Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- About linu1988
linu1988
Champion
Member since:
12-18-2012
06-05-2020
Community Statistics
| Posts | 979 |
| Solutions | 75 |
| Karma Given | 127 |
| Karma Received | 253 |
| Member Since | 12-18-2012 |
Activity Feed
- Got Karma for Re: Throttling-parameters in realtime search. 01-04-2023 06:13 AM
- Got Karma for Re: Convert a string into a number. 02-03-2022 07:44 AM
- Karma Re: Is there a way to change the font size or bold text in alert emails? for martin_mueller. 06-05-2020 12:48 AM
- Karma Re: Require input value in text box for dfoster_splunk. 06-05-2020 12:47 AM
- Karma Re: How to prevent | stats count in a macro from triggering a remote search? for martin_mueller. 06-05-2020 12:47 AM
- Karma Re: Why is the Search app time range picker defaulting to 2001, even if I specify another date and time? for devicenul1. 06-05-2020 12:47 AM
- Karma Re: What is the easiest way to identify my universal forwarder versions for kscher. 06-05-2020 12:47 AM
- Karma Re: http://localhost/en-US/debug/refresh from terminal/console for MuS. 06-05-2020 12:47 AM
- Karma Re: Alert if source stops indexing for martin_mueller. 06-05-2020 12:47 AM
- Karma Re: How do i ignore the new line character in the _raw field? for martin_mueller. 06-05-2020 12:47 AM
- Karma Re: Python Script Not working via search command for psobisch. 06-05-2020 12:47 AM
- Karma Re: How to join value using wildcard? (Urgent) for somesoni2. 06-05-2020 12:47 AM
- Karma Re: Are there any search and performance pitfalls with keeping data in hot buckets for 1 month and moving it from hot to cold directly? for lguinn2. 06-05-2020 12:47 AM
- Karma Re: Is it possible to update a table with a drilldown value from another table's field in the same browser tab? for vtsguerrero. 06-05-2020 12:47 AM
- Karma Re: how to get 1st 2nd and 3rd place results? - based on value of a field - not frequency. for colineltringham. 06-05-2020 12:47 AM
- Karma Re: 6.1.3 issue with mounted Bundles for michael_herbert. 06-05-2020 12:47 AM
- Got Karma for Re: indexer configured but inactive on new Linux servers. 06-05-2020 12:47 AM
- Got Karma for Re: How to fix perfmon errors "Object specified...in conf file is not valid"?. 06-05-2020 12:47 AM
- Got Karma for Re: How to fix perfmon errors "Object specified...in conf file is not valid"?. 06-05-2020 12:47 AM
- Got Karma for Re: DBX JOIN 2 databases together. 06-05-2020 12:47 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 1 | |||
| 0 | |||
| 0 | |||
| 0 |
01-08-2014
10:33 AM
As per Martin's comment if the TZ will be skipped, why don't you give eval a try?
EVAL-<fieldname> = <eval statement>
* Use this to automatically run the <eval statement> and assign the
value of the output to <fieldname>. This feature is referred to as 'calculated fields'.
it would calculate the difference for you.
... View more
01-08-2014
10:21 AM
Yes better get the searching part done on SSD, but again how do we know which to keep in SSD and which one to HDD!! Mostly we will search on the recent data, where as the recent data keeps on updating in the Hot buckets! Again we are looped to the start of the discussion where to use it!!
... View more
01-08-2014
10:05 AM
And as you are new to splunk, you could go for splunk 6 where it is having some ready made functionality for filtering.
_http://blogs.splunk.com/2013/10/14/windows-event-logs-in-splunk-6/
And if you would like to do it the conventional way
_http://answers.splunk.com/answers/29218/filtering-windows-event-logs
... View more
01-08-2014
09:48 AM
Hello,
In a distributed environment you just need to control the search head capabilities provided to the users.
If you have indexers then , it's best practice to make them alike and make them load balanced.
Create roles specific to your user's requirements. Allow the roles to the Apps, Indexes they can search.
Only on Search head you configure the access control as the splunk web Interactive UI is only visible to the end user. So it depends on the admin which are the capabilities/objects being provided to the users.
If you go to the Manager->Access Control page you can play around a bit and get to know how you can create users/roles.
May also take a look in Authorize.conf.
