Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- Find Answers
- :
- About alemarzu
alemarzu
Motivator
Member since:
03-10-2014
11-22-2024
Community Statistics
| Posts | 321 |
| Solutions | 35 |
| Karma Given | 35 |
| Karma Received | 49 |
| Member Since | 03-10-2014 |
Activity Feed
- Posted Re: How to Identify which HF is sending logs/metrics on Getting Data In. 11-22-2024 07:47 AM
- Got Karma for Re: How to split data into separate sourcetypes with transforms. 07-16-2024 01:04 AM
- Got Karma for Re: How to find all the searches having "index=*" in the search or Alert or Reports. 05-25-2022 08:23 AM
- Got Karma for Re: How to find all the searches having "index=*" in the search or Alert or Reports. 04-11-2022 10:45 AM
- Got Karma for Re: How to find all the searches having "index=*" in the search or Alert or Reports. 01-06-2022 10:44 AM
- Posted Re: Windows Eventlog Blacklist Failing on Getting Data In. 06-09-2021 08:52 AM
- Posted Re: Using regex in field extraction on Splunk Search. 06-09-2021 08:40 AM
- Posted Re: CSVファイルのデータが一部文字化けして欠損する on Monitoring Splunk. 06-08-2021 02:43 PM
- Posted Re: Failed to load source for Event Timeline Viz visualization on Dashboards & Visualizations. 01-11-2021 12:38 PM
- Karma Re: ITSI Service Analyzer doesn't show anything for timothywatson. 01-11-2021 12:26 PM
- Got Karma for Re: Has anyone Splunked Trello data?. 01-04-2021 07:54 PM
- Got Karma for Re: How to configure UF to send data to splunk stand alone instance?. 10-28-2020 03:02 AM
- Got Karma for Re: How to configure UF to send data to splunk stand alone instance?. 10-28-2020 02:57 AM
- Got Karma for Re: Clarification on search query to detect outliers. 10-26-2020 11:11 PM
- Posted Re: How can one change the ITSI status of multiple episodes at once? on Splunk Cloud Platform. 10-24-2020 02:27 AM
- Posted Re: Clarification on search query to detect outliers on Splunk Enterprise Security. 10-24-2020 12:40 AM
- Posted Re: help on where condition on Dashboards & Visualizations. 10-23-2020 06:28 PM
- Posted Re: How to configure UF to send data to splunk stand alone instance? on Splunk Enterprise. 10-23-2020 06:04 PM
- Posted Re: TA-DMARC scheme error on All Apps and Add-ons. 10-23-2020 05:44 PM
- Posted Re: How can one change the ITSI status of multiple episodes at once? on Splunk Cloud Platform. 10-23-2020 05:31 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
10-11-2016
06:15 AM
Hi there @mchandrasekaran
Thats weird, I've tested it on prod data and it's working. May I ask, why do you believe is not working after the append?
Regarding the new approach, its doable for sure. Avoid gigantic CSV's.
... View more
10-05-2016
07:40 AM
Hi @mchandrasekaran
This obviously needs hardcore improvement but it might help you.
index=wineventlog sourcetype=WinEventLog:Security EventCode=4740
| eval Account=mvindex(Account_Name, 1)
| regex Account!="\\$"
| eval blockTime=_time
| eval modtime=if(blockTime > relative_time(now(), "@d"), "Today", "PreviousDays")
| search modtime=Today
| stats latest(_time) AS accblockTime, sum(eval(EventCode="4740")) AS AccBlocks by Account modtime
| convert ctime(accblockTime)
| appendcols [search index=wineventlog sourcetype=WinEventLog:Security (EventCode=4723 OR EventCode=4724 OR EventCode=4625)
| eval Account=mvindex(Account_Name, 1)
| regex Account!="\\$"
| eval eventTime=_time
| eval modtime2=if(eventTime < relative_time(now(), "@d"), "PreviousDays", "Today")
| search modtime2=PreviousDays
| stats sum(eval(EventCode="4724")) AS PwdResets, sum(eval(EventCode="4723")) AS PwdChanges, sum(eval(EventCode="4625")) AS LoginFailures by Account modtime2]
| table Account AccBlocks accblockTime PwdResets PwdChanges LoginFailures
So, this will give you the amount of account blocks and the latest block's timestamp per user for the current day. After that, this will search for any password resets, password changes and login failures for each one of them during the previews days.
You can also add some case statement to alert based on certain conditions.
Hope it helps.
... View more
09-29-2016
11:39 AM
Hi @Karl12347
Did you check your Audit Policies ? Perhaps you are not auditing those events.
... View more
09-29-2016
05:32 AM
Nice, I'm glad it helped !
... View more
09-28-2016
02:03 PM
3 Karma
Hi there mate,
Check this out: http://docs.splunk.com/Documentation/Splunk/latest/Report/Embedscheduledreports
... View more
09-28-2016
01:00 PM
Hi @ppanchal
I'm not sure about this, but I believe it's because you set up 10k rows in "Max Rows to Retrieve" and you schedule the execution of the sqlquery to run only at 14:12 each day. So you end up with 10k of events per day only.
This parameter adjusts the number of rows to retrieve with each query execution.
So you either increase the amount of rows to retrieve or you can schedule your query to run more often.
Hope it helps.
