Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Are you a member of the Splunk Community?
Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- Find Answers
- :
- About whrg
whrg
Motivator
Member since:
11-29-2018
09-18-2024
Community Statistics
| Posts | 320 |
| Solutions | 73 |
| Karma Given | 96 |
| Karma Received | 110 |
| Member Since | 11-29-2018 |
Activity Feed
- Posted Re: Splunk User of windows SplunkForwarder on Getting Data In. 08-14-2024 09:13 AM
- Karma Re: Splunk User of windows SplunkForwarder for Shahrukh_S. 08-14-2024 09:12 AM
- Karma Re: Splunk User of windows SplunkForwarder for gcusello. 08-14-2024 09:12 AM
- Got Karma for Re: What is crc_Salt = means and in which case its used?. 08-01-2024 09:04 AM
- Posted Re: Cannot change email address of Splunk Community account on Other Usage. 06-23-2024 07:46 AM
- Posted Re: Cannot change email address of Splunk Community account on Other Usage. 06-19-2024 11:48 PM
- Posted Cannot change email address of Splunk Community account on Other Usage. 06-19-2024 10:39 AM
- Got Karma for Re: How can I find out what the deployment errors are?. 06-07-2024 11:14 AM
- Posted Re: How do I change the email address of my splunk.com account? on Other Usage. 05-28-2024 03:35 AM
- Posted Re: How do I change the email address of my splunk.com account? on Other Usage. 05-28-2024 03:23 AM
- Posted How do I change the email address of my splunk.com account? on Other Usage. 05-28-2024 03:07 AM
- Got Karma for How to prevent automatic translation of input labels?. 03-06-2024 12:09 AM
- Posted Re: KVStore is not ready. Token auth system will not work. on Splunk Enterprise. 03-05-2024 04:48 AM
- Posted KVStore is not ready. Token auth system will not work. on Splunk Enterprise. 02-29-2024 04:26 AM
- Got Karma for Re: How can I automate the downloading of universal forwarder?. 01-10-2024 09:12 AM
- Got Karma for Re: How come our Splunk 6.5 REST API calls with curl command are not working?. 01-24-2023 05:45 AM
- Got Karma for Re: Can you help me identify when end time overlaps start time for the following events?. 12-11-2022 04:24 PM
- Posted How to prevent automatic translation of input labels? on Dashboards & Visualizations. 12-07-2022 12:25 AM
- Got Karma for Re: What is crc_Salt = means and in which case its used?. 10-03-2022 03:01 AM
- Got Karma for Re: How can I automate the downloading of universal forwarder?. 08-17-2022 02:14 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 1 | |||
| 1 | |||
| 0 | |||
| 13 | |||
| 1 |
12-06-2018
04:52 AM
Hi! Could you post the initial form?
... View more
12-06-2018
01:06 AM
Hi! Try it like this using join commands:
| inputlookup userlist.csv | table username,fullname
| join username type=left [search index=... | stats count by username,workstation_name | sort -count | dedup username | table username,workstation_name]
| join workstation_name type=left [search index=... | dedup workstation_name,ip_addr | table workstation_name,ip_addr]
| table username,fullname,workstation_name,ip_addr
With "| stats count by username,workstation_name | sort -count | dedup username" you will get the user's most-used workstation.
With "| dedup workstation_name,ip_addr" you will get the most recent IP address for each workstation.
... View more
12-05-2018
06:02 AM
First, you need to find out which fields are relevant for your search. Search for logins by Account_AB in Splunk and have a look at the available fields. Relevant fields might be EventCode, Account_Name, Workstation_Name...
If you are using the Windows Add-on then there should be standardized CIM fields available like tag, user and src.
Now create a search to find login events by Account_AB from systems other than Server_A:
index=* source="WinEventLog:Security" tag=authentication action=success user="Account_AB" src!="Server_A"
Now save this search as an alert and have the trigger condition "Number of Results is greater than 0".
... View more
12-05-2018
05:39 AM
How about using a single value panel showing the total number of results as well as a drilldown to the actual search?
