Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- Find Answers
- :
- About dbcase
dbcase
Motivator
Member since:
12-15-2015
06-05-2020
Community Statistics
| Posts | 704 |
| Solutions | 24 |
| Karma Given | 11 |
| Karma Received | 57 |
| Member Since | 12-15-2015 |
Activity Feed
- Got Karma for How to adjust chart column width?. 08-24-2021 03:26 AM
- Got Karma for Re: Dashboard: Set Token When Dashboard is Open. 09-09-2020 06:31 PM
- Got Karma for Add to a dynamic dropdown. 08-20-2020 09:18 AM
- Got Karma for Re: Condition value using a drilldown. 07-21-2020 06:10 PM
- Karma Re: String concatentation (strcat command) is duplicating results for somesoni2. 06-05-2020 12:49 AM
- Karma Re: How can I set a default "yes" radio button that can change to "no" with user input? for kamlesh_vaghela. 06-05-2020 12:49 AM
- Karma Re: How can I set a default "yes" radio button that can change to "no" with user input? for niketn. 06-05-2020 12:49 AM
- Got Karma for Unset a token if it is equal to a value. 06-05-2020 12:49 AM
- Got Karma for Re: What is wrong with my regex? "Regex: missing terminating ] for character class". 06-05-2020 12:49 AM
- Got Karma for Re: How to find the time duration between logins. 06-05-2020 12:49 AM
- Got Karma for Re: How to find the time duration between logins. 06-05-2020 12:49 AM
- Got Karma for Re: Histogram of counts. 06-05-2020 12:49 AM
- Got Karma for How to get the top 10 values using timechart?. 06-05-2020 12:49 AM
- Got Karma for Re: How to get the top 10 values using timechart?. 06-05-2020 12:49 AM
- Got Karma for Condition value NOT equal to....whatever. 06-05-2020 12:49 AM
- Got Karma for If a token is equal to a value run query 1 if it is equal to another value run query 2. 06-05-2020 12:49 AM
- Got Karma for Re: Tricky regex. 06-05-2020 12:49 AM
- Got Karma for Re: Tricky regex. 06-05-2020 12:49 AM
- Got Karma for Re: Seems to be complicated regex day. 06-05-2020 12:49 AM
- Got Karma for Re: Another regex. 06-05-2020 12:49 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 0 | |||
| 0 |
05-30-2018
08:05 AM
Hi,
Is it possible to have a "smart" text or dropdown input on a dashboard?
Example:
Here is a list of account ID's
1234
1112
1113
2001
2002
3999
3998
3400
If a user inputs the number 1 then the list would be narrowed down to
1234
1112
1113
then if the user inputs another 1 (input now = 11) then the list would be further narrowed down to
1112
1113
Is this sort of thing possible?
... View more
05-29-2018
01:06 PM
Got it, using your help on the mvzip as a primer 🙂 . TY!!!
index="cox_camera_status" sourcetype=access_combined_cox_camerastatus |rex max_match=0 "Premise=\s+(?<premiseid>\d+)"|rex max_match=0 "Mac=\s+(?<macid>[a-fA-F0-9\.:-]{12,17})"|rex max_match=0 "RSSI=\s+(?<rssiid>[^\s]+)"|rex max_match=0 "Model=\s+(?<cmodel>.+)"|dedup macid|eval temp=mvzip(mvzip(macid,rssiid,"###"),cmodel,"###")|mvexpand temp | rex field=temp "(?<macid>.+)###(?<rssiid>.+)###(?<cmodel>.+)"|eval rssiid=if(cmodel="iCamera2-C" AND rssiid!=0, rssiid+-20,rssiid)|eval rssiid=if(rssiid="dB",0,rssiid)|stats list(macid) as MAC, list(cmodel) as "Camera Model" count(macid) as "Number of Cameras", list(rssiid) as RSSI by premiseid|sort premiseid RSSI|rename RSSI as "Current RSSI"|rename premiseid as "PREMISE - Click for Detail"
... View more
05-29-2018
01:02 PM
Here is a sample
Current RSSI
0
0
-47
0
-27
-60
-45
-47
-59
-48
-52
-61
0
0
-51
-35
-45
-52
-45
-45
... View more
05-29-2018
12:47 PM
no joy 😞 . I had tried that one earlier but tried it again and no luck. Something tells me it has to do with this mvzip/mvexpand thing you helped me with before. Maybe the whole query would help
