About MuS

MuS · ‎02-14-2016

update done

MuS · ‎02-14-2016

Ahh, sorry my bad ! I'll update the answer ....

MuS · ‎02-14-2016

Hi fredkeiser, Your regex is missing the double escaped backslashes and you can test it with Splunk's internal regex functions: splunk cmd pcregextest test_str="C:\Program Files (x86)\LIC\Current\test\filename.log" mregex=".+\\(.+)\\[^\\]*" returns: Original Pattern: '.+\(.+)\[^\]*' Expanded Pattern: '.+\(.+)\[^\]*' ERROR: Regex: unmatched parentheses But if you double escape the backslashes it works: splunk cmd pcregextest test_str="C:\Program Files (x86)\LIC\Current\test\filename.log" mregex=".+\\\(.+)\\\[^\\\]+" returns: Original Pattern: '.+\\(.+)\\[^\\]+' Expanded Pattern: '.+\\(.+)\\[^\\]+' Regex compiled successfully. Capture group count = 1. Named capturing groups = 0. SUCCESS - match against: 'C:\Program Files (x86)\LIC\Current\test\filename.log' #### Capturing group data ##### Group | Name | Value -------------------------------------- 1 | | test Hope this helps ... cheers, MuS

MuS · ‎02-14-2016

Hi kuga_mbsd, This is not possible with Splunk native user management to my knowing. There are some setting to define the password encryption and the minimum length of the password https://answers.splunk.com/answers/143631/splunk-configuration-of-password-encryption-and-complexity.html but for anything else use an external authentication service such as AD or LDAP. Hope this helps ... cheers, MuS

MuS · ‎02-11-2016

Hi shashankraina, You can store your map tiles inside etc/apps/YourAppName/appserver/static/YourMaptilesDirectory/ and use it like this in your map dashboard: <option name="mapping.tileLayer.url">/static/app/YourAppName/YourMaptilesDirectory/{z}/{x}/{y}.png</option> Hope this helps ... cheers, MuS

MuS · ‎02-11-2016

Hi napomokoetle, did you open a support case?

MuS · ‎02-11-2016

Hi Rob, the Browse More Apps from Splunk UI will only list Apps that are support with your running Splunk version. See this answer for some details https://answers.splunk.com/answers/327251/why-cant-i-find-the-timewrap-app-in-the-find-more.html cheers, MuS

MuS · ‎02-11-2016

Hi debanjankundu, take a look at the docs http://docs.splunk.com/Documentation/Splunk/6.3.3/Viz/Understandbasictableandchartdrilldownactions or download the Dashboard examples App https://splunkbase.splunk.com/app/1603/ where you can find pre-build drill down examples. Hope this helps ... cheers, MuS

MuS · ‎02-11-2016

Hi xbbj3nj, let's say your lookup file is called cities.csv and the lookup is called cities then you can run this search : your base search here to get back city name | lookup cities | geostats latfield=Latitude longfield=Longitude count and use the map visualisation to show it on a map. See the docs for more details: http://docs.splunk.com/Documentation/Splunk/6.3.3/SearchReference/Lookup http://docs.splunk.com/Documentation/Splunk/6.3.3/SearchReference/Geostats Hope this helps ... cheers, MuS

MuS · ‎02-10-2016

The Add on provides a script that connect to the Service Now REST API and processes the returned information which then will be available in Splunk for further reporting.

MuS · ‎02-10-2016

I assume this could be done with some css and/or js hacks, but not out of the box as far as I know - sorry.

MuS · ‎02-10-2016

Hi dernst, take a look at this answer https://answers.splunk.com/answers/214487/can-i-extract-a-field-with-a-regexed-dynamic-field.html which provides an example to the same question. You simply have to use this "([^"]+)"\s:\s"([^"]+)" as your regex in transforms.conf . Hope this helps ... cheers, MuS

MuS · ‎02-10-2016

Hi chustar, You can put your image in the etc/apps/YourAppName/appserver/static folder and use it in the dashboard: <row> <panel> <html> <p> <img src="/static/app/YourAppName/image.png" align="left" height="75" width="75"/> </p> </html> </panel> </row> Hope this helps ... cheers, MuS

MuS · ‎02-10-2016

Hi IRHM73, just had a quick look at it; your subsearch (which is executed first) uses user1="Y" but this is set in the outer search so this will not match. It will be bed time for me soon - no time to think about this further...maybe tomorrow cheers, MuS

MuS · ‎02-09-2016

and to add two important notes: The indexed events still contain the original source type name. The renaming occurs only at search time. Also, renaming the source type does only that; it does not fix any problems with the indexed format of your event data caused by assigning the wrong source type in the first place. and Data from a renamed source type will only use the search-time configuration for the target source type

MuS · ‎02-08-2016

hmmm, fschange is deprecated since Splunk 5.x and therefore could possibly disappear some when in the future. Also, from my point of view, the idea to have something watching itself is a bit - sorry - strange. If I want something to watch/monitor something, I would use a different software that uses external checks. cheers, MuS

MuS · ‎02-08-2016

Hi Jeffland, Yes, this works - but it will give you a 6 digit value for milliseconds and I reckon @IRHM73 was after a 2-3 digit millisecond value. cheers, MuS

MuS · ‎02-08-2016

Hi ibondarets, Timewrap is running fine on Splunk 6.3 - the listing is just not updated on the App page. cheers, MuS R.I.P. David!

