All Topics

Find Answers
Ask questions. Get answers. Find technical product solutions from passionate members of the Splunk community.

All Topics

Hey Guys, this is a continuation of the below topic: https://community.splunk.com/t5/Splunk-Search/Search-query-to-remove-results-from-another-source/m-p/564733#M196718 As you can see from my quest... See more...
Hey Guys, this is a continuation of the below topic: https://community.splunk.com/t5/Splunk-Search/Search-query-to-remove-results-from-another-source/m-p/564733#M196718 As you can see from my question before, I thoug I only needed the last event from the same Identification - and if this was the case, the dedup would work fine - but it turns out I need all the events for that ID that comes after the DELETED message.   To get the info, I'm running the following search:     index=xpto (source= inserted OR source=deleted) data.Date="2021-08-25T00:00:00" data.Identification=11894 | sort 0 -data.Timestamp | fillnull value="INSERTED" data.Action | table id data.Action data.Identification       And it returns me the following:     id data.Action data.Identification 8941786c-ab05-46a7-9610-e1d5ee135df7 INSERTED 11894 7232b292-4665-416f-a867-8eac88051b5b INSERTED 11894 901607ac-5c28-4da2-996e-4c6a6b4995f8 INSERTED 11894 2cf1ecd8-dff3-4602-8106-9877ef2d1104 DELETED 11894 b7255bf1-14a9-44f6-899f-12f83c6be6f9 DELETED 11894 392fca7c-18b1-4953-8300-39ff9768033a DELETED 11894 08e49dbd-f0d8-4ca0-897f-6a3ac3ee54cb INSERTED 11894 27c05aa4-6bf0-4a7a-87bf-3d1c90774cc7 DELETED 11894       My goal and help needed is to get all the events that come after the DELETED, in this case, the first 3 events of the search(as this is sorted by Timestamp). Of course it's not always the first 3 as this may vary. Any ideas how I can achieve that?   Thank you!
I were able to send my application log to splunk via HTTP event using the splunk java logging library. But somehow the message doesn't look like what appears on my console. Did this happen because th... See more...
I were able to send my application log to splunk via HTTP event using the splunk java logging library. But somehow the message doesn't look like what appears on my console. Did this happen because the console appender contains an encoder tag? If yes, is there a way for us to specify that inside of the splunk appender? I want splunk to display event exactly like what on my console.  I manually send an event to the index to create the view of what I want it to look like. This's the body content of my rest call to achieve the result in picture 1.  {"sourcetype": "httpevent", "index": "customeindex", "host": "optional-field", "event": "2021-09-15 17:07:58.483 [main] INFO  org.springframework.boot.autoconfigure.logging.ConditionEvaluationReportLoggingListener.logMessage - Error starting ApplicationContext. To display the conditions report re-run your application with 'debug' enabled.\r\n"}   what i want it to look like But the below is what I got. All the information like logger, severity, threat and time are already included in the message so I don't want my app to send all that to splunk in the event.  the current data     <?xml version="1.0" encoding="UTF-8"?> <configuration> <include resource="org/springframework/boot/logging/logback/defaults.xml" /> <property name="defaultPattern" value="%d{yyyy-MM-dd HH:mm:ss.SSS} [%thread] %-5level %logger.%M - %msg%n"/> <property name="LogFilePath" value="${LogFilePath:-.}"/> <appender name="CONSOLE" class="ch.qos.logback.core.ConsoleAppender"> <encoder class="ch.qos.logback.classic.encoder.PatternLayoutEncoder"> <pattern>${defaultPattern}</pattern> </encoder> </appender> <Appender name="splunkAppender" class="com.splunk.logging.HttpEventCollectorLogbackAppender"> <url>https://random:8088</url> <token>132</token> <index>randomindex</index> <disableCertificateValidation>true</disableCertificateValidation> <host>${hostname}</host> <source>orchestrator</source> <sourcetype>json</sourcetype> <layout class="ch.qos.logback.classic.PatternLayout"> <pattern>${defaultPattern}</pattern> </layout> </Appender> <springProfile name="!local"> <root level="info"> <appender-ref ref="CONSOLE" /> <appender-ref ref="splunkAppender" /> </root> </springProfile> <springProfile name="local"> <root level="info"> <appender-ref ref="CONSOLE" /> <appender-ref ref="APPLICATION" /> </root> </springProfile> </configuration>      
I'm in the process of implementing Splunk ES.  We are using the Splunk_TA_windows and use the generate_windows_update_logs.ps1script to generated update log files.  However, that file looks useless i... See more...
