Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- About maciep
maciep
Champion
Member since:
09-18-2013
10-22-2024
Community Statistics
| Posts | 826 |
| Solutions | 118 |
| Karma Given | 98 |
| Karma Received | 251 |
| Member Since | 09-18-2013 |
Activity Feed
- Got Karma for Re: How do I stop datamodel accelerations from turning themselves back on?. 08-19-2024 09:33 AM
- Got Karma for Re: What is the correct way to edit conf files and propagate changes in a search head cluster ?. 06-12-2024 09:48 AM
- Got Karma for Re: How do I stop datamodel accelerations from turning themselves back on?. 12-06-2023 11:53 AM
- Posted Re: Join query with condition and comparison on Splunk Search. 01-20-2023 06:43 AM
- Got Karma for Re: How can I return specific results using head and tail commands?. 01-20-2023 04:22 AM
- Posted Re: Join 3 sources without join on Splunk Search. 11-28-2022 10:03 AM
- Got Karma for Re: Join 3 sources without join. 11-28-2022 06:33 AM
- Got Karma for Re: Join 3 sources without join. 11-25-2022 04:30 PM
- Posted Re: Join 3 sources without join on Splunk Search. 11-25-2022 08:12 AM
- Got Karma for Re: How to join search based on multiple values?. 11-16-2022 01:48 AM
- Got Karma for Re: How do I stop datamodel accelerations from turning themselves back on?. 10-26-2022 12:56 AM
- Got Karma for Re: Unable to distribute to peer from search head. 10-10-2022 09:14 AM
- Posted Re: Error in 'eval' command: The expression is malformed on Dashboards & Visualizations. 09-29-2022 04:58 AM
- Got Karma for Re: Heavy Forwarder data loss prevention. 09-22-2022 08:05 AM
- Posted Re: Heavy Forwarder data loss prevention on Splunk Cloud Platform. 09-22-2022 05:42 AM
- Posted Re: How to event break on multiple dashes? on Splunk Enterprise. 09-22-2022 05:23 AM
- Posted Re: How to join search based on multiple values? on Splunk Search. 09-16-2022 12:26 PM
- Posted Re: How to compare 2 Search's percentage results? on Splunk Search. 09-16-2022 11:43 AM
- Got Karma for Re: [udp://:portnumber] Event Blacklist. 09-14-2022 05:45 AM
- Posted Re: [udp://:portnumber] Event Blacklist on Getting Data In. 09-14-2022 04:10 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 2 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 0 | |||
| 7 | |||
| 0 | |||
| 0 | |||
| 1 |
10-20-2016
04:29 PM
I think I misread the documentation, so you can ignore the comment about them being AND'd together. I think that is only if multiple expression in one blacklist entry.
... View more
10-20-2016
04:06 PM
I think the problem is that %s represents Epoch time, not seconds since midnight.
%s The Unix Epoch Time timestamp, or the number of seconds since the Epoch: 1970-01-01 00:00:00 +0000 (UTC). (1352395800 is Thu Nov 8 09:30:00 2012)
So Splunk is grabbing 10 digits for epoch, ie 6273371272. And that resolves to GMT: Mon, 17 Oct 2168 11:07:52.
I don't think there is a common time format variable that represents seconds since midnight.
... View more
10-20-2016
03:05 PM
oh and is that configured on your forwarder or indexer or elsewhere?
... View more
10-20-2016
02:46 PM
The regex seems right. If you're modifying the conf file directly (as opposed to using Forwarder Management), have you reloaded/restarted splunk? Have you tried removing the (?i), since matches are always case insensitive anyway? Not sure if that would matter...
Have you tried adding any exact sever names to the whitelist, just to rule out some other issue?
... View more
10-20-2016
02:22 PM
have you tried searching the internal logs from that server? Maybe restart the forwarder and then review the logs to see if splunk throws any warning/errors about those files that are getting indexed.
... View more
10-20-2016
02:15 PM
what does your entire props stanza look like for this sourcetype? are you using indexed_extractions?
... View more
10-20-2016
07:36 AM
The documentation does say that they would be AND'd together. So if both blacklist entries are there, are Logon Type 3 events excluded for those particular users? That's the way I think it would work.
Not sure what the solution would be, maybe find a way to whitelist one of those conditions instead? For example, whitelist any Messages that don't equal Logon Type 3?
... View more
10-19-2016
03:22 PM
1 Karma
In which way is not working? Is neither filter working? Or one but not the other?
I'm not sure if/how relevant, but the documentation mentions putting delimiters around the regex expression.
* key=regex format
* A whitespace-separated list of event log components to match, and
regexes to match against against them.
* There can be one match expression or multiple per line.
* The key must belong to the set of valid keys provided below.
* The regex consists of a leading delimiter, the regex expression, and a
trailing delimeter. Examples: %regex%, *regex*, "regex"
* When multiple match expressions are present, they are treated as a
logical AND. In other words, all expressions must match for the line to
apply to the event.
