith=6006 endswith=6005 maxevents=2 | eval duration = ...

Hi, I am trying this cmd index="wineventlog" host IN (*) EventCode=6006 OR EventCode="6005" Type=Information | transaction host startswith=6006 endswith=6005 maxevents=2 | eval duration = duration + " Sec" | table _time host duration If the output in sec.. i need sec... if its in minutes then minutes .. if its in hours and if in days it should calculate the same. Thanks in Advance

nanoo1 · ‎12-20-2021

Hi, I need a help with a query to display the count based on a particular message. For example, "Failed project on ABC", the query basically should read and count 2 and if it's greater than 2 , shou...

Hi, I need a help with a query to display the count based on a particular message. For example, "Failed project on ABC", the query basically should read and count 2 and if it's greater than 2 , should display the number I tried something like this, but not working index="Project" | stats count(eval(message like("%Failed Project on%")) | where count>2 Could someone suggest way of achieving this? /nanoo1

vadim_osipov · ‎12-20-2021

Hey guys, I am a nebbie with Splunk, but already fell in love with it. Such a great tool! I was tasked with storing settings of a website from Cloudflare into Splunk. Without much of a knowledge ...

Hey guys, I am a nebbie with Splunk, but already fell in love with it. Such a great tool! I was tasked with storing settings of a website from Cloudflare into Splunk. Without much of a knowledge I wrote a small Python script that basically gets settings data from CF and sends it to Splunk via HEC token, on my local instance. This is one of the ways of doing it, but I'm sure there must be much slicker way. Question is, what would you guys recommend to achieve this task? What would be the best practices? Thanks in advance, Vadim

cadrija · ‎12-20-2021

My current panel looks like this How to make it look like doughnut like below With the total inside the hollow center like this Is there any way to do this, please let me know.

bosseres · ‎12-19-2021

Hello, Is it possible to user OR with regex? For example i have search | regex something="", and I need | regex something="" OR | regex something2="" Maybe should I change construction? Any ideas?...

Hello, Is it possible to user OR with regex? For example i have search | regex something="", and I need | regex something="" OR | regex something2="" Maybe should I change construction? Any ideas? Thank you.

prashant_t · ‎12-19-2021

Hello Splunkers, In my Splunk Dashboard, i have a splunk table, when clicking on any cell value of defined field name, a splunk panel, opens up, below splunk table. Now the drilldown panel is not a...

Hello Splunkers, In my Splunk Dashboard, i have a splunk table, when clicking on any cell value of defined field name, a splunk panel, opens up, below splunk table. Now the drilldown panel is not a table view, neither a chart view, its a form, a HTML form. How can i show this drilldown panel, the form view in pop-up window? TIA,

cadrija · ‎12-19-2021

How can I show organization's banner at the top of Splunk Dashboard. In my case it is coming below the label & filters. Below is my code snippet. <dashboard theme="light" hideChrome="true" h...

How can I show organization's banner at the top of Splunk Dashboard. In my case it is coming below the label & filters. Below is my code snippet. <dashboard theme="light" hideChrome="true" hideExport="true"> <label>*Welcome To Lending Command Center*</label> <description>Lending Command Center is a collection of visualized data which will provide the client with details on its business at various levels of technology and operations.</description> <row> <html> <center><img src="/static/app/search/Header-black@2x-100.jpg" ></img></center> </html> </row>

jackin · ‎12-19-2021

Hi, Search 1: It is used to findout the server health index=win sourcetype="xmlwineventlog" host=Prod_UI_* | eval Status=if(EventCode=41 OR EventCode=6006 OR EventCode=6008,"Down","Up") | dedup h...

