About sduff_splunk

sduff_splunk · ‎05-12-2017

sduff_splunk · ‎05-11-2017

index=abc sourcetype="audit" | rex field=_raw "/service-list/(?<api>[^/]+)/" | stats count by api The rex command will run a regular expression over the strings, grab the portion that follows /service-list/ and stores it in the field 'api'. The stats count command counts the frequency of each unique api, giving you the usage.

sduff_splunk · ‎05-11-2017

There isn't a conversion tool available that I'm aware of, but Splunk dashboards are pretty easy to develop, its drag-and-drop for most parts. I recommend asking this question again but focusing on the particular dashboards/queries that you are trying to convert.

sduff_splunk · ‎05-09-2017

The problem was likely that your editor (Excel?) converted some of the values in the CSV into scientific notation. As you said, going directly into Splunk didn't have that issue.

sduff_splunk · ‎05-09-2017

Can you confirm in the source file that it is using exponential notation? You can check by using the "Show Source" Event Action, or look at the original event. I expect that the original file will have both decimal and exponential notation, which is causing this.

sduff_splunk · ‎04-26-2017

You need to be a little more specific as to why it didn't work. Can you provide some sample events, I'm sure that would be helpful.

sduff_splunk · ‎04-17-2017

The license is based on the actual volume size, that is, the amount of data being indexed, not the compressed volume. In your situation, you would need a 100GB/day license.

sduff_splunk · ‎04-08-2017

I suggest you create a lookup and use that to enrich your events, I don't see the additional need to create an eventtype or macro Assuming your lookup looks like the following, city_name, state, region You can then do a search such as stats count by region or stats values(city_name) by state to find all the cities in a particular state. Using different commands with stats should provide you additional information

sduff_splunk · ‎04-06-2017

Add the following to etc\system\local\inputs.conf [monitor://path/to/your/file/outfile] index=main Refer to http://docs.splunk.com/Documentation/Splunk/6.5.3/Admin/Inputsconf and http://docs.splunk.com/Documentation/Splunk/6.5.3/Data/WhatSplunkcanmonitor.

sduff_splunk · ‎04-06-2017

Splunk will automatically monitor changes in that outfile automatically! You can either append data to the file, or create a new file each time, but Splunk will get updates made to it. You just need to use a monitor clause that you've already done with that add monitor command (check etc\system\local\inputs.conf, it should be listed there).

sduff_splunk · ‎04-06-2017

You mention that you have just started working on Splunk ES. Note that in the search you have provided, xswhere is used, which is an extreme search. The extreme search provides a non-fixed threshold on when to alert, but it needs time to first baseline. During this time, this correlation rule may be very active in creating notables, as it has yet to establish a base line for each destination port. You can look into the current levels set by extreme search by looking at the extreme search app and selecting the appropraite context. You could choose replace the xswhere clause with something like the following, but you would lose the huge benefit that extreme search provides. | tstats allow_old_summaries=true count from datamodel=Network_Traffic by All_Traffic.dest_port | `drop_dm_object_name("All_Traffic")` | localop | where count > 10

sduff_splunk · ‎04-04-2017

Using the predict command, you can specify the hold back option to specify how many values before the end to start the prediction from.. However, you are asking something a little different, predicting based on each month's volumes. In this case, I would modify the splunk search to remove all the non-required months (everything except April) and base my prediction on this. Personally, I don't think this would produce great results. If you have a large volume of ticket in May, for example, it is likely that April may get a little bit of a bump as well. If you remove all other months, you're probably going to miss that influence.

sduff_splunk · ‎03-07-2017

Can you provide the full search you are using to convert the data into the table? I expect we will be able to extend the regex you are using to include all the email addresses, do an makemv and then mvzip to get the output you require

sduff_splunk · ‎03-07-2017

I would check firewalls are not blocking the traffic between Splunk and your syslog server. Can you also try using udp instead of tcp as a test? Also run splunk btool outputs list --debug and confirm the outputs are being parsed correctly and there are no other config items overwritting your settings.

