Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- Find Answers
- :
- About asimagu
asimagu
Builder
Member since:
12-03-2012
06-05-2020
Community Statistics
| Posts | 250 |
| Solutions | 27 |
| Karma Given | 53 |
| Karma Received | 50 |
| Member Since | 12-03-2012 |
Activity Feed
- Got Karma for disk usage from the monitoring console does NOT match the reality. 01-07-2021 12:57 PM
- Karma Re: In a Splunk dashboard, how do you make the cell coloring range different for each row? for niketn. 06-05-2020 12:50 AM
- Karma Re: In a Splunk dashboard, how do you make the cell coloring range different for each row? for niketn. 06-05-2020 12:50 AM
- Got Karma for Re: In a Splunk dashboard, how do you make the cell coloring range different for each row?. 06-05-2020 12:50 AM
- Karma Has anyone Splunked Trello data? for David. 06-05-2020 12:48 AM
- Karma Re: Threat list download failed - palevo_ip_blocklist download failed after multiple retries for MuS. 06-05-2020 12:48 AM
- Karma Re: How to set loading order for panels? for woodcock. 06-05-2020 12:48 AM
- Karma Cisco eStreamer for Splunk: How to troubleshoot error in which eStreamer logs are not displayed in Splunk? for mohammed7860. 06-05-2020 12:48 AM
- Karma How to deal with datamodel retention period as summary range is not working for thambisetty_bal. 06-05-2020 12:48 AM
- Karma Re: How to deal with datamodel retention period as summary range is not working for thambisetty_bal. 06-05-2020 12:48 AM
- Karma Re: Why is geostats not showing data for all expected countries when the search finishes? for marina_rovira. 06-05-2020 12:48 AM
- Karma Re: Why is geostats not showing data for all expected countries when the search finishes? for marina_rovira. 06-05-2020 12:48 AM
- Got Karma for is it possible to create a new threat intelligence source with json format in Enterprise Security ?. 06-05-2020 12:48 AM
- Got Karma for Re: How to refer to JSON array object in a Splunk search?. 06-05-2020 12:48 AM
- Got Karma for Re: How to break events as Every Line. 06-05-2020 12:48 AM
- Got Karma for Re: How to break events as Every Line. 06-05-2020 12:48 AM
- Got Karma for Enterprise Security script exited abnormally status="exited with code 3". 06-05-2020 12:48 AM
- Got Karma for Enterprise Security script exited abnormally status="exited with code 3". 06-05-2020 12:48 AM
- Got Karma for Re: Why is the wrong value being extracted when using this regular expression?. 06-05-2020 12:48 AM
- Got Karma for Re: Why is the wrong value being extracted when using this regular expression?. 06-05-2020 12:48 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 2 |
05-27-2015
01:29 AM
1 Karma
hi guys
I have 2 different kind of events inside the same file. I am aware that I need to use a custom datetime.xml in order to recognize the timestamp of each sort of event. However it is not working for me.
These are the two kinds of events and I highlight in bold what should be recognized as the timestamp:
1081|2|20150512|436959|1660|0.00|1.00|0.00|4.5000|0|20
1081|2|436968|20150512|20150512|1336|1|1|000|0.00|0.00|3.20|5959|0034|G|0|20
This is what I coded in my new datetime.xml
<datetime>
<define name="_mc1" extract="year, month, day">
<![CDATA[^[^\|]*(\|[^\|]*)\|(\d\d\d\d)(\d\d)(\d\d)(\|[^\|]*){8}$]]>
</define>
<define name="_mc2" extract="year, month, day, hour, minute">
<![CDATA[^[^\|]*(\|[^\|]*){3}\|(\d\d\d\d)(\d\d)(\d\d)\|(\d\d)(\d\d)(\|[^\|]*){11}$]]>
</define>
<timePatterns>
<use name="_mc2"/>
</timePatterns>
<datePatterns>
<use name="_mc1"/>
<use name="_mc2"/>
</datePatterns>
</datetime>
and in my props.conf this is what I have:
[test]
SHOULD_LINEMERGE = false
MAX_EVENTS = 1
DATETIME_CONFIG = /etc/apps/testing/local/datetime.xml
TZ = Europe/Madrid
MAX_TIMESTAMP_LOOKAHEAD=100
any ideas why my code is not working??
... View more
02-16-2014
04:49 PM
these apps are all about scripted inputs, so the pc stats are usually extracted using scripts. You would need to check if those scripts change much from version to version (I suspect they don't) so all the standard dashboards should work
... View more
02-12-2014
06:39 PM
sorry, I assumed you knew how to create a field extraction. There are two ways: using the Manager or doing an inline extraction
Inline extraction, you need to pipe this in the search:
| rex field=_raw "<the regular expression from above"
Using the manager:
Create field extractions -> New Extraction -> Complete the form with the sourcetype and the regex from above
... View more
02-12-2014
06:32 PM
just edited the answer above, try that and let me know how it goes 😉
... View more
02-12-2014
06:06 PM
1 Karma
Just create your field extraction as usual. If you require any help with that we need to see a sample from your log. You can create several conditions for field extractions so two different formats is not a problem
about the stat you want: stats count by user
Edit:
Try this field extraction:
\d{4}\-\d{2}\-\d{2}\s\d{2}\:\d{2}\:\d{2}\s\-\s\w+\s\-\s\[(\d+\.){3}\d+\]\s(?P<user>[^\(]+)\(
... View more
02-02-2014
07:01 PM
if this worked for you, could you tick the answer as valid? thanks!
