Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- Find Answers
- :
- About Glasses
Glasses
Builder
Member since:
09-06-2018
05-01-2023
Community Statistics
| Posts | 177 |
| Solutions | 4 |
| Karma Given | 14 |
| Karma Received | 14 |
| Member Since | 09-06-2018 |
Activity Feed
- Karma Re: How to allow wildcard inputs in a dashboard input textbox, but not allow just "*" (star) to be entered? for somesoni2. 06-07-2022 04:54 AM
- Karma Re: How to allow wildcard inputs in a dashboard input textbox, but not allow just "*" (star) to be entered? for jeffland. 06-07-2022 04:53 AM
- Posted Re: How to allow wildcard inputs in a dashboard input textbox, but not allow just "*" (star) to be entered? on Dashboards & Visualizations. 06-03-2022 09:04 AM
- Posted Re: How to allow wildcard inputs in a dashboard input textbox, but not allow just "*" (star) to be entered? on Dashboards & Visualizations. 06-03-2022 08:39 AM
- Posted Re: How to allow wildcard inputs in a dashboard input textbox, but not allow just "*" (star) to be entered? on Dashboards & Visualizations. 06-03-2022 08:31 AM
- Posted Re: How to allow wildcard inputs in a dashboard input textbox, but not allow just "*" (star) to be entered? on Dashboards & Visualizations. 06-03-2022 08:24 AM
- Posted Re: How to allow wildcard inputs in a dashboard input textbox, but not allow just "*" (star) to be entered? on Dashboards & Visualizations. 06-03-2022 08:07 AM
- Posted Re: How to allow wildcard inputs in a dashboard input textbox, but not allow just "*" (star) to be entered? on Dashboards & Visualizations. 06-03-2022 08:00 AM
- Posted How to allow wildcard inputs in a dashboard input textbox, but not allow just "*" (star) to be entered? on Dashboards & Visualizations. 06-03-2022 07:32 AM
- Posted How to build a multi-input dashboard and ignore inputs that are left blank? on Dashboards & Visualizations. 06-02-2022 04:02 PM
- Tagged How to build a multi-input dashboard and ignore inputs that are left blank? on Dashboards & Visualizations. 06-02-2022 04:02 PM
- Posted Re: How to calculate statistical outliers over a 90d@h sliding window? on Splunk Search. 05-03-2022 03:22 PM
- Karma Re: How to calculate statistical outliers over a 90d@h sliding window? for bowesmana. 05-03-2022 03:22 PM
- Posted Re: How to calculate statistical outliers over a 90d@h sliding window? on Splunk Search. 05-03-2022 06:37 AM
- Got Karma for How to calculate statistical outliers over a 90d@h sliding window?. 05-02-2022 06:49 PM
- Posted How to calculate statistical outliers over a 90d@h sliding window? on Splunk Search. 05-02-2022 02:12 PM
- Posted Re: How to take output from a lookup and feed it to another lookup and append the results? on Splunk Search. 03-28-2022 03:33 PM
- Posted How to take output from a lookup and feed it to another lookup and append the results? on Splunk Search. 03-28-2022 02:14 PM
- Posted Re: How to drop all events that start with DEBUG at the HF? on Splunk Search. 03-08-2022 12:47 PM
- Posted Re: How to drop all events that start with DEBUG at the HF? on Splunk Search. 03-08-2022 06:53 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
06-02-2020
03:01 PM
there is no option to do that from the UI, I tried commenting them out but still get the error...
... View more
06-01-2020
04:00 PM
I am on Splunk 7.3.3 and I installed the Palo Alto TA on the SH, FH, and IDX for field parsing. The TA works but I am getting the following errors:
6 errors occurred while the search was executing. Therefore, search results might be incomplete
Could not load lookup=LOOKUP-minemeldfeeds_dest_lookup
Could not load lookup=LOOKUP-minemeldfeeds_src_lookup
I only see these lookups under automatic lookups. I am using Palo Alto TA add on 6.2.0. I am not using the MineMeld Palo feature, so I am looking for a way to disable it and stop the errors.
Any advice is appreciated.
Thank you.
... View more
Labels
- Labels:
-
installation
05-21-2020
06:13 AM
thank you for confirming, I could not find a list of tstats fields.... is there a doc for tstat fields?
... View more
05-20-2020
12:02 PM
Just wondering if its possible to get data volume / size from TSTATS.