... View more
09-28-2016
12:44 PM
Hi there @seetharamanPr
Try like this:
index=mail sourcetype="symantec:mail:syslog" sender "ML-DELIVERY" | stats count by sender | sort - count | head 50
Hope it helps
... View more
09-27-2016
12:19 PM
Hello @kulls,
Try this, is a working example with metrics.log charting values from previous week. This is assuming that you have date_* fields in your events, if not let me know.
index=_internal source="*metrics.log" earliest=-1w@w latest=@w
| eval date_hour=strftime(_time, "%H")
| eval date_wday = strftime(_time, "%w")
| search date_hour>=8 date_hour<=17 date_wday>=1 date_wday<=5
| chart avg(kb) by date_wday
Edit: New query, this will work even if you don't have date_* fields and it's easier to understand if you want a montly report,
index=_internal source="*metrics.log" earliest=-1mon@mon latest=@mon
| eval hour = tonumber(strftime(_time,"%H"))
| eval wday = tonumber(strftime(_time,"%w"))
| bin _time span=1d
| where hour>=8 AND hour<=17 AND wday!=0 AND wday!=6
| eval formatedTime=strftime(_time, "%b %d")
| chart avg(kb) by formatedTime | rename formatedTime AS "Date"
Hope it helps.
... View more
09-27-2016
10:57 AM
Hi there kiran331,
If you create an eventtype for each zone you'll end up with one value as token for each zone, like this.
eventtypes.conf
[zone1]
search = (eventtype="host-detection_zone1" OR eventtype=vm_detection-zone1")
[zone2]
search = (eventtype="host-detection_zone2" OR eventtype=vm_detection-zone2")
Hope it helps.
... View more
09-26-2016
05:40 AM
I'm glad it helped you! Happy Splunking!
... View more
09-26-2016
05:36 AM
Hi there mate, sure there is.
In the link that pasted above from Splunk docs if you look at the left side of the web page, you'll see this menu. In there you will find the step by step procedure to index your data.
... View more
09-23-2016
06:27 AM
1 Karma
Hi there jepoyyy,
Assuming that you don't have certain fields already extracted, try this.
main search | rex "TransactionID\((?<transactionId>\d+)\)\s" | rex "\)\sReceived\spacket\s\S+\s(?<status>\d+)\s\w+$" | stats latest(_time) AS lastTime, sum(amount) AS Amount, values(status) AS Status by transactionId | where Status=200 | convert ctime(lastTime)
Hope it helps.
... View more
09-23-2016
06:01 AM
Hi there,
Just go to Settings > Data Inputs > Files & Directories OR select how to index your input according to your data source. After that, just follow the wizard.
If you have any doubt, don't hasitate.
This will probably help you a lot more, http://docs.splunk.com/Documentation/Splunk/6.4.3/Data/Configureyourinputs
... View more
09-12-2016
05:43 AM
Hi there inventsekar,
Perhaps dedup command can help you with this.
source=sdesktop "Available" | dedup resource | table resource _time
Hope it helps.
... View more
09-05-2016
12:08 PM
Hi there,
Did you try disabling enable_query_wrapping on your inputs.conf ?
... View more
06-01-2016
05:41 AM
Passing a false value to TIME_PREFIX parameter could work, splunk wont be able to find the timestamp, hence one big event with the current timestamp.
With the given sample data, this worked for me.
[<SOURCETYPE NAME> ]
SHOULD_LINEMERGE=true
NO_BINARY_CHECK=true
CHARSET=UTF-8
disabled=false
TIME_PREFIX=asdasd
Hope it helps.
... View more
06-01-2016
05:18 AM
Hi there, try with this
main search | stats sum(bytes_field) by User IP
... View more
04-11-2016
06:16 AM
Hi kpavan,
You could try doing this
https://code.google.com/archive/p/eventlog-to-syslog/
Hope it helps.
... View more
04-11-2016
05:55 AM
Hi apurva,
For search-time extractions add this to your props.conf
[log4j]
EXTRACT-my_ext = your_regex
Hope it helps.
... View more
03-23-2016
10:30 AM
I see now, give this a try.
your search | rename ENDPOINT_LOG{}.* as * | eval temporal=mvzip(EML_REQUEST_TIME,EML_RESPONSE_TIME,"##") | table temporal | mvexpand temporal | rex field=temporal "(?<EML_REQUEST_TIME>.*)##(?<EML_RESPONSE_TIME>.*)" | eval average_response_time= strptime(EML_REQUEST_TIME , "%Y-%m-%d %H:%M:%S.%3N") - strptime(EML_RESPONSE_TIME , "%Y-%m-%d%H:%M:%S.%3N") | table EML_REQUEST_TIME EML_RESPONSE_TIME average_response_time
... View more
03-22-2016
11:31 AM
Can you provide sample data ?
... View more
03-22-2016
11:28 AM
Can tell if it works with the complete _raw data, but I believe its possible.
... View more
03-21-2016
01:33 PM
Did you try with my last answer ?
... View more
03-21-2016
01:02 PM
I can see whats happening.
Try with this,
| rename "ENDPOINT_LOG.EML_REQUEST_TIME" as EML_REQUEST_TIME | rename "ENDPOINT_LOG.EML_RESPONSE_TIME" as EML_RESPONSE_TIME | eval average_response_time = strptime(EML_REQUEST_TIME, "%Y-%m-%d %H:%M:%S.%3N") - strptime(EML_RESPONSE_TIME, "%Y-%m-%d%H:%M:%S.%3N")
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
11-22-2024
07:49 AM
|
Karma given to
