Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- About maciep
maciep
Champion
Member since:
09-18-2013
10-22-2024
Community Statistics
| Posts | 826 |
| Solutions | 118 |
| Karma Given | 98 |
| Karma Received | 251 |
| Member Since | 09-18-2013 |
Activity Feed
- Got Karma for Re: How do I stop datamodel accelerations from turning themselves back on?. 08-19-2024 09:33 AM
- Got Karma for Re: What is the correct way to edit conf files and propagate changes in a search head cluster ?. 06-12-2024 09:48 AM
- Got Karma for Re: How do I stop datamodel accelerations from turning themselves back on?. 12-06-2023 11:53 AM
- Posted Re: Join query with condition and comparison on Splunk Search. 01-20-2023 06:43 AM
- Got Karma for Re: How can I return specific results using head and tail commands?. 01-20-2023 04:22 AM
- Posted Re: Join 3 sources without join on Splunk Search. 11-28-2022 10:03 AM
- Got Karma for Re: Join 3 sources without join. 11-28-2022 06:33 AM
- Got Karma for Re: Join 3 sources without join. 11-25-2022 04:30 PM
- Posted Re: Join 3 sources without join on Splunk Search. 11-25-2022 08:12 AM
- Got Karma for Re: How to join search based on multiple values?. 11-16-2022 01:48 AM
- Got Karma for Re: How do I stop datamodel accelerations from turning themselves back on?. 10-26-2022 12:56 AM
- Got Karma for Re: Unable to distribute to peer from search head. 10-10-2022 09:14 AM
- Posted Re: Error in 'eval' command: The expression is malformed on Dashboards & Visualizations. 09-29-2022 04:58 AM
- Got Karma for Re: Heavy Forwarder data loss prevention. 09-22-2022 08:05 AM
- Posted Re: Heavy Forwarder data loss prevention on Splunk Cloud Platform. 09-22-2022 05:42 AM
- Posted Re: How to event break on multiple dashes? on Splunk Enterprise. 09-22-2022 05:23 AM
- Posted Re: How to join search based on multiple values? on Splunk Search. 09-16-2022 12:26 PM
- Posted Re: How to compare 2 Search's percentage results? on Splunk Search. 09-16-2022 11:43 AM
- Got Karma for Re: [udp://:portnumber] Event Blacklist. 09-14-2022 05:45 AM
- Posted Re: [udp://:portnumber] Event Blacklist on Getting Data In. 09-14-2022 04:10 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 2 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 0 | |||
| 7 | |||
| 0 | |||
| 0 | |||
| 1 |
09-14-2019
07:28 AM
can you share your current search? I mean, it should just be a matter of tabling those fields...and possibly creating them first if needed.
... View more
09-14-2019
07:26 AM
I'd say grab the word, look it up and then filter....maybe something like this (not at all tested)
index=whatevs
| rex field=Field1 "^(?:\S+\s+){2}(?<my_word>\S+)"
| lookup word_lookup_table Field1 AS my_word OUTPUT Field1 AS found_word
| where isnotnull(found_word)
And if you didn't want to rex out the word, you could also configure your lookup to wildcard the Field1 field.
https://docs.splunk.com/Documentation/Splunk/7.3.1/Knowledge/Addfieldmatchingrulestoyourlookupconfiguration
... View more
09-14-2019
07:13 AM
1 Karma
Yes, either in the web gui or in transforms.conf (which is where the web will write it), you need to specify the match type for that field.
https://docs.splunk.com/Documentation/Splunk/7.3.1/Admin/Transformsconf#Lookup_tables
match_type = <string>
* A comma and space-delimited list of <match_type>(<field_name>)
specification to allow for non-exact matching
* The available match_type values are WILDCARD, CIDR, and EXACT. Only fields
that should use WILDCARD or CIDR matching should be specified in this list.
* Default: EXACT
So probably something like this in transforms:
[subnet]
filename = subnet.csv
match_type = CIDR(subnet)
And if you want the lookup to happen automatically, that would be in props.conf (but also in the web).
So the simple lookup is in the lookups directory. The table definition (case sensitivity, wildcards, max matches, etc) is defined in transforms. And automatically running the lookup command for host/source/sourcetype is done in props.
... View more
09-14-2019
06:58 AM
1 Karma
appendcols is dangerous my friend - you need to be absolutely SURE that the you have the same number of branches in the same order, because splunk isn't going to join those up for you at all - it's literally going to append the columns to the right without a care for your well being. And so based on your scenario...it's not the way to go.
you could either start with inputlookup, then left join to your search and then decide yes no on whether the branch2 field is there.
or you could append instead of appendcols, then stats values() by branch and then decide yes/no from there.