* If the value represented by the key does not exist, it is not considered
a match, regardless of the regex.
* Example:
whitelist = EventCode=%^200$% User=%jrodman%
Include events only if they have EventCode 200 and relate to User jrodman
... View more
10-19-2016
03:04 PM
What kind of file is it? Does it have a header line maybe? Splunk identifies a file by the first xx bytes, so if all of the files have a common header, splunk may think it's just various copies of the same files, so it won't re-ingest it. There are ways around that.
Also, posting the monitor stanza from your inputs.conf could be helpful too.
... View more
10-17-2016
06:41 PM
So you have one app with two dashboards? If so, do both dashboards have the same problem? Anything consistent? Is it always the same users that don't work? Is it the same data on the same peer? Does the problem persist on each sh in the cluster?
If were to create a dashboard from Splunk web in your app and just copy the source over, does the issue surface for it as well?
No real ideas here, just some troubleshooting steps to narrow down some pattern.
... View more
10-17-2016
06:31 PM
I think you'd probably want to make this a bit more robust. But to just give you an idea, you could do something like this in your props.conf on your indexer/parsing layer.
[your:sourcetype]
SEDCMD-mac_1 = s/\(([\d\w]):/(0\1:/g
SEDCMD-mac_2 = s/:([\d\w]):/:0\1:/g
SEDCMD-mac_3 = s/:([\d\w])\)/:0\1)/g
Each of the sed commands is replacing a single digit with the same digit but includes a leading 0.
The first sed command takes care of the first octet (based on the open paren) The second takes care of the next 4 (based on :xx:). And the final takes care of the last (based on the close paren). There might be a better way, but should get you started I think. Keep in mind, this is just looking for anything that matches within parens, so you might want to be sure you're actually replacing the mac address and not something else that might be in your event.
Hope it helps.
... View more
10-17-2016
06:13 PM
I think at least INDEXED_EXTRACTIONS needs to be on the uf, and so then the remaining parsing might need to be there as well. Not sure if I'm reading the caveats section correctly, but the answer is probably in here somewhere
http://docs.splunk.com/Documentation/Splunk/6.5.0/Data/Extractfieldsfromfileswithstructureddata
... View more
10-17-2016
05:34 PM
maybe use join to put them together by creating a common field for each search.
| inputlookup app_lookup.csv | eval join_field="temp" | join join_field max=0 [|inputlookup link_lookup.csv | eval join_field="temp"] | fields - join_field
... View more
10-14-2016
05:15 PM
1 Karma
Whenever I work with mv fields, I always feel like I'm going out of my way to get where I'm headed, but this seems to work with some very basic test data...
... | eval tmp = split(mvjoin(mvzip(colA,colB),","),",")
| mvexpand tmp
| eventstats count by key tmp
| eval result = if(count=1,tmp,"")
| fields - count tmp
| mvcombine result
So I start by putting colA and colB togehter in one field and then use join/split to ultimately get each value from both fields in one mv field, dups included.
Then I use mvexpand to create one event for each of those values.
Now I can use eventstats to count how many of each value exist for each key.
Then create a new result field that contains the value if there is only one of them (so it only exists in one of the lists), or just an empty string if greater than one.
Finally, get rid some of those unneeded field I created and combine the events back together based on the result field.
Side note, not sure if your search/data is more complicated than it looks, but are you sure you need to be doing a join? Any reason you can't just do stats values(stuff) as M values(otherStuff) as N by key
... View more
10-13-2016
07:16 PM
You're asking to do a timechart with a one hour span, which means that in your sample events the aggregate will be calculated over the 8pm hour. And you're only grouping by LoginString, which has two distinct values. So you'll only have 2 points on the timechart, one for each LoginString. You can't have 3 points for 2 values. That's where the aggregate comes into play (count in this case). It will perform the aggregate for each group by field and display the result on the graph.
So what exactly would you like to see? You could concatenate LoginString with Connections and then group by that result. That would leave you with 3 values for the group by field and so you would see each of those points on your graph
Does that make sense?
... View more
10-12-2016
05:01 PM
We simply use the syslog sourcetype, except for the securelog which we use linux_secure. I didn't see syslog in the pretrained sourcetype list, but linux_secure and linux_messages_syslog are there.
Your host segment looks right to me. What is the host being set as? The syslog server? Since you're not specifying a sourcetype, what sourcetype is being assigned?
... View more
10-12-2016
04:29 PM
I'm not sure exactly what you mean when saying you don't want to hardcode them in a lookup. I think you have a couple different options.
First, if those are literally the only two environements and sites, you could just create a couple calculated fields
eval env = case(match(host,"(?i)\.prod\."),"Production",match(host,"(?i)\.sys\."),"System Testing",1=1,"unknown")
eval site = case(match(host,"(?i)\.d2"),"BOHO",match(host,"(?i)\.d3"),"Cranebank",1=1,"unknown")
Or i you have a lot of them, you can use a couple lookup tables - maybe one for site and one for environment. Configure them to allow wildcard matching on host, and I think you should be fine.
