Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- About to4kawa
to4kawa
Ultra Champion
Member since:
07-05-2019
a week ago
Community Statistics
| Posts | 3430 |
| Solutions | 472 |
| Karma Given | 222 |
| Karma Received | 623 |
| Member Since | 07-05-2019 |
Activity Feed
- Got Karma for Re: mvexpand gives "mvexpand output will be truncated due to excessive memory usage". 02-02-2026 03:59 PM
- Got Karma for Re: Convert Snap-To Time to Epoch Time. 07-11-2025 10:57 AM
- Got Karma for Re: rex over multiple lines. 06-12-2025 09:46 PM
- Got Karma for Re: Setting earliest and latest.. 04-11-2025 08:15 AM
- Got Karma for Re: Using a subquery result in 'IN' clause. 02-18-2025 03:42 PM
- Got Karma for Re: How to search indexed JSON array output for objects that match a distinct name/value pair. 10-10-2024 05:19 AM
- Got Karma for Re: Dynamic SNMP OID - Convert ASCII number to Text Value. 09-25-2024 09:24 AM
- Got Karma for Re: Check if Field is a Multivalue Field. 08-28-2024 10:28 AM
- Got Karma for Re: How do I convert a timestamp from one timezone to another (inline). 05-15-2024 11:20 PM
- Got Karma for Re: Windows serveruptime Dashboard. 01-24-2024 12:29 PM
- Got Karma for Re: Windows serveruptime Dashboard. 01-24-2024 12:28 PM
- Got Karma for Re: Convert HEX data to Text via search query. 12-01-2023 07:01 AM
- Got Karma for Re: main search | where not <fieldname> IN [subsearch] not working. 12-01-2023 03:01 AM
- Got Karma for Re: rex over multiple lines. 11-20-2023 02:42 PM
- Got Karma for Re: timechart limit: pick top 10 series with the highest peaks (of all time), not total sums. 10-30-2023 09:16 PM
- Got Karma for Re: How to query a lookup table based on time. 10-26-2023 08:28 PM
- Got Karma for Re: Why are some of the fields showing ascii hex values for string after I get CEF stream data into splunk using cefutils?. 10-26-2023 12:22 PM
- Got Karma for Re: How to get current GMT time?. 09-13-2023 07:48 AM
- Got Karma for Re: Display lines before and after the results of your string search. 06-01-2023 11:31 AM
- Got Karma for Re: change the color of row based on cell value in splunk without css or js. 05-19-2023 06:02 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 3 | |||
| 1 | |||
| 0 | |||
| 0 | |||
| 0 |
02-22-2021
04:03 PM
try CASE("") NOT ( CASE("TASK") OR CASE("CHG") ) sample: index=_internal NOT (CASE("Metrics") OR CASE("splunkd") OR CASE("WARN") )
... View more
02-22-2021
03:47 PM
index=firewall host="HQ-5020-1.firstagain.local"
| stats sum(bytes_in) as Received,sum(bytes_out) as Sent by dest_interface
``` bytes_in field is gone.```
| rename dest_interface as Interface
| convert memg(Recieved) memg(Sent)
| eval Bandwidth=round(Received + Sent,2)
... View more
02-22-2021
03:41 PM
eval ? you don't need it. sample: <dashboard>
<label>lookup_drilldown</label>
<init>
<unset token="viz"></unset>
</init>
<search id="lookup">
<query>| inputlookup geo_attr_countries.csv</query>
<earliest>0</earliest>
</search>
<row>
<panel>
<table>
<search base="lookup">
<query>
| eval first_letter=substr(iso2,1,1)
| stats count values(iso2) as iso2 by first_letter delim=","
| nomv iso2</query>
</search>
<option name="count">50</option>
<option name="drilldown">cell</option>
<drilldown>
<set token="first_letter">$click.value$</set>
<set token="viz">1</set>
</drilldown>
</table>
</panel>
</row>
<row>
<panel depends="$viz$">
<table>
<search base="lookup">
<query>search iso2="$first_letter$*"
| table iso2 country</query>
</search>
<option name="drilldown">none</option>
<option name="refresh.display">progressbar</option>
</table>
</panel>
</row>
</dashboard> You can use drilldown if you like.
... View more
02-22-2021
03:15 PM
1 Karma
index=index sourcetype=cpu AND sourcetype=top host=$host$
| timechart latest(cpu_load_percent) by COMMAND sourcetype=top doesn't have cpu_load_percent. try coalesce
... View more
02-22-2021
01:23 AM
https://github.com/splunk/botsv1 https://www.splunk.com/en_us/blog/security/boss-of-the-soc-scoring-server-questions-and-answers-and-dataset-open-sourced-and-ready-for-download.html
... View more
- Tags:
- BOTSv1
02-22-2021
01:21 AM
| stats count, values(signature) as signature by src This makes signature multi-values. mvexpand separetes them to single rows. It's going to everyone, but I can't make queries without logs.
