Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- Find Answers
- :
- About jonuwz
jonuwz
Influencer
Member since:
03-07-2012
04-17-2024
Community Statistics
| Posts | 543 |
| Solutions | 122 |
| Karma Given | 131 |
| Karma Received | 450 |
| Member Since | 03-07-2012 |
Activity Feed
- Got Karma for Re: No results found, I want to show other message！！！. 01-24-2025 05:43 AM
- Got Karma for Re: grouping and delta in search. 08-05-2024 11:02 PM
- Got Karma for Re: grouping and delta in search. 06-03-2024 11:51 PM
- Got Karma for Re: how to set max column length. 05-29-2024 11:03 PM
- Got Karma for Re: get rid of this awful other column. 03-06-2024 11:51 AM
- Got Karma for Re: snap to 10 minutes. 06-28-2023 09:37 AM
- Got Karma for Re: aggregating stats by wildcard or arbitrary number of fields. 05-11-2022 12:48 AM
- Got Karma for Re: process control chart e.g. upper/lower control limit.. 04-26-2022 11:22 AM
- Got Karma for Re: Replace space in multi-value filed with comma. 01-14-2022 04:47 AM
- Got Karma for Re: Automatically Refresh Dashboard. 11-23-2021 03:38 PM
- Got Karma for Re: Group results by range values. 09-22-2021 12:01 PM
- Got Karma for Re: Group results by range values. 06-29-2021 12:58 PM
- Got Karma for Re: Group results by range values. 09-27-2020 08:41 PM
- Got Karma for Re: Timechart with multiple fields and calculating percentage. 09-03-2020 10:57 PM
- Got Karma for Re: Can I access the search timeframe within the search?. 07-30-2020 01:08 PM
- Karma Re: Are data model summaries linked to the original events? Can tstats access them? for dshpritz. 06-05-2020 12:48 AM
- Karma Re: How do I search specified fields with the same keyword list without searching the entire index? for martin_mueller. 06-05-2020 12:47 AM
- Karma Re: How to extract age from a birthday field before the year of our Splord 1970? for alacercogitatus. 06-05-2020 12:47 AM
- Karma Re: field extraction for latency message for Ayn. 06-05-2020 12:46 AM
- Karma Re: Exporting search to csv contains headers, exporting with cURL/API does not for dart. 06-05-2020 12:46 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 2 | |||
| 0 | |||
| 0 | |||
| 1 |
09-27-2012
08:49 AM
There seems to be a dependency on roles inheriting from 'user' and 'admin'.
Example.
I create a new role defined like this (an exact replica of 'user'):
[research]
change_own_password = enabled
get_metadata = enabled
get_typeahead = enabled
request_remote_tok = enabled
rest_apps_view = enabled
rest_properties_get = enabled
rest_properties_set = enabled
rtSrchJobsQuota = 1
search = enabled
If I create a user with only this role assigned, when he logs in, and clicks 'Manager', the page is completely blank.
Likewise, if I create a replica of the admin role (which inherits from 'power' and 'user'), all the admin tabs (like user roles, index management) are missing.
I've tested this against 4.3.2 4.3.3 and 4.3.4
Am I missing something, is this a bug, or expected behaviour?
It defeats the purpose of having capabilities like 'edit_user' and 'change_own_password'
John
... View more
- Tags:
- t
09-25-2012
02:45 AM
Where does actualcount come from - can you calculate it - if so how ? post the search that gives you the value of actualcount
... View more
Try something like this :
| stats count as Traffic, avg(duration) as duration by host
| appendpipe [ stats count | eval Traffic=0 | eval duration=0 | eval host="NULL" | where count==0 | fields - count ]
This adds an extra line to your output with default values, but only if the result count = 0
... View more
09-17-2012
01:40 PM
1 Karma
Does stats give you the information you need ?
It feels like you're trying to get the number of unique values for each of source IP, dest IP, source port and dest port
splunk_server="server" index="index" | stats dc("source ip") as "source ips" dc("dest ip") as "dest ips" dc("source port") as "source ports" dc("dest port") as "dest ports" by tag severity
This will count the unique values of each per tag-severity combination.
... View more
09-13-2012
09:17 AM
6 Karma
Add " | addinfo " to your search.
This gives you access to the following fields :
info_min_time: the earliest time bound for the search
info_max_time: the latest time bound for the search.
Docs here
... View more
09-13-2012
03:09 AM
1 Karma
Like this :
... | rex "(?si)^(?P<DATEFIELD>[^,]+),\d+\s+\[(?P<FIELDNAME>[^ ]+)\] (?P<LOGTYPE>(INFO|ERROR|DEBUG)) (?P<CALLNAME>[^ ]+) \((?P<FIELDNAME2>\d+)\).*?:.*?:\s+(?P<FIELDNAME3>[^:]+).*?[\r\n]+\s*at\s+(?P<FIELDNAME4>[^\(]+)"
| table DATEFIELD FIELDNAME LOGTYPE CALLNAME FIELDNAME2 FIELDNAME3 FIELDNAME4
The 's' in (?si) means treat \n as a character, not a line break.
This returns :
DATEFIELD 14 Jun 2012 07:38:55
FIELDNAME ABCD
LOGTYPE ERROR
CALLNAME my.classname
FIELDNAME2 46
FIELDNAME3 System.Runtime.Remoting.RemotingException
FIELDNAME4 com.sun.xml.ws.fault.SOAP11Fault.getProtocolException
... View more
09-13-2012
02:49 AM
1 Karma
Don't think you can use table like that.
