Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- Find Answers
- :
- About jodros
jodros
Builder
Member since:
01-18-2011
06-13-2024
Community Statistics
| Posts | 231 |
| Solutions | 23 |
| Karma Given | 26 |
| Karma Received | 48 |
| Member Since | 01-18-2011 |
Activity Feed
- Posted Re: Stream App + Netscaler AddOn: Why are Netflow elements not decoded? on All Apps and Add-ons. 02-16-2023 06:24 PM
- Posted Re: Search That Looks Back in Time and Checks Fields on Splunk Search. 08-11-2020 12:56 PM
- Posted Re: Search That Looks Back in Time and Checks Fields on Splunk Search. 08-11-2020 08:56 AM
- Posted Re: Search That Looks Back in Time and Checks Fields on Splunk Search. 08-10-2020 06:37 AM
- Posted Re: Search That Looks Back in Time and Checks Fields on Splunk Search. 08-10-2020 06:36 AM
- Posted Search That Looks Back in Time and Checks Fields on Splunk Search. 08-07-2020 02:33 PM
- Got Karma for Create alert when average events greater than 2 standard deviations from rolling average. 06-05-2020 12:49 AM
- Got Karma for Why am I getting "ERROR:root:code for hash md5 was not found." running a Python script on a search head?. 06-05-2020 12:48 AM
- Karma Re: How to find the average of daily indexed data by host for a given time range and show all hosts on a timechart, not just the top 10? for martin_mueller. 06-05-2020 12:47 AM
- Karma Re: Is there a way i can schedule a saved search to run for every 2 weeks? for woodcock. 06-05-2020 12:47 AM
- Karma Re: How to get Windows logs into my Splunk instance on Ubuntu? for somesoni2. 06-05-2020 12:47 AM
- Karma Re: How to assign syslog file to specific index based on file name in transforms.conf? for strive. 06-05-2020 12:47 AM
- Karma Re: What is the quickest way to see if a host was ever indexed in Splunk? for somesoni2. 06-05-2020 12:47 AM
- Karma Re: Google Maps not working after upgrade to 6.1.2 for southeringtonp. 06-05-2020 12:47 AM
- Karma Re: Does Splunk for Juniper SA SSL VPN support Syslog over TCP? for xinger. 06-05-2020 12:47 AM
- Karma Re: Where is the Splunk logrotate file located? for yannK. 06-05-2020 12:47 AM
- Karma Re: At what point do you need to consider scaling horizontally for Syslog collection and what would that architecture look like? for ltrand. 06-05-2020 12:47 AM
- Got Karma for Where is the Splunk logrotate file located?. 06-05-2020 12:47 AM
- Got Karma for Re: At what point do you need to consider scaling horizontally for Syslog collection and what would that architecture look like?. 06-05-2020 12:47 AM
- Got Karma for Google Maps not working after upgrade to 6.1.2. 06-05-2020 12:47 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 1 | |||
| 1 | |||
| 0 | |||
| 0 |
04-28-2014
11:25 AM
Thanks! This worked for me.
... View more
04-24-2014
09:02 AM
I need to create a search that will look back over the last year and list all users that have not logged into a webserver. I was thinking about running a search that normalized, deduped, and listed all users in a table. Then I wanted to run a search against the table for all users with timestamps older than 30 days. I have the first part working, but not the search against the table. Any help would be appreciated.
sourcetype=webserver audit_event=AUTHN_SUCCESS tag=prod | eval username=lower(username) | dedup username | table _time username | search _time>-30d
... View more
03-25-2014
01:02 PM
I there any benefit to upgrade the Splunk_TA_nix to 5.0.2 if it is used with *nix 4.6?
... View more
03-25-2014
11:15 AM
Also on a side note, why does the new *Nix app utilize the old flashtime as well as old breadcrumb navigation within Splunk 6?
Thanks
... View more
03-25-2014
11:15 AM
Thank you for your quick response. I think that seals the deal for me. I like the *nix 4.6 UI much more than the new one. I do think the new UI is more modern and sleek, as well as easier to configure. However, the old *nix 4.6 UI provides much more meaningful data in a way which is easier to digest and utilize for my server engineers. It would be great to enter enhancement request for this. I would love to see all missing data from the old UI in the new; network, diff files, user, ntp, etc.
Thanks
... View more
03-25-2014
09:05 AM
1 Karma
I am testing the new *nix app. I was a heavy user of the previous *nix 4.6 app. Loved it. Am I missing some here? Where do I find the network utilization, file diff, user logon, etc data displayed?
... View more
12-27-2013
12:11 PM
Currently I have three scheduled searches that run once a day to baseline possible APT on our network by showing the top 25 hosts for total bytes, connections and length of time for connections through our firewall. The searches take some time to run even with report acceleration enabled, so they are run during the night. I would like to identify hosts that show up on all three top 25 reports. I have all three in a dashboard that allows me to manually view and identify hosts, however it would be easier if it could also be automated. What I would like is to have a search run across the result sets of the three top 25 APT reports that would display any host showing up on all three.
If anyone has any suggestions, I would appreciate it. Thanks in advance.
... View more
11-22-2013
08:22 AM
I had to comment out the following lines in savedsearches.conf for my searches to display in the new Splunk 6 format:
#displayview = flashtimeline
#request.ui_dispatch_view = flashtimeline
#vsid = <some unique value>
After commenting out the vsid line, it auto gens a new one in both of the savedsearches.conf and viewstates.conf. I was not able to get the saved searches to display properly without commenting out all three of these lines. I originally thought just the vsid was the only thing that was needed, but it turns out they were all needed.