I know you can do something like this to get counts (events/per sec)
| tstats count WHERE index=* by index| eval events_per_second=count/(3600*24)
but how can you use tstats for find volume of data per time?
... View more
05-19-2020
08:30 AM
Thank you!!!
I tried something similar but jacked it up... went the wrong way, thanks for your help.
... View more
05-19-2020
07:54 AM
I have a subsearch query that uses a wildcard keyword list as an inputlookup to find filenames that contain a keyword.
I then rename the resulting filenames as keyword to do a reverse lookup to output the keyword that matched the filename.
The problem is I want to list out the filename and the keyword that matched in the filename...
For example>>>
index=foo sourcetype=bar
[|inputlookup keyword-list.csv |fields keyword |rename keyword as FileName]
| rename FileName as keyword
| lookup keyword-list.csv keyword OUTPUT keyword as Matched
| stats values(Matched)
From this query my results are the keywords:
(for example)
*jedi*
*sith*
*falcon*
Here are the FileName results containing the keyword
index=foo sourcetype=bar
[|inputlookup keyword-list.csv |fields keyword |rename keyword as FileName]
| stats values(FileName)
"D:/Rey Skywalker/jedi/report.pdf"
"D:/Kilo Ren/sith/report.pdf"
"E:/starship/falcon/rebel/report.pdg"
I was requested to list both together in the results... like this
*jedi* "D:/Rey Skywalker/jedi/report.pdf"
*sith* "D:/Kilo Ren/sith/report.pdf"
*falcon* "E:/starship/falcon/rebel/report.pdg"
Any advice greatly appreciated, thank you!
... View more
05-12-2020
02:20 PM
So I have the following _json event that I need to wrangle into a more useful format.
As you can see there are 2 key:value pairs that are related, e.g name = and value =
For example I would like to combine the following into 1 field like a re-key, but do it globally for the entire source.
name: target_user
value: rey.skywalker@jedi.com
name:target_user,value: rey.skywalker@jedi.com or target_user= rey.skywalker@jedi.com
any suggestions appreciated, I tried a props and transforms on the search head with no luck.... thx in advance
{ [-]
actor: { [-]
email: kilo.ren@sith.com
profileId: 100
}
etag: "abcd1234"
events: [ [-]
{ [-]
name: edit
parameters: [ [-]
{ [-]
boolValue: false
name: primary_event
}
{ [-]
boolValue: true
name: billable
}
{ [-]
name: doc_id
value: jakjd446532
}
{ [-]
name: doc_type
value: pdf
}
{ [-]
name: doc_title
value: Overview.pdf
}
{ [-]
name: visibility
value: shared_externally
}
{ [-]
name: owner
value: kilo.ren@sith.com
}
{ [-]
boolValue: false
name: owner_is_shared_drive
}
{ [-]
boolValue: false
name: owner_is_team_drive
}
]
type: access
}
{ [-]
name: change_user_access
parameters: [ [-]
{ [-]
boolValue: true
name: primary_event
}
{ [-]
boolValue: true
name: billable
}
{ [-]
name: visibility_change
value: external
}
{ [-]
name: target_user
value: rey.skywalker@jedi.com
}
{ [-]
multiValue: [ [+]
]
name: old_value
}
{ [-]
multiValue: [ [+]
]
name: new_value
}
{ [-]
name: old_visibility
value: private
}
{ [-]
name: doc_id
value: 1d8546542318
}
{ [-]
name: doc_type
value: pdf
}
{ [-]
name: doc_title
value: Overview.pdf
}
{ [-]
name: visibility
value: shared_externally
}
{ [-]
name: owner
value: kilo.ren@sith.com
}
{ [-]
boolValue: false
name: owner_is_shared_drive
}
{ [-]
boolValue: false
name: owner_is_team_drive
}
]
type: acl_change
}
]
id: { [-]
applicationName: drive
customerId: abcd1234
time: 2020-01-12T18:42:34.543Z
uniqueQualifier: 123456
}
kind: admin#reports#activity
}
Show as raw text
... View more
05-12-2020
06:17 AM
So as an update, I have hundreds of useless field extractions now that seem to be coming from the URL and trailing pages (which have = contained in them). Also I lost a valuable field "src", after I disabled the app and ta on the search head the src field returned... and of course Splunk support won'ts help with a "Palo" app and Palo has not replied to my request for support... grrrrrrrrreat!
