Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- Find Answers
- :
- About jrodriguezap
jrodriguezap
Contributor
Member since:
08-06-2013
06-22-2025
Community Statistics
| Posts | 110 |
| Solutions | 1 |
| Karma Given | 19 |
| Karma Received | 16 |
| Member Since | 08-06-2013 |
Activity Feed
- Posted Re: separate rows from columns with multivalue on Splunk Search. 06-22-2025 11:04 AM
- Posted Re: separate rows from columns with multivalue on Splunk Search. 06-22-2025 11:02 AM
- Posted separate rows from columns with multivalue on Splunk Search. 06-16-2025 05:01 PM
- Got Karma for Where to add custom artifact types to use in the workbench?. 01-12-2023 02:57 AM
- Got Karma for How to display dashboard panels dynamically?. 12-29-2022 11:09 AM
- Posted Re: Where to add custom artifact types to use in the workbench? on Splunk Enterprise Security. 12-19-2022 05:03 PM
- Posted Where to add custom artifact types to use in the workbench? on Splunk Enterprise Security. 12-04-2022 02:12 PM
- Karma Re: command map not working for to4kawa. 06-05-2020 12:51 AM
- Karma Re: How to write a search to merge logs with transaction where OR if? for OL. 06-05-2020 12:47 AM
- Karma Re: Can inner join be used to join null fields? for musskopf. 06-05-2020 12:47 AM
- Karma Re: How to get top 2 MB users per website? for lguinn2. 06-05-2020 12:47 AM
- Karma Re: How to prevent field names with periods (.) OR hyphens (-) from getting replaced with underscores (_)? for martin_mueller. 06-05-2020 12:47 AM
- Karma Re: return command works only with numeric values? for musskopf. 06-05-2020 12:47 AM
- Got Karma for Re: return command works only with numeric values?. 06-05-2020 12:47 AM
- Got Karma for How to display dashboard panels dynamically?. 06-05-2020 12:47 AM
- Got Karma for How to display dashboard panels dynamically?. 06-05-2020 12:47 AM
- Got Karma for Re: How to display dashboard panels dynamically?. 06-05-2020 12:47 AM
- Got Karma for How to get top 2 MB users per website?. 06-05-2020 12:47 AM
- Got Karma for Can inner join be used to join null fields?. 06-05-2020 12:47 AM
- Got Karma for How to write a search to merge logs with transaction where OR if?. 06-05-2020 12:47 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 1 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 3 | |||
| 0 | |||
| 0 |
08-28-2014
03:19 PM
1 Karma
Hi there
A query, you can do something like a "transaction where"
For example, all of the following logs, merged with the exception of those with the "dst" field
Aug 27 17:42:40 172.24.20.35 sessionid=53f2b45b0526 [email protected]
Aug 27 17:42:40 172.24.20.35 sessionid=53f2b45b0526 subject="regards"
Aug 27 17:42:40 172.24.20.35 sessionid=53f2b45b0526 size=452132
Aug 27 17:42:40 172.24.20.35 sessionid=53f2b45b0526 [email protected]
Aug 27 17:42:40 172.24.20.35 sessionid=53f2b45b0526 [email protected]
Aug 27 17:42:40 172.24.20.35 sessionid=53f2b45b0526 [email protected]
Whereas should continue to show the logs have "dst"
PS: Skip APPEND
... View more
- Tags:
- transaction
- where
08-28-2014
10:42 AM
thank you very much Musskopf
The latter option INNER JOIN helped me a lot in getting what he wanted, I had to associate in many fields, but if proved.
Best Regards
... View more
08-27-2014
07:18 PM
Hi there
Thanks for the data transaction, it is very good, but in this case I have multivalue fields will prevent getting the stats I need at the end of this association.
Also try to do it, then mvexpand, but nothing.
:(
... View more
08-27-2014
06:50 PM
Hi HiroshiSatoh
Thanks for your support, look, those commands only show me the first row
sessionid sender subject dst deliver
53f2b45b0526 [email protected] regards [email protected] [email protected]
it may be?
