About lakromani

lakromani · ‎09-28-2016

If data are at fixed length, you can do some like this: (?<name>.{39})(?<port>.{15})(?<info>.{26})(?<protocol>.+) Look at this: https://regex101.com/r/RwdS6Y/2

lakromani · ‎09-27-2016

They should use resource on upgrade the NT4 to some later, not time to find forwarder working with it. It's out of support on every way and a security risk to use.

lakromani · ‎09-27-2016

I would like to use the Syntax Highlighting and Autocomplete coming in the new 6.5.0. Since I have converted my home system to Free license group, I do not have any Account Settings. How do we then enable these functions? PS upgraded from 6.4 to 6.5.0

lakromani · ‎04-19-2016

You can shorten this: host LIKE "%", "Others" to 1=1, "Others" Since both above is true, this will be true of noen of the other is true.

lakromani · ‎03-16-2016

This should be added to GUI, since it already there for Panel.

lakromani · ‎03-13-2016

I already have a CSV file for an other app that uses mac to IP/Name. Format is like this: mac,ip,host_name 6067.209c.ce2c,10.10.10.186,pc-test c01a.da25.da0e,10.10.10.163,server 100b.a91e.5cdc,10.10.10.160,phone Now I have an other input that looks like this: nic1 BC:F2:AF:C6:F0:25 TX 209 mbps nic1 BC:F2:AF:C6:F0:18 TX 129 mbps Is there a way to do a lookup for the mac in the mac to IP/Host file when format is different?

lakromani · ‎03-11-2016

This is an answer to an old topic. But I did get inn to same problem my self. For some reason my dashboard started showing it code in the bottom of my dashboards. Not sure how it got there, but I could not get rid of it. Then I guessed it was som sort of debugging. So I just closed my Splunk, and open a new window. When I the went back to the same view, the source code was gone. So I guess its for debugging, and goes away when you close the window 🙂

lakromani · ‎03-11-2016

This works, but you will loose granularity or you need to adjust the pixel height to compensate for more graphs. Using various scales does work, as long as you only need two different one, but I will try to fine tune it som more.

lakromani · ‎03-11-2016

That would work, but I like to set a fixed with, not depending of changing the legend name :9

lakromani · ‎03-11-2016

Lets say I have two different panels in a Dashboard. One with search like this: sourcetype=UPS | timechart avg(battery_volt) AS "Volt" and the other like this: sourcetype=UPS| timechart avg(battery_temperature) AS "Temperature" Since they have different legend with different lengt in right side of the panel (Volt/Temperature), they take up different space of the overall window. This makes the x-axis og the two graphs not align. Is there a way to set a fixed size of the legend? I do like them to be on the right side. I could have used on panel if numbers was close to each other, but they are not: sourcetype=UPS| timechart avg(battery_volt) AS "Volt" avg(battery_temperature) AS "Temperature"

lakromani · ‎03-05-2016

Problem was the ASCII code 245 = § ( Section sign ) and I need to use SEDCMD and not SED After some sleep and some more googling, I found how to remove it, like this: [minecraft] SEDCMD-remove_data = s/\xa7\(r\|4\)//g

lakromani · ‎03-04-2016

Will test it out. I do only have one Splunk server, no forwarder. Edit. Dit not work on my server. [minecraft] SEDCMD-remove_data = "s/(§4|§r)//g" Edit2. It seem to be that the § symbol messes things up. After removing the " in SEDCMD command, it has no more player , but changed it to playe and have removed the 4 from the time, so it get like this: playe=§BirksX§r I can see in nano that the § shows like a strange character, but ok using cat .

lakromani · ‎03-04-2016

I am testing using Splunk to index a minecraft server, but have some problem with user name. Lines look like this: Fri Mar 04 22:24:58 CET 2016 action=block_broken player=§4BirksX§r world=world x=30.0 y=105.0 z=-281.0 game_time=8303 block_type=LONG_GRAS Fri Mar 04 22:24:58 CET 2016 action=block_broken player=Pardur1 world=world x=30.0 y=105.0 z=-281.0 game_time=8303 block_type=LONG_GRAS Since field names do confirm to some=data they are automatically extracted. For some reason some user has §4 in front of name and §r after it. I have temporary solved this by using SED like this: source=minecraft | rex mode=sed field=player "s/(§4|§r)//g" | top player This works fine. But I would like to remove the data from the indexed data, so I tried this: props.conf [minecraft] SED-remove_data = "s/(§4|§r)//g" and props.conf [minecraft] SED-remove_data = s/(§4|§r)//g But none of them works. What do I do wrong?