For example:
host,env
*.prod.*,Production
*.sys.*,System Testing
... View more
10-11-2016
04:37 PM
5 Karma
what about using stream stats to essentially create a row number?
... | streamstats count as row_num | where row_num <=5 | fields - row_num
... | streamstats count as row_num | where row_num >5 AND row_num <=10 | fields - row_num
... | streamstats count as row_num | where row_num >10 | fields - row_num
... View more
10-11-2016
02:39 PM
1 Karma
I was able to do it on 6.5 on my test machine (windows 10). Have you tried removing the single quotes surrounding your token? Not sure why those are there?
Here is what I have:
<form>
<label>sampling test</label>
<fieldset submitButton="false">
<input type="dropdown" token="t_ratio" searchWhenChanged="true">
<label>Ratio</label>
<default>100</default>
<choice value="0">0 - All Events (Computationally HEAVY)</choice>
<choice value="10">1:10</choice>
<choice value="25">1:25</choice>
<choice value="50">1:50</choice>
<choice value="75">1:75</choice>
<choice value="100">1:100</choice>
<choice value="150">1:150</choice>
<choice value="200">1:200</choice>
<choice value="300">1:300</choice>
<choice value="500">1:500</choice>
<choice value="750">1:750</choice>
<choice value="1000">1:1000</choice>
<choice value="5000">1:5000</choice>
</input>
</fieldset>
<row>
<panel>
<table>
<search>
<query>index=wineventlog earliest=@d | table _time, EventCode</query>
<earliest>$earliest$</earliest>
<latest>$latest$</latest>
<sampleRatio>$t_ratio$</sampleRatio>
</search>
</table>
</panel>
</row>
</form>
... View more
10-07-2016
06:45 PM
First things first, it doesn't look like you're using the actual timechart command at all.
You're using the stats command. I'm not sure if it's quite this simple, but you could just try sorting your results by _time:
index=web_mongodb host=mongodb-* "protocol:op_command" NOT "sleeping" NOT "splitChunk"
| rex "(?\d+)ms"
| eventstats avg(query_duration) as avg_query_duration
| sort 0 _time
| table _time _raw query_duration avg_query_duration
I'm not sure if this is really what you want to see, but we can help you with further requests too. For example, maybe you just want to see a graph of duration difference (duration - avg duration)...maybe that would be more telling over time?
... View more
10-07-2016
05:20 PM
this post is over a year old. I think 4.0 was released last year after .conf, so it wasn't available at the time of this post 😉
... View more
10-06-2016
04:29 PM
not sure if I'm misunderstanding, but you can drop unwanted events on the indexer too. That happens during the parsing phase which should happen on your indexer with the current setup.
This might be a good page to review as well - high level overview of the phases and where each phase happens in different types of splunk deployments.
http://wiki.splunk.com/Where_do_I_configure_my_Splunk_settings%3F
... View more
10-05-2016
07:10 PM
Glad it worked for you!
I guess I'd have to understand better how you want to see the timestamp again. Do you still want to see the table view like you posted, but just with another field for the count? If so, I think the eventstats command might be better. It does the same agg calculation as stats, but keeps all of the original events too.
source="/var/log/auth.log" host="samplehost" sourcetype="authentication" user!=null |eventstats count by rhost | table _time rhost user count
Or do you want to see a list of timestamps for each remote device?
source="/var/log/auth.log" host="samplehost" sourcetype="authentication" user!=null |stats count list(_time) as timestamps by rhost
Other than those two examples, not sure how else to add the timestamp back in over the aggregrate view.
... View more
10-05-2016
05:23 PM
Not sure if this will work, but if the data is consistent maybe you can use rex to along with some mv commands
| stats count | eval blah="match_1=\"Don\'t Be So Shy\" match_2=\"Imany\" match_3=\"8,980,580\" match_4=\"Human\" match_5=\"Rag\'n\'Bone Man\" match_6=\"763,862\" match_7=\"Closer\" match_8=\" Chainsmokers\" match_9=\"3,671,646\""
| rex field=blah "match\_\d+=(?<title>\"[^\"]+\")\s+match\_\d+=(?<name>\"[^\"]+\")\s+match\_\d+=(?<score>\"[^\"]+\")" max_match=0
| eval temp = mvzip(title,name)
| eval temp = mvzip(temp,score)
| fields temp
| mvexpand temp
| rex field=temp "^(?<title>[^,]+),(?<name>[^,]+),(?<score>.+)"
| fields - temp
| table title name score
... View more
10-04-2016
07:05 PM
how are the first and second values related? I could be mistaken, but I thought the single value only worked with one value - so the coloring would have to be based on that value.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
10-22-2024
07:27 AM
|
Karma from
Karma given to
