Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- Find Answers
- :
- About sandeepmakkena
sandeepmakkena
Contributor
Member since:
09-19-2018
06-05-2020
Community Statistics
| Posts | 166 |
| Solutions | 6 |
| Karma Given | 0 |
| Karma Received | 10 |
| Member Since | 09-19-2018 |
Activity Feed
- Got Karma for Re: How to connect search head to new indexer in a distributed environment (beginner here). 01-09-2025 05:24 AM
- Got Karma for Day to day comparison. Using stats and timechart.. 06-05-2020 12:50 AM
- Got Karma for How to append column total to column name?. 06-05-2020 12:50 AM
- Got Karma for Re: How to append column total to column name?. 06-05-2020 12:50 AM
- Got Karma for Re: How to setup alert for x% decrease in count by market?. 06-05-2020 12:50 AM
- Got Karma for Re: How to setup alert for x% decrease in count by market?. 06-05-2020 12:50 AM
- Got Karma for Re: What's the delay between last event written to disk and now()?. 06-05-2020 12:50 AM
- Got Karma for Re: What's the delay between last event written to disk and now()?. 06-05-2020 12:50 AM
- Got Karma for Re: Length of every column in a table?. 06-05-2020 12:50 AM
- Got Karma for Re: Way to monitor splunkforwarder. 06-05-2020 12:50 AM
- Posted Re: Group by id. on Splunk Search. 11-11-2019 09:48 AM
- Posted Group by id. on Splunk Search. 11-08-2019 07:18 PM
- Tagged Group by id. on Splunk Search. 11-08-2019 07:18 PM
- Posted Re: print latest and values of status in an order. on Splunk Search. 11-08-2019 07:05 PM
- Posted Re: print latest and values of status in an order. on Splunk Search. 11-08-2019 06:05 PM
- Posted print latest and values of status in an order. on Splunk Search. 11-08-2019 05:14 PM
- Tagged print latest and values of status in an order. on Splunk Search. 11-08-2019 05:14 PM
- Posted Re: How to calculate percentage of usage on VPN on Security. 11-05-2019 02:31 PM
- Posted Re: Setting Workload Categories for Workload Management on Reporting. 11-05-2019 02:19 PM
- Posted Re: Pass Variable to Panel Title. on Dashboards & Visualizations. 11-05-2019 02:11 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
10-22-2019
12:17 PM
YourBasicSearch
| eval url_word = split(("URL_field_Here"),"/")
| search url_word = organizations
| stats count
Replace the URL_firld_Here with your URL field name.
Hope this helps, Thanks!
... View more
10-22-2019
12:02 PM
Here is are a couple of ways you can do it.
https://answers.splunk.com/answers/7193/easy-way-to-check-if-a-windows-service-is-running.html
https://answers.splunk.com/answers/7193/easy-way-to-check-if-a-windows-service-is-running.html
If you are getting through logs, you can do it by using transaction command or other commands to check for a string service_start after service_stop is found, if not you can generate an alert.
I hope this helps, thanks!
... View more
10-22-2019
11:26 AM
Did you try using chart
| chart count(action) as Attempts, count(eval(match(action,"failure"))) as Failed,
count(eval(match(action,"success"))) as Success
earliest(_time) as FirstAttempt latest(_time) as LatestAttempt by user Country
... View more
10-22-2019
10:54 AM
index= sourcetype="cisco:asa" (eventtype="cisco_vpn_start" OR eventtype="cisco_vpn_end") src_ip= user=*
| stats earliest_time(user_login) as user_logout_time,latest_time(user_logout) as user_login_time, earliest_time(VPN_login) as VPN_start latest_time(VPN_logout) as VPN_end by user, src_ip
| eval User_On_VPN_minutes = (VPN_end-VPN_start)/60
| eval User_On_Network_minutes = (user_logout_time-user_login_time)/60
| eval perc_On_VPN = (User_On_Network_minutes/User_On_VPN_minutes) * 100."%"
| where perc_On_VPN > 80%
You can replace user_login, user_logout, VPN_login and VPN_logout with your specific events.
Hope this helps, Thanks!
... View more
10-21-2019
07:11 PM
| metadata index=YourIndexName type=hosts
| stats max(lastTime) as lastTime, min(firstTime) as firstTime
| convert ctime(firstTime), ctime(lastTime)
This should do it!
If it helped can you accept the answer, please.
... View more
10-21-2019
04:51 PM
(YourSearch)
| eval mail= Emailid
| eventstats values(mail) AS mail_adresses
| eval recipients=mvjoin(mail_adresses, ",")
| table Name,lastname,mail, recipients
| sendemail to=$result.recipients$
Hope this helps, Thanks!