index="camera_status" sourcetype=access_combined_camerastatus 8773|rex max_match=0 "Premise=\s+(?<premiseid>\d+)"|rex max_match=0 "Mac=\s+(?<macid>[a-fA-F0-9\.:-]{12,17})"|rex max_match=0 "RSSI=\s+(?<rssiid>[^\s]+)"|rex max_match=0 "Model=\s+(?<cmodel>.+)"|dedup macid|eval temp=mvzip(macid,rssiid,"###") |mvexpand temp | rex field=temp "(?<macid>.+)###(?<rssiid>.+)"|eval rssiid=if(rssiid="dB",0,rssiid)|eval rssiid=if(cmodel="iCamera2-C" AND rssiid!=0, rssiid+-20,rssiid)|stats list(macid) as MAC, count(macid) as "Number of Cameras", list(rssiid) as RSSI by premiseid|sort premiseid RSSI|rename RSSI as "Current RSSI"|rename premiseid as "PREMISE - Click for Detail"
... View more
05-29-2018
12:28 PM
Hi,
This should be easy but for some reason, my brain is making it hard. I'm trying to get a 2-condition IF statement to work and well needless to say not successfully so far.
Here is the synopsis:
If the model of a camera is iCamera2-C then add -20 to the rssiid field, but only if the rssiid field is NOT zero. I've tried multiple different ways of approaching this and I can get one condition to work but not both.
Here is the latest non-working one
eval rssiid=if((cmodel!="iCamera2-C") OR (rssiid=0),rssiid,rssiid+-20)
... View more
05-29-2018
09:36 AM
Ok first off, thank you! That worked!
would you mind walking me thru what this line is doing? I'll go read the docs as well but just so I can apply what you did to this query would be most helpful in framing it for me.
| eval temp=mvzip(macid,rssiid,"###") |mvexpand temp | rex field=temp "(?.+)###(?.+)"
... View more
05-29-2018
08:32 AM
Hi,
I have this query that works query wize but the resulting timechart is blank and I don't know why
earliest=-4hr index="camera_status" sourcetype=access_combined_camerastatus 8773|rex max_match=0 "Premise=\s+(?<premiseid>\d+)"|rex max_match=0 "Mac=\s+(?<macid>[a-fA-F0-9\.:-]{12,17})"|rex max_match=0 "RSSI=\s+(?<rssiid>[^\s]+)"|mvexpand rssiid|mvexpand macid|timechart span=1hr values(rssiid) by macid
Resulting timechart and data looks like the below.
... View more
05-29-2018
08:30 AM
ah ok that helped, still getting some odd behavior. I'll open up a new question
... View more
05-25-2018
10:39 AM
whups forgot the other part. If there is a way to graph negative numbers I'd do that as well
... View more
05-25-2018
10:38 AM
Hi,
I'm trying to do a time chart of RSSI values (typically negative values). I have a query that extracts the values and puts them into a table (just for troubleshooting). I'm also trying to convert the values to positive using the abs function but it keeps coming up blank. I've checked using isstr to see if the values were a string and needed to be converted but the function returned no (it is not a string). Can't figure out what the heck is wrong here. Thoughts?
earliest=-4hr index="camera_status" sourcetype=access_combined_camerastatus 8773|rex max_match=0 "Premise=\s+(?<premiseid>\d+)"|rex max_match=0 "Mac=\s+(?<macid>[a-fA-F0-9\.:-]{12,17})"|rex max_match=0 "RSSI=\s+(?<rssiid>[^\s]+)"|eval n=abs(rssiid)|table n rssiid
Resulting table. As you can see the rssiid comes across just fine but n (where I'm doing the eval/abs) is null
... View more
- Tags:
- splunk-cloud
05-25-2018
08:42 AM
Hi,
I have this query that filters the results to a single Premise (8773). It then extracts out the premiseid, macid and rssiid. Each mac has a corresponding rssi value. So far so good but the last mac in the below table does not reflect a rssi value even though one is there. Makes my head hurt to figure out why. Thoughts?
