Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- About johnhuang
johnhuang
Motivator
Member since:
07-10-2019
02-18-2026
Community Statistics
| Posts | 378 |
| Solutions | 78 |
| Karma Given | 73 |
| Karma Received | 130 |
| Member Since | 07-10-2019 |
Activity Feed
- Got Karma for Re: What search can list the Empty indexes which are not sending data to splunk enterprise?. 04-10-2025 07:12 AM
- Posted Re: CSS changes in v9.4.0 on Dashboards & Visualizations. 03-04-2025 11:15 AM
- Karma Re: CSS changes in v9.4.0 for coreyCLI. 03-04-2025 11:14 AM
- Posted Re: CSS changes in v9.4.0 on Dashboards & Visualizations. 02-25-2025 12:59 PM
- Posted Re: Dashboard CSS Width setup doesn't work anymore with 9.x version ? on Dashboards & Visualizations. 02-25-2025 12:58 PM
- Karma Dashboard CSS Width setup doesn't work anymore with 9.x version ? for JulienKVT. 02-25-2025 12:57 PM
- Got Karma for Re: Cannot get count by case statement. 11-08-2024 12:39 PM
- Got Karma for Re: Splunk doesn't display extra spaces. 11-08-2024 05:26 AM
- Got Karma for Re: Splunk doesn't display extra spaces. 11-07-2024 08:49 PM
- Karma Re: Join two indexes on time where time is different by 2 sec for yuanliu. 11-07-2024 07:30 PM
- Posted Re: Splunk doesn't display extra spaces on Splunk Search. 11-07-2024 07:23 PM
- Posted Re: Cannot get count by case statement on Splunk Search. 11-07-2024 07:13 PM
- Posted Re: Moving indexers from centos to redhat8 on Getting Data In. 10-04-2024 04:10 AM
- Got Karma for Re: mvexpand multiple multi-value fields?. 08-29-2023 05:49 AM
- Posted Re: How can I adjust the query to include total connections that are initiated out of the country? on Splunk Enterprise. 04-13-2023 10:40 AM
- Posted Re: Need Help with Query Involving Countries on Splunk Enterprise. 04-13-2023 08:23 AM
- Got Karma for Re: Metadata fields license consumption. 04-13-2023 08:12 AM
- Posted Re: Metadata fields license consumption on Getting Data In. 04-13-2023 08:08 AM
- Karma Re: Metadata fields license consumption for mattymo. 04-13-2023 07:53 AM
- Posted Does the length of metadata fields and its value, host, source, and sourcetype count against license consumption? on Getting Data In. 04-12-2023 07:41 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
11-08-2022
06:36 AM
1 Karma
One of these could work: index="my index" sourcetype="my sourcetype" action="heartbeatfailure"
| bucket _time span=1d
| eventstats count BY _time host action
| table _time host action failure_reason count
| where count>2 index="my index" sourcetype="my sourcetype" action="heartbeatfailure"
| bucket _time span=1d
| stats count values(failure_reason) AS failure_reason BY _time host action
| table _time host action failure_reason count
| where count>2
... View more
11-07-2022
06:00 PM
Assuming that Ing values are always formatted as a phone number: | rex field=Logs "\"(?<ing_values>\d\-\d{3}\-\d+)\""
| eval ing_6=MVINDEX(ing_values, 6)
... View more
11-07-2022
05:51 PM
Yes you could do that.
... View more
11-07-2022
08:06 AM
You can do the lookup twice. Either of these should work: | lookup lookup_name host AS host OUTPUT app AS app_1 owner AS owner_1
| lookup lookup_name ip AS host OUTPUT app AS app_2 owner AS owner_2
| eval app=COALESCE(app_1, app_2)
| eval owner=COALESCE(owner_1, owner_2) | lookup lookup_name host AS host OUTPUTNEW app owner
| lookup lookup_name ip AS host OUTPUTNEW app owner
... View more
11-04-2022
02:49 PM
You can do this with schedule report or alert. As long as you have an outputlookup in the query, it should update the lookup.
... View more
11-04-2022
02:47 PM
Could you provide a sample an event or string that meets your criteria?
