Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- Find Answers
- :
- About aelliott
aelliott
Motivator
Member since:
10-03-2013
06-05-2020
Community Statistics
| Posts | 451 |
| Solutions | 66 |
| Karma Given | 96 |
| Karma Received | 202 |
| Member Since | 10-03-2013 |
Activity Feed
- Got Karma for Re: Display percentage on pie charts in Splunk 6?. 12-26-2024 07:49 AM
- Got Karma for Re: How to use a $ in a form search?. 12-17-2023 12:27 AM
- Got Karma for Re: How to use a $ in a form search?. 05-16-2022 09:15 AM
- Got Karma for Re: How to use a $ in a form search?. 10-06-2021 06:14 PM
- Got Karma for Re: Display percentage on pie charts in Splunk 6?. 03-10-2021 10:12 AM
- Got Karma for Re: How to use a $ in a form search?. 09-10-2020 10:58 PM
- Got Karma for Anonymous access to dashboards. 09-03-2020 06:31 AM
- Karma So many Spams in Splunk answers for guilmxm. 06-05-2020 12:47 AM
- Karma Re: How to tell if accelerated data model is still rebuilding? for jamesvz84. 06-05-2020 12:47 AM
- Karma Re: How to fill a field with an ip address extracted from another field? for somesoni2. 06-05-2020 12:47 AM
- Karma Re: Will changing a lookup file persist on app update? for strive. 06-05-2020 12:47 AM
- Karma Re: Split ip and port into two fields using delims for somesoni2. 06-05-2020 12:47 AM
- Karma Re: Splunk app for windows infrastructure, CIM Compliance and Role with Enterprise Security for jcoates_splunk. 06-05-2020 12:47 AM
- Karma Re: Quick Question - CPU Search Limit on Search Head or Indexer? for martin_mueller. 06-05-2020 12:47 AM
- Karma Re: Splunk plz help for alacercogitatus. 06-05-2020 12:47 AM
- Got Karma for Splunk_TA_nix 5.0.2 Eventtype does not exist or is disabled. 06-05-2020 12:47 AM
- Got Karma for Re: Splunk_TA_nix 5.0.2 Eventtype does not exist or is disabled. 06-05-2020 12:47 AM
- Got Karma for Will changing a lookup file persist on app update?. 06-05-2020 12:47 AM
- Got Karma for Splunk app for windows infrastructure, CIM Compliance and Role with Enterprise Security. 06-05-2020 12:47 AM
- Got Karma for Re: Documentation on implementing a function triggered by change of a token's value?. 06-05-2020 12:47 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 1 | |||
| 1 | |||
| 1 | |||
| 1 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 1 |
04-03-2014
07:26 AM
What is coming back from your query as far as column names, are they . ? When running in db query
... View more
04-03-2014
07:12 AM
try
|eval MyDate=strptime(Date,"%a, %m/%d/%y") | sort MyDate | table MyDate, Total_GB
... View more
04-03-2014
06:53 AM
Yes, I have order by that field too, so then it will not import anymore data since the rising_column will be the last date in your selection.
No, it will automatically be replaced with the last value of DATE_FIELD returned from the result set.
... View more
04-03-2014
06:50 AM
Should be ok, splunk simply sends the query at the database and takes in the result set and may format it as epoch when storing it in it's index so that it will work with _time
... View more
04-03-2014
06:48 AM
Is it stored in the database as epoch format? If splunk is converting it, i see no issue with that.
... View more
04-03-2014
06:38 AM
If you are definining a rising column..
SELECT * FROM TABLE_NAME WHERE TRUNC(DATE_FIELD) BETWEEN to_date('04-03 2014','mm/dd/yyyy') AND to_date('04-03 -2014','mm/dd/yyyy') {{AND $rising_column$ > ?}}
ORDER BY DATE_FIELD ASC
... View more
04-02-2014
01:52 PM
1 Karma
You could just have "s/[^.]//g" in your sed
... View more
04-02-2014
01:28 PM
Sounds good, Looks like I'll be making an attempt at making it CIM compliant in the future 🙂
... View more
04-02-2014
01:21 PM
I saw that http://apps.splunk.com/app/533/ Cisco ESA is deprecated, however, what add-on replaces it in the Cisco Enterprise Security Suite? I'm only seeing ISE, WSA, and ASA
... View more
04-02-2014
01:00 PM
I've solved this question. The answer is, When the log contains events that are specifically authentication, then assign those events to authentication. Otherwise a Network Log should just be a network log.
... View more
04-02-2014
11:17 AM
We have some new logs we would like to import.
These logs seem to contain all the fields of network traffic, but it was requested to also show them as authentication. Is it best practice to tie in a given log with multiple Common Information Models? Or should everything be Network Or Authentication Or Web etc..
I was thinking definitely not as the "action" field would need to follow each model.
... View more
04-02-2014
10:45 AM
1 Karma
someone else had this issue, and this worked for them:
http://answers.splunk.com/answers/28276/count-of-character-in-field
... View more
04-02-2014
09:37 AM
3 Karma
Deleting the apps in the app directories is the way I did it, it worked like a charm and was though it never existed.
... View more
04-02-2014
08:56 AM
Have you attempted to use db connect? https://apps.splunk.com/app/958/
... View more
04-02-2014
08:06 AM
inputcsv can be treated as "events" by setting a flag that will allow for timecharts of the data.
... View more
04-02-2014
07:33 AM
try this:
SELECT TOP 1000 * FROM TABLE_NAME
where start_date between to_date('01-JAN-14 00:00:00')
and to_date('31-MAR-14 23:59:59')
... View more
04-02-2014
07:28 AM
Right, have you tried any of the queries i have suggested? such as one like
SELECT TOP 1000 * FROM TABLE_NAME WHERE DateField <= '01/01/2014 00:00:00' and DateField >= '03/31/2014 23:59:59'
... View more
04-02-2014
07:16 AM
Also, You may have to re-create your data input if you are changing the query as it will not re-run the first run again, the clone feature works nicely for this.
... View more
04-02-2014
07:10 AM
The stuff in the brackets will not be run the first time the query is run, so if you have curly braces around that, it will grab all your data. the curly braces are meant to hold the {{ $rising_column$ > ?}} pattern
... View more
04-02-2014
06:52 AM
SELECT * FROM TABLE_NAME WHERE DateField <= '01/01/2014 00:00:00' and DateField >= '03/31/2014 23:59:59'
... View more
04-02-2014
06:49 AM
There should be a readme within the app directory that explains how to use it.
... View more
04-02-2014
06:21 AM
3 Karma
I think you want something like
SELECT * FROM TABLE_NAME WHERE ROWNUM <= 30 {{AND $rising_column$ > ?}}
Or if you are not doing "Tail"
SELECT * FROM TABLE_NAME WHERE ROWNUM <= 30
The stuff in the brackets will not be run the first time, so putting {{ where rownum <= 30 }} will exclude this from the first run.
... View more
04-02-2014
06:04 AM
3 Karma
I would suggest looking here: http://www.splunk.com/view/professional-services/SP-CAAABH9
... View more
04-01-2014
07:36 AM
The timezone will be applied on index time. Therefore you cannot modify existing data to show correctly. You may want to export the data and re-import it.
... View more