... View more
02-19-2021
09:35 PM
1 Karma
| makeresults
| eval _raw="date count usd_total product_name
1612180800 24 240 product_1
1612267200 18 360 product_2
1612353600 30 900 product_3
1612440000 11 110 product_1
1612526400 11 220 product_2
1612612800 37 1110 product_3
1612699200 43 430 product_1
1612785600 27 540 product_2
1612872000 15 450 product_3
1612958400 47 470 product_1
1613044800 12 240 product_2
1613131200 46 1380 product_3"
| multikv forceheader=1
| rename date as _time
| fields - _raw linecount
| stats sum(count) as count by _time usd_total product_name
... View more
02-19-2021
07:52 PM
https://community.splunk.com/t5/Getting-Data-In/Make-extractions-in-props-conf-from-search-query/m-p/469435
... View more
02-19-2021
07:47 PM
<dashboard>
<label>link_drilldown</label>
<row>
<panel>
<table>
<search>
<query>| makeresults
| eval employeeid =123
| append [| makeresults | eval app = "abc"]</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
<sampleRatio>1</sampleRatio>
</search>
<option name="count">50</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">cell</option>
<option name="percentagesRow">false</option>
<option name="rowNumbers">false</option>
<option name="totalsRow">false</option>
<option name="wrap">true</option>
<drilldown>
<link target="_blank">/app/search/search?q=index=x%20$click.name2$=$click.value2$</link>
</drilldown>
</table>
</panel>
</row>
</dashboard>
... View more
02-19-2021
06:19 PM
This is not about what to do with the query, but about first understanding which log contains the event. The results I'm giving you as an example are not from Flash, and you need to find the log first.
... View more
02-19-2021
06:14 PM
1 Karma
sample: index=_internal
| top name
| eval host="host".random() % 5
| rename name as DisplayName , percent as DisplayVersion
| sort host, DisplayName
| eval Names=host."_".DisplayName."_".DisplayVersion
| table Names count
... View more
02-19-2021
06:03 PM
1 Karma
I don't know the result of sourcetype=top at all, so it's hard to say.
... View more
02-19-2021
06:00 PM
https://docs.splunk.com/Documentation/SplunkCloud/latest/SearchReference/Appendcols try appendcols with subsearch
... View more
02-19-2021
05:53 PM
index=_internal | head 1 |fields _raw
| eval _raw="{\"stages\":[{\"duration\":12,\"status\":\"Success\",\"children\":[{\"test\":\"integration\",\"result\":\"passed\"},{\"test\":\"regression\",\"result\":\"failed\"}]},{\"duration\":1.5,\"status\":\"Success\",\"children\":[{\"test\":\"unit\",\"result\":\"passed\"},{\"test\":\"regression\",\"result\":\"passed\"}]},{\"duration\":3.1,\"status\":\"Success\",\"children\":[{\"test\":\"integration\",\"result\":\"passed\"},{\"test\":\"unit\",\"result\":\"failed\"}]}]}"
| spath stages{} output=stages
| stats count by stages
| streamstats count as session
| spath input=stages children{} output=child
| spath input=stages duration
| spath input=stages status
| stats values(duration) as duration values(status) as status by session child
| spath input=child
| fields - session child You can make a table with it. index=_internal | head 1 |fields _raw
| eval _raw="{\"stages\":[{\"duration\":12,\"status\":\"Success\",\"children\":[{\"test\":\"integration\",\"result\":\"passed\"},{\"test\":\"regression\",\"result\":\"failed\"}]},{\"duration\":1.5,\"status\":\"Success\",\"children\":[{\"test\":\"unit\",\"result\":\"passed\"},{\"test\":\"regression\",\"result\":\"passed\"}]},{\"duration\":3.1,\"status\":\"Success\",\"children\":[{\"test\":\"integration\",\"result\":\"passed\"},{\"test\":\"unit\",\"result\":\"failed\"}]}]}"
| rex mode=sed "s/children\":\[.*?\]/children\":[]/g" If you want to delete it, try this.
... View more
02-19-2021
05:44 PM
sample: |makeresults | table[| inputlookup geo_attr_countries.csv | table iso2 iso3] This can't work. your sub search can't work. What do you want to do?