... View more
10-21-2019
04:13 PM
| inputlookup lookupfile1 | lookup lookupfile2 host OUTPUTNEW host as isFound | where isnull(isFound)
Hope this helps, Thanks!
... View more
10-21-2019
04:00 PM
1 Karma
If it is a universal forwarder, the monitoring would be whether it is forwarding the data to a specific index or not. I best approach would create an alert.
Something like this
| metasearch index=_internal
| eval host=upper(host)
| stats count by host
| append [ | inputlookup Perimeter.csv | eval count=0 | eval host=upper(host) | fields host count]
| stats sum(count) AS Total by host
| where Total=0
You can set the time interval depending on the data it is forwarding.
Hope this helps, Thanks!
... View more
10-21-2019
03:45 PM
I'm sure there will be a better way to achieve this, for now, I can only think of below two options.
Write the event of your Security_index to a file using curl commands like collect and configure other Splunk instant to monitor that file.
The other way is by running the script, here is the link that could help https://docs.splunk.com/Documentation/Splunk/latest/AdvancedDev/ScriptSetup
Thanks, hope this helps!
... View more
10-21-2019
03:20 PM
You have to know the retention policy of your index 1st, I don't think you can do that through UI.
You can run this query to get the retention policy in days
| rest /services/data/indexes
| rename title as index | dedup index | sort index
| streamstats count as Row
| eval Days=frozenTimePeriodInSecs/86400
| fields Row index frozenTimePeriodInSecs Days
If this info is not good enough, you can ask your Splunk team for more information on the retention policy, with that being answered one more question would be can we query that frozen data the answer is Yes.
here is the link you can refer to https://wiki.splunk.com/Community:UnderstandingBuckets
Thanks! hope this helps.
... View more
10-17-2019
04:54 PM
Can you share your search query?
... View more
10-17-2019
04:36 PM
https://answers.splunk.com/answers/339034/is-there-a-way-to-know-which-fields-were-extracted.html
I think this is answering a similar question.
Hope this helps, Thanks!
... View more
10-17-2019
04:21 PM
props.conf
[WinEventLog://System]
TRANSFORMS-FilterEvent = FilterEvent
transforms.conf
[FilterEvent]
REGEX = EventCode="^104$"
DEST_KEY = queue
FORMAT = nullQueue
Try this as well!
... View more
10-17-2019
04:09 PM
whitelist = EventCode=%^104$%
Try this edit and restart the Splunk, I hope this will help!
... View more
10-17-2019
03:44 PM
https://answers.splunk.com/answers/6573/alternative-ways-to-assigning-sourcetype.html
I found a similar question answered, please take a look at the above link.
Hope this helps, Thanks!
... View more
10-17-2019
02:04 PM
sourcetype=
| eval startTime=if(response_code=503,_time,null())
| eval endTime=if(response_code=200,_time,null())
| stats min(startTime) as startTime max(endTime) as endTime by Some_request_ID
| eval duration=endTime-startTime
When you have large data transaction will take more resources and not accurate, try using an alternative.
Hope this helps, Thanks!
... View more
10-17-2019
01:41 PM
| eval fields=split(mvfield,"/")
| eval my_new_value=mvindex(fields,0)
before you use mvindex try using split before that.
Hope this helps, Thanks!
... View more
10-16-2019
10:34 AM
| eval sort_field = if(count==disctinct_count, distinct_count, count)
| sort -sort_field
You can try this.
Hope this helps, Thanks!
... View more
10-16-2019
10:25 AM
I think this is something related to Splunk version Or the browser you are using if you can try using a different browser. You can also try running your search in developer mode.
Hope this helps, Thanks!
... View more
10-15-2019
05:47 PM
| eval Mdate = strftime(_time, "%Y-%m-%d")
| stats count by user,Mdate
| stats values(Mdate), values(count) by user
| sort -values(c)
hope this helps, Thanks!
... View more
10-15-2019
04:36 PM
There two ways to fix it.
1. Pass the token values to the drill-downs with original names
2. Just follow the same naming in the drill-downs as well, what I mean is just rename the fields as in your main search.
Hope this helps, Thanks!
... View more
10-15-2019
04:31 PM
| eval NewValue = FirstValue*.60
| eval NewValue = SecondValue*.40
| chart count by NewValue
| eventstats sum(count) as total
Hope this helps, please comment if you have any questions.Thanks!
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:04 AM
|
Karma from
