Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- Find Answers
- :
- About jsven7
jsven7
Communicator
Member since:
04-29-2019
06-17-2022
Community Statistics
| Posts | 76 |
| Solutions | 1 |
| Karma Given | 7 |
| Karma Received | 9 |
| Member Since | 04-29-2019 |
Activity Feed
- Posted Re: How do I fill my null field from a subsearch? on Splunk Enterprise. 06-17-2022 11:13 AM
- Posted Re: How do I fill my null field from a subsearch? on Splunk Enterprise. 06-17-2022 04:20 AM
- Tagged Re: How do I fill my null field from a subsearch? on Splunk Enterprise. 06-17-2022 04:20 AM
- Posted How do I fill my null field from a subsearch? on Splunk Enterprise. 06-16-2022 03:25 PM
- Got Karma for Re: How to search and filter by a field that contains spaces?. 03-17-2022 09:31 AM
- Got Karma for Re: ES: Add a Carriage Return to "Description". 07-22-2021 02:07 PM
- Posted Re: How to create a base search that uses values from a multi-value field as indices? on Splunk Search. 09-08-2020 07:15 AM
- Posted How to create a base search that uses values from a multi-value field as indices? on Splunk Search. 09-03-2020 11:50 AM
- Posted Re: Track changes to lookup tables on Monitoring Splunk. 09-03-2020 11:39 AM
- Posted Which sourcetype to use in order to track changes made to lookup tables? on Monitoring Splunk. 06-12-2020 06:04 AM
- Karma Re: How do I drilldown to a unique URL using a table row's unique token? for memarshall63. 06-05-2020 12:51 AM
- Karma Re: How to get specified events from 2 indices. for richgalloway. 06-05-2020 12:51 AM
- Karma Splunk Enterprise Security: Is there a way manually force a newline in notable event descriptions? for alandeandrea. 06-05-2020 12:48 AM
- Got Karma for Re: Proper etiquette and timing for voting here on Answers (particularly down-voting)?. 06-05-2020 12:47 AM
- Got Karma for Why is my search with "where NOT equals this OR this OR this" not filtering out results as expected?. 06-05-2020 12:47 AM
- Got Karma for Why won't my multiple "eval if match" expressions work?. 06-05-2020 12:47 AM
- Got Karma for Re: Why won't my multiple "eval if match" expressions work?. 06-05-2020 12:47 AM
- Got Karma for Re: Why won't my multiple "eval if match" expressions work?. 06-05-2020 12:47 AM
- Got Karma for Re: Searching EventCodes for logon and logoff events, LOGON_ID includes 0x0 before actual LOGON_ID. How do I exclude the 0x0?. 06-05-2020 12:47 AM
- Got Karma for Re: Searching EventCodes for logon and logoff events, LOGON_ID includes 0x0 before actual LOGON_ID. How do I exclude the 0x0?. 06-05-2020 12:47 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
06-15-2017
06:43 AM
index=myindex server="server1234" OR "server1235" OR "server1236" OR "server1237" OR "server1238" | stats count(_raw) by server
results:
server1234
server123456 <----- why am I getting this?
server1235
server1236
server1237
server1238
server12347 <----- why am I getting this?
server12348 <----- why am I getting this?
server123890 <----- why am I getting this?
How do I only get in return what I asked for? Thanks in advanced.
... View more
12-31-2015
06:57 AM
This is really helpful ty!
... View more
12-31-2015
06:36 AM
Thank you for this. What if I want to specify letters or a combination of letters and numbers that follow numbers?
... View more
12-30-2015
12:07 PM
Suppose I have a field like this: a1234
Is there a way to grab all the letters that are immediately followed by numbers? I know I can substr the first position but I want be able to work with this for example too: abc1234 .
Ty in advance
... View more
12-24-2015
04:14 AM
That's brilliant thank you sir. Merry Christmas!
... View more
12-22-2015
10:12 AM
Yes the column tile/field name. Sorry about: first condition is "C0" and second condition is "C1". Even though the conditions are different they drilldown to the same dashboard.
... View more
12-22-2015
08:10 AM
I have a bar chart. When I click on a particular bar, I'd like to control the drilldown to another dashboard. Combed through the docs, but can't find anything. Also checked Answers and checked answers for other similar questions, but they are not working for me.
<drilldown>
<condition click.name="C0">
<link target="_blank">
<![CDATA[
/app/RAS/cluster0?q=search%20$click.name$
]]>
</link>
</condition>
<condition click.name="C0">
<link target="_blank">
<![CDATA[
/app/RAS/cluster_1?q=search%20$click.name$
]]>
</link>
</condition>
</drilldown>
... View more
12-18-2015
06:22 AM
@halkelley mark as answer pls.