index="camera_status" sourcetype=access_combined_camerastatus 8773|rex max_match=0 "Premise=\s+(?<premiseid>\d+)"|rex max_match=0 "Mac=\s+(?<macid>[a-fA-F0-9\:]+)"|rex max_match=0 "RSSI=\s+(?<rssiid>[^\s]+)"|where rssiid!="dB"|stats values(premiseid) as PREMISE values(macid) as MAC, values(rssiid) as RSSI
The actual data looks like the below
Premise= 8773
Name= Front Room Camera
IP= 172.16.12.106
ID= 6
Mac= 94:4A:0C:11:92:C6
FW Ver= 3.0.01.32
Manufacturer= iControl
Model= RC8026
Video Size= LARGE
Verified= true
RSSI= -23 dB
Supported Video Formats= [MJPEG, FLV, RTSP]
Supported Video Codecs= [H264, MPEG4]
FLV URL= https://172.16.12.106:80/openhome/streaming/channels/0/flv
MJPEG URL= https://172.16.12.106:80/openhome/streaming/channels/2/mjpeg
API Version= 3.3
MotionTurnedOn= true
MotionSensitivy= 1 (LOW)
Local Video Aspect Ratio= 4:3
Local Video Resolution= 640:480
Remote Video Aspect Ratio= 4:3
Remote Video Resolution= 640:480
Name= Gate Camera
IP= 172.16.12.104
ID= 7
Mac= 78:94:B4:E8:2E:92
FW Ver= 3.0.02.51
Manufacturer= iControl
Model= iCamera2-C
Video Size= MEDIUM
Verified= true
RSSI= -56 dB
Supported Video Formats= [MJPEG, FLV, RTSP]
Supported Video Codecs= [H264, MPEG4]
FLV URL= https://172.16.12.104:80/openhome/streaming/channels/0/flv
MJPEG URL= https://172.16.12.104:80/openhome/streaming/channels/2/mjpeg
API Version= 3.3
MotionTurnedOn= false
Local Video Aspect Ratio= 16:9
Local Video Resolution= 1280:720
Remote Video Aspect Ratio= 16:9
Remote Video Resolution= 1280:720
Name= Back Of House
IP= 172.16.12.143
ID= 9
Mac= B4:A5:EF:F8:53:27
FW Ver= 3.0.02.51
Manufacturer= iControl
Model= iCamera2-C
Video Size= MEDIUM
Verified= true
RSSI= -45 dB
Supported Video Formats= [MJPEG, FLV, RTSP]
Supported Video Codecs= [H264, MPEG4]
FLV URL= https://172.16.12.143:80/openhome/streaming/channels/0/flv
MJPEG URL= https://172.16.12.143:80/openhome/streaming/channels/2/mjpeg
API Version= 3.3
MotionTurnedOn= false
Local Video Aspect Ratio= 16:9
Local Video Resolution= 1280:720
Remote Video Aspect Ratio= 16:9
Remote Video Resolution= 1280:720
Name= Back Patio Camera
IP= 172.16.12.105
ID= 5
Mac= 94:4A:0C:19:B2:58
FW Ver= 3.0.02.51
Manufacturer= iControl
Model= iCamera2-C
Video Size= LARGE
Verified= true
RSSI= -46 dB
Supported Video Formats= [MJPEG, FLV, RTSP]
Supported Video Codecs= [H264, MPEG4]
FLV URL= https://172.16.12.105:80/openhome/streaming/channels/0/flv
MJPEG URL= https://172.16.12.105:80/openhome/streaming/channels/2/mjpeg
API Version= 3.3
MotionTurnedOn= false
Local Video Aspect Ratio= 16:9
Local Video Resolution= 1280:720
Remote Video Aspect Ratio= 16:9
Remote Video Resolution= 1280:720
Name= Driveway Camera
IP= 172.16.12.103
ID= 4
Mac= 94:4A:0C:19:B2:CB
FW Ver= 3.0.02.51
Manufacturer= iControl
Model= iCamera2-C
Video Size= LARGE
Verified= true
RSSI= -58 dB
Supported Video Formats= [MJPEG, FLV, RTSP]
Supported Video Codecs= [H264, MPEG4]
FLV URL= https://172.16.12.103:80/openhome/streaming/channels/0/flv
MJPEG URL= https://172.16.12.103:80/openhome/streaming/channels/2/mjpeg