sduff_splunk · ‎03-06-2017

Do you have a session id in the logs, or are you just using the IP. The following search will filter events that only contain the two URLs in question, and then count the number of unique URLs visited by each IP address. Finally, only keep the rows that have visited both URLs. index=logs (URL="xxx.com") OR (URL="zzz.com") | stats dc(URL) as URLs by IP | where URLs > 1

sduff_splunk · ‎03-06-2017

Check the permissions on the file and the lookup. They may be restricted to app only, which is why its not visible.

sduff_splunk · ‎03-05-2017

Is this the app you are looking for? https://splunkbase.splunk.com/app/2755/

sduff_splunk · ‎03-02-2017

You can use the Syndication Input (RSS/ATOM/RDF) app, https://splunkbase.splunk.com/app/2646/

sduff_splunk · ‎09-20-2016

WatchGuard uses standard syslog for logging. More details can be found in http://www.watchguard.com/docs/tech/watchguard-splunk-integration-guide.pdf

sduff_splunk · ‎07-10-2016

You may need to extract the netapp and vmware apps into $SPLUNK_HOME, as they unpack to /etc You may have $SPLUNK_HOME/etc/apps/etc/splunk_app_netapp, which isn't going to work. Please follow the instructions listed at http://docs.splunk.com/Documentation/NetApp/2.1.2/DeployNetapp/InstalltheSplunkAppforNetAppDataONTAP

sduff_splunk · ‎08-31-2015

In general, most other roles will inherit the permissions and capabilities from the user role (some elevated roles would use power), so I would strongly advise against removing the user and power roles.

sduff_splunk · ‎08-30-2015

If you don't know how many parameters you are going to have, you can have all the params extracted into a multi-value field called 'oneparam', and then use mvjoin to put them into a single parameter (called params). Each field will be separated by a space. | rex max_match=0 field=_raw "Param=\"(?<oneparam>[^\"]*)\" | eval params=mvjoin(oneparam, " ")

sduff_splunk · ‎08-30-2015

if you are not getting two Params being field-extracted, you could use a rex and an eval | rex field=_raw "Param=\"(?<p1>[^\"]*)\" Param=\"(?<p2>[^\"]*)\"" | eval param=p1.p2

sduff_splunk · ‎08-24-2015

Note that this measurement is in kilo bytes per second, whereas the throughput you are recording may be in kilo bits per second, which would be 8 times that rate.

sduff_splunk · ‎08-19-2015

Firstly, refer to http://answers.splunk.com/answers/52580/can-we-use-wild-characters-in-lookup-table.html about setting up a lookup with wildcards. You may also want to add an additional field to the lookup file (maybe call it 'in_lookup'). Then you will want to do the following search... index=* sourcetype=websence http_method=post | lookup weblink_lookup | where NOT in_lookup="*"

Posts	186
Solutions	36
Karma Given	44
Karma Received	70
Member Since	‎09-23-2013

Online Status	Offline
Date Last Visited	‎12-07-2020 11:08 PM

Re: How do I capture unique API list my applicatio...

Re: How do I capture unique API list my applicatio...

Re: convert Grafana dashboard to Splunk Dashboard

Re: CSV inconsistent field value

Re: CSV inconsistent field value

Re: Can't calculate time difference

Re: License requirement for 100GB/day data ingesti...

Re: Eventtype or macros - Need Suggestion

Re: Adding text file into splunk

Re: Adding text file into splunk

Re: Modifying Correlation search - Substantial Inc...

Re: Splunk Predict - Is it possible to forecast fu...

Re: MVZIP With the same field on the same Line

Re: Unable to forward syslog to third-party syslog...

Re: How to edit my search to find a session where ...

Re: lookup table not visible when creating "New Au...

Re: Can't find Dropbox for Business in the App cat...

Re: RSS/Atom feed

Re: How to log Watchguard into Splunk?

Re: Installation netapp app on splunk

Re: Delete the roles power and user

Re: How to combine duplicate fields in the same ev...

Re: How to combine duplicate fields in the same ev...

Re: Universal Forwarder KBps Limit not being appli...

Re: How to refer to a lookup CSV file I just uploa...

Join the Conversation