About chrisyounger

chrisyounger · ‎03-11-2019

This looks a bit crazy, but below is one way to do it. Paste it into a new dashboard. I am assuming you have some background knowledge of how to do HTML/CSS. Otherwise this will be very hard. <dashboard> <label>TestDashboard</label> <row depends="$hide_this$"> <panel> <html> <style> #background_table { background:url(https://i.imgur.com/ZodtLh7.jpg); } #background_table th, #background_table td, #background_table .table { background-color: transparent !important; } </style> </html> </panel> </row> <row> <panel> <table id="background_table"> <search> <query>|makeresults count=10 | eval value = random()</query> <earliest>-24h@h</earliest> <latest>now</latest> <sampleRatio>1</sampleRatio> </search> <option name="count">100</option> <option name="dataOverlayMode">none</option> <option name="drilldown">cell</option> <option name="percentagesRow">false</option> <option name="rowNumbers">false</option> <option name="totalsRow">false</option> <option name="wrap">true</option> </table> </panel> </row> </dashboard>

chrisyounger · ‎03-11-2019

You should check out this app: https://splunkbase.splunk.com/app/4403/ and its companion website here: https://github.com/splunk/mltk-algo-contrib All the best

chrisyounger · ‎03-11-2019

Both of these attempts should be correct to extract keys. I recommend KV_MODE = json becuase Splunk's strength is that its a search-time platform. If its doing the nice formatting, then that means its valid JSON. Might be worth using btool to check the sourcetype is definitely KV_MODE = json

chrisyounger · ‎03-11-2019

Yes you are absolutly right. Better to use fields over table

chrisyounger · ‎03-11-2019

You can use * with table and it will do it in ascii order: e.g. |table * (but this might have fields you need to remove with |fields - ) or |table Date Inc* All the best

chrisyounger · ‎03-11-2019

Not that I am aware of, but you should take a close look at Splunkbase. This is kinda what you need to do but it doesn't track errors: https://splunkbase.splunk.com/app/1539/#/details and boomerang is an abandoned project now.

chrisyounger · ‎03-11-2019

Ignore my other answer, I see you need to carry the time forward not backwards. Try this: | streamstats window=1 current=f last(_time) as prevTime last(GREEN) as prevGREEN last(YELLOW) as prevYELLOW last(RED) as prevRED | eval duration = _time - prevTime | table prevTime prevGREEN prevYELLOW prevRED duration

chrisyounger · ‎03-11-2019

Try this: | streamstats window=1 current=f last(_time) as prevTime | eval duration = _time - prevTime Hope this helps

chrisyounger · ‎03-11-2019

You can actually use btool with the --dir option to run it against apps in different locations https://docs.splunk.com/Documentation/Splunk/7.2.4/Troubleshooting/CommandlinetoolsforusewithSupport#btool

chrisyounger · ‎03-11-2019

"earliest" is not special value for either the REST API or normal search. As such, what happens when you do a search with that is that it will look for any records that have that exact key and that exact value. If you are on an older version of Splunk, the default will be "all time" and it will be very slow. If you are using the REST API? The documentation here lists the valid keys: https://docs.splunk.com/Documentation/Splunk/7.2.4/RESTREF/RESTsearch#search.2Fjobs (expand [POST]) All the best

chrisyounger · ‎03-11-2019

Just use eventstats instead of stats index=x | eventstats count (oneOfTheFieldNames) AS Total

chrisyounger · ‎03-11-2019

Does this do what you need? index=indexA OR index=indexB | stats values(rel) as Release values(app-id) as "App-id" by ip | rename ip as IP

chrisyounger · ‎03-11-2019

You can use the relative_time function in eval like so: index=mlbso sourcetype=ISP_abaptraces ( mtx OR mmx OR mm_diagmode OR sigigenaction OR thierrhandle OR mutex OR "ca blocks" ) AND (WARNING OR ERROR) earliest=-90d@d latest=now | rename comment AS "1.) ------------------------- SPL Search string based on the expert domain knowledge --------------------------" | rex field=_raw "^(?<firstLine>.*)\n.(?<remainingLines>[\s\S]*)$" | eval text=replace(remainingLines,"\d{0}\d+","") |rename comment AS "2.) ------------------------- Pre-parsing: get rid of first line with date / time and the digits ---------------" | anomalies field=text | rename comment AS "3.) ------------------------- Anomalies -----------------------------------------------------------------------" | table _time _raw text unexpectedness | sort 3 -unexpectedness | cluster field=text | eval time_ago_24 = relative_time(now(), "-24h") | where _time > time_ago_24

chrisyounger · ‎03-11-2019

Does this do what you need: index=appweec sourcetype=dxejje host=* |stats p90(CURDEPTH) AS "QueueDepth" p90(MSGAGE) as "MessageAge" by QUEUE _time where (QUEUE=MESSAGE.ACTION.Q QueueDepth > 1200 MessageAge > 400) OR (QUEUE=INCOMING.MESSAGEACTION.WIN.SYSLOW.Q QueueDepth > 0 AND MessageAge > 0)

chrisyounger · ‎03-10-2019

Could be a few things: - Did you specify an index? If so when you run the search you will need to specify it as index=whatever to see your data. Alternativly in access_controls you can configure it to search that index by default. - Is there a firewall on the box? Make sure its not blocking traffic to your port. All the best

chrisyounger · ‎03-07-2019

Because _time is a special field, you will need to do this: index=app sourcetype=mq_metric host=prod* QUEUE=DEAD.LETTER.Q OR MESSAGE.ACTION.Q |stats p90(CURDEPTH) AS "Queue Depth" p90(MSGAGE) as "Massage Age" by QUEUE, _time | stats max(*) AS * max(_time) as _time |table _time,QUEUE,"Massage Age","Queue Depth"

chrisyounger · ‎03-07-2019

The dashboards are from this app: https://splunkbase.splunk.com/app/3564/ Azure template app.

