About thambisetty

thambisetty · ‎08-30-2020

are you still facing problem?

thambisetty · ‎08-30-2020

you can't do that. but you can write below in your search. | eval lookedup_val = if(isnull(lookedup_val),ip,lookedup_val) if you think, you can add this to props.conf, it won't work because first EVAL will be executed then Lookup configuration will be executed next. https://docs.splunk.com/Documentation/Splunk/8.0.5/Knowledge/Searchtimeoperationssequence

thambisetty · ‎08-29-2020

check below thread. https://community.splunk.com/t5/Splunk-Enterprise-Security/ES-notable-urgency-changing-for-old-notables/m-p/516527#M9186

thambisetty · ‎08-29-2020

Notable modular alerts actions values are not written to index=notable. To display severity or priority or urgency, Incident review will perform rest query to get values of correlation search and display in Incident review. However, I believe there is an option to overwrite severity from in-line search of correlation search. just add below line to your correlation search. | eval severity="informational/high/low"

thambisetty · ‎08-29-2020

There could be multiple logons and multiple logoffs for a single session but user may not aware of this (you could test this just by login and logoff in a minute). I am not sure why windows event logging is creating many. Logon_ID is unique ID to track starting and ending of session. The simplest way to identify duration between logon and logoff using Logon_ID would be something like below: index=windows EventCode IN (4624,4634,4647) | stats earliest(_time) as earliestTime latest(_time) as latestTime range(_time) as duration by user,host,Logon_ID | search user!=*$ | convert ctime("*Time") timeformat="%d/%m/%Y %T"

thambisetty · ‎08-29-2020

How much volume are you indexing per day? How many users you have? How many scheduled searches you have?

thambisetty · ‎08-29-2020

sourcetype=access_combined | eval action = if(isnull(action) OR action="", "Unknown", action) | bin _time span=40h | chart count over _time by action

thambisetty · ‎08-29-2020

index=someindex | eval qualdayOfWeek=strftime(_time, "%a") | rex field=_raw "is\s(?<status>(NO|YES))\sto" | eval sun=if(qualdayOfWeek="Sun", $status$, "-") | eval mon=if(qualdayOfWeek="Mon", $status$, "-") | eval tue=if(qualdayOfWeek="Tue", $status$, "-") | eval wed=if(qualdayOfWeek="Wed", $status$, "-") | eval thu=if(qualdayOfWeek="Thu", $status$, "-") | eval fri=if(qualdayOfWeek="Fri", $status$, "-") | eval sat=if(qualdayOfWeek="Sat", $status$, "-") | stats values(status) as status by email, sun, mon, tue, wed, thu, fri, sat

thambisetty · ‎08-29-2020

replicating 265 MB should not be a problem. can you check the connectivity of search peer in search head, settings -> Distributed search -> search peers. is status healthy?

thambisetty · ‎08-29-2020

The reason for consuming more memory, your query is collecting all matching events to search head. why don't you apply transforming commands after your base filters, this will reduce the number of results fetched from indexers to search head. https://docs.splunk.com/Splexicon:Transformingcommand

thambisetty · ‎08-29-2020

Yes, you can take.

thambisetty · ‎08-28-2020

you should pass something like below: | search earliest=“” latest=“” the format of earliest and latest is %m/%d/%Y:%H:%M:%S https://docs.splunk.com/Documentation/Splunk/8.0.5/SearchReference/SearchTimeModifiers

thambisetty · ‎08-28-2020

and also, share your props.conf confirm if there is timestamp in json logs printing from script.

thambisetty · ‎08-28-2020

Can you set all time range and Search with sourcetype and index given in inputs.conf

thambisetty · ‎08-28-2020

Any reason for adding below: send_index_as_argument_for_path can you remove that line and restart splunk service and check.