... View more
02-19-2021
05:37 PM
1 Karma
sourcetype=snort
``` There is no need for sub-searching, since you end up searching for everything.```
| stats count, values(signature) as Sigs by src
| sort 20 - count
| lookup dnslookup clientip as src OUTPUT clienthost as DST_RESOLVED
| iplocation src
| fields src, count, Country, DST_RESOLVED, Sigs
| mvexpand Sigs
| search NOT [ | inputlookup Signatures.csv | rename Signatures as Sigs | format ]
``` exclude Sgnatures CSV ```
| rename src as "Source IP", count as Count, DST_RESOLVED as "DNS Resolution", Sigs as Signatures
... View more
02-09-2021
04:30 AM
https://docs.splunk.com/Documentation/SplunkCloud/latest/Data/IngestEval
... View more
02-09-2021
04:24 AM
index=_internal | head 1 | fields _raw
| eval _raw="{\"externalId\": null, \"statusChanged\": \"2021-02-09T09:51:42.000Z\", \"userName\": \"[email protected] \", \"appid\": \"0oa97rn2ymPrbgM430x612344\", \"lastUpdated\": \"2021-02-09T09:51:42.000Z\", \"scope\": \"\", \"userid\": \"00u1a2mn8ouOvSO2A0x71234\", \"created\": \"2021-02-09T09:51:42.000Z\", \"status\": \"ACTIVE\"}"
| rex mode=sed "s/(userName\":\s*\").*@/\1XXXXXX@/" your SEDCMD is wrong.
... View more
02-09-2021
04:18 AM
index=_internal | head 1 | fields _raw
| eval _raw="\"Indicators\": [
\"HAS_ACCOUNT\",
\"NON_ZERO_BALANCE_ACCOUNT\",
\"JOINT_ACCOUNT\",
\"NOT_EXPIRED\",
\"REGISTERED\"
]"
| rex mode=sed "s/(?ms)(.*)/{\1}/"
| spath
| rename *{} as *
| rex field=Indicators max_match=0 "(?<indicators>.*ACCOUNT)"
| table indicators
... View more
02-08-2021
04:56 AM
| eval TIMESTAMP=coalesce(strptime(TIMESTAMP,"%d-%b-%y %H:%M:%S"),strptime(TIMESTAMP,"%Y-%m-%d %H:%M:%S.%6Q")) This will be OK.
... View more
02-08-2021
03:11 AM
The rex is performed for each event, so I am not sure what the problem is. And it doesn't say how the logs for the past 30 days will appear.
... View more
02-08-2021
03:07 AM
index=month source=XYZ (sourcetype=OVERDRAFT_REC1 OR sourcetype=OVERDRAFT_REC2 OR sourcetype=OVERDRAFT_REC3)
| eval TIMESTAMP=strptime(TIMESTAMP,"%d-%b-%y %H:%M:%S")
| bin span=1min TIMESTAMP
| stats values(SMS_RECORD) AS SMS_RECORD BY TIMESTAMP sourcetype
| mvexpand SMS_RECORD
| where your_condition Why not this?
... View more
02-08-2021
03:01 AM
| gentimes start=1/1/2021 end=2/1/2021
| eval time=strftime(starttime,"%d")
| eval y-axis = random()
| eval bubble = random() / 10000000000
| table time y-axis bubble x-axis should be number.
... View more
02-08-2021
02:44 AM
index=_internal | head 1 | fields _raw
| eval _raw="\"Indicators\": [
\"HAS_ACOUNT\",
\"NON_ZERO_BALANCE_ACCOUNT\",
\"JOINT_ACCOUNT\",
\"NOT_EXPIRED\",
\"REGISTERED\"
]"
| rex mode=sed "s/(?ms)(.*)/{\1}/"
| spath I think you will make it JSON better.
... View more
02-08-2021
02:02 AM
'上午' → \x{4e0a}\x{5348} '下午' → \x{4e0b}\x{5348} please modify datetime.xml https://docs.splunk.com/Documentation/SplunkCloud/8.1.2012/Data/Configuredatetimexml <define name="_ampm" extract="ampm">
<text><![CDATA[([ap]m(?:[^A-Za-z0-9]|$)|[\x{4E0A}\x{4E0B}]\x{5348})?]]></text>
</define> I wrote that, but there is a setting. props.conf TIME_FORMAT = %Y/%m/%d %p %I:%M:%S sample: index=_internal | head 1 | fields _raw
| eval _raw="2020/12/29 下午 02:39:45 \"下午\" means PM ==> 2020/12/29 14:39:45
2020/12/29 上午 05:15:08 \"上午\" means AM ==> 2020/12/29 05:15:08"
| multikv noheader=t
| rex "(?<time>.*?)\""
| eval time_epoch=strptime(time,"%Y/%m/%d %p %I:%M:%S")
| convert ctime(time_epoch) as time1
| table time time_epoch time1 well, AM/PM is %P not %p
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
a week ago
|
Karma given to