Thanks
... View more
11-13-2013
06:48 AM
I noticed that after the Splunk 6 Upgrade, all of the saved searches displayed in what I called a "hybrid" format, where the new Splunk 6 feel exists on the upper part of the page, but starting at the search bar, it looks like Splunk 5. I think this might be due to older viewstates or possibly something in the savedsearches.conf. I have tried a few things but nothing seems to convert it fully to Splunk 6 look and feel.
Any suggestions would be appreciated.
Thanks
... View more
- Tags:
- savedsearch
- splunk6
11-13-2013
05:35 AM
Because it will only take the last FIELDALIAS statement it reads. So actually in your example, the ip field will only contain the values from the dest_ip field.
... View more
11-06-2013
09:47 AM
Hey yong.ly, sorry about the last comment 18 hours ago. Apparently my session wasn't fresh and I did not see your comments. Yes, using the mvexpand is exactly what I need. I really appreciate the assistance.
... View more
11-05-2013
02:44 PM
So at this point, I need to know why I can run a stats count with a multi value field, but not a timechart count. Also, the iplocation is a custom python script and I guess I need to know how to make it work with a multi value field.
I also need to decide if this is worth it, to extract both IP's (src and dest) from logs and display them by unique IP count on a map.
... View more
11-05-2013
06:41 AM
And apparently I cannot run a "| iplocation" on a multi-value field. Hmmmm.
... View more
11-05-2013
06:34 AM
Ok, so now how can I further filter out my transformed search results. I am able to use a "| search NOT ip=10.0.0.0/8" when I run a stats, but not a timechart. I would like to filter out results from internal IP's and only display foreign IP's.
... View more
11-04-2013
02:16 PM
I don't know if this is possible for the same sourcetype when I want to evaluate both IP addresses and then assign them to one single field.
... View more
11-04-2013
02:16 PM
Tried separate EXTRACT commands for the sourcetype. Didn't work.
I think I am running into an issue where a field cannot exist more than once per sourcetype possibly. I know that I can create field aliases for fields from differing sourcetypes. For instance, I can define a field alias src = src_ip for sourcetype a, and another field alias sip = src_ip for sourcetype b. The when I run the search src_ip=1.1.1.1, if the value exists across both sourcetypes, it will return data from both.
... View more
11-04-2013
01:22 PM
I don't think that this will work. For one the logs don't actually contain the field names, so it doesn't looks like src_ip=1.1.1.1 dest_ip=2.2.2.2 in the log. However if we took this approach anyway, I think this regex would always match the first and would not show results from both for the new field "phrase".
Thanks for the suggestion.
... View more
11-04-2013
11:15 AM
Or if there is a way to sum the output of a two separate stats commands:
stats count by src_ip
1.1.1.1 count 2
stats count by dest_ip
1.1.1.1 count 3
sum of both stats
1.1.1.1 count 5
Thanks
... View more
11-04-2013
08:44 AM
I just tried running stats on the src_ip and dest_ip in separate searches and appending it together. That didn't work either.
Neither did a join. Was looking at foreach command. Wonder if it would do it?
... View more
11-04-2013
07:33 AM
Ok. So maybe that isn't what a want to do. I thought if I were able to merge all values from two fields into one field, than I could show the total count for an unique IP on a map, whether it was the source or destination in a log.
Is there a better way to accomplish this?
Ultimate goal:
log 12:00:00 src_ip=10.10.10.10 src_port=12345 dest_ip=1.1.1.1 dest_port=80 action=allow
log 12:00:01 src_ip=1.1.1.1 src_port=12345 dest_ip=10.10.10.10 dest_port=80 action=block
The stats count for a new field ip should show 1.1.1.1 as having a count of 2.
Let me know if this makes more sense.
Thanks
... View more
11-04-2013
07:10 AM
1 Karma
I have two fields, src_ip and dest_ip. These two fields show up in the same log. I am trying to merge all values of these two fields into a new generic field, ip. I have tried using rename, eval with coalesce(), rex, as well as field aliases. In all cases, only one of the fields (either src_ip or dest_ip) shows as ip.
Summary:
log 12:00:00 src_ip src_port dest_ip dest_port action
src_ip = 1.1.1.1
dest_ip = 2.2.2.2
New ip field = 1.1.1.1 and 2.2.2.2
Any suggestions would be appreciated.
Thanks
... View more
- Tags:
- field
10-30-2013
09:31 AM
Was able to use this thread as a model.
http://answers.splunk.com/answers/47037/delta-then-sum-then-graph-from-multiple-hosts
Thanks
... View more
10-30-2013
08:21 AM
I need some assistance with constructing a search to help identify machines with reoccurring infections. I thought that I could basically look for any machine logs that show infections with a _time greater than 1 hour. I am having difficulty trying to apply the diff or delta command with relation to computer. It would be great to have something like delta _time AS timeDelta by Computer, so that it would only run the delta on the _time from the same Computer. As it is now, it is running the delta or diff from the last log without any consideration for computer.
If anyone has any suggestions on how to accomplish this, or another way of identifying reoccurring infections, please let me know.
Thanks
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-13-2024
05:04 PM
|
Karma from
Karma given to
