Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- Find Answers
- :
- About landen99
landen99
Motivator
Member since:
02-26-2014
07-02-2024
Community Statistics
| Posts | 475 |
| Solutions | 19 |
| Karma Given | 191 |
| Karma Received | 167 |
| Member Since | 02-26-2014 |
Activity Feed
- Got Karma for Re: renaming fields in search. 01-02-2025 04:35 AM
- Got Karma for Re: Merge two fields into one field. 10-23-2024 09:28 AM
- Got Karma for Re: Merge two fields into one field. 10-23-2024 09:24 AM
- Got Karma for Re: DNS debug log dns.log Format Review. 07-08-2024 10:21 AM
- Got Karma for Re: Merge two fields into one field. 04-25-2024 04:04 AM
- Got Karma for Re: Merge two fields into one field. 03-07-2024 12:35 PM
- Posted Re: Splunk time parse on Splunk Enterprise Security. 01-04-2024 09:38 AM
- Got Karma for Re: Dark theme. 06-12-2023 10:27 AM
- Got Karma for How do I get the dark theme to all of Splunk, regardless of version?. 06-12-2023 10:26 AM
- Got Karma for Re: Show all lines for Windows event-log events. 05-03-2023 09:47 AM
- Posted Re: Dealing with OMG huge events on Getting Data In. 03-08-2023 12:04 PM
- Posted Re: Browser sluggish when browsing through large raw data events. on Security. 03-08-2023 11:10 AM
- Got Karma for Re: inputlookup followed by transaction - No results found. 11-23-2022 07:30 AM
- Got Karma for Re: How can I generate a list of users and assigned roles?. 11-04-2022 06:20 AM
- Karma Re: Splunk web stuck at Loading page.. for att35. 10-12-2022 11:47 AM
- Karma Re: What are your Splunk t-shirt ideas? for nickstone. 10-04-2022 03:13 PM
- Karma Re: What are your Splunk t-shirt ideas? for ccl0utier. 10-04-2022 03:08 PM
- Posted Download Splunk Add-On Builder version 2.2.0 on All Apps and Add-ons. 10-04-2022 02:45 PM
- Posted How to resolve: ServiceNow TA Error "Failed to load current state for selected entity in form!" on Getting Data In. 08-24-2022 07:08 AM
- Got Karma for Re: how can i see all of the searches that are looking for a specific field?. 08-10-2022 08:02 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 0 |
01-13-2019
07:21 PM
Accepted answer was selected based on the votes today. 9 votes for NOC, NOC. But please keep submitting your ideas here and share your favorites with Splunk.
... View more
12-28-2018
01:40 PM
2 Karma
The proper answer is:
| sort 0 _time | eval mids=mvappend(mid,mid2,rewrite_mid) | transaction mids
other options on transaction may be added as desired, but aren't necessary if the search time frames are short.
... View more
12-17-2018
07:46 AM
1 Karma
I downvoted this post because epoch time!
... View more
11-28-2018
12:59 PM
I downvoted this post because the results from this solution are incomplete. only the top 10 sourcetypes are recorded in metrics
... View more
11-28-2018
12:58 PM
I downvoted this post because incomplete. only top 10 sourcetypes recorded in metrics
... View more
11-27-2018
10:11 AM
...|search NOT [...|rename field AS query]
Does not search the field query , but instead the raw data.
Instead of searching:
NOT(query=value1 OR query=value2 ...)
It searches
NOT(_raw=value1 OR _raw=value2 ...)
If you want to actually search the query field then do this:
...| rename query AS query_name |search NOT [...|rename field AS query_name] | rename query_name AS query
... View more
11-27-2018
10:10 AM
The following two searches yield very different results:
...|search NOT [...|rename field AS query]
...| rename query AS query_name | search NOT[...|rename field AS query_name]
... View more
- Tags:
- splunk-enterprise
10-29-2018
01:14 PM
Load the values into a lookup table. Use a multi-select input to load the lookup and format each value into a token. Add the token to a panel.
... View more
10-22-2018
05:34 AM
Without seeing the raw source data in Splunk, the data presented in the image link provided (https://postimg.cc/grSW3mrG) reveals that there is insufficient information to reliably bring your events together. Even if source and destination files were used (similar source and file names in distinct transfers would mess with that method for grouping the transfers), the events do not hold the target filename constant throughout the transfer. Thus we must filter the ones out which are not constant.
| where SrcFileName!=TgtFileName OR Status=ERROR | stats last(Status) AS status by SrcFileName TgtFileName
from there you just add to the stats the other fields of interest using the same last command seen above on Status with the rest of the fields: BusinessObject, SrcFileName, SourceServer, DestinationServer, Environment, ExecutionStep, Status, TgtFileName, StartDateTime, EndDateTime
... View more
10-22-2018
05:18 AM
To remove duplicates on time and count by eventcode:
index=windows sourcetype="wineventlog:system" SourceName="Disk" (EventCode=7 OR EventCode=11 OR EventCode=51 OR EventCode=52) Type="Critique" OR Type="Avertissement" OR Type="Erreur" | dedup _time | bin span=1mon _time| stats count values(Message) by EventCode Type host _time
If the field date_month is available, you could use that instead of _time, if you wished.
... View more
10-13-2018
01:38 PM
http://docs.splunk.com/Documentation/Splunk/latest/Admin/Transformsconf?splunkbot
filter = <string>
* Filter results from the lookup table before returning data. Create this filter like you would a typical search query using Boolean expressions and/or comparison operators.
* For KV Store lookups, filtering is done when data is initially retrieved to improve performance.
* For CSV lookups, filtering is done in memory.
It looks like performance is improved after the filter is applied on reading the kvstore.
... View more
10-13-2018
01:21 PM
Let's say I have a search that immediately goes into a lookup with a filtered kvstore of 1 million events followed by a stats by a lookup output field:
index=my_index | lookup ioc_sha256 Indicator_Value AS sha256 OUTPUT Type Malware | stats first(_time) AS _time first(field1) AS field1 values(Malware) AS Malware etc.. by Type sha256
How can the performance of that search be improved? The goal is to show all match_field matches with other event level information from the event matches.
... View more
10-13-2018
01:15 PM
When a kvstore lookup definition filters a kvstore of 1 million events down to 300k, does performance improve vs using the original kvstore collection unfiltered?
... View more
10-08-2018
08:43 AM
lol, brilliant inside but extremely slow to communicate those ideas with the world?
... View more
09-19-2018
09:39 AM
3 Karma
I'll cast a SPL on you.
On the back:
And now() your mine.
... View more
09-19-2018
09:37 AM
Multiple answers are desired. Please do.
And please upvote the ones you like.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
07-02-2024
08:32 PM
|
Karma from
Karma given to