thambisetty · ‎08-28-2020

You should invoke script using splunk inputs.conf to collect events which are printed upon script execution. can you share inputs.conf which will call your script? if you don’t have created, create one like below: [script://./bin/yourscript.extension] index=<indexname> interval = <set frequency > sourcetype = <set sourcetype> https://docs.splunk.com/Documentation/Splunk/8.0.5/Admin/Inputsconf

thambisetty · ‎08-28-2020

Of course you can. First run your query as batch. Once results are returned, you can change to rising column and add query suggested in the db connect app. set checkpoint, in your case choose logon_time and date also login_time.

thambisetty · ‎08-28-2020

Send an email to [email protected] with your registered email.

thambisetty · ‎08-28-2020

Values should match in results and charting.fieldColors. below is the example: {"foo\: bar": 0xffff00, foo: 0xff0000, "foobar": 0x000000} Escape the following special characters in a key or string value with double quotes: []{}(),:" example in your case: <option name="charting.fieldColors">{"Complete":0x9BE8AB,"Cancelled":0xFF0000}</option> you can change color codes.

thambisetty · ‎08-28-2020

To use rising column option, your sql query results should have a column which will be incremented by 1 or timestamp. can you share header? identify the key column which will be changing when new record is inserted into table.

thambisetty · ‎08-27-2020

Great to hear that my answer solved your problem. Keep posting new questions.😊

thambisetty · ‎08-27-2020

| bin _time span=1d | stats count by column1,column2,column3_time | streamstats count by column1,column2,column3

thambisetty · ‎08-27-2020

python.version in inputs.conf and restmap.conf is introduced in Splunk version 8. Since you are running 7.3.5 , your Splunk Enterprise is not recognizing. You need to comment python.version in inputs.conf and restmap.conf to get rid of warnings.

thambisetty · ‎08-27-2020

host=machine EventCode=4608 OR EventCode=6005 OR EventCode=6006 | chart count over _time by EventCode click on visualization format option go to y-axis choose count as chart overlay.

thambisetty · ‎08-27-2020

If you are talking about Splunk cloud managed by Splunk team then You should create an app and share with Splunk cloud team by raising support case. App will go through vetting process once vetting is done, they will install app for you.

Posts	1137
Solutions	129
Karma Given	55
Karma Received	364
Member Since	‎03-27-2014

Online Status	Offline
Date Last Visited	‎07-14-2026 07:48 AM

Microsoft Office 365 Reporting Mail Add-on for Spl...

tenable add-on dest missing values

SPLUNK ES Notable Event Closure

Issue while downloading logs

Search is not running from JS

how to apply these trained data models to actual D...

getting econnreset error while trying to fetch azu...

Where does collect command indexes its result?

Query on Splunk certification

Is anyone using SPLUNK MLTK for windows events?

Re: Error: KV Store process terminated abnormally

Re: automatic lookup based on condition

Re: Why does modifying notable severity in Splunk ...

Re: ES notable urgency changing for old notables.

Re: Get login duration from WinEventLogs

Re: How to make Splunk effectively use hardwares?

Re: Unable to get field value wise segregation cou...

Re: Give results by email and days of the week on ...

Re: Problem replicating config (bundle) to search ...

Re: filter field that starts with certain alphabet...

Re: Classes & Certification

Re: time field search in load job not working

Re: Configuring outputs.conf for an "all in one" b...

Re: Configuring outputs.conf for an "all in one" b...

Re: Configuring outputs.conf for an "all in one" b...

Re: Configuring outputs.conf for an "all in one" b...

Re: Rising Column

Re: Need Certification ID/Certification URL

Re: Bar Chart Color change for dynamically changin...

Re: Rising Column

Re: Palo Alto Networks Add-on 6.3.1 upgrade on Spl...

Re: increment count in a field based on field valu...

Re: Palo Alto Networks Add-on 6.3.1 upgrade on Spl...

Re: correlate log collection with specific windows...

Re: Splunk cloud Dashboard - how to add a static i...

Join the Conversation