API Version= 3.3
MotionTurnedOn= false
Local Video Aspect Ratio= 16:9
Local Video Resolution= 1280:720
Remote Video Aspect Ratio= 16:9
Remote Video Resolution= 1280:720
Name= Front Porch Camera
IP= 172.16.12.102
ID= 8
Mac= E0:60:66:11:9C:31
FW Ver= 3.0.02.51
Manufacturer= iControl
Model= iCamera2-C
Video Size= MEDIUM
Verified= true
RSSI= -45 dB
Supported Video Formats= [MJPEG, FLV, RTSP]
Supported Video Codecs= [H264, MPEG4]
FLV URL= https://172.16.12.102:80/openhome/streaming/channels/0/flv
MJPEG URL= https://172.16.12.102:80/openhome/streaming/channels/2/mjpeg
API Version= 3.3
MotionTurnedOn= false
Local Video Aspect Ratio= 16:9
Local Video Resolution= 1280:720
Remote Video Aspect Ratio= 16:9
Remote Video Resolution= 1280:720
... View more
05-24-2018
01:52 PM
Hi,
I have the below data and query (with Regex), what I'd like to have the Regex do is extract ALL occurrences of MAC and RSSI values. Is there any way it can do that?
index="camera_status" sourcetype=access_combined_camerastatus|rex "Premise=\s+(?<premiseid>\d+)"|rex "Mac=\s+(?<macid>[a-fA-F0-9\.:-]{12,17})"|rex "RSSI=\s+(?<rssiid>-\d+)"|where rssiid!=0|table premiseid, macid, rssiid
Premise= 434268
Name= Rawr
IP= 172.16.12.103
ID= 4
Mac= 78:94:B4:FF:7F:C4
FW Ver= 3.0.02.51
Manufacturer= iControl
Model= iCamera2-C
Video Size= LARGE
Verified= true
RSSI= -45 dB
Supported Video Formats= [MJPEG, FLV, RTSP]
Supported Video Codecs= [H264, MPEG4]
FLV URL= https://172.16.12.103:80/openhome/streaming/channels/0/flv
MJPEG URL= https://172.16.12.103:80/openhome/streaming/channels/2/mjpeg
API Version= 3.3
MotionTurnedOn= false
Local Video Aspect Ratio= 16:9
Local Video Resolution= 1280:720
Remote Video Aspect Ratio= 16:9
Remote Video Resolution= 1280:720
Name= SammyCam
IP= 172.16.12.100
ID= 2
Mac= B4:A5:EF:E7:21:91
FW Ver= 3.0.02.51
Manufacturer= iControl
Model= iCamera2-C
Video Size= LARGE
Verified= true
RSSI= -45 dB
Supported Video Formats= [MJPEG, FLV, RTSP]
Supported Video Codecs= [H264, MPEG4]
FLV URL= https://172.16.12.100:80/openhome/streaming/channels/0/flv
MJPEG URL= https://172.16.12.100:80/openhome/streaming/channels/2/mjpeg
API Version= 3.3
MotionTurnedOn= false
Local Video Aspect Ratio= 16:9
Local Video Resolution= 1280:720
Remote Video Aspect Ratio= 16:9
Remote Video Resolution= 1280:720
Name= Unicorn Zombie Apocalypse
IP= 172.16.12.102
ID= 5
Mac= 78:94:B4:FF:7F:BF
FW Ver= 3.0.02.51
Manufacturer= iControl
Model= iCamera2-C
Video Size= LARGE
Verified= true
RSSI= dB
Supported Video Formats= [MJPEG, FLV, RTSP]
Supported Video Codecs= [H264, MPEG4]
FLV URL=
MJPEG URL=
API Version= 3.3
MotionTurnedOn= false
Local Video Aspect Ratio= 16:9
Local Video Resolution= 1280:720
Remote Video Aspect Ratio= 16:9
Remote Video Resolution= 1280:720
... View more
05-23-2018
11:18 AM
Hi,
I have the below data and I know that props and/or transforms.conf need to be modified to have the below report as 1 event. I'm not that familiar with how props/transforms.conf work since we have Splunk Cloud and have never modified them.