... View more
11-04-2022
02:45 PM
Just add the outputlook command to the end of your search query. | outputlookup <lookup_file_name>.csv
... View more
11-04-2022
02:42 PM
index=commerce ((loginSuccessful=true) OR ("profile email!="<null>" AND email!=null))
| eval login_ct=CASE(loginSuccessful="true", 1)
| stats sum(login_ct) AS login_ct BY profile email
... View more
11-03-2022
07:18 AM
For LOL or “Living off the Land" attacks, the ideal tool is an EDR/HIDS solution that provides you with raw logs, e.g. Carbonblack, or Sysmon which is free.
... View more
11-02-2022
10:28 PM
There's windows event logs do not monitor NTFS. You may be able get kerberos auth to fileshares but thats about it.
... View more
11-02-2022
06:43 PM
1 Karma
The sample data looks like _raw rather than msg. You can try something like this which extracts any 13 digit number nested between forward slashes. This could be more flexible depending on the variability of your data. | rex "\/(?<myid>\d{13})\/"
| table myid
... View more
11-02-2022
11:26 AM
Base search refers to the initial part of the query, for example, it may look like this: index=<index_name> sourcetype=<source_type> | table _time id, type, status, duration As long as you have the fields ( d, type, status, duration) available, this should work: <base_search>
| chart avg(duration) AS avg_duration BY type status
| eval LAST_VAL=0
| foreach IN_QUEUE_* [
| eval CURRENT_VAL=<<FIELD>>
| eval AVG_TIME_<<FIELD>>=<<FIELD>>-LAST_VAL
| eval LAST_VAL=CURRENT_VAL
]
| table type AVG_TIME_*
... View more
11-01-2022
09:09 PM
If a user logged in from the office, how would you tell if/when they logged off or offline?
... View more
11-01-2022
07:30 PM
Not sure if you want one time use alert or one alert per run. For the latter: configure the Trigger to "Once" which will limit the alert to one per run.
... View more
11-01-2022
07:21 PM
1 Karma
You don't need to use appendpipe for this. You can simply use addcoltotals to sum up the field total prior to calculating the percentage. | inputlookup Patch-Status_Summary_AllBU_v3.csv | stats count(ip_address) as total, sum(comptag) as compliant_count by BU | addcoltotals labelfield=BU label=TOTAL total compliant_count | eval patchcompliance=round((compliant_count/total)*100,1) | fields BU total compliant_count patchcompliance | rename BU as Domain, total as TAM, patchcompliance as "% Compliance"
... View more
11-01-2022
01:33 PM
The lookup name is lookup_sfdc_usernames, not lookup_sfdc_usernames_kvstore. 1. Check if you have any data in the lookup: | inputlookup lookup_sfdc_usernames If 1 doesn't work: Check if the above lookup in configured in lookup definition. Check if the populating search "Lookup - USER_ID to USER_NAME" is scheduled. Once you have the lookup working, you should modify the dashboards to point to this lookup.
... View more
11-01-2022
11:26 AM
<base_search>
| chart avg(duration) AS avg_duration BY type status
... View more
11-01-2022
09:46 AM
Wow, you did provide fair warning, there's a lot to unwind here. Just on a high level, the very generous use of multiple append and joins forces the search and processing to occur in a certain sequential order which is likely the cause of the delay. In particular, the join in your base search 2 would the first I would focus on. When using a join, the subsearch actually runs before the main search. See if this is the issue by deleting the join in your 2nd search and see how it impacts performance.
... View more
11-01-2022
07:40 AM
If you're willing to provide the query of the base searches, i'll be happy to help optimize it.
... View more
11-01-2022
06:55 AM
How are you generating the multivalued filters for services_type and type? Are you using base searches in the dashboard?
... View more
10-31-2022
01:42 PM
It'll be easier if you can provide a sample query for the first and second search.
... View more
10-31-2022
12:42 PM
You can utilize condition match to set the link target. https://kinneygroup.com/blog/mastering-splunk-drilldowns-with-conditions/
... View more
10-31-2022
12:32 PM
I'm not sure if there are other ways, but I've only used CURL to submit an package for cloud vetting. https://dev.splunk.com/enterprise/docs/releaseapps/cloudvetting
... View more
10-31-2022
11:29 AM
You have to have the app validated before it can be installed on Splunk Cloud. https://dev.splunk.com/enterprise/docs/releaseapps/cloudvetting
... View more
- Tags:
- y
10-31-2022
09:30 AM
1 Karma
You will have to build a dashboard and configure the drill down to open the URL value of the field.
... View more