lakromani · ‎03-02-2016

Works perfectly. Follow up question. Can this be done in Props.conf? If so, how?

lakromani · ‎03-02-2016

Our DNS server logs' date in the following format: 02.03.2016 13:57:08 027C PACKET 0220AFE8 UDP Snd 10.10.10.160 6f8b R Q [8081 DR NOERROR] A (5)nexus(10)officeapps(4)live(3)com(0) 02.03.2016 14:06:33 027C PACKET 02C0D668 UDP Snd 10.10.10.130 6fc3 R Q [8081 DR NOERROR] A (7)android(10)googleapis(3)com(0) How do I use eval to get: url=nexus.officeapps.live.com url=android.googleapis.com I have tried several regex to get out various groups, but url varies in length.

lakromani · ‎02-05-2016

Fond that I do need to run ./splunk start from the bin folder. All is ok now...

lakromani · ‎02-05-2016

Here is what I have done. Ubuntu 15.10 running Splunk Enterprise 6.3.2 fine. Download splunk-6.3.3-f44afce176d0-linux-2.6-amd64.deb to the server. Installing: dpkg -i splunk-6.3.3-f44afce176d0-linux-2.6-amd64.deb (Reading database ... 140697 files and directories currently installed.) Preparing to unpack splunk-6.3.3-f44afce176d0-linux-2.6-amd64.deb ... This looks like an upgrade of an existing Splunk Server. Attempting to stop the installed Splunk Server... Stopping splunkd... Shutting down. Please wait, as this may take a few minutes. .. Stopping splunk helpers... Done. Unpacking splunk (6.3.3) over (6.3.2) ... Setting up splunk (6.3.3) ... complete Web not responding, so I tried to start the service manually: service splunk restart Job for splunk.service failed because the control process exited with error code. See "systemctl status splunk.serv ice" and "journalctl -xe" for details. Then look at error gives this: systemctl status splunk.service â splunk.service - LSB: Start splunk Loaded: loaded (/etc/init.d/splunk) Active: failed (Result: exit-code) since Fri 2016-02-05 09:13:50 CET; 9s ago Docs: man:systemd-sysv-generator(8) Process: 19007 ExecStop=/etc/init.d/splunk stop (code=exited, status=0/SUCCESS) Process: 19036 ExecStart=/etc/init.d/splunk start (code=exited, status=2) Feb 05 09:13:50 Varg systemd[1]: Starting LSB: Start splunk... Feb 05 09:13:50 Varg splunk[19036]: Starting Splunk... Feb 05 09:13:50 Varg splunk[19036]: License not yet accepted, but executed with no-prompt flag. Exiting. Feb 05 09:13:50 Varg systemd[1]: splunk.service: Control process exited, code=exited status=2 Feb 05 09:13:50 Varg systemd[1]: Failed to start LSB: Start splunk. Feb 05 09:13:50 Varg systemd[1]: splunk.service: Unit entered failed state. Feb 05 09:13:50 Varg systemd[1]: splunk.service: Failed with result 'exit-code'. Anyone have an idea on how to fix Failed to start LSB: Start splunk.?

lakromani · ‎01-25-2016

This does not work since one user may log inn between another user sends SMS and logs inn. transaction startswith="PORTAL: SMS sent to" endswith="logged in with username" This mixes user together.

lakromani · ‎01-22-2016

Since majority av the users only have one SMS and one login, and the transaction need to contain both, I just use eventcount=2 in search after the transaction. This way I ignore all other and get a correct view. Thanks.

lakromani · ‎01-22-2016

Thanks. This was very close to what I need. Problem is where user has logged inn more than once with same username. avg(duration) gives the time between the first and last event. I need the time between first event and second event. Or to be more specific, time between last received SMS and first login after it. A user may request as many SMS he likes, so he can request two SMS and then login using information on last SMS.