I'm in the process of implementing Splunk ES.  We are using the Splunk_TA_windows and use the generate_windows_update_logs.ps1script to generated update log files.  However, that file looks useless in populating the Update data model used in ES.  Is there another script that will produce suitable output from Windows OS to populate the Update data model that can be used by ES?    
HI Splunkers, I am using Splunk tables inbuilt color coding to highlight a cell based on certain condition. The problem which I am facing is when the color coding condition meets, the total cell is ... See more...
HI Splunkers, I am using Splunk tables inbuilt color coding to highlight a cell based on certain condition. The problem which I am facing is when the color coding condition meets, the total cell is highlighted (background of the cell). But i want to highlight only the value not the complete background of the cell.  I know we should be able to do it using JS, but is there any other easy way to achieve it? I want to get the output as represented in correctnumber column  not the number column. (I have used dev tools on the front end to change the background color for correctnumber column). Thanks in Advance.  
Also please guide me on how to optimize my Lookups for more efficiency. When does one use Lookups vs KVstores? Thank u very much
Hello, If a free profile is already set up and created with the software download option, can you switch it to cloud based? I'm running into downloading and uploading errors with the current profile... See more...
Hello, If a free profile is already set up and created with the software download option, can you switch it to cloud based? I'm running into downloading and uploading errors with the current profile and need to switch to cloud base.
Hi team,   I have one requirement to prepare a query to get a value from json and do chart count around it. For this I have added multiple chart count queries using appendcols, but it is very slow.... See more...
Hi team,   I have one requirement to prepare a query to get a value from json and do chart count around it. For this I have added multiple chart count queries using appendcols, but it is very slow.  Also I need the timestamp.  log is like as below:  Success: 1 failed: 2 Total: 3 index=<<>> |search app="app1" |rex "Total: (?<TCount>[^\"]*)" |eval TCount=rtrim(TCount,"\\") |chart count(TCount) over TCount |appendcols [search |rex "Success: (?<S_Count>[^\"]*)"|eval S_Count=rtrim(S_Count,"\\") |chart count(S_Count) over S_Count] |appendcols [search |rex "failed: (?<FCount>[^\"]*)"|eval F_Count=rtrim(FCount,"\\") |chart count(FCount) over FCount] Can anyone help me on this to make it run faster.    Thanks in Advance.  
Let's suppose I have TOTO in successfully in my logs. I want to display the result for TOTO and append that no result found for TITI and TUTU with linecount=0 and their name in UNIT. Somebody can he... See more...
Let's suppose I have TOTO in successfully in my logs. I want to display the result for TOTO and append that no result found for TITI and TUTU with linecount=0 and their name in UNIT. Somebody can help me ?   | search "successfully" | makemv delim="," _raw | table host, unit, linecount | stats count by unit | where unit IN ("TOTO",TITI",TUTU") | append [ ... I'm bugging ... ]   If there is another way to loop on value, I'm open. I didn't found how to declare and use variable exept with token ...
Need direction on how to configure Linux Auditd app to collect data from a host on an Index. Thank u 
Hi, I am using dbxquery to fetch around 800000 data from database into splunk | dbxquery connection=x query="select * from table002 " shortnames=t maxrows=800000 The above query is taking around 5... See more...
Hi, I am using dbxquery to fetch around 800000 data from database into splunk | dbxquery connection=x query="select * from table002 " shortnames=t maxrows=800000 The above query is taking around 500 seconds.The default maxrow is 1000 in dbxquery.py script.How do reduce the time taken without impaction performance of my server? P.S | noop search_optimization=false This doesnt improve my search time      
I feel like this is a known issue & I feel like it's been around for a while, reaching out to see if anyone has worked around this. I found one single post related to this where the only suggestion w... See more...
