Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About shayhibah
shayhibah
Path Finder
Member since:
02-28-2018
10-01-2020
Community Statistics
| Posts | 103 |
| Solutions | 0 |
| Karma Given | 1 |
| Karma Received | 7 |
| Member Since | 02-28-2018 |
Activity Feed
- Posted lookup input value null on Splunk Search. 09-30-2020 06:08 AM
- Posted How to identify eventtype in props.conf on Splunk Enterprise Security. 08-27-2020 02:49 AM
- Posted Re: Change field value to ES allowed value based on criteria on Splunk Enterprise Security. 08-20-2020 07:50 AM
- Posted Change field value to ES allowed value based on criteria on Splunk Enterprise Security. 08-20-2020 06:19 AM
- Karma Re: merge 2 logs into one with at most one value for each field for niketn. 06-05-2020 12:50 AM
- Got Karma for How come Splunkd is crashing whenever I try to install an app using the Splunk user interface?. 06-05-2020 12:50 AM
- Got Karma for Splunk 7.2.0 - Field Aliases incorrect behavior. 06-05-2020 12:50 AM
- Got Karma for Splunk 7.2.0 - Field Aliases incorrect behavior. 06-05-2020 12:50 AM
- Got Karma for Splunk 7.2.0 - Field Aliases incorrect behavior. 06-05-2020 12:50 AM
- Got Karma for Splunk 7.2.0 - Field Aliases incorrect behavior. 06-05-2020 12:50 AM
- Got Karma for Splunk 7.2.0 - Field Aliases incorrect behavior. 06-05-2020 12:50 AM
- Got Karma for Re: How to create a static column in a table?. 06-05-2020 12:49 AM
- Posted Mapping field values to allowed valued for Enterprise Security (CIM Data Models) on Splunk Enterprise Security. 01-12-2020 07:29 AM
- Tagged Mapping field values to allowed valued for Enterprise Security (CIM Data Models) on Splunk Enterprise Security. 01-12-2020 07:29 AM
- Posted Re: Multi Value Fields Extraction using Props and Transform on Splunk Search. 01-08-2020 10:06 PM
- Posted Re: Multi Value Fields Extraction using Props and Transform on Splunk Search. 01-08-2020 10:05 PM
- Posted Re: Multi Value Fields Extraction using Props and Transform on Splunk Search. 01-08-2020 12:56 PM
- Posted Multi Value Fields Extraction using Props and Transform on Splunk Search. 01-08-2020 10:06 AM
- Tagged Multi Value Fields Extraction using Props and Transform on Splunk Search. 01-08-2020 10:06 AM
- Posted Issues with props.conf and EVAL function on Splunk Search. 01-07-2020 12:54 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
10-14-2018
02:56 AM
I have dashboards with drill down option.
The drill down query contains custom earliest and latest tokens since there was an issue with the time frame.
<link>....|rename "0" as "High" "1" as "Critical" | table _time,"Critical","High"&earliest=$clicked_earliest_date$&latest=$clicked_latest_date$</link>
After drilling down, the time frame is correct (based on the clicked event time value):
** 158 events (9/14/18 12:00:00.000 AM to 9/15/18 12:00:00.000 AM) **
But, when click on the results and choose "view events", the time frame is changed to its old value (which was wrong - 1 ms instead of 2 days).
0 events (9/14/18 12:00:00.000 AM to 9/14/18 12:00:00.001 AM)
How can I fix it?
... View more
- Tags:
- splunk-enterprise
10-08-2018
11:19 PM
@harishalipaka
I used your syntax (you can see it in the post above) but I does not work for me.
Any suggestions?
... View more
10-08-2018
11:12 PM
@harishalipaka
Thank you for your response.
This query works great but for some reason mine isn't.
What can be the issue? I don't want to use 'head' in my query since I want to see all results.
... View more
10-08-2018
10:30 PM
I have a query like this:
first_query | dedup 1 id | search action=drop | stats count by action, destination | fields action | stats count(eval(action=drop)) |
append [search second_query | dedup 1 id | search action=drop | stats count by action, source | fields action | stats count(eval(action=drop))]
After pressing on "events" tab in search view, I get relevant logs only for the first query and not even 1 log of the second query.
when running each query separately, the first_query gives me 11 events and the second_query gives me 71 events.
