Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- About linu1988
linu1988
Champion
Member since:
12-18-2012
06-05-2020
Community Statistics
| Posts | 979 |
| Solutions | 75 |
| Karma Given | 127 |
| Karma Received | 253 |
| Member Since | 12-18-2012 |
Activity Feed
- Got Karma for Re: Throttling-parameters in realtime search. 01-04-2023 06:13 AM
- Got Karma for Re: Convert a string into a number. 02-03-2022 07:44 AM
- Karma Re: Is there a way to change the font size or bold text in alert emails? for martin_mueller. 06-05-2020 12:48 AM
- Karma Re: Require input value in text box for dfoster_splunk. 06-05-2020 12:47 AM
- Karma Re: How to prevent | stats count in a macro from triggering a remote search? for martin_mueller. 06-05-2020 12:47 AM
- Karma Re: Why is the Search app time range picker defaulting to 2001, even if I specify another date and time? for devicenul1. 06-05-2020 12:47 AM
- Karma Re: What is the easiest way to identify my universal forwarder versions for kscher. 06-05-2020 12:47 AM
- Karma Re: http://localhost/en-US/debug/refresh from terminal/console for MuS. 06-05-2020 12:47 AM
- Karma Re: Alert if source stops indexing for martin_mueller. 06-05-2020 12:47 AM
- Karma Re: How do i ignore the new line character in the _raw field? for martin_mueller. 06-05-2020 12:47 AM
- Karma Re: Python Script Not working via search command for psobisch. 06-05-2020 12:47 AM
- Karma Re: How to join value using wildcard? (Urgent) for somesoni2. 06-05-2020 12:47 AM
- Karma Re: Are there any search and performance pitfalls with keeping data in hot buckets for 1 month and moving it from hot to cold directly? for lguinn2. 06-05-2020 12:47 AM
- Karma Re: Is it possible to update a table with a drilldown value from another table's field in the same browser tab? for vtsguerrero. 06-05-2020 12:47 AM
- Karma Re: how to get 1st 2nd and 3rd place results? - based on value of a field - not frequency. for colineltringham. 06-05-2020 12:47 AM
- Karma Re: 6.1.3 issue with mounted Bundles for michael_herbert. 06-05-2020 12:47 AM
- Got Karma for Re: indexer configured but inactive on new Linux servers. 06-05-2020 12:47 AM
- Got Karma for Re: How to fix perfmon errors "Object specified...in conf file is not valid"?. 06-05-2020 12:47 AM
- Got Karma for Re: How to fix perfmon errors "Object specified...in conf file is not valid"?. 06-05-2020 12:47 AM
- Got Karma for Re: DBX JOIN 2 databases together. 06-05-2020 12:47 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 1 | |||
| 0 | |||
| 0 | |||
| 0 |
01-17-2014
09:33 PM
I do understand the full outer join which you want to do, but i am not quite understanding what is the requirement with a nonuniform dataset of 161919 and how do we handle that in splunk. And knowing the values is very important as that will give you the required data rather than a redundant set. I am curious to know what is the solution to this.
... View more
01-17-2014
09:29 PM
| stats count by _time sourcetype
|makecontinuous _time span=1m
| timechart span=1h sum(count) as count by sourcetype limit=500
Could you give it a try, then fill 0s?
... View more
01-17-2014
01:27 PM
So you mean you don't have a distinct combination of 161919 computer and cputypes in your table? In your AD you have only 28000 records why do you want to compare with that many records from table!
Correct me with the below details
select distinct ComputerName,CPUType from EPOComputerProperties =161919?
select distinct name,serial_number from inv_machine=75323?
I want to know the values, if they are correct i may be of no help to you.
... View more
01-17-2014
12:59 PM
if you have the script and it's echoing you some output in the window then it will be sent to splunk
... View more
01-17-2014
12:57 PM
if yes then you should use Join to get it done, if you don't have any common field with same values it is not possible to relate them.
... View more
01-17-2014
12:55 PM
So is it like you want to get the set like
ComputerName,distinguishedName,CPUType,Serial_number?
Secondly after the grouping from sql , do you still get 161919 and 75323 records?
... View more
01-17-2014
12:17 PM
two append queries will return very less no of records, did you check executing them separately? You may need to see if all the 3 queries you have have the same ComputerName returned. Without seeing the data its not quite easy to give the optimum soultion.
Or you may want to look at set opration here to see how the results come. Union will give you everything i guess.
|set [search 1][search 2]
_http://docs.splunk.com/Documentation/Splunk/6.0.1/SearchReference/Set
... View more
01-17-2014
10:59 AM
i missed a group by statement, but the last stats statement doesn't use the count, why do we have the count then? And if you want 15 results, why don't you make join type left and start from the table C, it will contain 15 records at last..
... View more
01-17-2014
10:44 AM
So does it give you what you need? The result set is very less compared to your query
... View more
01-17-2014
10:42 AM
Hello,
If you don't want the extra details or want to customize the output email you need to modify the default sendmail.py file fro your app. Please take a backup before do ant changes.
