Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- Find Answers
- :
- About adonio
adonio
Ultra Champion
Member since:
02-25-2015
10-07-2021
Community Statistics
| Posts | 2238 |
| Solutions | 322 |
| Karma Given | 90 |
| Karma Received | 489 |
| Member Since | 02-25-2015 |
Activity Feed
- Got Karma for Re: How to change password using CLI in splunk. 03-20-2026 01:31 AM
- Got Karma for Re: Lookup CSV location. 01-23-2026 04:24 AM
- Got Karma for Re: Retrieve/download the original source file(s) after a search. 12-18-2025 05:17 PM
- Got Karma for Re: Does the blocking of a heavy forwarder cause data drop or event drop?. 06-02-2025 01:57 PM
- Got Karma for Re: Difference between two string date fields. 04-11-2025 02:47 AM
- Got Karma for Re: clustering not working. 04-09-2025 12:54 PM
- Got Karma for Re: Get Log size. 03-05-2025 05:43 AM
- Got Karma for Re: What are the steps to remove data from an indexer cluster?. 12-18-2024 10:38 AM
- Got Karma for Re: how to extract the list of ITSI services?. 04-05-2024 07:08 AM
- Got Karma for Re: How to do an outer join on two tables with two fields?. 03-26-2024 06:40 AM
- Got Karma for Re: How to restart Universal Forwarder from a Deploy Server?. 01-23-2024 05:37 AM
- Got Karma for Re: What are the steps to remove data from an indexer cluster?. 12-04-2023 08:57 AM
- Got Karma for Re: Get Log size. 09-18-2023 02:32 PM
- Got Karma for Re: How to audit capability assignment?. 06-28-2023 03:57 PM
- Got Karma for Re: Splunk as a tool for capacity and performance management. 05-17-2023 11:33 PM
- Got Karma for Re: What are the steps to remove data from an indexer cluster?. 05-09-2023 12:07 AM
- Got Karma for Re: How to transpose some rows to columns?. 03-09-2023 01:55 AM
- Got Karma for Re: Best Practice for Alert Time Range and Cron Expression. 07-26-2022 12:42 AM
- Got Karma for Re: Does anyone know of a few Windows event logs to monitor in Splunk for system crashes and errors?. 06-15-2022 08:18 AM
- Got Karma for Re: how to Count warm buckets per indexer per index. 05-16-2022 01:44 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 1 | |||
| 0 |
04-20-2020
07:48 PM
... your search and filters with index and sourcetype here ... | chart avg(Runtime_A) as avg_A avg(Runtime_B) as avg_B by guid ...
you can use any functions that you wish ... look into the chart or stats command documentation
https://docs.splunk.com/Documentation/Splunk/8.0.3/SearchReference/Stats
... View more
04-20-2020
07:43 PM
i dont think so ... it might in some cases, but if so it will be on the docs.
in transforms.conf it indicate only the [true|false] variables
https://docs.splunk.com/Documentation/Splunk/8.0.3/Admin/Transformsconf
... View more
04-20-2020
07:40 PM
1 Karma
do you mean something like below?
.... | eventstats count(eval(DLP_installed=="yes")) as instlled_count ... then use the new field as you see fit
... View more
04-19-2020
06:21 PM
start here:
index=_internal component=PackageDownloadRestHandler host=* app=<YourAppNameHere>
or here:
index=_internal sourcetype=splunkd action=install
run in verbose and see how the events look like and write your own logic to answer the questions you care about
hope it helps
... View more
04-06-2020
08:29 AM
please use the | dbinspect command
you can also use | rest /services/data/indexes
... View more
04-01-2020
05:21 AM
try this:
| tstats count as event_count where index=* by host sourcetype
... View more
03-27-2020
12:39 PM
your stats dc(id) as ID takes away all other fields
if i understand your needs, try this:
index = one eventtype=one_tu open=false | stats values(id) as all_ids
if you want to see it with other fields context, add a by clause for your stats command
... View more
03-13-2020
02:50 AM
what exactly do you want to do?