Premise= 135019
Name= Front Door
IP= 172.16.12.103
ID= 1
Mac= E8:F2:E2:2D:CB:73
FW Ver= 0.9.2.1708101
Manufacturer= LGInnotek
Model= Titan
Video Size= LARGE
Verified= true
RSSI= -79 dB
Supported Video Formats= [MJPEG, FLV, RTSP]
Supported Video Codecs= [H264, MPEG4]
FLV URL= https://172.16.12.103:80/openhome/streaming/channels/0/flv
MJPEG URL= https://172.16.12.103:80/openhome/streaming/channels/2/mjpeg
API Version= 3.3.7
MotionTurnedOn= true
MotionSensitivy= 1 (LOW)
Local Video Aspect Ratio= 16:9
Local Video Resolution= 1280:720
Remote Video Aspect Ratio= 16:9
Remote Video Resolution= 1280:720
... View more
05-17-2018
12:50 PM
well that is a fair question. I've not actually tried anything yet but I did look at KV_MODE=True but it appears that uses "=" as the delimiter and I wasn't sure how to change it. Then I'm looking at multiple ":" in a single line and thats where it went out of my ballpark.
... View more
05-17-2018
12:31 PM
Hi,
I have the below data that I will be importing into splunk. Id like to be able to delimit based on the FIRST (and ONLY the first) colon in the line. How would I go about doing this?
Name: HD Front Driveway
IP: 0.0.0.0
ID: 11
Mac: D4:21:22:C9:B4:62
FW Ver: 3.0.02.51
Manufacturer: iControl
Model: iCamera2-C
Video Size: LARGE
Verified: true
RSSI: dB
Supported Video Formats: [MJPEG, FLV, RTSP]
Supported Video Codecs: [H264, MPEG4]
FLV URL:
MJPEG URL:
API Version: 3.3
MotionTurnedOn: true
MotionSensitivy: 1 (LOW)
Local Video Aspect Ratio: 16:9
Local Video Resolution: 1280:720
Remote Video Aspect Ratio: 16:9
Remote Video Resolution: 1280:720
... View more
05-07-2018
01:19 PM
failed attempt #2
index=blah source="/var/nfs/SAT_SplunkLogs/wscvr/blah_portal*" [search index=blah source="/var/nfs/SAT_SplunkLogs/wscvr/blah_portal*" 405|rex "deviceregistry.(?<mac>[a-fA-F0-9\.:-]{12,17})"|dedup mac|table mac] |rex ".macAddress.:.(?<mac>[a-fA-F0-9\.:-]{12,17})"|rex "externalAccountId...(?<extref>\d+)"|where len(extref)<10| stats list(extref) AS "External Reference", values(mac) AS "Mac Address" BY mac
... View more
05-07-2018
12:59 PM
Hi,
I have this query, what I'm trying to do is pull the mac address out of events with a 405 error dedup them then put them in a table. Then taking that table search the same index and match on mac address and pull out the external account id and finally put the mac address and external account id in a table. I can break apart the query and it seems to work, just not working when I put it together. Thoughts?
index=blah source="/var/nfs/SAT_SplunkLogs/wscvr/blah_portal*" [search index=blah source="/var/nfs/SAT_SplunkLogs/wscvr/blah_portal*" 405|rex "deviceregistry.(?<mac>[a-fA-F0-9\.:-]{12,17})"|dedup mac|table mac] |rex ".macAddress.:.(?<mac>[a-fA-F0-9\.:-]{12,17})"|rex "externalAccountId...(?<extref>\d+)"|table extref|where len(extref)<10|table mac extref
... View more
04-11-2018
11:29 AM
Ahhhh now I see what was missing. Thanks Somesoni2!
