×

Join the Conversation

Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
Ask a Question
skoelpin
SplunkTrust
Member since: ‎01-02-2015
3 weeks ago
Community Statistics
Posts 1911
Solutions 211
Karma Given 616
Karma Received 446
Member Since ‎01-02-2015
Activity Feed
Topics I've Started
View All

Re: Multiple source types to a single listner

by SplunkTrust in Getting Data In
‎07-31-2015 11:33 AM
‎07-31-2015 11:33 AM
Glad I could help! Can you clarify your question? You need a Splunk forwarder (usually a universal-forwarder) to forward data to your splunk indexer which makes it available in the GUI. The universal forwarders are light weight and use little resources on a server So if you don't have a forwarder on a server then it will not make it into Splunk, unless you directly upload it.. ... View more

Re: Multiple source types to a single listner

by SplunkTrust in Getting Data In
‎07-31-2015 11:19 AM
1 Karma
‎07-31-2015 11:19 AM
1 Karma
You can do both. You can have multiple source-types forwarding to the same index. You define what index they go on the server with the forwarder $Splunk_Home/etc/system/local inputs.conf [sourcetype1] index = indexName [sourcetype2] index = indexName2 If you don't specify an index in your inputs.conf then it will default to index=main ... View more

Re: How to extract the OS and Browser from a user ...

by SplunkTrust in Splunk Search
‎07-31-2015 06:43 AM
‎07-31-2015 06:43 AM
Excellent suggestion. I'm doing a project related to this and this also solves a secondary problem I have... When users interact with the dashboard, they won't have to know what Windows NT 6.1 is, they can just see Windows 7 ... View more

Re: How to extract the OS and Browser from a user ...

by SplunkTrust in Splunk Search
‎07-30-2015 10:29 AM
‎07-30-2015 10:29 AM
Do 2 separate field extractions.. One for your browser and the other for the OS.. (?P<OSextraction>(?<=Mozilla\/\d\.\d).*(?=)) answers.splunk.com is not allowing the full regular expression to be posted for some reason.. Put < > before and after OSextraction I haven't tested this but it should work.. If not then send a few more lines of sample data and I'll fix it up ... View more

Re: How to get time duration between consecutive e...

by SplunkTrust in Splunk Search
‎07-30-2015 10:18 AM
‎07-30-2015 10:18 AM
Can you provide us your query and some sample data? You need to group the events together using the Transaction command.. So if you have your eventStart as a seperate event from your eventFinish then the transaction command will group them both as 1 event then you can find the duration So it would look something like this .. | transaction startswith="eventStart" endswith="eventFinish" | timechart avg(duration) ... View more

Does Splunk Index Everything on the Server?

by SplunkTrust in Getting Data In
‎07-29-2015 12:52 PM
‎07-29-2015 12:52 PM
I have 3 servers which process web service calls and are being indexed by Splunk. I specified their index in the inputs.conf on the forwarder as index=uvtrans and their sourcetype is ATG_Message_Log .. So now I see in Splunk 2 different sources coming in named WinEventLog.Application and WinEventLog.System which are in index=main which means their index was not specified on the forwarder so it defaults there. I'm looking in Splunk_Home/etc/system/local/inputs.conf on all 3 boxes and I do not see anywhere where WinEventLog is located. I've looked through all the conf files and cannot find it. Does Splunk index EVERYTHING on that server regardless if it's been specified in my conf files? How can I exclude the WinEventLog sources from being indexed by Splunk? ... View more

Re: How to exclude a sourcetype from being indexed...

by SplunkTrust in Getting Data In
‎07-29-2015 12:44 PM
‎07-29-2015 12:44 PM
I just looked at the 3 hosts which have the WinEventLog:Application and these are being indexed in index=main while my legitimate events are being indexed in the index I specified in the inputs.conf file.. So maybe this would explain why I can't find it.. But why is data being indexed if I didn't specify the source or sourcetype in the inputs.conf? ... View more

Re: How to exclude a sourcetype from being indexed...

by SplunkTrust in Getting Data In
‎07-29-2015 12:29 PM
‎07-29-2015 12:29 PM
Should I do this on the Indexer or forwarder? ... View more

Re: How to exclude a sourcetype from being indexed...

by SplunkTrust in Getting Data In
‎07-29-2015 07:46 AM
‎07-29-2015 07:46 AM
Yeah I have that pulled open and the sourcetype is already defined as sourcetype=ATG_Message_Log .. I see nothing on any of the boxes which show the source or sourcetype as WinEventLog:Application ... View more

How to exclude a sourcetype from being indexed?