How can I get all results of all appended queries (82 events)?
Thanks
... View more
- Tags:
- splunk-enterprise
10-04-2018
12:23 AM
@493669
Thanks for your reply.
Your proposal semi-helped - it now shows the search window but the time range is still wrong and therefore I don't get results.
The time range is based on the tokens I defined ans for some reason is does not related to them.
... View more
10-03-2018
11:21 PM
Hi,
In my dashboards I use custom drilldown:
<drilldown>
<set token="clicked_earliest_date">$earliest$</set>
<eval token="clicked_latest_date">$clicked_earliest_date$+86400</eval>
<link target="_self">search?q=my_query
| eval Time=_time
| convert timeformat="%Y-%m-%d" ctime(Time)
&earliest=$clicked_earliest_date$&latest=$clicked_latest_date$</link>
</drilldown>
This drilldown used to work but I noticed that there are times it does not work.
1. if I use convert timeformat="%Y-%m-%d" ctime(Time), when drilling down I get an empty search window but I can notice that the URL of this page contains the query.
2. If I remove convert timeformat="%Y-%m-%d" ctime(Time), I get non-empty search window but I also see that time range is different than the time of the clicked event.
I must say again that this drill down sometimes works and sometimes doesn't.
Someone is familiar with this issue?
... View more
10-02-2018
03:46 AM
@HiroshiSatoh
Thanks for your response.
Unfortunately, it still gives me the same results - 9/16/18 3:00:00.000 AM to 9/16/18 3:00:00.001 AM.
Maybe the bucket in the query affect the results?
... View more
10-02-2018
02:05 AM
I have a dashboard with a chart inside it.
The query of the chart is:
base_search | eval _time = time| bucket _time span=24h | chart count over _time by app_risk| fields _time,Critical,High,Medium,Low
The drill down settings are: On Click=Link to Search & Auto.
When clicking on "High" category on specific date, I would like to see the events related to this combination of risk and date.
For some reason, I have no results after drilling down.
For example: I click on events from Sep 15 - I expect the rime range to be Sep 15 00:00:00,000 to Sep 15 23:59:59,999 but (!) the time range is Sep 15 00:00:00,000 to Sep 15 00:00:00,001
Can someone tell me why the results are not related to the specific column date?
... View more
09-26-2018
12:22 AM
I would like to map to data model and want that specific field to behave like A=B only if C="some value" (A is the new field while B,C are existing fields).
I tried to go to setting and under "Field Aliases" looked for condition but I could not find.
Does someone know how to do it?
Thanks
... View more
- Tags:
- splunk-enterprise
09-13-2018
04:59 AM
unfortunately it still does not work.
I copied your query into the search bar - it looks fine.
When I change the query in my dashboard source code - the visualization is different.
Here is my code behind:
<chart>
<search>
<query>index=_* earliest=-15m|eval app_risk=case(sourcetype="splunkd","Very Low",sourcetype="audittrail","Medium",sourcetype="kvstore","Low",sourcetype="splunkd_access","Critical",sourcetype="splunk_web_access","High")|search app_risk=*
|bucket span=5m _time|chart count over _time by app_risk| fields _time,Critical,High,Medium,Low,"Very Low"
<earliest>$general_overview_time_picker.earliest$</earliest>
<latest>$general_overview_time_picker.latest$</latest>
</search>
<option name="charting.axisTitleX.visibility">collapsed</option>
<option name="charting.axisTitleY.text">Logs</option>
<option name="charting.axisY.abbreviation">auto</option>
<option name="charting.chart.stackMode">stacked</option>
<option name="charting.legend.labels">[Unknown,"Very Low",Low,Medium,High,Critical]</option>
<option name="charting.legend.placement">bottom</option>
<option name="charting.seriesColors">[#A6A6A6,#6FA0F9,#89C73A,#FFE614,#FF8B1A,#E55D5D]</option>
<option name="refresh.display">progressbar</option>
<option name="trellis.enabled">0</option>
<option name="trellis.size">small</option>
</chart>
... View more
09-13-2018
02:59 AM
@renjith.nair
When I run the query on search bar it looks good.