What you're trying to do is get statistics for your F5s connect rate per second
The field _time is easier to manipulate than all the date parts - you can format the _time field later.
sourcetype="syslog" TCP_DST_PORT="31621"
| bin _time span=1s
| stats count(eval(TCP_TYPE=="TCP_Client_Accepted")) as F5_ACCEPT, count(eval(TCP_TYPE=="TCP_Node_Connected")) as F5_CONNECT by _time
| eval F5_MISSED=F5_ACCEPT-F5_CONNECT
| WHERE F5_MISSED>2
| eval timestamp=strftime(_time),"%%Y-%m-%d:%H:%M:%S")
| table timestamp F5_ACCEPT F5_CONNECT F5_MISSED
Does the above search show the results you need ?
... View more
09-12-2012
03:41 PM
1 Karma
Do the events contain session ids and logon / logoff event entries ?
If so, you can work out the start of the session, the duration of the session, and use the concurrency search command
... View more
09-12-2012
03:38 PM
Pretty sure UDP should be udp in props.conf
[source::udp:514]
TRANSFORMS-set= setnull
Update....
Have you restarted splunk since making the changes?
... View more
09-12-2012
03:09 PM
1 Karma
yeah - i don't have your data, but this seems to be similar to what you're using :
index=_internal | eval instock=10 | stats first(instock) as instock count(eval(group=="pipeline")) as pipe count(eval(group=="queue")) as queue | transpose | rename "row 1" as count`
or
index=_internal group="pipeline" OR group="queue" | stats count by group | appendpipe [ head 1 | eval group="InStock" | eval count=10 | fields group count ]
... View more
09-12-2012
02:51 PM
1 Karma
Add this to the end of your search
| transpose | rename "row 1" as count
The trick is to get your data in multiple rows, not across multiple columns.
You can also replace 'chart' with 'stats'
A neater search might be
sourcetype="fruitlog" type="pear" OR type="grape"
| stats count by type
| appendpipe [ head 1 | eval type="InStock" | eval count=10 | fields type count ]
The 1st 2 lines gets the count per type (which will graph as-is)
the last line just spoofs an entry for InStock
... View more
09-12-2012
01:03 PM
1 Karma
No. The extracion is done on an event by event basis.
With this extraction, every result will have a src1 and a src2
So, if i'm reading the question correctly, src1 will be the firewall IP and src2 will be the user IP.
If you have a specific search requirement (like listing the top user IPs) post it up..
... View more
09-12-2012
04:21 AM
2 Karma
Walkthrough here
If you don't want the link in the 1st column, you'll need to change the drilldown for SimpleResultsTable to 'all'.
You may also need to override the drilldown for the other fields too.
Probably easier all round to keep the link in the 1st column..
... View more
09-12-2012
03:56 AM
3 Karma
You might want to do this in your search like this :
| rex "src=(?<sources>[0-9.]+)" max_match=2 | eval src1=mvindex(sources,0) | eval src2=mvindex(sources,-1) | table src1 src2
If this is a regular thing, then you might want to look at this
The MV_ADD directive tells splunk to make fields multivalue if a field is repeated.
... View more
09-10-2012
04:02 AM
You wrap it around any searches you want to be modified by your intention. (Don't forget to close the </module>
Also, HiddenIntention might not be valid as a root module, wrap it in a GenericHeader to test
... View more
09-10-2012
02:32 AM
The sample output you require is just reformatting the event data you already have - there's no joins or group by.
Perhaps you could give a sample output when there is more than one of human(male) and/or more than one of human(female)
... View more
09-07-2012
02:12 PM
Are you actually using a search bar, and wanting to append the addition search?
If the user can enter a freeform search string, the extra search may or may not be relevant..
... View more
09-07-2012
07:27 AM
1 Karma
You can get a list of your saved searches like this :
| rest /servicesNS/admin/search/saved/searches | search title="*threshold"
(you may need to swap out 'search' with the name of your app)
Then you can add
| map maxsearches=20 search="| savedsearch \"$title$\" | eval savedsearch=\"$title$\" "
I added "savedsearch" as a field because you'll probably need it anyway, plus there has to be at least 1 common field across all the searches.
One thing to note, all the searches will be run across the same time range.
map is cool. if you run a search, by using map, you can run a subsearch with string replacement.
In the above example, the initial rest query returns the saved searches in a field called 'title'
The map command runs the search n times, replacing $title$ with the savedsearch name each time.
... View more
09-06-2012
02:59 PM
1 Karma
Something like this :
host="20.20.20.5" denied | chart count by src_ip
?
... View more
09-06-2012
02:57 PM
Have you changed the permissions in manager so that your tag is available to all apps ?
Sounds like it still has 'private' permissions
... View more
09-06-2012
02:35 PM
7 Karma
Just stick the export module within the search with your simpleresults table.
<module name="HiddenSearch" layoutPanel="panel_row1_col1" autoRun="True">
<param name="search">* | head 10 | table sourcetype source _time</param>
<module name="Export">
<param name="exportType">result</param>
</module>
<module name="SimpleResultsTable"/>
</module>
Edited to make SRT + Export siblings as suggested by Sideview
... View more
09-06-2012
02:09 PM
5 Karma
For capturing groups - there is no real difference
given the string : "<data>stuff</data>"
You can do this
| rex "<(?<node>[^>]+)>(?<text>.*?)</(?P=node)>"
This : (?P=node) is a string replacement for 'data' which was previously captured in the group named 'node'
So we're making sure that in the xml snippet, the closing tag contains the same tag that opened the xml node.
In non-jargon...
node = everything betwenn the < and the next >
text = everything between <node> and the next instance of </node> (whatever string 'node' might be)
... View more