... View more
08-27-2014
03:59 PM
1 Karma
Hi
Someone may have required this case can support me.
I have the following logs
Aug 27 17:42:40 172.24.20.35 type=A sessionid=53f2b45b0526 [email protected]
Aug 27 17:42:40 172.24.20.35 type=A sessionid=53f2b45b0526 subject="regards"
Aug 27 17:42:40 172.24.20.35 type=B sessionid=53f2b45b0526 [email protected]
Aug 27 17:42:40 172.24.20.35 type=B sessionid=53f2b45b0526 [email protected]
Aug 27 17:42:40 172.24.20.35 type=B sessionid=53f2b45b0526 [email protected]
Aug 27 17:42:45 172.24.20.35 type=B sessionid=53f2b45b0526 [email protected]
Aug 27 17:42:53 172.24.20.35 type=B sessionid=53f2b45b0526 [email protected]
Aug 27 17:42:53 172.24.20.35 type=B sessionid=53f2b45b0526 [email protected]
And by linking them to an INNER JOIN in SQL as:
index=summary type=A | join type=outer max=0 session_id [ search index=summary type=B ]
| table session_id sender subject dst deliver
I get the following table:
sessionid sender subject dst deliver
53f2b45b0526 [email protected] regards [email protected]
53f2b45b0526 [email protected] regards [email protected]
53f2b45b0526 [email protected] regards [email protected]
53f2b45b0526 [email protected] regards [email protected]
53f2b45b0526 [email protected] regards [email protected]
53f2b45b0526 [email protected] regards [email protected]
That sentence could be used for the following table?
sessionid sender subject dst deliver
53f2b45b0526 [email protected] regards [email protected] [email protected]
53f2b45b0526 [email protected] regards [email protected] [email protected]
53f2b45b0526 [email protected] regards [email protected] [email protected]
... View more
- Tags:
- inner
- join
- relational
08-27-2014
03:08 PM
Hi there
Someone could complete what smolcj mentioned? I have the same problem with null fields.
In your example, the result of the table is as follows:
no value some1 some2 some3
1 we ddf df dfdf
2 this sd sf sdfsd
3 that sds sds sdfds
4 from
4 here
Help me please!
... View more
08-22-2014
02:35 PM
Hi thanks Somesoni
Look I mention, the example I gave I tried to be as practical as possible, but better to avoid confusion, I'll show you what I'm really trying to get:
The queue_time multivalued field is subtracted from (time_deliver - time_start)
I ran what you mention me, but I think the mvexpand is spreading the values of multi-value field
... View more
08-22-2014
01:26 PM
I understand. I'm using that index to store logs of other teams, and I consume X amount of license, the X value is retained or added consumption summary I am applying?
... View more
08-22-2014
01:15 PM
Thanks for your answer Somesoni2
But I see what they do in that case is to get the sum of the values in the multivalued field, what I wanted is to add each of the field values "c_user" plus the value of the field "count", and as a result give "sum_usr"
... View more
08-22-2014
10:48 AM
Hello!!!
I was looking for ways to add the values of a multi-value field (c_user) with the value of count, which generates me the following result:
count | user | c_user | sum_usr
5 jean 5 10
peter 7 12
yvan 9 14
But I tried: | eval sum_usr=count+c_user
And I did not get it, is there any way to add these values?
... View more
- Tags:
- multi-value
- sum
08-22-2014
10:38 AM
Thank you very much Martin
I'm reviewing these tracks that you have given me, I will be commenting at the end how it goes. What concerns me is the use of licensing currently have scheduled two automatic searches that generate a summary, the first goes to "summary index" and the second "mydbindex", adding the host = field "172.x.x.x"
I have not checked the license consumption, but I'll be consuming extra for that?