lakromani · ‎01-22-2016

Using transaction I have grouped together events for same users. There are two types of event. 1. Send SMS to user. 2. Log in with this user. It looks like this: Jan 22 11:52:15 172.30.112.1 PORTAL: SMS sent to 91813504. Jan 22 11:54:11 172.30.112.1 AAA: 172.30.44.246 logged in with username 91813504 Jan 22 11:52:04 172.30.112.1 PORTAL: SMS sent to 91300083. Jan 22 11:53:36 172.30.112.1 AAA: 172.30.53.83 logged in with username 91300083 Jan 22 11:51:10 172.30.112.1 PORTAL: SMS sent to 41237212. Jan 22 11:51:50 172.30.112.1 AAA: 172.30.40.116 logged in with username 41237212 Jan 22 12:01:37 172.30.112.1 AAA: 172.30.40.113 logged in with username 41237212 Some user logs inn several times. I do like to calculate the time from sent SMS to the first log in. Result I need is some like this: 91813504 00:01:56 91300083 00:01:32 41237212 00:00:40 Then I can graph the duration over time and see if there are some wrong with the SMS sent to the user. How to do this? Maybe I do not need it use Transaction, but it gives me a visual view of events that belongs to same user.

lakromani · ‎01-05-2016

This was nice. Just what I was looking for and gives a great way to separate Syslog input. Thanks.

lakromani · ‎11-09-2015

Problem is that doing this will hit lots of other stuff, that is already to tagged. So I need to differentiate this data from other stuff.

lakromani · ‎11-09-2015

I have data in following formats: Nov 04 21:47:59 server1 gtu[22038]: 2833CA0D c (master) 1A 0B 81 2D 5F 66 36 A7 DC F3 60 B0 Nov 04 21:47:59 server1 gtu[22038]: 2833CA0D c (master) 02 6D A0 3C B1 B3 59 CD EC BC CB 7B 55 65 85 CA Nov 04 21:47:59 server1 gtu[22038]: 2833CA0D c (master) 82 70 29 01 02 06 02 BE 04 A5 FB 6C 1F 90 1D 40 Nov 04 21:47:58 server1 gtu[22038]: 2833CA0D c (master) 7E A0 51 E5 B2 CA I need to set this as one eventtype. Number of data field can go from 2 to 16. With normal search, I can use this format: * | regex _raw="gtu.* \(master\)\s+\w\w\s+\w\w" But in eventypes.conf this does not work. [gtu-master-data] search = regex _raw="gtu.* \(master\)\s+\w\w\s+\w\w" Does regex not work in *eventypes.conf

lakromani · ‎10-29-2015

This works fine if only one index is search, but if you have some like this: index=cisco_firewall OR index="cp_firewall user="Garth" Your result will only show cisco_firewall A search like this: index=*_firewall user="Garth" will show up as **_firewall* Other than that its a nice way to see what is used in search.

Posts	210
Solutions	4
Karma Given	48
Karma Received	37
Member Since	‎09-03-2013

Online Status	Offline
Date Last Visited	‎03-01-2021 12:34 PM

Eventtype are broken in Splunk 8.0.0

Need help to setup a configuration dashboard.

Using color in reports (saved search) table based ...

How to count unique events pr class

Can you differentiate between various Splunk serve...

Split data from different hosts comming from syslo...

Background color in navbar is gone in 7.1 and 7.2

Why does the CIDR not include all IP's in a range?

Setting field based on eventtype

Problem splitting data, lines are lost from script...

Re: How do I develop a rex command that extracts n...

Re: Is there a version of Splunk Universal Forward...

Syntax Highlighting and Autocomplete in your Accou...

Re: multiple like within if statement

Re: Add shared time picker option for dynamic opti...

Lookup when format is not equal.

Re: How to removed source code (xml, js..) that is...

Re: How to make x-axis line up in dashboard.

Re: How to make x-axis line up in dashboard.

How to make x-axis line up in dashboard.

Re: Field manipulation using SED

Re: Field manipulation using SED

Field manipulation using SED

Re: How to write the regex to convert an entry in ...

How to write the regex to convert an entry in my s...

Re: Upgrading from Splunk 6.3.2 to 6.3.3 on an Ubu...

Upgrading from Splunk 6.3.2 to 6.3.3 on an Ubuntu ...

Re: Finding time between two events.

Re: Finding time between two events.

Re: Finding time between two events.

Finding time between two events.

Re: Different sourcetypes for different syslog hos...

Re: How to use regex in eventtypes.conf

How to use regex in eventtypes.conf

Re: How to find the most searched index in splunk?

Join the Conversation