chrisyounger · ‎03-07-2019

Well as long as the times are exactly the same, this should work: index ABC OR index XYZ |stats latest(CRUD) as CRUD latest(action) as action latest(sessionkey) as sessionkey by _time name

chrisyounger · ‎03-07-2019

You need to do it like this: eventtype=RAS AND (EventCode=20272) AND ConnectionID!="NA" AND UserID="XYZ" | dedup ConnectionID | bucket _time span=1mon@mon | stats sum(Data_Sent) as Monthly_Total_Sent stdev(Data_Sent) as Monthly_Sent_Stdev by _time UserID | eval 'Monthly_Avg_Sent(MB)'=round(Monthly_Avg_Sent/(1024*1024),2), 'Monthly_Sent_Stdev(MB)'=round(Monthly_Sent_Stdev/(1024*1024),1),'Abnormal_Sent_Limit(MB)'= 2 * 'Monthly_Sent_Stdev(MB)' + 'Monthly_Avg_Sent(MB)' As a general rule, its a good idea to keep your field names very simple. and then just rename to proper names at the very end. That way you don't need to worry about single quoting fields.

chrisyounger · ‎03-07-2019

Does it happen even if you leave the tab in the foreground? These days browsers like Chrome aggressively throttle backgrounded tabs. This can cause the real-time search to think you have closed the window and it will auto-cancel the search. I was able to just replicate this with a lot of tabs open and backgrounding the tab for 30 seconds. There are workarounds you can do to Chrome to prevent this behaviour.

chrisyounger · ‎03-07-2019

I am not sure if this is the exact problem you are haivng, but if it really did work before and now doesn't you are probably having this problem: The behaviour of field alias changed. See this thread for more detail: https://answers.splunk.com/answers/693737/splunk-720-field-aliases-incorrect-behavior.html You can use coalesce to fix the problem. I can't see this tracked as a known issue, but I have a feeling it will be corrected soon (maybe?)

chrisyounger · ‎03-07-2019

Does this work: | tstats summariesonly=true allow_old_summaries=true count from datamodel=Authentication.Authentication where Authentication.action="failure" by Authentication.user | append [| tstats summariesonly=true allow_old_summaries=true values from datamodel=Authentication.Authentication where Authentication.action=failure by _time Authentication.user Authentication.src Authentication.dest Authentication.app] | `truncate_name("Authentication")` | eval Time = strftime(_time, "%d-%b-%Y %H:%M:%S") | stats values(Time) as Time values(app) as "App" values(dest) as "Destination" values(src) as "Source" sum(count) by user | rename user AS User | sort -Time

chrisyounger · ‎03-07-2019

make sure you set disabled=0

chrisyounger · ‎03-07-2019

What about this: |makeresults | eval _raw = "X Mon Mar 4 19:57:48:935 2019 X *** WARNING => MMX 'EGPH5': mm_diagmode set 0 118: possible performance degradation #102400" | rex mode=sed field=_raw "s/\d+//" |rex mode=sed "s/^(.*?)\*+//g"

chrisyounger · ‎03-07-2019

Yes you can install the Splunk_TA_Nix on Debian. Follow the instructions here: http://docs.splunk.com/Documentation/AddOns/released/UnixLinux/About This will allow you to monitor the system health. You don't need this app to monitor apache logs though. All the best.

Posts	526
Solutions	132
Karma Given	112
Karma Received	189
Member Since	‎06-12-2018

Online Status	Offline
Date Last Visited	8 hours ago

Filter events on UF

Changing formatter.html without restarting splunk

Re: How can I check the CPU utilization of the SH ...

Limit on number of Services in ITSI

Colors for visualisation

Re: How to apply background image for table visual...

Re: How to add a Machine Learning algorithm in spl...

Re: How to extract keys and values from the JSON d...

Re: How to sort the column names alphabetically at...

Re: How to sort the column names alphabetically at...

Re: Does Splunk have API or utilities to store UI ...

Re: How to compute for duration between two consec...

Re: How to compute for duration between two consec...

Re: How do you run btool check against all apps in...

Re: 'earliest': '03/09/2019:17:07:00' is signific...

Re: How do I perform a stats count(fieldname) with...

Re: How to populate column in results using two in...

Re: How to select yesterdays date from the followi...

Re: How to use 'where' command in multiple places?

Re: Why is host missing from Search?

Re: How to add the _time failed in the output.

Re: Bad Request for url: https://management.azure....

Re: How do you correlate events from two different...

Re: How do you add the average and the standard de...

Re: Why does my real time search job keeps getting...

Re: Field extractions aren’t working as expected s...

Re: Put stats(values) and stats(count) in the same...

Re: Could i Install Splunk_TA_nix on debian?

Re: Help with regex / replace needed

Re: Could i Install Splunk_TA_nix on debian?

Join the Conversation