Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- Find Answers
- :
- About kmaron
kmaron
Motivator
Member since:
10-12-2016
07-11-2023
Community Statistics
| Posts | 343 |
| Solutions | 54 |
| Karma Given | 88 |
| Karma Received | 78 |
| Member Since | 10-12-2016 |
Activity Feed
- Got Karma for Re: How do I force a timestamp to be recognized as UTC in a query for strptime?. 05-15-2023 08:14 AM
- Got Karma for Re: How can I extract the first 10 characters of token value in query?. 07-13-2022 02:48 AM
- Got Karma for Re: How do I get the total and percentage on each row on the following table?. 02-18-2022 11:53 PM
- Got Karma for Re: Dashboard - Base Search not returning results into panel. 02-03-2022 06:43 AM
- Got Karma for Re: What is the real difference between a $token$ and $form.token$?. 01-24-2022 04:58 PM
- Got Karma for Re: What is the real difference between a $token$ and $form.token$?. 12-16-2021 05:11 AM
- Posted Re: How to hide dashboard panel when user's search times out? on Dashboards & Visualizations. 09-09-2021 11:45 AM
- Posted How to hide dashboard panel when user's search times out? on Dashboards & Visualizations. 09-09-2021 09:46 AM
- Posted seemingly empty log returned with search query on Splunk Search. 06-22-2021 09:48 AM
- Got Karma for Re: How to drilldown a pie chart and get specific results for each slice of pie?. 04-27-2021 04:48 AM
- Posted I don't Re: Extracting fields from nested JSON event on Splunk Search. 12-08-2020 05:12 AM
- Posted Re: Extracting fields from nested JSON event on Splunk Search. 12-07-2020 05:02 AM
- Posted Extracting fields from nested JSON event on Splunk Search. 12-03-2020 12:46 PM
- Karma Re: Using NOT and != would return the same results. for woodcock. 06-05-2020 12:50 AM
- Karma Re: Using NOT and != would return the same results. for richgalloway. 06-05-2020 12:50 AM
- Karma Re: How do I add a check box to change my search? for niketn. 06-05-2020 12:50 AM
- Karma Re: How to clean up old indexes, reports, alerts, etc ? for DavidHourani. 06-05-2020 12:50 AM
- Karma Re: How do you extract fields from an existing field's value? for Raschko. 06-05-2020 12:50 AM
- Karma Re: how to get the first event time and last event time for field value for niketn. 06-05-2020 12:50 AM
- Karma Re: Can you help me identify when end time overlaps start time for the following events? for whrg. 06-05-2020 12:50 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
04-09-2018
10:48 AM
1 Karma
index="wineventlog" sourcetype="wineventlog:" SourceName="" Type="Critique" OR Type="Avertissement"
| dedup _time SourceName
| table _time SourceName
| stats count by SourceName
| sort - count limit=10
Sort by the field you want the top 10 of. (I used your count)
Then set limit= for how many you want to keep.
... View more
04-05-2018
12:47 PM
Glad to hear it!!
... View more
04-05-2018
12:30 PM
3 Karma
I think it might have to do with your field name. I used a query of mine and when I renamed the field to a field name that required quotes the Where clause no longer worked.
Can you try changing your query to this:
index=a source=ab sourcetype=qm DESK=$desk_token$
|stats sum(PNR_COUNT) as TotalTicketsonQueue sum(AGENT_COUNT) as "Total Agents on Queue" max(OLDEST_Ticket) as "Oldest Ticket on Queue (mins)" by DESK,QUEUE_CITY,QUEUE_NUMBER
| replace "0" WITH " " IN "Total of Agents on Queue" "Oldest PNR on Queue (mins)"
|rename QUEUE_CITY as "Queue city", QUEUE_NUMBER as "Queue Number"
|rangemap field="Oldest PNR on Queue (mins)" low=1-22000 elevated=22001-35000 severe=35001-99999999 default=" "
|sort "Oldest PNR on Queue (mins)" desc
| where NOT TotalTicketsonQueue == "0"
| rename TotalTicketsonQueue as "Total Tickets on Queue"
... View more
04-05-2018
12:04 PM
1 Karma
You just need to add a where clause.
| where NOT field==0
... View more
04-05-2018
10:13 AM
If you wanted to extract the computer name, message and status you could try something like this:
rex field=_raw "Status of device '(?<COMPUTERNAME>.*?)' (?<MESSAGE>.*?): (?<STATUS>.*?)\."
... View more
04-05-2018
07:18 AM
You're going to need four separate alerts for that because each one has a different trigger time and a different earliest/latest setting.
... View more
04-05-2018
06:35 AM
1 Karma
you should be able to use a cron schedule for that
0 4-7,9-14,17-22 * * *
from crontab.guru: “At minute 0 past every hour from 4 through 7, every hour from 9 through 14, and every hour from 17 through 22.”