When I create a panel - the order is changed.
Do you know why? Maybe its because I used custom colors for the app_risk values?
The current query is:
my_query | eval _time = time| bucket _time span=1d
| chart count over _time by app_risk| fields _time,Critical,High,Medium,Low,"Very Low",Unknown
... View more
09-13-2018
02:59 AM
didnt help.. the xyseries command change the order of the columns
... View more
09-13-2018
02:59 AM
@renjith.nair
Thanks for your response.
What I am trying to do is to show all the data in stacked column but the order of the data should be by their risk - top will be critical and bottom will be unknown.
I tried to do what you have suggested but it does not work.
... View more
09-12-2018
10:49 PM
I want the results of the following query to be sorted by orders I declare.
For some reason, it does not work so I might missing something:
my_query | eval _time = time| bucket _time span=1d | stats count by _time, app_risk | eval risk_order=case(app_risk=="Unknown",0, app_risk=="Very Low",1, app_risk=="Low",2, app_risk=="Medium",3, app_risk=="High",4, app_risk=="Critical",5) | sort -risk_order | xyseries _time,risk_order,count | rename "0" as "Unknown" "1" as "Very Low" "2" as "Low" "3" as "Medium" "4" as "High" "5" as "Critical"
Anyone?
Thanks!
... View more
- Tags:
- splunk-enterprise
09-03-2018
07:04 AM
Does someone know if "All time" behaves differently than real-time and relative options?
... View more
09-02-2018
11:51 PM
Hi,
In my dashboard, I have time picker and many single value components with trend.
The query behind each single value contains span of 24 hours, and the single value is compared to "Custom" with "Auto" option.
For example:
my_query... |
timechart span=24h count
I don't actually understand single value behavior.
If I choose "Last Year" in the time picker, I see the value 0 (which is correct). But when I press on it and drill down, it opens the results in "new search" with "Date time range" (9/3/18 3:00:00 AM to 9/4/18 3:00:00 AM) and not "Last Year"
If I choose "All time" in the time picker, I see the value 89 ; I don't know if that's correct because in the last 24 hours, I didn't ingest any event. When I press on it, it opens the results in "new search" with "Date time range" (10/9/17 3:00:00 AM to 10/10/17 3:00:00 AM) and not "All Time".
Can someone please explian to me:
1. Why the time range is changed when I drill down?
2. Why I get 89 and not 0?
Thank you
... View more
09-02-2018
07:50 AM
1 Karma
Thank you Niket, exactly what I need
... View more
09-02-2018
02:48 AM
I would like to create one column with labels that should not be changed.
For example:
column title: my_own
first row value: A
second row value: B
third row value:C
Is it possible to do it?
... View more
08-29-2018
07:37 AM
@andreacorvini
Thank you for the clarification, but if so, I see 5 events but when I visualize it using single value - I see only 1 instead of 5
... View more
08-29-2018
07:36 AM
@pyro_wood
Thank you for the clarification, but if so, I see 5 events but when I visualize it using single value - I see only 1 instead of 5
... View more
08-29-2018
07:35 AM
@DalJeanis
next to events tab I still see 5 but when I visualize it using single value, I see only 1
... View more
08-29-2018
07:02 AM
Over the last 3 days I was trying to create dashboard with single value + trends.
The query was something like this:
| dedup 1 src | timechart count by src
The goal was to get total number of src based on dashboard time range (before talking about the trends).
right now, by mistake (must be honest), I changed the query so I replaced the word by with as and it seems to work but not perfectly - when I change the time range to all time i expect to see all events but I get only one of them (although there are 5 events in results):
Can someone please tell me why I got confused and to translate my goal above into query correctly for next time?
Thanks
... View more
- Tags:
- splunk-enterprise
- src
08-28-2018
07:21 AM
works perfectly! I appreciate it Niket
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
10-01-2020
07:08 AM
|
Karma from