MuS · ‎02-08-2016

Hi IRHM73, Although this was asked before 😉 I'll try to answer it again - use this search: |rest /services/search/jobs |rename custom.search as customSearch |search NOT author="splunk-system-user" |eval SearchString=if(isnotnull(customSearch),customSearch,eventSearch) |search SearchString!="" |convert ctime(searchEarliestTime) as STime timeformat=%d/%m/%y |convert ctime(searchLatestTime) as LTime timeformat=%d/%m/%y |addtotals fieldname=duration *duration_secs |convert rmunit(duration) as numSecs |eval stringSecs=tostring(duration,"duration") |eval stringSecs = replace(stringSecs,"(\d+)\:(\d+)\:(\d+)","\1h \2min \3s") | rex field=stringSecs "\.(?<ms>\d{3})" | rex field=stringSecs "(?<myRest>.+)s\." | eval stringSecs=myRest. "s " .ms. "ms" |table author SearchString duration stringSecs It has an additional line with rex and eval to get milliseconds in the result. Hope this helps and works for you ... cheers, MuS

MuS · ‎02-04-2016

For your sake I hope you won't need hours in the search run time ?!? If you still need it add it in the eval |eval stringSecs=strftime(numSecs, "%Hh %Mm %Ss %2Nms")

MuS · ‎02-04-2016

Hi IRHM73, try this search: |rest /services/search/jobs |rename custom.search as customSearch |search NOT author="splunk-system-user" |eval SearchString=if(isnotnull(customSearch),customSearch,eventSearch) |search SearchString!="" |addtotals fieldname=duration *duration_secs |eval groupduration=case(duration<=300, "Less Than 5 Minutes", duration>300 AND duration<=600, "Between 5 and 10 Minutes", duration>600 AND duration>=1200, "Between 10 and 20 Minutes", duration>1200, "Greater Than 20 Minutes" ) |convert rmunit(duration) as numSecs |eval stringSecs=strftime(numSecs, "%Mm %Ss %2Nms") |eval earliestTime=strptime(earliestTime, "%Y-%m-%dT%H:%M:%S")|convert timeformat="%d/%b/%Y" ctime(earliestTime) |eval latestTime=strptime(latestTime, "%Y-%m-%dT%H:%M:%S")|convert timeformat="%d/%b/%Y" ctime(latestTime) |eval daterange= "From: ".earliestTime.", To: ".latestTime |makemv delim=", " daterange |sort +author |table author,SearchString , daterange, request.earliest_time, request.latest_time, duration, stringSecs |rename author as "Author", SearchString as "Search Performed", earliestTime as "Earliest Date Used", latestTime as "Latest Date Used", request.earliest_time as "Earliest Time Query Setting", request.latest_time as "Latest Time Query Setting", stringSecs as "Query Runtime" cheers, MuS

MuS · ‎02-04-2016

Hi jmartens, un-tested and not sure if this will work, but your assumption about the spaces is correct - this causes havoc. What you could try is to use FORMAT = "$1"::$2 in props.conf . Another approach would be to remove/replace all whitespace from the left hand part of the string with sed in a first transform and in the second transform use the extract to get left hand side as key and right hand side as value. Hope this helps ... cheers, MuS

MuS · ‎02-04-2016

Hi IRHM73, can you provide your search, because the link provides multiple different approaches. cheers, MuS

MuS · ‎02-04-2016

Okay, you must misunderstand something here; it's not ServiceNow updating Splunk. There is an input in the ServiceNow App which reads all the data in ServiceNow from Splunk, check if they are enabled. Also, enable debugging in the TA and check what the logs report see http://docs.splunk.com/Documentation/ServiceNow/latest/Install/Troubleshoot for more details. Again, Splunk is creating/pushing Incidents or Events in ServiceNow and also Splunk is reading from ServiceNow; it's never that ServiceNow is pushing anything into Splunk. Hope this helps ...

MuS · ‎02-03-2016

Hi kearaspoor, take this REST search as a start: | rest /servicesNS/-/-/saved/searches You will get heaps of information from this search. Hope this helps ... cheers, MuS

Posts	4458
Solutions	814
Karma Given	2144
Karma Received	3944
Member Since	‎05-02-2011

Online Status	Offline
Date Last Visited	a week ago

Report Capture app for Splunk: Exception capturing...

How to use eval if there is no result from the bas...

How to compare fields over multiple sourcetypes wi...

Splunkbase Apps update bug?

docs.splunk.com wrong link to answers

splunkbase feature request

splunkbase colored background

Captain Picard's Star fleet messages

the pony command

max throughputs of forwarders

Re: dynamically assign sourcetype on folder

Re: dynamically assign sourcetype on folder

Re: dynamically assign sourcetype on folder

Re: Every 90days Password change for SplunkWeb ID

Re: How to use custom tiles in Splunk maps offline...

Re: How do I improve ldapsearch performance

Re: Where can I get a list of apps that are approv...

Re: How do I create a dashboard where I can click ...

Re: How do I run a lookup on a list of cities/coun...

Re: Splunk App and Add-on for ServiceNow: How to u...

Re: How do I render an image on a local network pa...

Re: How to extract a field within quotes and extra...

Re: How do I render an image on a local network pa...

Re: How do I edit my search to identify inactive u...

Re: How to move data from one sourcetype to anothe...

Re: How to monitor and alert me via email when a S...

Re: Extract Milliseconds

Re: Timewrap support for 6.3?

Re: Extract Milliseconds

Re: Convert Seconds To Hours, Minutes, Seconds and...

Re: Convert Seconds To Hours, Minutes, Seconds and...

Re: How can I extract key value pairs with spaces ...

Re: Convert Seconds To Hours, Minutes, Seconds and...

Re: Splunk App and Add-on for ServiceNow: How to u...

Re: Is there a way to report on the information lo...

Join the Conversation