Hi, Search 1: It is used to findout the server health index=win sourcetype="xmlwineventlog" host=Prod_UI_* | eval Status=if(EventCode=41 OR EventCode=6006 OR EventCode=6008,"Down","Up") | dedup host | table Status Search 2 : It is used to findout the CPU Usage | mstats avg(_value) prestats=true WHERE metric_name="Processor.%_Processor_Time" AND "index"="winperf" AND host=Prod_UI_* span=60s | eval Timestamp=strftime(_time ,"%d/%m/%Y %H:%M:%S") | stats avg(_value) AS CPU BY host Timestamp | where CPU>=0 | eval Status="Critical",CPU=round(CPU,2),CPU=CPU+"%" | rename host as Hostname | table Timestamp Hostname CPU Status | dedup Hostname | sort - CPU Search 3 : It is used to findout the Memory Usage | mstats avg(_value) prestats=true WHERE metric_name="Memory.%_Committed_Bytes_In_Use" AND "index"="winperf" AND host=Prod_UI_* span=60s | eval Timestamp=strftime(_time ,"%d/%m/%Y %H:%M:%S") | stats avg(_value) AS Memory BY host Timestamp | where Memory>=0 | eval Status="Critical",Memory=round(Memory,2),Memory=Memory+"%" | rename host as Hostname | table Timestamp Hostname Memory Status | dedup Hostname | sort - Memory finally I need a query to know the server health and CPU and memory usage in single table. and if CPU used >75% or memory used >75% it should show that the server is Down. Like Hostname Health CPU Memory Google Down 76% 45%

loligator · ‎12-19-2021

Hello all, One of our home grown apps copies logs to a directory monitored by Splunk once a day around midnight. Splunk, however, will not index the events in the log if they contain a past time sta...

Hello all, One of our home grown apps copies logs to a directory monitored by Splunk once a day around midnight. Splunk, however, will not index the events in the log if they contain a past time stamp. The lines in the log look similar to this: 12/18/2021,00:00:20,UDP,Rcv,10.132.133.29,app-measurement.com These lines are skipped, however, if the line looks like this it will be indexed: UDP,Rcv,10.132.133.29,app-measurement.com It appears having a date and time in the log is causing the forwarder to not forward the data. Here's the input.conf for the Splunk app that handles the files: [monitor://C:\Logs\CustomApp] disabled = 0 index = customapp sourcetype = customappevents recursive = false blacklist = \.tmp$ crcSalt = <SOURCE> Thanks in advance!

einars · ‎12-19-2021

Playing around to find a way to gather IP-Addresses from one type of search, to gather other type of information about the ip-addresses. In this example I try to gather all ip-addresses that is in t...

Playing around to find a way to gather IP-Addresses from one type of search, to gather other type of information about the ip-addresses. In this example I try to gather all ip-addresses that is in the source type threat log, this source type does not contain session_end_reason, that is in the traffic log. So, I try to fetch all ip addresses that accsess *sonos.com* and use this to get all session_end_reason for those ip addresses. Mayby it’s not possible, and it’s a proof of concept i try achieving here. index="paloalto" src_ip="*" src_ip="*" [search index="paloalto" url="*sonos.com*" src_ip="*"] | table url src_ip session_end_reason The result from this gives blank session_end_reason If I have this in my first search: index="paloalto" src_ip="*" src_ip="*" session_end_reason="*" All ends up blank. This at the end: | table src_ip session_end_reason Ends up with only ip addresses, and no session_end_reason Is this possible? Best regards

mah · ‎12-19-2021

Hi, I want to find specific strings in all event in order to classify them into two values, like "if there is "A" or "B" or "C" so put it under "OK" value, if not put it in default value "KO". I tr...

Hi, I want to find specific strings in all event in order to classify them into two values, like "if there is "A" or "B" or "C" so put it under "OK" value, if not put it in default value "KO". I tried first this query : | eval field=if(searchmatch("A"),"OK,"KO") But I tried ("A" OR "B") and it does not work. I don't know how to add other strings in this command. Can you help me ?

jkauling · ‎12-19-2021

In my logfile I need to count a unique piece of string. This string is many times in the logfile. The unique parts (bold within this example string, the capital NNNN is a number but not known how ma...

In my logfile I need to count a unique piece of string. This string is many times in the logfile. The unique parts (bold within this example string, the capital NNNN is a number but not known how many digits and the capital CCC are optional filled with a number or character but also not known how many characters) it is always separated by underscores: "ID": "20201218_HD_111111_20201218_HD_111111_1111_1000AB_NNNN_CCC_BE" Your help is much appreciated with this query.

splunkxorsplunk · ‎12-18-2021

Hi, Need help to get following results from the search. all helps will be appreciated. On the image below, same colors show match cases I would like to get out of my search. Here is the conditi...