Go to [Splunk\etc\apps\[search\app_name]\bin\]the content carefully remove which ever part you don't require:
intro += "Saved search results.\n\n"
if settings != None:
user = settings.get("user", None)
if user:
intro += "User: \'" + escape(user, plainText) + "\'\n"
if ssName:
intro += "Name: \'" + escape(ssName, plainText) + "\'\n"
query = getarg(argvals, "ssquery", None)
if query:
intro += "Query Terms: \'" + escape(query, plainText) + "\'\n"
ssLink = getarg(argvals, "sslink", None)
if ssLink and not plainText:
ssLink = "<a href=\"" + ssLink + "\">" + ssLink + "</a>"
if ssLink:
intro += "Link to results: " + ssLink + "\n";
ssSummary = getarg(argvals, "sssummary", None)
if ssSummary:
intro += "Alert was triggered because of: \'" + escape(ssSummary, plainText) + "\'\n"
Thanks
... View more
01-17-2014
10:37 AM
in dbx app you also have the same implementation where you choose the database and then write the query. it is kinda same what you are looking for..
... View more
01-17-2014
10:36 AM
yes as per your previous post you mentioned you are advanced xml i.e. on dashboard right!?
Follow some examples in sideview utils/splunk UI examples how to pass the value from parent to child module. You can get the user name then pass it as a variable to your |dbquery...
... View more
01-17-2014
10:33 AM
and it should give the negative result as per the query as f < l. Moreover when calculating this big range in the query you can bucket the time which will give your reult bit faster as you are not looking for granular detail.
index=_internal|bucket _time span=6h|stats...
... View more
01-17-2014
10:24 AM
Hello,
i don't quite understand the retirement but there are several things noticeable and can be optimized.
There is no point doing a database query operation in splunk as it is an overhead on both the system + network traffic. If you want to get the Computer name it can be renamed later on the returned result. There is the query.
index=ad_test
| rename cn as ComputerName
| dedup ComputerName
| stats count by ComputerName distinguishedName
| append [ | dbquery mcafee "SELECT count(1) as CNT,ComputerName,CPUType FROM EPOComputerProperties group by ComputerName,CPUType" | rename CNT as Count]
| append [ | dbquery marimba_2014 "SELECT count(1) as CNT,name,serial_number FROM inv_machine group by name,serial_number" | rename name AS ComputerName | rename CNT AS Count1]
| stats values(serial_number) as serial_number values(distinguishedName) as distinguishedName values(CPUType) as CPUType by ComputerName
Now this should give you a better performance and result. Thanks.
... View more
01-17-2014
09:58 AM
yes it is possible. I have done a similar thing where it will find the logged in user and log their activity. You can maintain a lookup or pass them directly to the query by finding the logged in user. Apply the intention to pass it to dbquery. This is my assumtion
|rest /services/authentication/users splunk_server=local | search [| rest /services/authentication/current-context splunk_server=local | rename username as title | fields title]
this will give you the logged user.
... View more
01-17-2014
09:50 AM
You get results are parameter in splunk, if you have idea in any scripting language you can extact it to csv file and manipulate and then send it to mail ids. Follow the steps
_http://docs.splunk.com/Documentation/Splunk/latest/Alert/Configuringscriptedalerts
... View more
01-17-2014
06:59 AM
Did you try to restart the forwarder?
... View more
01-17-2014
06:29 AM
1 Karma
Yes it gives the value till you have something distinct with the above combination.
... View more
01-17-2014
06:27 AM
HTML doesn't contain a line break "\n", you need to use " ". And be careful modifying the code, you are using python where indentation is a big issue. If you go into issues with missing mails monitor splunkd.log to see where exactly,yes the exact line number you can find from there.
... View more
01-17-2014
06:22 AM
why don't you try this?
sourcetype="*Ledf.log" tid|rex field=_raw "stid((?<tid>d+)"|dedup tid |bucket _time span=1w | eval status = if(error == 200, "OK", "Error")| timechart count as Trans
Or if you want to show the dates directly then you need to use the stats command to extract the date and time of the year then make a chart rather than a timechart
sourcetype="*Ledf.log" tid|rex field=_raw "stid((?<tid>d+)"|dedup tid |bucket _time span=1w|eval TimeStamp=strftime(_time,"%A %d/%m/%Y") | eval status = if(error == 200, "OK", "Error")|chart count as Trans by TimeStamp
... View more
01-16-2014
07:45 PM
Did you check for the firewall at the indexer,or check the outbound port from you localhost? Perform a
telnet 192.168.1.66 9998
Check if you are able to connect.. If you are having any antivirus software try disabling them.
... View more
01-15-2014
07:42 PM
Hello,
you need to format the times before you send the mail.
timechart ...|eval Time=strftime(_time,"%Y/%m/%d %T")|table Time,field1,field2
... View more
01-15-2014
09:45 AM
As Somesh suggested you need to get a lookup which will get you the FLAG details. Alternative is to use a case/if statement. Have updated the query
... View more