... View more
08-21-2014
09:32 AM
Hi Martin
Thanks, I was looking at the option of using the summary index, running the "transaction sessionid" every 1 minute, however, I have seen that there are many log with sessionid outside the window of 1 minute. That is, for example:
Aug 18 21:22:02 172.24.20.35|sessionid:f79a66d0000002d5-cf-53f2b45b0526|EHLO|mail.netsol.com
Aug 18 21:22:02 172.24.20.35|sessionid:f79a66d0000002d5-cf-53f2b45b0526|MSG_SIZE|56702
--------------------- end window 1 minute---------------------------------------------
Aug 18 21:21:47 172.24.20.35|sessionid:f79a66d0000002d5-cf-53f2b45b0526|MSGID|35845b9268841243
Aug 18 21:21:31 172.24.20.35|sessionid:f79a66d0000002d5-cf-53f2b45b0526|SUBJECT| rv: informe
Aug 18 21:21:05 172.24.20.35|sessionid:f79a66d0000002d5-cf-53f2b45b0526|SOURCE|external
Aug 18 21:21:03 172.24.20.35|sessionid:f79a66d0000002d5-cf-53f2b45b0526|SENDER|[email protected]
--------------------- start window 1 minute---------------------------------------------
Aug 18 21:20:52 172.24.20.35|sessionid:f79a66d0000002d5-cf-53f2b45b0526|CLIENT|209.17.115.10
And when I look at the summary index, there are many events with incomplete fields.
Have you ever touched this case? maybe I can improve the search transaction
... View more
08-20-2014
08:59 AM
Hi Martin, thanks for the tip, I was reviewing options SHOULD_LINEMERGE and BREAK_ONLY_BEFORE.
And I think the most successful, is to make the BREAK when the value of sessionid is different.
Since the first event is not always the same, often varies, but always the sessionid value is maintained.
What I thought would put something like:
SHOULD_LINEMERGE=True
BREAK_ONLY_BEFORE=sessionid\: IS DIFFERENT
And it's not just where you could use regex to Splunk understands.
Do you think that possible?
Jorge
... View more
08-19-2014
08:10 PM
Hello
Maybe someone can give me an idea about this case.
I have a AntiSpam sending messages like this:
Aug 18 21:21:41 172.24.20.35|sessionid:f79a66d0000002d5-cf-53f2b45b0526|EHLO|mail.netsol.com
Aug 18 21:21:41 172.24.20.35|sessionid:f79a66d0000002d5-cf-53f2b45b0526|MSG_SIZE|56702
Aug 18 21:21:41 172.24.20.35|sessionid:f79a66d0000002d5-cf-53f2b45b0526|MSGID|35845b9268841243
Aug 18 21:21:41 172.24.20.35|sessionid:f79a66d0000002d5-cf-53f2b45b0526|SUBJECT| rv: informe
Aug 18 21:21:41 172.24.20.35|sessionid:f79a66d0000002d5-cf-53f2b45b0526|SOURCE|external
Aug 18 21:21:41 172.24.20.35|sessionid:f79a66d0000002d5-cf-53f2b45b0526|SENDER|[email protected]
Aug 18 21:21:41 172.24.20.35|sessionid:f79a66d0000002d5-cf-53f2b45b0526|CLIENT|209.17.115.10
For every email, 7 or more logs are sent which have as their only common ground "sessionid" . I know that transaction sessionid can be used in a search, but I would like these logs to be merged into one event when indexing so transaction won't be necessary.
I thank You in advance.
Greetings
Jorge
... View more
08-08-2014
07:57 AM
Oh, I see it is complicated.
Since there is no function or style to convert these values, an alternative would be suspected Javascript.
Hopefully sometime Splunk can have this option, it would be good to show what great graphics figures.
Thank you all!
... View more
08-07-2014
09:24 PM
Hi!!
Please, someone who perhaps has ever happened, I'm generating a report with timechart, but the Y value reaches thousands and millions. I wish for these cases, the value becomes 1K or 1M, without the graphic timechart deformed.
