About andrey2007

andrey2007 · ‎07-18-2013

I saw this file but i have no permissions to edit it. I need that dbx works continuously that why it is not solution for me.Is it a DBX app bug?

andrey2007 · ‎07-01-2013

My tail input is not populating, i use ID field as increasing value. Once i created input, splunk indexed 12080826 events (12080826 it is a number of events in index created for this input). But later splunk tries to apply latest tail.rising.column value=12081329( i looked at dbx log), how can i change this value to 12080827 to make splunk continue indexing with next event?

andrey2007 · ‎06-27-2013

That is really good advice! but i have one question. I have How can i come over it? as i understand i can not do it using pulldown

andrey2007 · ‎06-17-2013

Thanks i used this app and UI Examples app, but my trouble is that: pulldown uses Search but staticselect uses hiddensearch. Now i have no ideas how to construct my search.

andrey2007 · ‎06-17-2013

Hello all, i need to create a view with multiple forms ( pulldowns, SearchSelectLister,StaticSelectListers and etc). Search consists of 2 indexes and join command, in first index i select depatment and login, using Pulldown and surname using static select , in second index i choose date using static select, then i chose surname and . Now i am in doubts how to do it best way. What should be the structure of my XML? Here is brief XML of my view Pulldown * 2 False index="1c3" | fields LOGIN, Department Department Department Department="$value$" <param name="postProcess">dedup $name$ | sort $name$</param> <param name="valueField">$name$</param> <module name="Pulldown"> <param name="name">LOGIN</param> <param name="label">LOGIN</param> <param name="size">4</param> <param name="template">LOGIN="$value$"</param> <param name="separator">+OR+</param> <param name="outerTemplate">( $value$ )</param> <param name="postProcess">search $Department$ | dedup $name$ | sort $name$</param> <param name="valueField">$name$</param> <module name="Search" > <param name="search">index="1c3" $Department$ $LOGIN$ surname=$surname$| join Login [search index=database] | search date=$date$| table Login Department date </param> <module name="StaticSelect"> <param name="staticFieldsToDisplay"> <list> <param name="value">*</param> <param name="label">all</param> </list> <list> <param name="value">1</param> <param name="label">1</param> </list> <list> <param name="value">2</param> <param name="label">2</param> </list> </param> <param name="label">Date</param> <param name="settingToCreate">date_setting</param> <param name="searchWhenChanged">False</param> <module name="ConvertToIntention"> <param name="settingToConvert">date_setting</param> <param name="intention"> <param name="name">stringreplace</param> <param name="arg"> <param name="date"> <param name="fillOnEmpty">True</param> <param name="value">$target$</param> </param> </param> </param> <module name="StaticSelect"> .... <!-- static select for surname> .... <module name="Pager"> <param name="entityName">results</param> <module name="Table"></module> </module> </module>

andrey2007 · ‎05-22-2013

I want my users to see only my app view and can not go to(see this links) manager, app and jobs. How can i restrict it?

andrey2007 · ‎04-26-2013

To Emiller42 I made this way and I got some transactions for the same user in the same day

andrey2007 · ‎04-26-2013

Thanks, but this way i will get number of transactions equal to number of user s logins for this day, but i need 1 transaction with all user actions since first login for day

andrey2007 · ‎04-25-2013

Hello, i group my events in transactions by user and day ...| transaction user day and then calculate duration, eventcount, time of transaction started and finished in logs there are fields action_type and action_time i want transaction to start with action_type=login and action_time for this action_type for this user and day is minimal, i.e. i want start transaction since first time user login this day something like this... | transaction user day startswith=min(action_time for action_type=login) What commands should i write? Thank a lot for answers!

andrey2007 · ‎03-21-2013

I need to group events by 3 filelds ip,login,city user1 192.168.1.1 London field4...fieldn user1 192.168.1.1 London field4...fieldn user1 192.168.1.1 London field4...fieldn user1 2.2.2.2 London field4...fieldn user1 2.2.2.2 London field4...fieldn .... user10 4.4.4.4 NY field4...fieldn user10 4.4.4.4 NY field4...fieldn user10 4.4.4.4 NY field4...fieldn after this i need to calculate custom fields INSIDE EVERY GROUP, for example sum of events in group with field4 s value=5, minimal value of fieldn where field4=12 and etc. in one table-report What s the best way to do it?

andrey2007 · ‎03-15-2013

the final goal of my question is to know how can i realize in splunk full outer join, i made something like this (search1) join by field [search2] | append [(search2) join by field [search1]]| dedup field it works correct, but it looks terrible and not optimal. Search on 200 events takes near 7 seconds, but this search is for 3000 events

andrey2007 · ‎03-14-2013

Hello, i need do something like this select t_resources.t_name, t_users.t_nick from t_resources left join t_users on t_users.t_id = t_resources.t_userid union select t_resources.t_name, t_users.t_nick from t_resources right join t_users on t_users.t_id = t_resources.t_userid I know there is only left join in Splunk, i can get right join from left by exchanging names of tables. How can i get union operator?