Hi, Need help to get following results from the search. all helps will be appreciated. On the image below, same colors show match cases I would like to get out of my search. Here is the condition I am looking for: Under the same pid which is all same already on image below. example -1 ( green on the image) : pid_of_curl = 990820 pid_of_sh = 990821 If exe = curl and ( pid_of_curl + 1 ) has exe = sh exe is curl and 990820 + 1 = 990821 = pid in which exe = sh if exe is either "curl" or "wget" and its pid +1 is equal to ( bash or sh ) pid

joomla · ‎12-18-2021

Hi Community Members, Anyone knows whether we can use Splunk Enterprise Security to map our correlation searches against MITRE Tactics and Techniques without installing more apps like MITRE Dashboar...

Hi Community Members, Anyone knows whether we can use Splunk Enterprise Security to map our correlation searches against MITRE Tactics and Techniques without installing more apps like MITRE Dashboard or Splunk Security Essentials. This mapping can help to see what security coverages we have and what requires improvements. Many Thanks in advance.

VijaySrrie · ‎12-18-2021

Hi, Why do we use IF in Splunk cloud. I know HF can work as IF, then why don't we call it as HF itself?? What will happen if we don't use IF?

VijaySrrie · ‎12-18-2021

Hi, Indexer can do Parsing and Indexing then why do we use HF between UF and Indexer?

jwilliams · ‎12-18-2021

All, Using the universal forwarder for windows to send to my indexer. I have installed the Splunk app for Windows on the indexer. How does the indexer know the difference between Security, Sys...

All, Using the universal forwarder for windows to send to my indexer. I have installed the Splunk app for Windows on the indexer. How does the indexer know the difference between Security, System, and Application logs? Is that figured out automajically? Thanks, Jim

ezmo1982 · ‎12-18-2021

Hi I have a single indexer in my splunk on-prem environment. I wish to take the Indexer offline so that I can perform a system upgrade. I am running on RHEL 8.3. The docs state the default restart...

Hi I have a single indexer in my splunk on-prem environment. I wish to take the Indexer offline so that I can perform a system upgrade. I am running on RHEL 8.3. The docs state the default restart period after issuing the splunk offline command is 60 seconds. I wish to change this to 60 minutes so that the upgrade will complete in time, before issuing the splunk restart command. The docs state that i can do this by issuing the command, passing 3600 as the argument. splunk edit cluster-config -restart_timeout <seconds> However when i run this command on my indexer i get the following message: mode=disabled cannot edit config. Please pick a mode [master|slave|searchhead] to edit clustering properties Which option should i use? Im reluctant to use any of the options as I dont have clustering enabled in my environment (no clustering for Indexing or Search heads) so dont want to make any unnecessary changes. Thanks.

dokaas_2 · ‎12-18-2021

The upgrade to KVStore engine wiredTiger fails with 'Search head cluster has static captain" This is a two node search head cluster (adding a 3rd search head is not an option at this time). So ho...

The upgrade to KVStore engine wiredTiger fails with 'Search head cluster has static captain" This is a two node search head cluster (adding a 3rd search head is not an option at this time). So how do I upgrade the KVStore engine to wiredTiger?

thomas_art · ‎12-17-2021

Hello, It is possible to obtain some generated data for the APM section in Obserbavility demo?

All Topics

All Topics

Need Minutes and hours conversion

Splunk query to display count based on message

Best way to connect Splunk and Cloudflare

I have created a pie chart visualization in splunk, I want to change it to doughnut visualization.

Using OR with regex

Modal Pop-up to show Splunk Panel on html button Click?

How can I show organization's banner at the top of Splunk Dashboard. In my case it is coming below the label & filters.

Need help on Queries Combination.

Lines in log file not indexed if line has time stamp from the past

Use subsearch to gather ip addresses for use in another type off search?

How to find several terms in all _raw ?

How to count number of unique part of string from log?

Two condition match - sequential number pid and certain values on associated fields

Splunk Enterprise Security

Intermediate Forwarder in Splunk cloud

Role of Heavy Forwarder between UF and Indexer

Universal forwarder on windows - How do you identify the index to be used?

How to extend restart period for single indexer that I wish to take offline

KVStore Upgrade wiredTiger static captain

Datagen for Observatory APM demo

All Topics

Are you a member of the Splunk Community?

All Topics