by SplunkTrust in Getting Data In
‎07-29-2015 07:24 AM
‎07-29-2015 07:24 AM
I have a forwarder on 3 different servers which grabs all the data coming from those servers. There is 1 specific sourcetype and source both called 'WinEventLog:Application' which we do not want indexed. Where in the forwarder do I exclude this source/sourcetype from being indexed? ... View more

Re: How To Accelerate a Search?

by SplunkTrust in Reporting
‎07-22-2015 11:07 AM
‎07-22-2015 11:07 AM
I see what you're saying, it would be much faster to take a chunk from the large pool then do a transaction which is much slower across that smaller pool to make the search faster. *The token I used in my form which is also in my search is the $ip$ and your search example says to include this in the index=access subsearch.. When I defined the token in my form input, it was taken from the RTG_IPmain which is from the main index. Can you help with making my search work correctly? This is what I have so far ( I stripped off the sort and renames to make it easier to read) (index=access OR index=main) [search index=access | stats count values(RTG_Browser) values(RTG_WebRequest)] | transaction RTG_JSession | search $ip$ | stats count values(RTG_Browser) values(RTG_WebRequest) BY RTG_IPmain | table RTG_IPmain RTG_WebRequest RTG_Browser ... View more

Re: How To Accelerate a Search?

by SplunkTrust in Reporting
‎07-22-2015 09:17 AM
‎07-22-2015 09:17 AM
I like your thinking on this and I agree. The transaction command is killing my performance, but it looks like you have a subsearch then pipe that output into the transaction command. Wouldn't a subsearch kill the performance just like having the Transaction command at the beginning? ... View more

Re: How To Accelerate a Search?

by SplunkTrust in Reporting
‎07-22-2015 09:10 AM
‎07-22-2015 09:10 AM
Thanks for the input martin_mueller. I've done some reading and I saw that it's not possible to accelerate a search that has a non-streaming command followed by a streaming command which in my case is the Transaction command followed by the Stats command. Can you please clarify what you meant in the second part of you sentence? Did you mean where did I put the token from my form input into my search? If so then it's that search RTG_IPmain=* right after the Transaction command. ... View more

Re: How To Accelerate a Search?

by SplunkTrust in Reporting
‎07-22-2015 09:05 AM
‎07-22-2015 09:05 AM
Yes very close to what I'm doing. First it will search both indexes and group events that have the same JSession ID. It will then return the events. The events returned will have the true client IP from index=main with the Web Request and Browser from index=access within 1 event. So basically combining events from multiple indexes. The Jsession ID is only used to match events together which may not have the same IP Address ... View more

Re: How To Accelerate a Search?

by SplunkTrust in Reporting
‎07-22-2015 06:14 AM
‎07-22-2015 06:14 AM
Hello Iguinn, thanks for the reply. Let me explain what I'm trying to do and maybe there's a better way to go about it. I'm working on a click fraud project for the marketing group. We need to identify what web requests and browser come from a true clients IP and if they are committing click fraud. I have 2 indexes (main and access). The main index has the true client IP while the access index has the IP located in the Browser header which may not be the true client IP. The access index has the web request info, Browser and the JSession ID. So I had to create a table which would show the true clients IP address from index=main and the other info which came from index=access. So since both indexes has one thing in common (JSession ID) I tied them together with a transaction command and showed results from both indexes. So now since the marketing people who will need to detect click fraud have zero Splunk knowledge, I made a dashboard where they can enter the IP Address or Web Request into a search box and the table will filter all results which include whatever the user entered. ... View more

How To Accelerate a Search?

by SplunkTrust in Reporting
‎07-21-2015 11:35 AM
‎07-21-2015 11:35 AM
I have search inside a dashboard which shows a table of IP Address | JSession Count | Browser | Web Request .. I have well over a million rows within my table and I included a search box which the user will search for an IP and it will return the other data I listed above from the table. Now I need to accelerate this process so the historical data is cached and can be loaded up quickly. I tried turning my search into a report and accelerating it but got the " Your report doesn't qualify for acceleration" message.. I removed the timerange picker and tried again and got the same message. The only thing I can think of is, that it's due to not having a transform command, but I am confused as I have a STATS command in my search. If all else fails can I accelerate the data model? Here's my search index=access OR index=main | transaction RTG_JSession | search RTG_IPmain=* | table RTG_IPmain RTG_WebRequest RTG_Browser | stats count values(RTG_Browser) values(RTG_WebRequest) BY RTG_IPmain | sort -count | rename RTG_IPmain AS "IP Address" | rename count AS "JSession Count" | rename "values(RTG_Browser)" AS "Browser" | rename "values(RTG_WebRequest)" AS "Web Request" ... View more

Re: How To Add a Search Box in Dashboard/Form?

