Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- Find Answers
- :
- About andrey2007
andrey2007
Contributor
Member since:
07-29-2011
06-23-2020
Community Statistics
| Posts | 131 |
| Solutions | 9 |
| Karma Given | 115 |
| Karma Received | 31 |
| Member Since | 07-29-2011 |
Activity Feed
- Got Karma for Re: Query To Identify Who Has Exported Data. 11-20-2020 10:30 AM
- Got Karma for Re: Query To Identify Who Has Exported Data. 06-25-2020 06:42 AM
- Karma Location and site definition in Indexer Cluster for SirHill17. 06-05-2020 12:49 AM
- Karma Re: Location and site definition in Indexer Cluster for nickhills. 06-05-2020 12:49 AM
- Karma Re: Split a column in the search data into multiple columns for gcusello. 06-05-2020 12:49 AM
- Karma Re: put splunk heavy forwarders behind loadbalancer for somesoni2. 06-05-2020 12:49 AM
- Karma Re: Can anyone tell how to get below graph using splunk. for cmerriman. 06-05-2020 12:49 AM
- Karma Re: Store Search Head collect on Search Peer for harsmarvania57. 06-05-2020 12:49 AM
- Got Karma for Re: Store Search Head collect on Search Peer. 06-05-2020 12:49 AM
- Got Karma for Re: How to filter date based on the future data?. 06-05-2020 12:49 AM
- Got Karma for Re: How to search anything from yesterday at 8 pm (20:00)?. 06-05-2020 12:49 AM
- Got Karma for Re: Need to shorten data and show it by count. 06-05-2020 12:49 AM
- Got Karma for Re: How to change table column headings?. 06-05-2020 12:49 AM
- Karma Duration between two events with start event re-occuring for splunkswede. 06-05-2020 12:48 AM
- Karma Re: Splunk archiving: how to reduce the number of buckets for martin_mueller. 06-05-2020 12:48 AM
- Karma Re: How to fix error "Forwarding to indexer group default-autolb-group blocked for 100 seconds"? for jensonthottian. 06-05-2020 12:48 AM
- Karma Every 15 min we get the following error: "Unknown error for peer . Search Results might be incomplete. If this occurs frequently, please check on the peer." for stefan1988. 06-05-2020 12:48 AM
- Karma Splunk App and Add-on for Unix and Linux: Why are my dashboards not loading? for saifuddin9122. 06-05-2020 12:48 AM
- Karma Re: How to center the title of a panel and color the title background? for jeffland. 06-05-2020 12:48 AM
- Karma Re: Using wildcards * in lookup csv files for aakwah. 06-05-2020 12:48 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 3 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 1 | |||
| 0 | |||
| 0 | |||
| 1 |
10-17-2014
04:21 AM
1 Karma
I have an index with start and finish time of user`s workday
27.08.2014 user="userA" weekday="monday" worktime="10.00-18.00"
27.08.2014 user="userB" weekday="monday" worktime="12.00-16.00"
.....
27.08.2014 user="userZZ" weekday="monday" worktime="09.00-16.00"
search for this looks like index=workday |....| table date, user, weekday, worktime
AND I have a csv timetable for every user for every day of week in different index(index=timetable)
user;monday_work_hours;tuesday_work_hours;......;sunday_work_hours
userA; 8.00-12.00;13.00-19.00;..........................................;12.00-16.00
.....
userZ; 7.00-12.00;11.00-19.00;..........................................12.00-19.00
AS a result i need a table like this
date user worktime work_hours
27.08.2014 "userA" "10.00-18.00" 8.00-12.00
now I have only idea about join and case
index=workday | eval....| fields date, user, weekday, worktime | join user [search index=timetable | eval work_hours=case(weekday="monday", monday_work_hours,.....,weekday="sunday", sunday_work_hours)| table date user worktime work_hours
but I have no idea how put weekday value to search in join((
If I will make LOOKUP table from csv table i have no idea how to compare field value and field name
for example for userA weekday="monday" and value in table monday_work_hours=8.00-12.00
Thanks all for help.
... View more
06-30-2014
04:20 AM
Hello, Alex
I have the same question which I described above with standalone search head server.
"I found new moment , Two users can not use Excel app at the same moment! Who ran export later gets error message page"
Is it possible to install Excel Export App on cluster of Search Heads which is used by 100 users at the same time (100 users press export button at the same time)?