... View more
02-02-2014
06:59 PM
first of all you would need to specify something to extract in the regex, could we see some sample code in order to help you?
... View more
02-02-2014
06:55 PM
http://docs.splunk.com/Documentation/Splunk/6.0/Viz/PanelreferenceforSimplifiedXML#html
... View more
02-02-2014
06:52 PM
/static/app/ /
check this for an example
http://docs.splunk.com/Documentation/Splunk/6.0/Viz/PanelreferenceforSimplifiedXML#html
... View more
01-29-2014
06:25 PM
2 Karma
Yes, there is. you need to use an iframe and configure insecure login
If the website of my company we have a couple of demos so people can see Splunk working without logging in.
In order to have the iframe working you need to configure this in web.conf
x_frame_options_sameorigin = false
more info:
http://answers.splunk.com/answers/104277/iframes-and-views-broken-after-splunk-6-upgrade
... View more
01-27-2014
06:36 PM
hi guys
I was wondering if anyone has tried to change the background color of the panel where a single value is displayed, based on that single value.
It would be sort of what we can see in the Splunk Dashboards Samples app, with highlighting rows in a table. In this case I want to highlight the panel of just a single value, not a table.
thanks
... View more
01-21-2014
06:29 PM
1 Karma
I believe the maps app is still not showing compatibility with Splunk 6, you could swap the geoip command for the new iplocation command
http://docs.splunk.com/Documentation/Splunk/6.0.1/SearchReference/Iplocation
I hope that helps
... View more
01-14-2014
03:55 PM
your logic to compare is wrong, with Userid=email you are telling Splunk to look for events with the value "email" in the field Userid
I take Userid is a field and then email is another field, right?
If that's the case you would need something like this:
index="index1" OR index ="main" sourcetype="SessionCount" OR sourcetype="Identity" | table Userid email | where Userid=email
... View more
12-19-2013
12:45 PM
You have two easy options:
1 - Using inline field extractions. You will need to use the attribute max_match
For example | rex max_match=100 field=foo "........"
2 - Creating the automatic field extractions via the manager:
Create the field extraction ticking the option of "using transform", then create the transform ticking the box where it allows the field to be multivalue
I hope that makes sense, buddy
... View more
12-12-2013
02:43 PM
3 Karma
I think I coded myself something that works for me
By including this in the beginning of my script, it does the magic I expect it to do
SPLUNK_HOME= pwd | sed -n 's/\(.*splunk\).*/\1/p'
... View more
12-12-2013
11:16 AM
I'm afraid I cannot do that due to my company policy, plus I was not the one who developed it...
However feel free to send me an email or pm and I could give you the right contact in this company.
... View more
12-11-2013
06:21 PM
In my company we created an app that did that kind of thing. You need a little bit of Javascript and python in order to be able to do that 😉
... View more
12-11-2013
06:14 PM
You can easily do that by adjusting the line breaking in props.conf
Have a play with regular expressions and the options under "Attributes that are available only when SHOULD_LINEMERGE is set to true" in
http://docs.splunk.com/Documentation/Splunk/6.0/Data/Indexmulti-lineevents
... View more
12-11-2013
06:05 PM
Hi guys
I am trying to deploy an app that contains a scripts that uses the variable $SPLUNK_HOME
the issue comes when $SPLUNK_HOME is different on several servers, or even the variable has not been set at all.
is there any way of including the setting of a variable in a script?
any other approaches would also be appreciated
thanks
... View more
12-11-2013
05:48 PM
sorry, not sure I understand what you are after.
are you after a timechart that each days shows: Total Hits that day, Total Hits in the last 30 days, Unique Users that day, Unique users in the last 30 days ??
I mean, do you want to calculate the 30 day thing each day?
... View more
12-11-2013
05:31 PM
it may be a problem of $SPLUNK_HOME not having been set, therefore when the scripts tries to find that variable, it is not able to find it
... View more
12-09-2013
07:05 PM
I finally spotted the problem. It was the version of Firefox that I was using.... everything worked alright on Chrome
... View more
12-09-2013
07:02 PM
there can be several approaches, the overlay view with advanced XML as a complex solution and something easier depending on how flexible you are on how you want the data displayed.
I would try first by appending | addtotals to your timechart by product
Check out the command options in the documentation to make it work the way you want 😉
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:04 AM
|
Karma given to
