Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- Find Answers
- :
- About jnudell_2
jnudell_2
Builder
Member since:
05-22-2019
06-05-2020
Community Statistics
| Posts | 186 |
| Solutions | 34 |
| Karma Given | 26 |
| Karma Received | 48 |
| Member Since | 05-22-2019 |
Activity Feed
- Got Karma for Re: Splunk Self Signed Certificates. 11-07-2022 10:41 AM
- Got Karma for Re: Splunk Self Signed Certificates. 11-07-2022 10:41 AM
- Got Karma for Re: How to compare two fields from two different searches and display results with matches and mis-matches?. 10-25-2022 12:29 PM
- Got Karma for Re: How to convert _time column to epoch time. 07-28-2022 10:44 AM
- Got Karma for Re: How to convert _time column to epoch time. 01-12-2022 03:01 PM
- Got Karma for Re: How to index same source to multiple indexes. 10-01-2021 02:09 PM
- Got Karma for Re: How to convert _time column to epoch time. 05-05-2021 02:21 PM
- Got Karma for Re: Search Peer indexer Minimum Free Disk Space Reached. 08-14-2020 01:46 AM
- Karma Re: How to find top 20 results and then do a subsequent search? for spayneort. 06-05-2020 12:50 AM
- Karma Re: How to use multiple saved searches for a single table for somesoni2. 06-05-2020 12:50 AM
- Karma Re: Using field option in join command for Richfez. 06-05-2020 12:50 AM
- Karma Re: Issues in creating the join for renjith_nair. 06-05-2020 12:50 AM
- Karma Re: In what case would there be a switch to Syslog-NG PE? for GergelyBodnar. 06-05-2020 12:50 AM
- Karma Re: How to extract a string from a particular XML tags with regular expression? for gcusello. 06-05-2020 12:50 AM
- Karma Re: Why is the KV pair extraction with custom delimiters not working? for FrankVl. 06-05-2020 12:50 AM
- Karma Re: How to convert a flat multivalue field back to a real multivalue format via regex? for woodcock. 06-05-2020 12:50 AM
- Karma Re: How to add a new search head to an existing SHC? for harsmarvania57. 06-05-2020 12:50 AM
- Karma Re: How to add a new search head to an existing SHC? for harsmarvania57. 06-05-2020 12:50 AM
- Karma Re: How to monitor an encrypted file? for kmorris_splunk. 06-05-2020 12:50 AM
- Karma Re: How do I set an enitre log file to be one single event? for ddrillic. 06-05-2020 12:50 AM
Topics I've Started
No posts to display.
06-14-2019
07:46 AM
Searching for just "AUK" won't work, because there is no space after the AUK value. That's why AUK* works.
... View more
06-14-2019
07:32 AM
I would also try this:
... [ your search without message_id= ] ...
| rex "^(?<message_id_test>...)"
| search message_id_test="AUK"
If that works, then I think there's something wonky with your field extractions, and it showing up on the interesting fields is definitely odd.
... View more
06-14-2019
07:28 AM
What do you get when you try:
| ... [ your search without message_id= ] ...
| stats dc(message_id) as message_id_count values(message_id) as message_id_values
Do you get a numeric value for the count and a list of message_id values?
... View more
06-14-2019
07:25 AM
Hi @wryanthomas ,
This might not be the right place to solicit Splunk app development work. If you're not sure about how to your app validated and installed on SplunkCloud, here is some information on how to do that:
https://docs.splunk.com/Documentation/SplunkCloud/7.2.6/User/PrivateApps
If you're not sure how to do the work needed to make the app validated for SplunkCloud, you might consider contacting Splunk Professional Services to assist.
https://www.splunk.com/services/119
... View more
06-14-2019
07:13 AM
What happens when you try message_id="*AUK*" ?
... View more
06-14-2019
07:05 AM
Hi @henriq_c ,
You search is a bit confusing. You're using a join to try and calculate percentused, when you can just use the first value to calculate it:
| eval percentused = round((100 - Value), 4)
So your search should look like:
index=xxxx eventtype="perfmon_windows" object="LogicalDisk" counter="% Free Space" host=cccc instance="C:"
| eval percentused = round((100 - Value), 4)
| timechart span=1m percentused by instance
If that's not what you're looking for, perhaps you could explain what you are trying to do more clearly.
