Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- About asimagu
asimagu
Builder
Member since:
12-03-2012
01-27-2026
Community Statistics
| Posts | 250 |
| Solutions | 27 |
| Karma Given | 53 |
| Karma Received | 50 |
| Member Since | 12-03-2012 |
Activity Feed
- Got Karma for disk usage from the monitoring console does NOT match the reality. 01-07-2021 12:57 PM
- Karma Re: In a Splunk dashboard, how do you make the cell coloring range different for each row? for niketn. 06-05-2020 12:50 AM
- Karma Re: In a Splunk dashboard, how do you make the cell coloring range different for each row? for niketn. 06-05-2020 12:50 AM
- Got Karma for Re: In a Splunk dashboard, how do you make the cell coloring range different for each row?. 06-05-2020 12:50 AM
- Karma Has anyone Splunked Trello data? for David. 06-05-2020 12:48 AM
- Karma Re: Threat list download failed - palevo_ip_blocklist download failed after multiple retries for MuS. 06-05-2020 12:48 AM
- Karma Re: How to set loading order for panels? for woodcock. 06-05-2020 12:48 AM
- Karma Cisco eStreamer for Splunk: How to troubleshoot error in which eStreamer logs are not displayed in Splunk? for mohammed7860. 06-05-2020 12:48 AM
- Karma How to deal with datamodel retention period as summary range is not working for thambisetty_bal. 06-05-2020 12:48 AM
- Karma Re: How to deal with datamodel retention period as summary range is not working for thambisetty_bal. 06-05-2020 12:48 AM
- Karma Re: Why is geostats not showing data for all expected countries when the search finishes? for marina_rovira. 06-05-2020 12:48 AM
- Karma Re: Why is geostats not showing data for all expected countries when the search finishes? for marina_rovira. 06-05-2020 12:48 AM
- Got Karma for is it possible to create a new threat intelligence source with json format in Enterprise Security ?. 06-05-2020 12:48 AM
- Got Karma for Re: How to refer to JSON array object in a Splunk search?. 06-05-2020 12:48 AM
- Got Karma for Re: How to break events as Every Line. 06-05-2020 12:48 AM
- Got Karma for Re: How to break events as Every Line. 06-05-2020 12:48 AM
- Got Karma for Enterprise Security script exited abnormally status="exited with code 3". 06-05-2020 12:48 AM
- Got Karma for Enterprise Security script exited abnormally status="exited with code 3". 06-05-2020 12:48 AM
- Got Karma for Re: Why is the wrong value being extracted when using this regular expression?. 06-05-2020 12:48 AM
- Got Karma for Re: Why is the wrong value being extracted when using this regular expression?. 06-05-2020 12:48 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 2 |
05-12-2017
06:08 AM
hi @adonio, the nix app is giving me the same results as the df -h command. The DMC gives a different value
... View more
05-12-2017
06:03 AM
hi @adonio
thanks for your help. I always thought that it didn´t matter where the df command was run.
it gives me the same result no matter where I am in the fylesystem....
... View more
05-09-2017
07:13 AM
2 Karma
hi fellas
I am experiencing an unexpected behavior when trying to monitor disk usage. Hopefully you can explain why this is happening
In the built-in dashboard "Resource Usage: Instance" in the DMC I am checking the disk usage of my indexers and then I am comparing those figures with the output of the df command.
This is what I get:
In the DMC:
host A Disk Usage: 2768.56 / 8400.31 (GB)
host B Disk Usage: 3429.27 / 8400.31 (GB)
While "df -h" gives me these:
host A Disk Usage: 2.7 T / 8 T
host B Disk Usage: 2.6 T / 6.4 T
As you can see, the numbers especially for host B, do not match at all.
any ideas about what must be happening???
... View more
04-13-2017
05:42 AM
I think you need to set up the indexers as peers in the DMC instance first because you will be searching the _introspection index when you use the DMC dashboards.
Then later you need to register the indexer nodes as well as the cluster master in the DMC settings. Pick the right server role from the list
https://docs.splunk.com/Documentation/Splunk/6.5.3/DMC/Configureindistributedmode
... View more
04-13-2017
04:38 AM
http://docs.splunk.com/Documentation/Splunk/6.5.3/DistSearch/Configuredistributedsearch
also, take a look at this other answer: https://answers.splunk.com/answers/496043/splunk-configuration-for-search-head-indexer-and-f.html
... View more
04-13-2017
04:31 AM
you could try something with streamstats maybe?
host=$field1$ sourcetype=fgt_traffic "user=" service=HTTPS (app=dropbox OR app=slack OR app=trello OR app=hightail OR app=icloud OR app=box OR app=evernote OR app=salesforce OR app=google*docs OR app=google*drive OR appcat="Storage.Backup" OR appcat=Collaboration NOT "Microsoft" NOT "Skype" NOT "OneDrive" NOT "Wikipedia")
| streamstats sum(BytesOUT_to_Megabytes) as Total by user
| stats sum(BytesOUT_to_Megabytes) as "MB Sent" max(Total) as Total by user,app
... View more
04-10-2017
02:38 AM
2 Karma
hi there, yes, that is correct.