by SplunkTrust in Splunk Search
‎07-21-2015 09:32 AM
2 Karma
‎07-21-2015 09:32 AM
2 Karma
I figured it out! I was using the alias "IP Address" instead of the extracted field RTG_IPmain.. The quotes also messed it up as it was calling it like this "RTG_IPmain=12.23.234.545" instead of this RTG_IPmain=12.23.234.545 Here's my source code if anyone else needs it in the future <form> <label>Click Fraud</label> <fieldset autoRun="true" submitButton="true"> <input type="text" token="ip"> <label>Enter IP Address Here</label> <default>204.44.87.88</default> <prefix>RTG_IPmain=</prefix> <suffix></suffix> </input> </fieldset> <row> <panel> <table> <search> <query>index=access OR index=main | search $ip$ | transaction RTG_JSession | table RTG_IPmain RTG_WebRequest RTG_Browser | stats count values(RTG_Browser) values(RTG_WebRequest) BY RTG_IPmain | sort -count | rename RTG_IPmain AS "IP Address" | rename count AS "JSession Count" | rename "values(RTG_Browser)" AS "Browser" | rename "values(RTG_WebRequest)" AS "Web Request" </query> <earliest>-15m</earliest> <latest>now</latest> </search> <option name="wrap">true</option> <option name="rowNumbers">true</option> <option name="dataOverlayMode">none</option> <option name="drilldown">cell</option> <option name="count">10</option> </table> </panel> </row> </form> ... View more

Re: How To Add a Search Box in Dashboard/Form?

by SplunkTrust in Splunk Search
‎07-21-2015 07:13 AM
‎07-21-2015 07:13 AM
I changed the source code up a bit and included the token in my input tag and referenced it in my search.. No results are coming back, but if I hard code the IP in the search then it will successfully filter the results in my table. What would you recommend I do so I can successfully enter an IP in the search box and have it filter the values in the table? <form> <label>Click Fraud</label> <fieldset autoRun="true" submitButton="true"> <input type="text" token="ip"> <label>IP</label> <default>133.20.33.20</default> <prefix>'IP Address'="</prefix> <suffix>"</suffix> </input> </fieldset> <row> <panel> <table> <search> <query>index=access OR index=main | transaction RTG_JSession | where RTG_IPmain="$ip$" | table RTG_IPmain RTG_WebRequest RTG_Browser | stats count values(RTG_Browser) values(RTG_WebRequest) BY RTG_IPmain | sort -count | rename RTG_IPmain AS "IP Address" | rename count AS "JSession Count" | rename "values(RTG_Browser)" AS "Browser" | rename "values(RTG_WebRequest)" AS "Web Request"</query> <earliest>-15m</earliest> <latest>now</latest> </search> <option name="wrap">true</option> <option name="rowNumbers">true</option> <option name="dataOverlayMode">none</option> <option name="drilldown">cell</option> <option name="count">10</option> </table> </panel> </row> </form> ... View more

Re: How To Add a Search Box in Dashboard/Form?

by SplunkTrust in Splunk Search
‎07-21-2015 06:08 AM
‎07-21-2015 06:08 AM
Yes I added a dashboard panel of the query I made previously which displays a table of IP Address | JSession Count | Browser | Web Request .. I have about 40 pages of results.. Now when I enter the IP Address (which is in the row 1) in the text box and hit the submit button, nothing happens. It appears like the search button doesn't have anything to search ** When I enter in an IP Address from the table, I see it's getting passed in the URL. So it's being read, but none of the results in the table are getting filtered (nothing changes in the table) ... View more

Re: How To Add a Search Box in Dashboard/Form?

by SplunkTrust in Splunk Search
‎07-20-2015 07:13 PM
‎07-20-2015 07:13 PM
Thanks for the reply MuS. I tried putting in what you recomended but it's not returning any results. Can you pick out what I'm doing wrong here? <form> <label>Click Fraud</label> <fieldset autoRun="true" submitButton="true"> <input type="text" token="ip"> <label>IP</label> <default>*</default> <prefix>'IP Address'="</prefix> <suffix>"</suffix> </input> </fieldset> <row> <panel> <table> <search> <query> index=access OR index=main | transaction RTG_JSession | stats count values(RTG_Browser) values(RTG_WebRequest) BY RTG_IPmain | sort -count | rename RTG_IPmain AS "IP Address" count AS "JSession Count" "values(RTG_Browser)" AS "Browser" "values(RTG_WebRequest)" AS "Web Request" | search $ip$ | table 'Web Request' Browser 'JSession Count'</query> <earliest>-15m</earliest> <latest>now</latest> </search> </table> </panel> </row> </form> ... View more

How To Add a Search Box in Dashboard/Form?