Like this:
<dashboard>
<label>Dashboard with Drilldowns</label>
<row>
<panel>
<single>
<title>index=_* sourcetype=splunkd</title>
<search>
<query>index=_* sourcetype=splunkd | stats count</query>
<earliest>-60m@m</earliest>
<latest>now</latest>
</search>
<option name="drilldown">all</option>
<option name="refresh.display">progressbar</option>
</single>
</panel>
</row>
</dashboard>
To add a drilldown to a single value panel in the UI editor, click on the three dots (More actions) next to the single value, then on Edit Drilldown and then Link to search.
... View more
12-05-2018
04:41 AM
I edited my first reply and added the sed command because apparently comments cannot display backslashes.
... View more
12-05-2018
03:47 AM
Hi!
Check out the Splunk documentation on Anonymize data.
EDIT: Here is the sed command:
s/\(SecurityQuestion\).+?\(SecurityQuestion\)\(SecurityAnswer\).+?\(SecurityAnswer\)/(SecurityQuestion)########(SecurityQuestion)(SecurityAnswer)########(SecurityAnswer)/g
... View more
12-05-2018
03:42 AM
It is working.
However, I cannot find any documentation as to Splunk handles multiple match objects.
... View more
12-05-2018
03:36 AM
Which operating system is running on the new host?
My first thought is that the system language is different on the new host. Depending on the language, the date might get displayed/interpreted differently.
To demonstrate on CentOS:
# localectl
System Locale: LANG=en_US.UTF-8
# date +"%x"
12/05/2018
# localectl | grep Locale
System Locale: LANG=de_DE.utf8
# date +"%x"
05.12.2018
... View more
12-05-2018
03:25 AM
I can see a lot of field extractions and evals in the highlighted section.
I think it might be best if you create field extractions and calculated fields via Settings / Fields. Then the fields will be automatically created for every search.
... View more
12-05-2018
01:34 AM
Hi! Check this out:
| makeresults count=1
| eval folder="prova^1.ED56GH"
| rex mode=sed field=folder "s/\./\//g"
| rex mode=sed field=folder "s/\^/./g"
Then you get:
folder
prova.1/ED56GH
Alternatively:
| makeresults count=1
| eval folder="prova^1.ED56GH"
| eval folder=replace(replace(folder,"\.","/"),"\^",".")
You could save this eval expression as a calculated field via Settings / Fields / Calculated fields.
... View more
12-05-2018
12:39 AM
Hi! I'm not 100% this will work. Try it like this:
ps -C splunkd -o user:50
If it is a local account then you should get something like "root".
If it is a domain account then you should get something like "user@domain".
So if the output contains a @ symbol then Splunk is run by a domain account.
... View more
12-05-2018
12:07 AM
2 Karma
Hi!
Try it like this:
...
| streamstats current=false last(start_time) as next_start_time
| eval overlap=if(next_start_time<end_time,"yes","no")
Then it looks like this:
run_date ObjectStore start_time end_time next_start_time overlap
2018-12-03 Underwriting 22:12:48 05:03:44 no
2018-12-03 Claims 20:40:03 20:51:23 22:12:48 no
2018-12-03 Life 18:25:00 22:06:29 20:40:03 yes
2018-12-03 FSCD 17:45:01 18:13:03 18:25:00 no
2018-12-03 Marketing 17:40:00 17:42:02 17:45:01 no
2018-12-03 HumanResources 17:30:00 17:38:25 17:40:00 no
2018-12-02 Underwriting 22:30:03 05:48:57 17:30:00 no
2018-12-02 Claims 20:45:03 20:55:04 22:30:03 no
2018-12-02 Life 18:33:04 20:52:03 20:45:03 yes
2018-12-02 FSCD 17:45:02 18:07:51 18:33:04 no
2018-12-02 Marketing 17:40:01 17:41:16 17:45:02 no
2018-12-02 HumanResources 17:35:00 17:39:23 17:40:01 no
You will need to add the run date to start_time and end_time, i.e. it should look something like "2018-12-03 22:12:48". Otherwise there will be a false positive if a process runs past midnight because "00:10:00"<"23:30:00" will evaluate to true. However, "2018-12-03 00:10:00"<"2018-12-02 23:30:00" will not.
Alternately, instead of run_date have two columns such as start_date and end_date and then modify the streamstats command to calculate last(start_time) as well as last(start_date).
... View more
12-04-2018
11:41 PM
Thank you for your answer!
When I test your regex then I see there are two match objects:
https://regex101.com/r/lQXqFx/1
How will Splunk behave in this case?