... View more
05-06-2020
01:48 PM
so that is the purpose of sort 0 > return all results, thanks
... View more
05-06-2020
01:30 PM
1 Karma
Wow that is awesome!!! Thanks
... View more
05-06-2020
11:45 AM
I am looking to find events where IP address changes from previous to current, however using fist(ip) and last(ip) misses the events in between the first and last...
Ideally I am looking to find when a change occurs for the IP value and then look at the previous IP value... this comparison is then used to find ip geoloc and calc the speed = dist/time with haversine app.
Thank you
... View more
05-06-2020
11:31 AM
still waiting on Palo to reply about this, but I am going to try your suggestion... would you disable it on the HF and Indexers?
... View more
05-01-2020
02:33 PM
Thank you but I am going to open a case, I think there are a lot of abandoned legacy confs - and might be a conflict, although btool check did not find anything
... View more
05-01-2020
02:17 PM
they don't want to, they want me to drop at receiving HF...
... View more
05-01-2020
02:12 PM
I am having trouble with Threat
... View more
05-01-2020
01:48 PM
The told me they were syslogging all fields threat and system to my HF > IDX... that is all I know.
... View more
05-01-2020
12:23 PM
I followed the Palo Alto Add-on instructions and installed the TA on the receiving HF and my distributed non-clustered indexers.
I am noticing hundreds of parsed and extracted fields that are meaningless, i.e. fields created based on the parsing of a uri... It seems something is telling splunk to parse the logs on commas and equal signs for example.
Has anyone else experienced this? Does anyone know how to fix this issue? I am using the 6.2.0 version of the TA. I also put the app and TA on the SH but that causes a useful field "src" to disappear. After disabling it the src field returned.
It seems like the add-on is mis-configured, but need some advice on how to t-shoot this.
Thank you
... View more
04-22-2020
01:47 PM
thank you! please convert previous to an answer and I will accept
... View more
04-22-2020
09:31 AM
WOW that is awesome!!!
I was going round and round not quite getting it... but that is exactly what I was trying to do...
although the system admin said that my default query would work as well - running every hour and sending an alert when results are greater than > 1
index=<foo> earliest=-24h@h latest=@h "<some bad failure msg>" |bin _time span=1h |stats count by host _time |eventstats sum(count) as totalCount by host | where totalCount > 10
one followup question, if I keep your outputlook method running, how do I purge the old data after a day or so, because the file might grow to a huge size and cause issues (I am thinking...)
Thank you very much !!!
... View more
04-21-2020
09:15 AM
...|table fields from inputlookup add results from current search to table then | outputlookup...
I am guessing
... View more
04-21-2020
08:54 AM
So trying the outputlookup method...
I created a lookup called "Failed_Count" with a file.csv that contains 2 fields host,count.
I can run a query like this>>
index=foo "failed" |stats count by host | outputlookup Failed_Count
and it updates, but I have no luck adding the previous hour count to the total...
Any ideas?
... View more
04-21-2020
08:17 AM
I was thinking about using a summary index with a 24 hour look back each hour, but someone mentioned using an output lookup instead...
... View more
04-21-2020
07:19 AM
Hi,
I need to monitor "host failure events" per hour over last 24 hours for a group of 50 hosts. When the total reaches a threshold like 10 fails, an alert email needs to be sent. This count and total needs to occur each hour.
What I want to do is schedule a report to count the fails by each host per hour, save the count, and then add the next hourly count to the previous count. When any host reaches 10 fails within the 24 hour window, the triggered action needs to send an email.
At midnight, I would like to reset the count.
Any advice appreciated.
Thank you
... View more
04-17-2020
10:21 AM
Hi
I have a Windows Server Collecting WinEventLogs from a number windows host endpoints.
I was told the Server was a WEC, Windows Event Collector, unfortunately I don't have access to it.
The UF is install and has the following inputs.conf however I am not receiving the ForwardedEvents.
Is this inputs correct for collecting the Forwarded Events? Any advise T-shooting is appreciated. Thank you!
[WinEventLog://Application]
disabled=0
index = <idx_name>
[WinEventLog://Security]
disabled=0
index = <idx_name>
[WinEventLog://System]
disabled=0
index = <idx_name>
[WinEventLog://ForwardedEvents]
disabled=0
index = <idx_name>
... View more
04-16-2020
03:10 PM
thanks for the reply but that does not make sense, I never index on a SH...
My indexes are not clustered at the moment, but some TAs require installation on the Indexer... are you from Palo?
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
05-01-2023
11:10 AM
|
Karma from
Karma given to