If you need more help, i can put answers post together too. But if you figure it out on your own, post your answer here and accept it.
... View more
09-14-2019
06:48 AM
how many patterns do you have? if it's no many, you can just use eval command with case/match functions.
... | eval my_val = case(match(_raw,"aaa\s+:\d\d:"),2,match(_raw,"aaa\s+:\d:"),1,true(),"n/a")
If you have a lot that might be a bit more difficult. Splunk does not have a regex match built into the lookup functionality - only wildcard and cidr.
And being new to Splunk, you'll have to rework your brain a bit from programming to puzzle solving. In general (but not exactly always true), when you pipe your search results to a new command, splunk loops through all of the events - that's your outer loop. And so you need to munge your results through one or commands/pipes until it's the way you want it - in this case we're using eval to create a new field on each iteration
... View more
09-14-2019
06:30 AM
and if you need to know which fruit and not just the amount, you may need eventstats instead - get the max, then use it to find the winner.
... | eventstats max(FruitSold) as day_max by CurrentDate | where FruitSold=day_max | table CurrentDate, FruitName, FruitSold
and probably need to decide what you want to do when there's a tie.
... View more
09-14-2019
06:17 AM
doesn't dc() just return a single number?
... View more
09-14-2019
06:10 AM
Assuming that is the entire message and useragent/proxy id will be numbers, I'd probably write it like this, with just one regex.
^\s*(?<user_agent>\d+)\s*(?<proxy_id>\d*)\s*(?<cust_field>[^:]+)
Also, I believe if you specify the named capture group in your regex, then you don't need to specify the FORMAT....at least at search time.
... View more
09-14-2019
06:00 AM
did you try restarting splunk? i think restarting splunk will force the bucket to roll from hot? So you could at least test that theory and/or verify if the bucket rolls to warm/cold...
... View more
08-27-2019
03:47 AM
if you get rid of the case statements, does it run? if not, there's probably something wrong elsewhere causing the issue to show up there? If it does, then maybe try one condition in the case, then the next and so on to see where it's getting upset exactly.
... View more
07-12-2019
03:28 AM
I would probably do something like this, which should start each event at the timestamp. of course, you can use sed to get rid of the line separators if you don't want them
[your_sourcetype]
LINE_BREAKER = ([\r\n]+)(?=\d+\/\d+\/\d+\s+\d+:\d+:\d+)
TIME_PREFIX = ^
TIME_FORMAT = %m/%d/%Y %H:%M:%S %p
MAX_TIMESTAMP_LOOKAHEAD = 24
SHOULD_LINEMERGE = false
... View more
06-06-2019
06:07 AM
yeah, if you can't get the wildcard option for the lookup, this problem does become a bit different. Would the wildcard match always be the domain prefix? If so, then you could maybe create a field for that and add another lookup. Maybe like this?
| base search
| table Website "IP address"
| eval Domain = mvindex(split(Website,"."),0)
| lookup input.csv Address as Website OUTPUT Date
| lookup input.csv Address as Domain OUTPUTNEW Date
| lookup input.csv Address as 'IP address' OUTPUTNEW Date
| table Website "IP address" Date
... View more
06-05-2019
05:57 PM
oh sorry, that was a reference to me not reading your question closely ("read the f'ing manual").
how about including the quotes in the values instead of the prefix suffix?
<input type="multiselect" token="field1">
<label>field1</label>
<choice value=""some raw text option "">option 1</choice>
<choice value=""some raw text option"">option2</choice>
<prefix>(</prefix>
<suffix>)</suffix>
<valuePrefix></valuePrefix>
<valueSuffix></valueSuffix>
<delimiter> OR </delimiter>
</input>
... View more
06-05-2019
05:21 PM
ah...rtfm...got it.
... View more
06-05-2019
05:13 PM
1 Karma
what about maybe just using the lookup command...maybe something like this?
| base search
|table Website "IP address"
| lookup input.csv Address as Website OUTPUT Date
| lookup input.csv Address as 'IP address' OUTPUTNEW Date
| table Website "IP address" Date
... View more
06-05-2019
04:51 PM
assuming this is the same as your other question?
... View more
06-05-2019
04:48 PM
if i add the space in the simple xml, it seems to honor it? See the valueSuffix below. When i went back to the gui, it kept the space.