... View more
04-11-2018
09:02 AM
Hi JCISplunker,
Ran this
| inputlookup yourlookup.csv | format
and ended up with this.... So it looks like the inputlookup is working
( ( MAC="944A0C19A58A" ) OR ( MAC="D42122C9B556" ) OR ( MAC="B4A5EFE7218E" ) OR ( MAC="B4A5EFE71C04" ) OR ( MAC="944A0C19A98F" ) OR ( MAC="B4A5EFE72197" ) OR ( MAC="B4A5EFE71C36" ) OR ( MAC="B4A5EFE71C3D" ) OR ( MAC="944A0C19A982" ) OR ( MAC="B4A5EFE71C2E" ) OR ( MAC="944A0C19A26A" ) OR ( MAC="B4A5EFF45530" ) OR ( MAC="E060660AA2C2" ) OR ( MAC="944A0C19A585" ) OR ( MAC="944A0C19B6A3" ) OR ( MAC="D42122C9B486" ) OR ( MAC="B4A5EFE72031" ) OR ( MAC="B4A5EFE72072" ) OR ( MAC="B4A5EFE7218C" ) OR ( MAC="944A0C19A230" ) OR ( MAC="D42122C9B462" ) OR ( MAC="B4A5EFE71C26" ) OR ( MAC="944A0C19B3BD" ) OR ( MAC="D42122D9C3BC" ) OR ( MAC="944A0C19A222" ) OR ( MAC="B4A5EFE72076" ) OR ( MAC="B4A5EFF43C37" ) OR ( MAC="E060660AA2C2" ) OR ( MAC="944A0C1D7091" ) OR ( MAC="7894B4E8C2B2" ) OR ( MAC="B4A5EFE72196" ) OR ( MAC="D42122C9B503" ) OR ( MAC="944A0C179598" ) OR ( MAC="D42122C9B581" ) OR ( MAC="E06066144107" ) OR ( MAC="944A0C254208" ) OR ( MAC="7894B4FA4E5E" ) OR ( MAC="B4A5EFE72081" ) OR ( MAC="B4A5EFE72069" ) OR ( MAC="944A0C19B504" ) OR ( MAC="B4A5EFE72192" ) OR ( MAC="E06066144125" ) OR ( MAC="7894B4EEFE71" ) OR ( MAC="944A0C19A1F8" ) OR ( MAC="D42122C9B57E" ) OR ( MAC="7894B4FA4E64" ) OR ( MAC="B4A5EFF45520" ) OR ( MAC="944A0C10FECB" ) OR (
... View more
04-11-2018
08:07 AM
Hi,
I have this updated query which now returns results but they are inaccurate. The results include MAC addresses that are NOT in the lookup file
earliest=-1h index="xhome" sourcetype="cvr-mesos-stdout" source="*latest*" cvr-livecache-service thumbnail "POST /" | rex field=_raw "\[Sercomm (?<cammodel>[\w-]+) (?<firmware>[\w.]+) (?<mac>\w+)\]" | append [ | inputlookup CoxQAMACs.csv | fields MAC ]| eval output="mac="+ mac + " model="+ cammodel + " firmware=" + firmware | fields output
... View more
04-10-2018
12:52 PM
lookup table just has one column . ->MAC
within the event the extraction is done in the search via rex, resolves to field ->mac
... View more
04-10-2018
12:31 PM
Hi,
I have a lookup table that is just a list of MAC addresses. I need to be able to search a data set that has mac addresses in the event (extracted via a rex function - this is already done) and pull out the firmware version.
I have a query that looks like this but sadly it doesn't match any events
index="blah" sourcetype="cvr-mesos-stdout" source="*latest*" cvr-livecache-service thumbnail "POST /" [ | inputlookup blahQAMACs.csv | fields MAC ]| rex field=_raw "\[Sercomm (?[\w-]+) (?[\w.]+) (?\w+)\]" | eval output="mac="+ mac + " model="+ cammodel + " firmware=" + firmware | fields output
... View more
03-20-2018
11:32 AM
it worked perfectly! Many thanks!!!
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:04 AM
|
Karma given to