by SplunkTrust in Splunk Search
‎07-20-2015 06:03 PM
‎07-20-2015 06:03 PM
I currently have a dashboard which shows the IP Address | Web Request | Browser | JSession Count I want to create a search box where the user can enter the IP Address into and Splunk will filter the results in the table based on that IP Address and show the Web Request | Browser | JSession Count So far I currently have 3 panels at the top of my dashboard, one is a drop down for the time frame, the next one is a submit button, then a text box where the user can enter the IP Address. I have a text box, but when I hit the submit button, nothing happens. I suspect that it's not tied to the query properly so it doesn't know what to search. Can anyone help me fix this so I'm able to filter through the table displayed? Here's my xml that I have so far <form> <label>Click Fraud</label> <fieldset autoRun="true" submitButton="true"> <input type="time" searchWhenChanged="true"> <default> <earliestTime>-15m</earliestTime> <latestTime>now</latestTime> <search> <query>index=access OR index=main | transaction RTG_JSession | table RTG_IPmain RTG_WebRequest RTG_Browser | stats count values(RTG_Browser) values(RTG_WebRequest) BY RTG_IPmain | sort -count | rename RTG_IPmain AS "IP Address" | rename count AS "JSession Count" | rename "values(RTG_Browser)" AS "Browser" | rename "values(RTG_WebRequest)" AS "Web Request"</query> <earliest></earliest> <latest></latest> </search> </default> </input> </fieldset> <row> <panel> <table> <search> <query>index=access OR index=main | transaction RTG_JSession | table RTG_IPmain RTG_WebRequest RTG_Browser | stats count values(RTG_Browser) values(RTG_WebRequest) BY RTG_IPmain | sort -count | rename RTG_IPmain AS "IP Address" | rename count AS "JSession Count" | rename "values(RTG_Browser)" AS "Browser" | rename "values(RTG_WebRequest)" AS "Web Request"</query> <earliest>-15m</earliest> <latest>now</latest> </search> <option name="wrap">true</option> <option name="rowNumbers">true</option> <option name="dataOverlayMode">none</option> <option name="drilldown">cell</option> <option name="count">10</option> </table> </panel> </row> </form> ... View more

Re: How to add Count Column to a Table?

by SplunkTrust in Splunk Search
‎07-20-2015 12:15 PM
‎07-20-2015 12:15 PM
Works perfectly! I was getting some null values in the RTG_WebRequest due to an error in my regular expression when I extracted that field. I did a lookbehind which didn't account for a string I wasn't aware of. I included that and all the fields populated exactly like they should have Here's my search for anyone needing it in the future index=access OR index=main | transaction RTG_JSession | table RTG_IPmain RTG_WebRequest RTG_Browser | stats count values(RTG_Browser) values(RTG_WebRequest) BY RTG_IPmain | sort -count | rename RTG_IPmain AS "IP Address" | rename count AS "JSession Count" | rename "values(RTG_Browser)" AS "Browser" | rename "values(RTG_WebRequest)" AS "Web Request" ... View more

Re: How to add Count Column to a Table?

by SplunkTrust in Splunk Search
‎07-20-2015 08:35 AM
‎07-20-2015 08:35 AM
I had to take the space out between values and (RTG_WebRequest) to get it to work. But its close to what I need. I see a Count column there now but I'm having the following issues.. 1) Anytime the count is greater than 1, there is no RTG_WebRequest results (They are null) 2) The RTG_Browser column disappeared Also, the search looks like it's counting the WebRequest occurrences and not the IPmain occurrences. ... View more

Re: How To List A Column Value Once in a Table?

by SplunkTrust in Splunk Search
‎07-17-2015 08:45 AM
‎07-17-2015 08:45 AM
This is close to what I was looking for, but the Browser got stripped from the table results. It successfully added the count column, but its giving a value of 1 for each web request. I need to sum the values for the number of times the IP occurred in the logs ... View more

How to add Count Column to a Table?

by SplunkTrust in Splunk Search
‎07-17-2015 07:48 AM
‎07-17-2015 07:48 AM
I have a table with 3 fields (IP Address, Web Request, and Browser used).. How can I add a column to that table to count the frequency of IP addresses? I suspect that I have to change my search around because the IP Addresses are listed multiple times, so I think I have to make them list one time then add a column to count the occurrences. So can someone help me add a column to count the number of times the IP is clicked Here's my search index=access OR index=main | transaction RTG_JSession | table RTG_IPmain dc(RTG_IPmain) RTG_WebRequest RTG_Browser | where isnotnull(RTG_IPmain) ... View more
Contact Me
Online Status
Offline
Date Last Visited
3 weeks ago
Karma from
Karma given to