if you want to write the data of the alert to a splunk index, use the Log Event option and choose the place (index) you want the data to be at. read here more:
http://docs.splunk.com/Documentation/Splunk/8.0.2/Alert/LogEvents
... View more
03-10-2020
09:46 AM
try to find the value for the sourcetype your event / data has
then run this search:
| rest services/saved/sourcetypes
| search title=<your_sourcetype>
if the list is huge, you can use the command:
| fieldsummary
look for the resutls and itll give you all the EVAL- REPORT- etc definitions for your fields
hope it helps
... View more
02-27-2020
12:32 PM
little clumsy solution, but maybe itll work for you
try it anywhere
| makeresults count=1
| eval data="1 a 14;;;2 b 2;;;3 c 19"
| makemv delim=";;;" data
| mvexpand data
| rex field=data "(?<label>[^\s]+)\s(?<app>[^\s]+)\s(?<tot_users>[^\s]+)"
| table label app tot_users
| rename COMMENT as "above generates fake data, below is solution"
| chart max(tot_users) as total over label by app
| stats values(*) as *
| mvexpand label
| eval b_plus_c = b + c
| eval percent = round(a / b_plus_c * 100, 2)
hope it helps
... View more
02-27-2020
01:58 AM
you can use the index time as your search filter:
_index_earliest=-11m@m _index_latest=-1m@m (for example) and you will never miss a bit as long as search doesn't skip
read more here
https://docs.splunk.com/Documentation/Splunk/8.0.2/SearchReference/SearchTimeModifiers
... View more
02-19-2020
05:01 AM
1 Karma
check out this answer:
https://answers.splunk.com/answers/803148/heavy-forwarder-multi-core.html#answer-801919
... View more
02-19-2020
05:00 AM
check out this answer, that links to many other answers as well:
https://answers.splunk.com/answers/563888/how-to-change-default-color-charts.html
... View more
02-17-2020
06:57 PM
yes,
read the docs for the apps ...
PAN:
https://splunkbase.splunk.com/app/2757/
Cisco ASA:
https://splunkbase.splunk.com/app/1620/
... View more
02-15-2020
03:06 PM
you cant range _time by ticket_id because you already dedup ed the ticket_id ...
meaning, you have only a single event (and therefore a single _time) for each ticket_id
can you share sample data and desired results?
... View more
02-12-2020
06:10 PM
if the data is balanced accordingly, your search performance will be better as more indexers generate more IOPS
otherwise, the performance will be based on your worse performing indexer both will also always depend on and your SH constrains (CPU, Memory)
... View more
02-12-2020
05:59 AM
better of writing 3 stanzas
if the files in each directory tree are different, you will want 3 stanzas anyways so you can apply the correct sourcetype to each
... View more
02-12-2020
05:39 AM
1 Karma
see here:
https://answers.splunk.com/answers/12027/single-multi-threading-cpu.html
maybe this will help as well:
https://docs.splunk.com/Documentation/Splunk/8.0.1/Capacity/Parallelization
... View more
02-10-2020
01:25 PM
install splunk on your laptop, have the same apps installed, and have them check for updates.
send an alert to yourself every time and app is set for update
... View more
02-08-2020
07:40 PM
it think the challenge with INDEXED_EXTRACTIONS there is that you have the timestamp first, so the file / event is not JSON per-se
you can use indexed extractions with transfoms.conf
... View more
02-07-2020
12:52 PM
switch it then:
index:: | eval time2 = _@timestamp| fields time2 time
... View more
02-07-2020
11:05 AM
try something like this:
index::<yourindexhere> | fields _@timestamp time | eval time2 = _@timestamp
... View more
02-05-2020
06:26 PM
you can use the very inefficient ... | eval raw_size = len(_raw) | stats sum(raw_size) as total by source index
how many events you have that are old (over 24 hours) but are indexed "new" (24 hours or more later)?
... View more
02-05-2020
05:00 AM
try something along those lines, search for the last 30 (or 31 days)
| tstats count as event_count where index=_internal by sourcetype _time span=24h
| eventstats avg(event_count) as days_avg by sourcetype
| eval delta = round(event_count - days_avg, 2)
| eval perc_change = round((event_count / days_avg) * 100, 2)
| where _time >= now() - 86400
| eval alert = if(perc_change > 70 AND delta < 0,"ALERT","OK")
hope it helps
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
10-07-2021
03:55 PM
|