... View more
06-30-2014
03:58 AM
Yes, it would be great if splunk will send e-mail with excel report. May be during year something changed and it is possible now?
... View more
04-29-2014
06:45 AM
and it does not work for case like this user has only Login1 OR Login2
Number Name Position Login1 Login2
1 John expert johns2
2 Willy expert will1
... View more
04-25-2014
06:14 AM
Thanks, it works!
But with message like this
Field 'Login' does not exist in the data.
... View more
04-21-2014
06:26 AM
sorry, but not
this way table looks like
Number Name Position Login2
... View more
04-21-2014
06:08 AM
Hello All
My table looks like these
Number Name Position Login1 Login2
1 John expert johns1 johns2
is it possible to make another table which looks like
Number Name Position Login
1 John expert johns1
2 John expert johns2
Thanks for all answers!
... View more
- Tags:
- row
03-07-2014
04:55 AM
Yes I had to choose this way and now i am modifying sendemail.py in search app.
... View more
03-07-2014
04:02 AM
But i will get alert name, link to results and etc. even if i turn off pdf delivery and include inline results(
... View more
03-07-2014
01:38 AM
yes, it is pdf attachment. My main goal is to get only table without message headers(alert name, link to results and etc.)
... View more
03-06-2014
03:13 AM
something like result of chart command execution but it is empty and has legend with specified field names which I used in my search (user host source).
... View more
03-06-2014
02:47 AM
Sure but when I make it i receive on email table with my results and empty graph above it. I do not know where does this graph originates from? So I tried sendemail command.
... View more
03-06-2014
02:29 AM
I use sendemail command in scheduled search which runs every 5 minutes .
search looks like
index=myindex user=* | table user host source| sendemail.py to="[email protected]" subject="SPLUNK alert" sendresults=true server=1.1.1.1
Even there are no results i receive message with text "No results".
Is it possible to exclude such messages?
... View more
03-05-2014
12:34 AM
I found new moment , Two users can not use Excel app at the same moment! Who ran export later gets error message page.
... View more
02-07-2014
03:08 AM
Is it a long way or may be I can do it if I make a copy of this app with another wb_client file?
... View more
02-05-2014
06:02 AM
1 Karma
Hello all!
My question is about Excel export app.
As i understand there is file wb_client.py which describes template of excel sheet and export format. Sometimes i need another template say with title of table.
Is it possible to create wb_client2.py file for exporting results in another template or i need to write ExcelExport2 module?
May be you have any ideas or advices?
... View more
12-26-2013
04:32 AM
Users use the same dashboard. There are 3 pulldown modules for choosing field values and final search which uses pulldown results. Size of my index near 800.000 events and it populates when nobody uses splunk.
... View more
12-26-2013
04:08 AM
Hello, all!
Shortly describe my problem.
We need that near 50 users can use Splunk at the same moment. Is it possible say on server like this: total 16 cores and 24 GB RAM (same server for indexing and searching)?
Or may be you have experience in using Splunk in cases like my , please describe you hardware.
... View more
- Tags:
- multiuser
12-09-2013
04:24 AM
I made it this way: I set permisions (view and Write)for Search app only for admin, so user can not see Settings view.
... View more
12-09-2013
04:17 AM
The reason was in McAfee antivirus settings we turned it off and allstarted to work!
... View more
12-09-2013
02:27 AM
May be my case is similar
I use splunk 6 and excel export app v2.0.3, my splunk web is at https://127.0.0.1:8000, but when i press excel export button i have window with file name and row limitation then i press export button and i get page at
https://127.0.0.1:8000/en-US/custom/excel_export/excel/1386581618.26?filename=srgsrt&count=10000
WEB page not found
Error code: ERR_FILE_NOT_FOUND
... View more
08-21-2013
12:38 AM
Certainly now your answer is the most complete but i am interesting in use cases. As i know Qradar and splunk ES are quite equal products(SIEMs) and have the same reports. That is why it is interesting for me to know is any profit from such kind of integration.
... View more
07-26-2013
12:12 AM
1 Karma
Hello,
I am interested in examples of integration of Splunk as data source to QRadar.
May be somebody has any? What kind of data, in what format and what way have you sent to Qradar?
Is it a complicated process?
Thanks for any advice!
... View more
- Tags:
- qradar