I feel like this is a known issue & I feel like it's been around for a while, reaching out to see if anyone has worked around this. I found one single post related to this where the only suggestion was to change how frequently Splunk reads in data, but tbh not much of an option here because Splunk is already known to peg out DBCPU time in my org. Short version of it is I'm having trouble with Splunk only ingesting a job from the AsyncApexJob object in my Salesforce org once, even though that job will get updated repeatedly as it goes through statuses of Queued, Running, Completed, etc. It's not every job that does this, but it's frequently enough that I can't build an accurate alert off it. There's a release note for add-on 4.2.2 that says this is a known issue: https://docs.splunk.com/Documentation/AddOns/released/Salesforce/Releasenotes#Known_issues however I'm on 4.0.3 of the Salesforce addon and my Splunk Enterprise is 7.3.3.  Has anyone else noticed this, worked around it without changing the frequency Splunk hits the org, is it to be fixed in a future update, etc.?
Hello, I want to remove all the back slashes and double quotes from following fields - conn=\"pass\"" ip=\"10.23.22.1\"" I am trying to extract with EVAL-conn = replace(conn,"\\\\(.),"") and EVAL... See more...
Hello, I want to remove all the back slashes and double quotes from following fields - conn=\"pass\"" ip=\"10.23.22.1\"" I am trying to extract with EVAL-conn = replace(conn,"\\\\(.),"") and EVAL-ip= replace(ip,"\\\\(.),"")  in my props.conf but it is not removing the last double quotes and give me following results - conn=pass" ip=10.23.22.1" Results I want :  conn=pass & ip=10.23.22.1 Can someone please help/guide me with this extraction. Thanks in Advance
Hello - I am new to splunk and am trying to do a search on data that calls out three different fields for duplicates so I can make a report out of that. Two of the fields are the name and serial numb... See more...
Hello - I am new to splunk and am trying to do a search on data that calls out three different fields for duplicates so I can make a report out of that. Two of the fields are the name and serial number, and the third field is the name and serial number combined. Any help is appreciated, thanks.
Hi, I'm trying to make a dashboard element that shows when one of our applications is restarted. So I have  a query that searches for "Starting Application". When I put this on my dashboard, I see t... See more...
Hi, I'm trying to make a dashboard element that shows when one of our applications is restarted. So I have  a query that searches for "Starting Application". When I put this on my dashboard, I see the columns "i", timestamp, event. How can I add column that shows the kubernetes_container_name? And how can I change column width and trim the original text so I get no line breaks? thanks for your help    
On a few Java servers.nodes in my environment /SaaS was getting Warning Metric registration limit of 5000 reached.  We have already increase the limit to 7500 on both nodes by adding parameters in... See more...
On a few Java servers.nodes in my environment /SaaS was getting Warning Metric registration limit of 5000 reached.  We have already increase the limit to 7500 on both nodes by adding parameters in the JVM startup file -Dappdynamics.agent.maxMetrics=7500   But again we are getting alert  "Metric registration limit of 7500 reached" Appd is only discovering 10 Business transactions on these nodes but not sure why the limit is being reached again and again. Even other nodes are running 40 BT but there is no such alert. How can we fix it permanently and find out the root cause?   Also on both of these servers HTTP Error is not being captured inside metric Errors|EIS-Dxp|HTTP Error Code : 504|Number of Error and Errors|EIS-Dxp|HTTP Error Code : 502Number of Error Is this issue also because of the metric registration limit? 
A client of mine is asking:  I’m hoping you can help me with something. I am trying to analyze the volume to a particular Apigee endpoint so I have wrote the following query where I am grouping the s... See more...
A client of mine is asking:  I’m hoping you can help me with something. I am trying to analyze the volume to a particular Apigee endpoint so I have wrote the following query where I am grouping the stats by my calculated date value to see a day-wise view for a service that hit a particular backend. index="apigee-prod-cne" sourcetype="apigee_metrics" (apiproxy="cc-cust-profile-01-v1")  target_host = "sapisugw-prd.duke-energy.com" proxy_pathsuffix = "/email/bp/retrieve" environment="prod" | dedup gateway_flow_id | spath request_verb | search request_verb != "OPTIONS"| eval yourdate = strftime(_time,"%D")| eval yourhour = strftime(_time, "%H")| eval yourmin=strftime(_time,"%M")  | stats count(x-apigee.edge.execution.stats.request_flow_start_timestamp) as hits by yourdate             What I’m not understanding is that when I add an additional parameter to group by (and changing none of my other conditions) that I suddenly see a spike in calls rather than a segmented number from the total?         Can you help me to understand what I may be missing to properly evaluate traffic through our proxies?
