About hartfoml

hartfoml · ‎01-26-2012

That was the answer... howd you get so smart 🙂

hartfoml · ‎01-26-2012

I have an event field called `LastBootUpTime=20120119121719.125000-360' I am trying to convert this to a more readable format by using this convert command | convert timeformat="%m-%d-%Y %H:%M:%S" ctime(LastBootUpTime) AS BootTime this is not working. What am I missing??

hartfoml · ‎01-20-2012

Used the SoS app This app will show you S.o.S - Splunk on Splunk > Metrics > Incoming Network Throughput this shows the network data comeing into splunk on what ports After checking with my lunix admin and looking in SoS I confrunted the firewall guy and they did not make the change requiered.

hartfoml · ‎01-20-2012

here is the short answer Splunk> Manager » Apps » windows » Permissions select "all apps" at the lower left corner of the GUI MODERATOR EDIT: this issue is fixed in version 4.5.1 of the app, available now on Splunkbase.

hartfoml · ‎01-20-2012

Here is the long answer from support it seems that the default.meta for the Windows app includes an entry for [props] being exported system wide. In other words the props configurations which refer to the lookup tables are made Global, thus reference-able by all apps, however the lookups are not. The solution would be to either make the Windows app Global under App permissions OR make all the lookup table files Global under Manager/Lookups OR edit local.meta under etc/apps/windows/metadata and enter: [props] export = none

hartfoml · ‎01-20-2012

here is the short answer Splunk> Manager » Apps » windows » Permissions select "all apps" at the lower left corner of the GUI

hartfoml · ‎01-20-2012

Thanks I really appreciate the help Now I need to read up on how to implement forms I got you code. I'll let you know if I can figure out how to implement it. Mike H.

hartfoml · ‎01-20-2012

I am monitoring the CPU use of the Splunk UF using WMI on my windows systems I have this search; source="WMI:LocalProcesses" Name=splunkd host="SYS20"| bucket _time span=1h | stats avg(PercentProcessorTime) AS "Average % CPU" by _time this lets me see the Splunk UF CPU use over time for "sys20" I can make this a dashboard without a problem. My question is how do I make a dashboard with a pull-down list of "system names" and "Search time" so that I can make the dashboard available for system owners so they can see how much of the CPU resource Splunk is using on there system. I have been using Splunk for 1 1/2 years and am at version 4.3 but I am not a developer. Any help would be great.

hartfoml · ‎01-18-2012

The lookup table 'wmi_version_range_lookup' does not exist. It is referenced by configuration 'WMI:Version' The lookup table 'windows_vendor_info_lookup' does not exist. It is referenced by configuration 'source::*:System' Any ideas what this means

hartfoml · ‎01-18-2012

I asked my Firewall admin to change the port for syslog to the Splunk indexer. He changed it from 514 to 1514. He said he made the change but I am not seeing the incoming log data. I'm sure the indexer host firewall port is open. Where would I go to see what data is coming in on what port? Does splunk tag the data with the indexer connection information?

hartfoml · ‎01-12-2012

This is the real answer. thanks this fixed the issue. you are a regex guru. thanks again

hartfoml · ‎01-11-2012

OK I think I understand well not relay So if I want to use case to get a variable named siteName and I have three possible sites identified by three possible IP’s I would normally use this '| eval siteName = case (Destination_IP == "199.47.”, dropbox.com, Destination_IP == “85.17.30.", megadownload.net, Destination_IP == "195.122.131.*", rapidshare.com)' But this isn’t working and the multiple matches are not working. Do you have any other suggestions for CASE

hartfoml · ‎01-11-2012

Opps the match doesn't seem to work in case '| eval siteName = case(match(Destination_IP, "^199.47..$"), "dropbox.com",match(Destination_IP, "^85.17.30.$"), "megadownload.net",match(Destination_IP, "^195.122.131.*$"), "rapidshare.com")'

hartfoml · ‎01-11-2012

HURA you are brilliant thanks

hartfoml · ‎01-11-2012

Here is what I am using: | eval siteName = case (Destination_IP == "199.47.*", dropbox.com) I have tried everything and it is not working. Do you think it is because of the numbers "199.47.*"?