andrey2007 · ‎03-13-2013

Thanks, but this request works not the way i need,

andrey2007 · ‎03-11-2013

i made without transaction command 1st report ...|where field4==12 | stats min(fieldn) by ip, login, city 2nd report ...|where field4==5 | stats count(field4) by ip, login, city but i need it all in one united report

andrey2007 · ‎03-11-2013

Basically, I need to group my events by 3 fields (LOGIN, field 1, field 2) and make custom calculations in each group(activity duration, login attempts, custom operation counts and so on). For example, events have 2 additional fields “TIME” and “TYPE”, besides 3 grouping fields. So in each group I need to find one event with “min (Time) AND Type=Login” and another one event with “max (Time) AND Type=Logout”. And calculate time difference between these two events. timeDifference = Time2 - Time1. Also, after timeDifference calculation I need to calculate some additional fields. For example, count of events included in group with “Type=Access denied” What is the best way to do this?

andrey2007 · ‎03-07-2013

Hello, I need to group events by 3 filelds ip,login and city (one group with same login,same ip and same city), something like this user1 192.168.1.1 London field4...fieldn user1 192.168.1.1 London field4...fieldn user1 192.168.1.1 London field4...fieldn user1 2.2.2.2 London field4...fieldn user1 2.2.2.2 London field4...fieldn .... user10 4.4.4.4 NY field4...fieldn user10 4.4.4.4 NY field4...fieldn user10 4.4.4.4 NY field4...fieldn after this i need to calculate custom fields INSIDE EVERY GROUP, for example sum of events in group with field4`s value=5 or minimal value of fieldn where field4=12. I tried to use transaction command | transaction ip, login, city but I don`t find out how to calculate custom fileds separately for each transaction. Also, I was looking at stats command, but as I understood, it`s not possible to use eval command inside stats statement. What`s the best way to do it?

andrey2007 · ‎02-17-2013

yes i setup to access_combined

andrey2007 · ‎02-14-2013

I locally index data from apache server. I can see events for search sourcetype="access_*" and field extraction works but no data in all reports. Any Ideas? Thanks Andrey

andrey2007 · ‎01-31-2013

Yes, my system is up to date and with correct time, for testing i have one Splunk instance.

andrey2007 · ‎01-31-2013

Hello, i have Splunk on freebsd 8.2 and i collect logs from Cisco Ips with Splunk for Cisco IPS App(using scripted input). Trouble is in timestamps, if event occurs at present moment, i see this event on splunk through some seconds, but with timestamp like this event was one hour ago. On freebsd i have Moscow timezone and correct time, time on Ips corresponds to realtime too, but in Splunk (Manager=>Your account) Moscow timezone is UTC+3, but really Moscow timezone is UTC+4. This is a problem. How can i change timestamps? Or may be somebody knows another solution for this problem. P.s. i tryed to change props.conf for this app, may be i forgot something? this is my props.conf [source::/opt/splunk/etc/apps/Splunk_CiscoIPS/var/log/ips_sdee.log.192.22.97.82] [cisco_ips_syslog] TZ = AE

andrey2007 · ‎10-30-2012

from splunkd.log ERROR ExecProcessor - message from ""D:\Program Files\Splunk\etc\apps\sos\bin\sospowershell.cmd" ps_sos.ps1" "Powershell" \xAD\xA5 \xEF\xA5\xE2\xE1\xEF \xA2\xAD\xE3\xE2७\xAD\xA5\xA9 \xA8\xAB\xA8 \xA2\xAD\xA5譥\xA9 i think this is reason, but what does it mean? what version of SOS sshould i follow for splunk start working?

andrey2007 · ‎10-30-2012

i saw this file but there nothing about splunk 5 and SOS 2.3.0

andrey2007 · ‎10-30-2012

What logs? Should i set windows event log as input?

andrey2007 · ‎10-30-2012

I have Splunk 5 on Windows, today i installed SOS 2.3.0, but i do not see graphs in Resource Usage>Splunk CPU/Memory Usage, only No results found. Inspect ... Did somebody have the same problem and what`s way to resolve problem?

andrey2007 · ‎02-08-2012

Thank you.

Posts	131
Solutions	9
Karma Given	115
Karma Received	31
Member Since	‎07-29-2011

Online Status	Offline
Date Last Visited	‎06-23-2020 12:08 PM

Change font size in Radial Gauge

How to create a user role with capabilities to man...

HF1 -> HF2 -> Indexer: How to route a set of data ...

Cloning set of data to specified Splunk indexer

How to edit my heavy forwarder tcpout configuratio...

Why should I use search head clustering and what a...

How to join field name and field value?

How to make from one row two?

Sendemail command

Excel export custom template

Re: How can I make DBX tail input populate?

How can I make DBX tail input populate?

Re: Pulldown and static select in view

Re: Pulldown and static select in view

Pulldown and static select in view

How to restrict user from links to App | Manager ...

Re: Transaction startswith

Re: Transaction startswith

Transaction startswith

Re: Union in Splunk like in MySQL

Re: Union in Splunk like in MySQL

Union in Splunk like in MySQL

Re: Field calculations in groups of events

Re: Calculating fields by groups of events

Field calculations in groups of events

Calculating fields by groups of events

Re: Web intelligence no data in reports

Web intelligence no data in reports

Re: How can i change timestamp?(Moscow Timezone in...

How can i change timestamp?(Moscow Timezone inexac...

Re: SOS 2.3.0 on Splunk 5

Re: SOS 2.3.0 on Splunk 5

Re: SOS 2.3.0 on Splunk 5

SOS 2.3.0 on Splunk 5

Re: Indexed data and Licensing

Join the Conversation