I have an indexer cluster and a search head environment. I've deployed the Splunk_TA_fortinet_fortigate app on both the search head and the cluster. Logs come in via syslog to syslog-ng where they ar... See more...
I have an indexer cluster and a search head environment. I've deployed the Splunk_TA_fortinet_fortigate app on both the search head and the cluster. Logs come in via syslog to syslog-ng where they are shipped to the indexer via HTTP Event Collector's raw endpoint. Logs come in via the fortigate_log sourcetype. Then the TA sets the sourcetype to the correct type via a transform. Those sourcetypes then specify TIME_PREFIX=^ in the props.conf. However, this doesn't work as there is no date field for Splunk to get the date from. There is a time field though... (see sample data below). What I want is to use the eventtime field as the timestamp. So, I create a local/props.conf file that looks like this:   [fortigate_log] MAX_TIMESTAMP_LOOKAHEAD = 0 TIME_PREFIX = eventtime= TIME_FORMAT = %s%9N [fgt_log] MAX_TIMESTAMP_LOOKAHEAD = 0 TIME_PREFIX = eventtime= TIME_FORMAT = %s%9N [fortigate_traffic] MAX_TIMESTAMP_LOOKAHEAD = 0 TIME_PREFIX = eventtime= TIME_FORMAT = %s%9N [fortigate_utm] MAX_TIMESTAMP_LOOKAHEAD = 0 TIME_PREFIX = eventtime= TIME_FORMAT = %s%9N [fortigate_anomaly] MAX_TIMESTAMP_LOOKAHEAD = 0 TIME_PREFIX = eventtime= TIME_FORMAT = %s%9N [fortigate_event] MAX_TIMESTAMP_LOOKAHEAD = 0 TIME_PREFIX = eventtime= TIME_FORMAT = %s%9N   The idea comes from a few places, notably these documents: https://splunkbase.splunk.com/app/2800/#/details (there is a section which has that) https://community.splunk.com/t5/Getting-Data-In/How-to-configure-int64-epoch-nanosecond-timestamp-as-time/m-p/26881 I deployed it to the indexer cluster first just in the traffic, utm blocks thinking that I need to override what is in the default props.conf. But that didn't help. So I added it to the incoming fortigate_log sourcetype hoping it would do the time extraction earlier in the ingestion process. Neither seems to do anything. I also tried putting it on the search head thinking that the configuration bundle it sends to the cluster may be overriding my config. Still nothing. What am I doing wrong? Any ideas? Thanks, Scott Sample data:   time=23:59:59 devname="hostname" devid="devid" slot=1 logid="0000000020" type="traffic" subtype="forward" level="notice" vd="root" eventtime=1630645200040167048 tz="-0500" srcip=1.2.3.4 srcport=35847 srcintf="port25" srcintfrole="undefined" dstip=2.3.4.5 dstport=49164 dstintf="port26" dstintfrole="undefined" srcuuid="xxx" dstuuid="xxx" sessionid=455176702 proto=17 action="accept" policyid=10873 policytype="policy" poluuid="xxxx" service="udp/49164" dstcountry="United States" srccountry="United States" trandisp="noop" duration=11699117 sentbyte=49457564285 rcvdbyte=0 sentpkt=164980295 rcvdpkt=0 appcat="unscanned" sentdelta=49457564285 rcvddelta=0    
I have a field (FIELD1) that may contain one of several strings.  These strings may appear in different locations within FIELD1.  I would like to select all records where FIELD1 contains any of these... See more...
I have a field (FIELD1) that may contain one of several strings.  These strings may appear in different locations within FIELD1.  I would like to select all records where FIELD1 contains any of these strings. Example of 4 strings:   "ABC(Z"   "DEF(Z"   "GHIJK (Z" "LMNOP (Z" What is an efficient method for selecting any records that contain any one of these strings in any location within FIELD1?
Hello, I have a script which always up and must never stopped. And I want to know how to deal with it in the inputs.conf.  If i do not put a cron interval, does it work the way I need ? Thanks.  