hartfoml · ‎01-04-2012

Thats it thanks this works

hartfoml · ‎01-04-2012

I am doing a monitor file input of a nessas scan data files. Splunk reads the files in as one event per line. The report on each system scaned is between the following to tags in the data file <ReportHost name="xxx.xxx.xxx.xxx"> </ReportHost> there can be as many as 3 or 4 hundred lines between these tags I have two questions 1) What is the best way to put the data into splunk so that all the "ReportHost" info is together for searching reporting on each system? 2) how do I get the multi event information already in the splunk index together into one event for each ReportHost so that I can use the existing data to develop reports?

hartfoml · ‎12-27-2011

Thanks that did it

hartfoml · ‎12-27-2011

I am using this search to get license use over 30 days index="summary_indexers" | timechart partial=f span=1d sum(kb) as KB | eval gb=round(KB/1048576,1) | convert timeformat="%A - %m/%d" ctime(_time) AS DATE | table DATE gb This gives ma b bar chart with one bar per day. I would like to put a RED SLA line at the license limit so that the managers can clearly see where the License SLA will be violated and how close we are to that line.

hartfoml · ‎12-21-2011

I am using this rex command | rex max_match=100 "(?i)<severity>(?P<Severity>[^<]+)" When I add this to the props.conf like this EXTRACT-Severity = max_match=100 (?i)<severity>(?P<Severity>[^<]+) I get no return at all If I use this in the props.conf EXTRACT-Severity = (?i)<severity>(?P<Severity>[^<]+) I only get the first return in the event not all the other possible returns in the event Can anyone help with this rex conversion to props.conf

hartfoml · ‎12-20-2011

I have a dashboard with multiple graphs based on the WMI info from one system. I am putting the WMI info in a selected index and only the systems that I am monitoring with the specific WMI counters are in that index. I would like to change all the searches in search graphs in the dashboard by selecting a host name from a pull down list. I am on version 4.2.5 do I need to have a developer do this or do I have to wait till 4.3 comes out to get this kind of dashboard functions as a beginner.

hartfoml · ‎12-15-2011

Great this is exactly what I needed. If it's not too much trouble can you post the unzip code you used. Thanks ever so much. I am using Founstone too and want to get the scan data directly without the operator having to uncompress the reports.

hartfoml · ‎12-15-2011

I am haveing the same issue. Did you ever find a salution?

hartfoml · ‎12-14-2011

Using the max_match= I get all three but not with the (?im)

hartfoml · ‎12-14-2011

As you can see by the sample shows up three times in the same event

Posts	584
Solutions	20
Karma Given	37
Karma Received	122
Member Since	‎10-05-2010

Online Status	Offline
Date Last Visited	‎06-05-2020 02:02 AM

Host name not showing correctly

Why is Splunk Web limited to 50 users when using S...

How to use timechart and streamstats

how to troubleshoot role restriction presidence

How to force retention time pruning

how to convert dbquery search to dbxquery search

Can a RHEL Universal Forwarder be installed on a R...

Splunk TA for Solaris 11: How to get the Solaris l...

Can I manualy create "_telemetry" index on older v...

What permissions can I give a role that will allow...

Re: Convert TimeFormat

Convert TimeFormat

Re: Syslog from Firewall issue

Re: 4.3 upgrade issues

Re: 4.3 upgrade issues

Re: 4.3 upgrade issues

Re: Dynamic Dashboard

Dynamic Dashboard

4.3 upgrade issues

Syslog from Firewall issue

Re: Having Trouble With CASE

Re: Having Trouble With CASE

Re: Having Trouble With CASE

Re: Having Trouble With CASE

Having Trouble With CASE

Re: NESSUS Scan digest

NESSUS Scan digest

Re: SLA Line on Chart

SLA Line on Chart

REX not working in props.conf

Dashboard Help

Re: Splunk fails to monitor zip file

Re: Splunk fails to monitor zip file

Re: REX for HTML

Re: REX for HTML

Are you a member of the Splunk Community?