Updated answer:
index=xxxx eventtype="perfmon_windows" object="LogicalDisk" (counter="% Free Space" host=cccc instance="C:") OR (counter="Free Megabytes" host=cccc instance="C:")
| eval percentfree = case( counter=="% Free Space", round(Value, 4) )
| eval gbfree = case( counter=="Free Megabytes", round(Value / 1000, 2) )
| stats latest(percentfree) as percentfree latest(gbfree) as gbfree by host instance
| eval gbused = round( ( gbfree / percentfree * 100 ), 2) - gbfree
| timechart span=1m gbused by instance
... View more
06-14-2019
06:57 AM
Hi @afx ,
Based upon your answers in the comments, you are probably not using the right search term(s). Can you provide a sample of what an event looks like that contains the data you're looking for? Highlight the value that is supposed to be the myfield value you're looking for.
Here's another thing you might try (seems to match your case):
https://www.splunk.com/blog/2011/10/07/cannot-search-based-on-an-extracted-field.html
... View more
06-14-2019
06:55 AM
Then everything is working fine, and you're not searching for the right value.
Can you provide a sample event where it contains the value you're looking for?
... View more
06-14-2019
06:49 AM
Hi @EHariharan ,
The answer provided by @ragedsparrow is how you should approach data onboarding. However, if you're the one tasked with owning the data, and you're just given some events you might try these values:
SHOULD_LINEMERGE = false
LINE_BREAKER = ([\r\n]+)
TIME_PREFIX = TransferStartTime=
TIME_FORMAT = %H%M%S,TransferStartDate=%Y%m%d
TRUNCATE = 10000
MAX_TIMESTAMP_LOOKAHEAD = 40
... View more
06-14-2019
06:42 AM
Hi @sahil237888 ,
I would use a lookup to do this, setting a threshold list for the countries.
Example lookup CSV:
City_Code,Threshold
US,10
PH,30
NR,10
Then you could do the following search:
... [ you search ] ...
| table City_Code Count
| lookup threshold_lookup City_Code OUTPUT Threshold
| fillnull Threshold
| where Count > Threshold
Here is an example of how it would look using dummy events and data:
... View more
06-14-2019
06:20 AM
And if you do:
index=myindex sourcetype=mysrc
| table index sourcetype myfield
| search myfield="A"
What do you see?
... View more
06-14-2019
05:57 AM
What results do you see when you table the events:
index=myindex sourcetype=mysrc
| table index sourcetype myfield
| sort myfield
Do you see values in myfield?
... View more
06-14-2019
05:53 AM
Hi @wfskmoney ,
You're better off using values instead of list and dedup if you want unique values of amountInCHFCat.
| table contractId amountInCHFCat
| eventstats count as HTamountCounts by contractId amountInCHFCat
| eventstats values(amountInCHFCat) as amountLabels, values(HTamountCounts) as HTamountCounts by contractId
| eval HTamountCounts=mvzip(amountLabels,HTamountCounts,"|")
| eval amountLabels = mvdedup(amountLabels)
| eval HTamountCounts = mvdedup(HTamountCounts)
Of course, you can use list in addition to values if your mvzip doesn't work the way you want it to after that.
In regards to your other observation, 100 might be the visible display limit, but the other limit in eventstats is memory based (the default is 200MB per search using eventstats). This is usually enough for most applications, but I have seen instances where the memory limit is reached (which you can see as a max_mem message in the search.log for the search job).
... View more
06-14-2019
05:38 AM
Hi @usernamejpblais ,
You cannot generate a wildcard value for a dropdown list, or a multichoice box, or a radio button (at least not with the standard Splunk simple XML format, advanced javascript/html is probably beyond the scope of your question). You can have a text box input that you can take the results from and put a wildcard after it.
You CAN create an static entry that includes a wildcard value in the list of choices.
For your use case, however, I would recommend NOT using a dropdown box because your list of options is very large. Dropdown lists make more sense for lists that are somewhere in the range of a few choices to maybe a couple of dozen. Anything more than that becomes a hassle to search and use.
There are other options. You could split the choices into two options:
First X characters (maybe 3 or 4 in your case) which filters to only items starting with those first 3 or 4 characters, and then a second dropdown that will provide results for all the values that start with the first 4 characters provided in the first box.