... View more
12-04-2018
07:24 AM
Hi!
Try this:
basesearch | stats earliest(value) as earliest latest(value) as oldest by host
... View more
12-04-2018
07:19 AM
For testing purposes, I uploaded the following csv file into index1:
time,ip4
2018-12-04,192.168.0.1
2018-12-04,192.168.0.2
2018-12-04,192.168.0.3
2018-12-04,192.168.0.4
Then I uploaded this file into index2:
time,ip4
2018-12-04,192.168.0.2
2018-12-04,192.168.0.4
2018-12-04,192.168.0.5
When I search for "index=index1 | table ip4" then I get:
ipv4
192.168.0.4
192.168.0.3
192.168.0.2
192.168.0.1
When I search for "index=index2 | table ip4" then I get:
192.168.0.5
192.168.0.4
192.168.0.2
Now when I search for "index=index1 NOT [search index=index2 | fields ip4] | table ip4" then I get (as expected):
192.168.0.3
192.168.0.1
... View more
12-04-2018
05:32 AM
Hello,
I have events that span multiple lines. One such event looks as follows:
...
# User details
ID: 123
Username: admin
Group: admin
Group: bin
...
Each event has at least one Group line.
I want to create a field extraction for the first occurence of Group.
So, for the example above the extracted field should have the value admin.
How do I create such a field extraction?
... View more
12-04-2018
12:28 AM
1 Karma
I had a similar issue once. I found out that regular expressions are not fully supported in stanzas.
However, I got it working like this:
[source::/path/(foo|bar)*.log]
... View more
12-04-2018
12:03 AM
How about:
index=main
| ...
| stats earliest(cpu) as total_cpu earliest(start_time) as start_time sum(cpu) as MB by job
| eval pct = ...
... View more
12-03-2018
11:49 PM
@chirsf
You wrote "LocalAddressIP4!=127.0.0.1 LocalAddress!=0.0.0.0". Is that a typo or do you have multiple IP fields (LocalAddressIP4 + LocalAddress) in INDEX1?
Because if you search for nonexistentfield!="something" then you won't get any results.
... View more
12-03-2018
11:35 PM
If you have multivalue fields like src_nt_hosts then you could either use
| mvexpand src_nt_hosts
or
| eval src_nt_hosts=mvindex(src_nt_hosts,1)
... View more
12-03-2018
11:30 PM
If these are real names in your sample data, you should mask them via ***.
Okay, so either you use these field names (Workstation_Name,Account_Name...) and place them in the search query above or you setup the Windows add-on to have the CIM fields user,src,dest... extracted automatically.
... View more
12-03-2018
12:48 PM
Hi!
Try using a subsearch like this:
index=index1 NOT [search index=index2 | fields ip_field]
In this example, both data sets should have the field ip_field.
If the field names (which you want to compare) are different, use rename to make them the same:
index=index1 NOT [search index=index2 | rename device as ip_field | fields ip_field]
... View more
12-03-2018
11:40 AM
Hi!
When creating the macro, did you enable Use eval-based definition (iseval = 1)?
If so, the macro will return a string. In your example that would be Yes, without quotes. Now tostring(Yes) in your search will return Null.
I tried it differently:
Name: FilterDates(1)
Definition: case(4>5,"No",5>4,"Yes",1=1,"Shrug")
Use eval-based definition: No
Arguments: arg1
Now when I search for
| makeresults count=1 | eval keep=`FilterDates(weeks)`
then I get:
keep
Yes
... View more
12-03-2018
08:13 AM
If two queries are fine (one for total count and one for failed ount) then you can search for:
index=... ... field1="News" | stats count
and
index=... ... field1="News" field4="Media" | stats count
If you require only one search then do it as follows:
index=... ... field1="News" | stats count as total_count count(eval(field4=="Media")) as failed_count
... View more
12-03-2018
07:59 AM
Do you have the Splunk Add-on for Microsoft Windows installed on your search head and indexers?
When you run "index=* EventCode=4625 | head 100 | table _time,tag,action,user,src" then do you see a table with all columns nicely filled out?
Alternatively, replace "user" and "src" with your own fields.
Also, remove the last line "| search count_users>10" for testing purposes.
... View more
- « Previous
- Next »
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
09-18-2024
08:46 AM
|