... View more
04-04-2018
09:38 AM
index="" sourcetype="wineventlog:" EventCode= Type="" | stats count by SourceName Type | fields - SourceName
You can remove a field from your result using the fields command and a minus
... View more
04-04-2018
07:44 AM
Try this - from here: https://answers.splunk.com/answers/467823/if-there-are-no-results-found-how-do-i-get-my-sear.html
base query | stats count by ABC
| appendpipe [ stats count | eval "NoResults"="0" | where count=0 |table "NoResults"]
... View more
04-04-2018
07:25 AM
Apparently I was taught wrong. Thanks for the info.
... View more
04-04-2018
07:23 AM
There are some issues with the SPL you pasted. But I also don't see a timechart. What value are you trying to timechart?
... View more
04-04-2018
07:11 AM
You have an extra OR and you should probably have parentheses if I am reading your intentions correctly.
index=my_index EventSubType="Computer Modified"
NOT UserName="System"
("HostIP=172.16.1." OR "HostIP=172.16.4." OR "HostIP=172.16.5.*")
| table _time EventSubType UserName HostIP HostName Message
With the order of processing and implied ANDs your OR's will not work correctly without the parentheses
... View more
04-04-2018
05:51 AM
You can only have 1 cron schedule per alert. So you will need multiple alerts.
... View more
04-04-2018
04:51 AM
Since it worked for you please accept my answer so others know your question was answered.
... View more
04-03-2018
10:05 AM
I believe you can do that with a subsearch. Maybe something like this?
sourcetype="mtab_executer" OR source="unix:useraccounts"
| rex max_match=0 "(^|\n)(?<usb_key>\/\S+\s\/\S+)"
| eval user_id=coalesce(user_id, uid)
| eventstats latest(user) AS user BY user_id
| convert timeformat="%d/%m/%Y %H:%M:%S" ctime(_time) AS c_time
| stats latest(c_time) AS Mount, latest(user) AS user, latest(user_id) AS user_id, count BY usb_key
[ search sourcetype="linux_audit"
| transaction startswith="type=SYSCALL" endswith="type=PATH"
| convert timeformat="%d/%m/%Y %H:%M:%S" ctime(_time) AS c_time
| stats latest(c_time) AS Umount, count BY name
| fields Umount ]
| table Mount Umount user user_id usb_key
... View more
04-03-2018
06:06 AM
Try this
sourcetype="ats_request" host!=dc*
| bucket _time span=1mon
| stats avg(duration) as "Average App Response Time" count(sourcetype) as "Total Count" by host _time
... View more
04-03-2018
05:32 AM
okay try this
base search
| bucket _time span=1d
| stats count BY _time countedfield
| eventstats stdev(count) as stdev BY countedfield
| eval stdevincrease = (stdev*1.1)
| where count > stdevincrease AND _time > now()-(24*60*60)
Set your earliest to be 7 days and your latest to be now.
Your buckets are 1 day time spans
the eventstats will do the standard deviation over the 7 days then the where clause only looks at the last day
So you can set your alert to trigger on anything greater than 0
... View more
03-29-2018
12:43 PM
try this:
| rex field=department "(?<base_department>.*)-\S"
| stats count by department, base_department
| appendpipe [stats sum(count) as count by base_department]
| sort base_department
| fields - base_department
... View more
03-29-2018
12:14 PM
date_wday only gives you the day of the week. What date are you saying you want as the legend?
Chart commands are basically three pieces. Your stats command which is your count, distinct count, etc. will build your Y axis. Your X axis will be your Over field and the BY field is your legend.
http://docs.splunk.com/Documentation/Splunk/7.0.3/SearchReference/Chart
... View more
03-29-2018
11:58 AM
a deviation over what time frame? You said 7 days for the total count but are you comparing daily? hourly?
... View more
03-29-2018
11:49 AM
Try this
sourcetype=* ( host="a" OR host="bOR host="c" OR host="d" OR host="e" OR host="f") event=AuthAccept (authlevel=5 OR authlevel=50)
earliest=-1month@month latest=now | chart count(authlevel) by date_wday, authlevel
... View more
03-29-2018
08:23 AM
are you looking for one chart with all of your options? Or separate charts?
... View more
03-29-2018
08:17 AM
Could you share your XML for your input and chart?
... View more
03-29-2018
07:59 AM
You could drop everything after and including the dash from the department name using a regex
| rex field=department mode=sed "s/-.*$//"
... View more
03-28-2018
12:34 PM
This is old so it may not apply anymore but you might find it pertains
https://answers.splunk.com/answers/246691/search-head-not-consistently-ordering-results-from.html
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
07-11-2023
03:09 PM
|