My query
search ... | timechart span=10m count by state
Under a modified image with the desired outcome to be more clear
Thank you in advance.
... View more
07-31-2014
07:11 PM
Excellent lguinn!
It was just the logic I had in mind but did not know how to make, I really appreciate it!
:)
... View more
07-31-2014
04:45 PM
1 Karma
Hi!
That maybe someone has been through this. I have the following table as a result of search:
**website** **user** **MB**
google.com jperez 125.71
facebook.com smartinez 116.90
facebook.com jperez 92.45
facebook.com asevalloz 71.09
twitter.com jperez 63.85
google.com marevalo 43.85
google.com arios 23.85
twitter.com lgutierrez 13.85
facebook.com asevalloz 11.09
And what I would like is to get the 2 users that generate more MB per website.
**website** **user** **MB**
google.com jperez 125.71
google.com marevalo 43.85
facebook.com smartinez 116.90
facebook.com jperez 92.45
twitter.com jperez 63.85
twitter.com lgutierrez 13.85
I tried with: search...| top 3 MB website by user
But it turned out, I would appreciate it much
:)
regards
... View more
03-13-2014
07:55 AM
Hello
I have a file with 30 lines that want to register in Splunk.
After you have configured the inputs.conf the splunk _raw saved one, with all lines of the file, when they should be 30 _raw
This is my configuration inputs.conf
I will be failing in something?
[monitor:///var/log/splunk/data_clientes.log]
index = main
source = txt
host = SIEM
SourceType = customers
disabled = false
... View more
03-05-2014
12:03 PM
1 Karma
This can also be even more efficient (if either com.br, com.pe, com.jo):
(?<_hostname>(\d{1,3}.\d{1,3}?|[^\.\s]+?)\.([^\.\s]{1,3}|[^\.\s]{1,3}\.[^\.\s]{1,3}))$
... View more
02-01-2014
07:18 AM
Hi lukejadamec, the result of that search is as follows
Feb 1 10:14:38 192.168.1.13 Feb 01 2014 10:27:01: %ASA-6-302014: Teardown TCP connection 104897871 for OUTSIDE:190.12.82.197/80 to INSIDE:192.168.1.64/29684 duration 0:00:30 bytes 0 SYN Timeou
... View more
02-01-2014
06:38 AM
Hi linu. This is a log received from that computer, you can see that the firewall log sending is the date
Feb 1 09:32:28 192.168.1.13 Feb 01 2014 09:32:51: %ASA-4-106023: Deny tcp src INSIDE:192.168.15.54/37549 dst OUTSIDE:195.124.8.57/7735 by access-group "INSIDE_access_in" [0x0, 0x0]
But the Time field shows the splunk
2/1/13
9:32:28.000 AM
... View more
01-31-2014
08:08 PM
Hello
I wonder if anyone would have happened.
I have a DB of the "main" where indexed logs of 4 teams. And one of them has problems with indexing date.
At this point I figure it is 1 year late
1/31/13 11:09:42.000 PM
To which may be due?
... View more
11-26-2013
12:46 PM
Hi, my configuration in Ironport is:
*SCP on Remote Server
Maximum Time Interval Between Transferring:3600
Protocol: SSH2
SCP Host: 172.24.150.35
Directory: /opt/splunk/var/log/
Username: usrscp
something that may be missing?
I log out as the next:
Nov 26 15:43:48 192.168.1.64 Nov 26 15:44:19 SIEM_System: Critical: Error while sending alert: Unable to send System/Critical alert to [email protected] with subject "Critical <System> ironport.euromotors.com: Log Error: Push error for subscription SIEM_AccessC: SCP fai...".
... View more
11-25-2013
04:34 PM
Hello such.
I disabled the SSH1 in Ironport, but the problem persists.
I understand that when I set the SCP, the ironport generates a key that I should add to the splunk server authorized_keys, as I did and still do not get it, what else could be missing?
Thanks
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-22-2025
11:00 AM
|