<input type="multiselect" token="field1">
<label>field1</label>
<choice value="some raw text option1">option 1</choice>
<choice value="some raw text option 2">option2</choice>
<prefix>(</prefix>
<suffix>)</suffix>
<valuePrefix>"</valuePrefix>
<valueSuffix> "</valueSuffix>
<delimiter> OR </delimiter>
</input>
... View more
05-23-2019
06:28 PM
I would likely do this at search time in props & transforms, but I'm not sure if that something you're familiar with?
props.conf
[your:sourcetype]
REPORT-my_aws_fields = my_aws_fields
transforms.conf
[my_aws_fields]
REGEX = "Value":\s*"([^"]+)",\s*"Key":\s*"aws:cloudformation:([^"]+)
FORMAT = $2::$1
You should be able plug the regex into regex101 to see what it's doing, but essentially it's capturing each of the Value/Key pairs in your data. For each, it captures the entire value to the first group and then just the part after aws:cloudformation: in the key to the second group. And then we tell splunk to create a field whose name is the second capture group and whose value is the first capture group.
So the end result should be those fields with those values. And more generically, any aws:cloudformation:* keys with their values.
... View more
05-15-2019
05:55 AM
Yes, i saw your other question too...still thinking about it. Please keep in mind that these are not simple questions and so it might take the community a while to get you answers, especially since we don't have access to the data like you do...and we have day jobs too.
That said, could you please work out maybe 10 iterations of your formula by hand on "paper" and share it here. Because your decision is defined by RFS3, it seemed to me that after the first couple iterations - decision just equals rfs3. So I'm probably misunderstanding the formula so an example output of 10 iterations might help me/us understand better - just a column for RFS3 and Decision should be enough.
I don't think you can accomplish number 2 w/o javascript, because that's just how splunk works...i could be wrong.
For number 3, if you have 15 unique values of your concatenated string, then you're going to get 15 results when counting by that field. Maybe just concentrate on #1 for now...
... View more
05-15-2019
04:28 AM
i think the difficult part would be trying to create panels dynamically - don't think it's doable in simple xml but can probably be done with js?
Did you check out the trellis layout though? I think that's probably going to be your best solution. And if you bump up on a limit of how many charts it can display, then I believe there are workarounds.
So your search would use the multi-select token you built to filter your events and would group by interface, but then you choose the trellis layout option for whatever visualization you want to use - and splunk will create a separate graph for each interface in the by clause.
index=your_api_gateway_logs $your_interface_ms_token_logic_here$ | timechart limit=100 useother=f span=1h count by interface
... View more
05-14-2019
03:29 PM
2 Karma
I'd probably build out the logic in the subsearch and just return it. Maybe something like this, where you build a comma separated list of addresses from your lookup and then build the condition using the IN operator for your check and finally return the entire condition back to the main search.
index=msexchange [
| inputlookup blocklist.csv
| eval indicator = "\"" . indicator . "\""
| stats values(indicator) as indicator
| eval indicator = mvjoin(indicator,",")
| eval condition = "sender IN (" . indicator . ") OR recipient IN (" .indicator . ")"
| return $condition
]
I think you could also do this after the fact with the lookup command.
index=msexchange
| lookup blocklist.csv indicator AS sender OUTPUT indicator as found_sender_indicator
| lookup blocklist.csv indicator AS recipient OUTPUT indicator as found_recipient_indicator
| where isnotnull(found_sender_indicator) OR isnotnull(found_recipient_indicator)
... View more
05-14-2019
02:57 PM
could you elaborate on exactly what you want? what type of charts? why a separate one for each value, instead of all values on the same chart?
Maybe a good candidate for a trellis layout?
... View more
05-13-2019
08:41 AM
do you have non-internal indexes with a field named called user that would match the username of the user running this? the subsearch seems to work for me when I just look at internal logs.
... View more
05-13-2019
08:22 AM
Maybe use a case in your where clause
SELECT *
FROM table_1
WHERE (case when [logoff_time] is NULL then [timestamp] else [logoff_time] end) > ?
ORDER BY timestamp, logoff_time
... View more
05-13-2019
08:13 AM
1 Karma
you might be able to just use eval instead of a field alias. Maybe like this...obviously you can additional allowed/blocked logic:
EVAL-action = if(match(ACTION,"(?i)allow|permit"),"allowed","blocked")
You could also create an automatic lookup to lookup ACTION and spit out the various actions as well - maybe not needed here, but that approach can come in handy in general when mapping data to the CIM.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
10-22-2024
07:27 AM
|
Karma from
Karma given to