_http://docs.splunk.com/Documentation/Splunk/4.3.5/Deploy/Howauthorizationworksindistributedsearches
... View more
01-07-2014
06:44 AM
if it is a realtime then shouldn't it be -1y to rt?
... View more
01-06-2014
10:51 PM
Then it needs to be set particular to the role in authorize.conf ,parameters like srchMaxTime,srchTimeWin,srchJobsQuota will help you restrict the users to have long queries. Regarding the complexity there are not many option if you don't have any static queries to allow them to.
... View more
01-06-2014
09:15 PM
The message shows up because of the limitation on the roles for concurrent searches. You can have savedsearch to avoid this, or the maximum concurrent searches needs to be altered
... View more
01-06-2014
08:24 AM
I don't know what to check but , i think if we remove the admin users capabilities we will be safe. Let's wait for the clarification
... View more
01-06-2014
06:37 AM
You can create your own regex statement or you can use splunk's exact field option to get the same. I have used it to get the value.
Please mark it as an answer if it solved your problem.
... View more
01-06-2014
05:10 AM
In your case splunk should automatically retrieve the timestamp from the log details. Even if you want to get it manually the search should be like the above one. I have updated the query in the answer. I am not aware if you are dividing the events or not, the timestamp can also be extracted from the log itself to assign it to the event time.
... View more
01-06-2014
03:05 AM
could you provide us a sample log file?
we could see the extraction derive the timestamp.
... View more
01-05-2014
09:54 PM
Could you check if the data is extracted from the rex before doing the stats? Could you post the result
sourcetype=csv| search 409,1| rex field=_raw "(d+,){2}(? d+)"|rex field=_raw "(d+,){3}(? d+)"|rex field=_raw "(d+,){44}(? d+)"|table headid,fieldid,head_value
... View more
01-03-2014
12:32 PM
How do you get the value of success? With a append statement u wont be able to combine it to single event right?
... View more
01-03-2014
11:29 AM
props and transforms.conf they define the sourcetype behavior if the user wants to field extraction/filter/parse it. But i doesn't contain the definition if not required. It is just a alias for the source you want to assign from forwarder or any inputs. So what you see is the name itself given to the netappAuditlog source.
... View more
01-03-2014
10:25 AM
Love the way you explain 🙂
... View more
01-03-2014
10:07 AM
1 Karma
sourcetype=SidewinderFirewall Idsiwall1.ids.net OR idsiwall3.ids.net OR Idsiwall2.ids.net OR idsiwall4.ids.net | stats count by hostname | sort by count | stats count AS Alive_Iwalls |Where Alive_Iwalls != 4
No conditions required anymore
... View more
01-03-2014
03:08 AM
1 Karma
Hello,
You would need to query like this.
source="RSBA_LOGS2" | rex field=_raw "(?i)\.log:(?P<timestamp>[^,]+)" | eval m=strptime(timestamp,"%Y-%m-%d")|eval timestamp=strftime(m,"%B %Y")|table timestamp
Thanks
... View more
01-03-2014
02:24 AM
2 Karma
Hello ,
If you just add a sum command with all the distinct fields you will get the desired result.
sourcetype=csv| search 409,1| rex field=_raw "(d+,){2}(?<fieldid>d+)"|rex field=_raw "(d+,){3}(?<headid>d+)"|rex field=_raw "(d+,){44}(?<head_value>d+)"| stats sum(head_value) as Value by fieldid,headid |eval Parameter = "parameter_1"|eval hex= "112"|eval bell_id= "33"|fields Parameter hex bell_ID fieldid headid Value|stats list(fieldid) as field_ID,list(headid) as HeadID,list(Value) as Value by Parameter,hex,bell_ID
Check if this works for you.
... View more
01-02-2014
03:48 PM
So could you save the database connection without validating? i dont have a DB to test it on my own.
... View more
01-02-2014
03:38 PM
are they saved in the same app you are using?
... View more
01-02-2014
02:59 PM
42612 The statement string is an SQL statement that is not acceptable in the context in which it is presented As per IBM. So are you giving the database info properly? Could you try saving without validate option?
... View more
01-02-2014
06:08 AM
did you check for all the other factor between the forwarder and second ip_server2?
telnet from the forwarder if they are able to connect. And if you want all events present in both the server remove the autoLB=true option.
... View more
01-02-2014
05:56 AM
Yes you may want to play with using .css with sideviewutil's html module. The best bet would be a join statement rather than many other work arounds
... View more