I have two dashboards I am currently working with. On the first dashboard I have two column chart panels, where the second one is based on the first one. So if I click on a column on the first chart... See more...
I have two dashboards I am currently working with. On the first dashboard I have two column chart panels, where the second one is based on the first one. So if I click on a column on the first chart it sets a token, based on this token the other panel appears with its results. Now if I click on one of those columns I want to set a second token. So far so good. I want to send these tokens as inputs for the second dashboard where I need to work with them. The first token should be passed to a dropdown input which works perfectly fine, no troubles here. The second token on the other hand needs to be passed to a multiselect input, which somehow doesn't work. The passing itself works perfectly fine, the url I get when opening the new tab to the other dashboard is good, but it somehow automatically changes the second token to a asterisk *. I tried tiping the url manually but it still happens, so I think something is wrong with the second dashboard. I guess there may be a problem with my inputs, since every input I have is based on another input, like a "higher level" input. My code is like this:   <fieldset submitButton="true" autoRun="false"> <input type="dropdown" token="first_level"> <label>1st Group</label> <prefix>1st_level="</prefix> <suffix>"</suffix> <fieldForLabel>1st_level</fieldForLabel> <fieldForValue>1st_level</fieldForValue> <search> <query>| inputlookup group_lookup | eval parent_group=mvindex(parent_group, -1), parent_group_count=mvcount(parent_group), 1st_level=mvindex(parent_group, -2), 2nd_level=if(parent_group_count=2, unit_name, mvindex(parent_group, -3)) | search parent_group="CEO" | stats count by 1st_level</query> <earliest>-24h@h</earliest> <latest>now</latest> </search> <change> <unset token="form.2nd_level"></unset> <unset token="form.3rd_level"></unset> <unset token="form.4th_level"></unset> <unset token="form.5th_level"></unset> </change> <choice value="*">All</choice> <default>*</default> <initialValue>*</initialValue> </input> <input type="multiselect" token="2nd_level"> <label>Second Level Group</label> <prefix>(</prefix> <suffix> OR 2nd_level="n/a")</suffix> <valuePrefix>2nd_level="</valuePrefix> <valueSuffix>"</valueSuffix> <delimiter> OR </delimiter> <fieldForLabel>2nd_level</fieldForLabel> <fieldForValue>2nd_level</fieldForValue> <search> <query>| inputlookup group_lookup | eval parent_group=mvindex(parent_group, -1), parent_group_count=mvcount(parent_group), 1st_level=mvindex(parent_group, -2), 2nd_level=if(parent_group_count=2, unit_name, mvindex(parent_group, -3)) | search parent_group="CEO" | search $1st_level$ | stats count by 2nd_level </query> <earliest>-24h@h</earliest> <latest>now</latest> </search> <choice value="*">All</choice> <default>*</default> <initialValue>*</initialValue> </input> <input type="multiselect" token="3rd_level"> <label>Third level group</label> <choice value="*">All</choice> <default>*</default> <prefix>(</prefix> <suffix> OR 3rd_level="n/a")</suffix> <initialValue>*</initialValue> <valuePrefix>3rd_level="</valuePrefix> <valueSuffix>"</valueSuffix> <delimiter> OR </delimiter> <fieldForLabel>3rd_level</fieldForLabel> <fieldForValue>3rd_level</fieldForValue> <search> <query>| inputlookup group_lookup | eval parent_group=mvindex(parent_group, -1), parent_group_count=mvcount(parent_group), 1st_level=mvindex(parent_group, -2), 2nd_level=if(parent_group_count=2, unit_name, mvindex(parent_group, -3)) , 3rd_level=if(parent_group_count&gt;=4, mvindex(parent_group, -4), "n/a") | search parent_group="CEO" | search $1st_level$ $2nd_level$ | search 2nd_level!="n/a" | stats count by bc_name_2nd</query> <earliest>-24h@h</earliest> <latest>now</latest> </search> </input> </fieldset>   I have two more deeper inputs, but I think you know how they work now. At first I thought the problem was resulting from the preselected "All" value, but when I changed to to nothing it didn't help. My guess is that it's coming from the Queries that are based on the higher level input, but I have no clue how I can prevent that without losing the token search filters. Any help is highly appreciated!! I've been stuck on this problem for hours now.