... View more
12-09-2015
06:12 AM
Thanks Runals! I'm trying to identify open sessions. AUT24414 and AUT22673 represent a login. AUT22673, AUT23574, AUT20915, AUT22886 represent logouts. So if I dedup per User ID and then disregard the logouts I can report on open sessions.
Courtesy of @jplumsdaine22.
... View more
12-08-2015
11:13 AM
Full code
mysearch... (MsgId=AUT22670 OR MsgId=AUT24414 OR MsgId=AUT22673 OR MsgId=AUT23574 OR MsgId=AUT20915 OR MsgId=AUT22886)
| dedup User
| where NOT MsgId=="AUT22673" OR MsgId=="AUT23574" OR MsgId=="AUT20915" OR MsgId=="AUT22886"
| eval Cluster="C"+substr(Node,10,1)
| table MsgId
... View more
12-08-2015
11:01 AM
1 Karma
| dedup _raw
| where NOT MsgId=="AUT22673" OR MsgId=="AUT23574" OR MsgId=="AUT20915" OR MsgId=="AUT22886"
What am I doing wrong here? I expect it to disregard events with that criteria. Its bringing up events with those MsgIds.
... View more
12-04-2015
05:32 AM
Trying to do the same thing with simple XML.
... View more
12-03-2015
07:30 AM
This works nicely. Yeah sometimes I get confused and try to attack things on Splunk as I would with a perl script.
Someone showed me this too.
my search...
| transaction User startswith="MsgId=AUT22670 OR MsgId=AUT24414" endswith="MsgId=AUT22673" keeporphans=true
| search linecount=1
Thanks!
... View more
12-03-2015
06:15 AM
Hi all. I'm trying to make a gauge that counts the amount of logged on users. Stuck on figuring out how to classify a session as "Open". Once I do this I'd just count the amount of "OPEN SESSIONS"s. (Doing it this way incase the boss prefers a table.)
If MsgId is AUT22670 or AUT24414 the event represent a login. If the MsgId is AUT22673 then the event represents a logout.
Example Events:
User, Date, Time, MsgId
my search..
| eval ID=User | eval LoginDate=Date | eval LoginTime=Time
| eval SESSIONS_STATUS = if((match(User,(?i)ID)) AND (NOT MsgId=AUT22673),"OPEN SESSION","CLOSED SESSION")
Its not working the way I want but am I headed in the right direction?
... View more
12-02-2015
04:31 AM
It's not clear to me what you want to extract from the events.
... View more
12-02-2015
04:20 AM
Are you trying to get a report? Can you provide some sample data and the conditions that represent "Anomalous Invalid Login Attempts"?
... View more
12-02-2015
04:15 AM
@Fatimabegum12 is Splunk's built in field extractor tool not working for you? I can walk you through using that field extractor.
... View more
12-01-2015
05:23 AM
Thanks @jeffland appreciate the explanation.
... View more
11-30-2015
07:02 AM
I read this doc. For some reason I can't get to $SPLUNK_HOME/etc/apps/search/appserver/static. When I try to go there from a window it opens up a browser and then opens a Bing search.
... View more
11-30-2015
06:14 AM
Can someone please explain from level 0 how to get a dashboard to execute some CSS code? Checked Answers and documentation none is helping me make contact with the ground.
... View more
11-30-2015
05:04 AM
Sorry for late response was out for Thanksgiving. Hope you enjoyed yours!
I'm trying to test with this:
my search | eval deltaDays = (now() - expiration_date)/86400 | where deltaDays<=30 | eval expiration_date=expiration_date/1000 | eval Expiration_date=strftime(expiration_date,"%m/%d/%Y") | table loginuid, token_serial, Expiration_date
I expect to see events where the Expiration_date field is <= 30 days from now() but this is not the case. Am I using the where command correctly?
... View more
11-24-2015
12:29 PM
Meant to write '<' instead of '>'. Its not giving events where now() is <= 30days of expiration_date
mysearch...
|eval now=now()
| eval deltaDays = (now() - expiration_date)/86400
| where deltaDays<=30
| table loginuid, token_serial, now, expiration_date
... View more
11-24-2015
10:41 AM
Spent all day trying to figure this out. The events I'm working with contain a field with an expiration date in Unix epoch time. I'm trying to bring up a table of events when current date is >= 30days before the expiration date. Combed through documentation and Splunk Answers no luck. Thanks in advance.
Example data:
expiration_date=1548910800000
... View more
- « Previous
-
- 1
- 2
- Next »
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-17-2022
11:06 AM
|
Karma given to