However the stanza name should not be an index name but a sourcetype name.
Also, you could use
SHOULD_LINEMERGE = false
more info here: http://docs.splunk.com/Documentation/Splunk/6.5.3/Admin/Propsconf
... View more
04-07-2017
07:07 AM
The batch input is a bulk "download" of the table entries while the Rising Column is an "incremental" download, that´s why a combination of the two is usually configured. You start y creating a batch input and then the Rising Column one
... View more
04-07-2017
02:12 AM
Hi Lisa, thanks for your help.
I understand currently there is no json parser built into the Threat Intelligence Framework in Splunk ES and that I would need to create a custom TA to fetch the data from a url and then normalize the fields according to the CIM. Then the data would get indexed in Splunk and I would need to create some saved searches to create a KVStore lookup or CSV lookup that the Threat Intelligence Framework already monitors.
did I get it right??
... View more
04-06-2017
05:23 AM
1 Karma
Hey gents
My customer is asking me to create a new threat intelligence source in the Enterprise Security app (version 4.5.1.)
He told me that he is going to provide an .ioc file with the fields and values in json format.....
This is my first time doing this and I am not quite sure it can be done as I have read everywhere that ioc files come in xml format, not json....
could you guys confirm this?? any word of advise I could use?
thanks a lot
... View more
04-05-2017
01:50 AM
To upgrade Splunk, you never need to uninstall it and reinstall it again. That's why it´s called an upgrade 😉
First, I would check the list of installed packages.
If you're running Ubuntu 14:
apt list --installed
For older versions:
dpkg --get-selections | grep
If you are running other systems, just try to locate the right commands.
I would also try to make sure that you don´t have any other splunk instances in that machine.
... View more
04-04-2017
02:28 AM
hey somesoni2
in the second appendpipe, when you calculate the totals, I think you are also including the figures from the first appendpipe, and then the final figure is wrong.
... View more
03-28-2017
01:27 AM
Support Case: 465446
... View more
03-28-2017
01:02 AM
I finally opened the Support Case: CASE [465439]
... View more
03-24-2017
02:14 AM
1 Karma
You cannot take directly the exam. You need to do the required courses first.
For Power User Certification these are the courses:
- Using Splunk
- Searching and Reporting with Splunk
- Creating Splunk Knowledge Objects
- Splunk Infrastructure Overview (eLearning)
You can check prices and info about all the course in the Splunk Education site: https://inter.viewcentral.com/Events/cust/catalog.aspx?cid=splunk&pid=1
Check the Calendar section for incoming courses and the prices
you can always send an email to [email protected]
... View more
03-21-2017
06:51 AM
could you doublecheck the format of your fields to be numeric?
... View more
03-20-2017
08:03 AM
I will try that once they give me access to open support cases. (I'm new here)
... View more
03-20-2017
07:09 AM
4.5.1
is it possible that when someone upgraded the app, forgot to do any manual steps??
... View more
03-20-2017
02:08 AM
are these lines the ones that I should delete/comment from my config file??
## Prevent correlation search list from being replicated via distsearch
## per SOLNESS-6255 these are no longer in use but will continue to be excluded
nocorrelationsearches = apps[/\\]SA-ThreatIntelligence[/\\]lookups[/\\]correlationsearches.csv
... View more
03-17-2017
07:44 AM
This particular data model (Risk Analysis) that comes with Splunk Enterprise Security is failing to build due to a calculated field that generates from the correlationsearches_lookup.
I believe that the problem lies in the replication bundle not being able to copy/sync from the Search Heads to the Indexers.
So, when I try to use that lookup from the SH, it gives me the following error from each Indexer:
Streamed search execute failed because: Error in 'lookup' command
any ideas about how I could fix the problem with the bundle being transferred from Search Head to Indexers?
... View more
03-17-2017
04:23 AM
is this what you were after??
| rest /services/apps/local | table title version
... View more
03-17-2017
04:11 AM
You could also take a look at this command: makemv
First, you could extract your field as single value with all the commas and then use makemv to convert it to multivalue
| makemv delim="," <yourfieldname>
http://docs.splunk.com/Documentation/Splunk/6.5.2/SearchReference/Makemv
... View more
03-17-2017
04:01 AM
Hi dwear
The wizard will not help you with multivalue fields. You need to play with props.conf and transforms.conf
An alternative using the UI would be:
1- Create the extraction with the wizard and copy the regular expression it generates to get your first value
2- Go to Fields -> Create a Tranform
3- Go to Fields -> Create a Field extraction "based on a transform" (the one you just created)
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
01-27-2026
10:31 AM
|
Karma given to