I hope this helps.
... View more
06-13-2019
02:12 PM
Is that consistent behavior? Every time you search for the last 90 days you don't see that event? I do agree with @Vijeta 's comment to try using the earliest=@d-90d latest=@d time range in the search itself to see if you return different results.
... View more
As mentioned in the answer, the summary range will not go past the retention limit of the index, because data models are stored in the index folder, and are subject to the retention of the index they're modeling off of. Therefore, even if you set the data model to accelerate for "all time", it would only be for all available time for that particular index given the retention period.
... View more
06-13-2019
11:25 AM
Can you provide some sample data and a more clear idea of what calculations you are looking to do after the initial chart command?
... View more
06-13-2019
11:23 AM
Hi @abwe ,
The important thing to have working for Enterprise Security is CIM compliance. This essentially means that fields are "normalized" according to the CIM that ES uses. Additionally, the events have to have the proper eventtypes and tags associated with the data source.
To learn how to make your data CIM compliant you can reference the CIM documentation:
https://docs.splunk.com/Documentation/CIM/4.13.0/User/Overview
As for the app you are referencing, it is not a Splunk approved or supported app. While that's not a requirement, it makes things a lot easier when you can find an app that has already been vetted to be compatible with Splunk and the most recent CIM version. Unfortunately, Kaspersky Security Center 10 does not appear to have a CIM compliant app on Splunkbase, so you're on your own for making it work with Enterprise Security.
If you don't have the required knowledge and/or time to make your data work with ES, you might be better off looking at Splunk Professional Services to handle this for you.
... View more
06-13-2019
09:47 AM
Hi @chengka ,
You could also try the following:
index=stats (sourcetype=services History Service) OR (sourcetype=logs_sl "org.apache.coyote.AbstractProtocol start")
| eval restart = if(sourcetype==logs_sl, 1, 0)
| stats max(restart) as restart count
| where (restart==0) AND (count < 40)
Each event will be assigned a restart value of 0, unless it's the logs_sl sourcetype that matches the restart string, which will then get assigned a restart value of 1. Then stats will find the highest value of restart, which should always be 0 unless there's a restart, in which case it's 1. Finally the where statement only shows results of there is no restart and the count is less than 40.
... View more
06-13-2019
07:17 AM
HI @santosh_hb ,
This is not supported. The search heads have to be at or above the version of the indexers. Therefore your search head would have to be running version 7.2.1 in your scenario.
... View more
06-13-2019
07:13 AM
1 Karma
Hi @wfskmoney ,
As per the document reference by @kamlesh_vaghela (https://docs.splunk.com/Documentation/Splunk/7.3.0/SearchReference/Multivaluefunctions#Description), the list(X) command has a limit of 100 values returned.
... View more
06-13-2019
07:09 AM
2 Karma
Hi @rosho ,
The stats version will discard time range buckets where the count is 0. Timechart will include these timeranges (and therefore the result count will be different). Additionally in your timechart command you're putting in a count of statuses and setting it to logins. You're not doing the same thing for the stats command.
... View more
06-13-2019
07:00 AM
1 Karma
Hi @mkrishnamoorthy ,
If you're looking for the count of syslog events for each device broken down per minute over time, then this is the right search. Generally, you don't need to specify a span= value for timechart because it automatically picks the most appropriate value given the time range used in the search.
... View more
06-13-2019
06:54 AM
Hi @emirhand ,
The answer provided by @richgalloway works and provides a table of maximum values. However, if you're looking for a single value for a particular device to display on a dashboard, you might try this:
| makeresults
| eval _time=now(), device="UPS001", BAT0Voltage=521, BAT1Voltage=500, BAT2Voltage=509, BAT3Voltage=593
| stats latest(BAT*) as BAT* by device
| where device="UPS001"
| table BAT*
| transpose
| stats max("row 1") as MaxVoltage
In the above example, I'm creating a dummy event for a device called UPS001 with 4 battery voltage values. We run a stats to get the most recent value for all devices, then we filter to a specific device (UPS001 in this case). After that we use a transpose command to line all the fields up in a column so that we can run a simple stats command to get the maximum value for the UPS001 device.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:04 AM
|
Karma given to
