Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- About damien_chillet
damien_chillet
Builder
Member since:
02-16-2017
04-27-2021
Community Statistics
| Posts | 152 |
| Solutions | 33 |
| Karma Given | 36 |
| Karma Received | 38 |
| Member Since | 02-16-2017 |
Activity Feed
- Got Karma for Re: Doing search through REST API using PostMan giving [Error in 'SearchParser']. 08-18-2022 06:54 AM
- Got Karma for Re: How do you disable/enable alerts via the REST API?. 01-25-2022 06:56 AM
- Got Karma for Re: Interval setting in inputs.conf. 11-23-2021 02:54 PM
- Got Karma for Re: Strftime adds 1 hour after converting. 12-02-2020 07:14 AM
- Karma Microsoft Office 365 Reporting Add-on for Splunk not pulling data - exiting with 500 Internal Server Error for nmadhok. 06-05-2020 12:50 AM
- Karma Re: With the Splunk Python SDK, how do I reload deploy client with 2.7? for harsmarvania57. 06-05-2020 12:50 AM
- Karma Re: Restful API: cannot change the 'removable' attribute of savedchanges for mbadhusha_splun. 06-05-2020 12:50 AM
- Karma Restful API: cannot change the 'removable' attribute of savedchanges for patng_nw. 06-05-2020 12:50 AM
- Got Karma for Re: How do you disable/enable alerts via the REST API?. 06-05-2020 12:50 AM
- Got Karma for Re: How do you disable/enable alerts via the REST API?. 06-05-2020 12:50 AM
- Got Karma for Re: How do you disable/enable alerts via the REST API?. 06-05-2020 12:50 AM
- Karma Re: What is the difference between DEST_KEY= _TCP_ROUTING and DEST_KEY = _MetaData:Index for harsmarvania57. 06-05-2020 12:49 AM
- Karma Re: Encrypted information from deployer to search head for woodcock. 06-05-2020 12:49 AM
- Karma Re: How to display only column(s) that has value greater than 0 for HeinzWaescher. 06-05-2020 12:49 AM
- Karma Re: How to display only column(s) that has value greater than 0 for Cbr1sg. 06-05-2020 12:49 AM
- Karma Re: litte search: all src-ips whitch alled more than 4 dest. in a short timerange for woodcock. 06-05-2020 12:49 AM
- Karma Re: how to edit the title after alert saved? for niketn. 06-05-2020 12:49 AM
- Karma What is the splunk.secret file, and is it possible to change it? for cdo_splunk. 06-05-2020 12:49 AM
- Karma Re: Field name changed while indexing csv file in splunk for sivaranjiniG. 06-05-2020 12:49 AM
- Karma Re: How to disable mouse hover on bar chart in XML for niketn. 06-05-2020 12:49 AM
Topics I've Started
No posts to display.
04-24-2018
03:19 AM
1 Karma
A good start would be to find out which index had a spike:
You can run something like this over the day you had the spike, see which indexed used licence the most,
index=_internal source=*license_usage.log* type="Usage"
| eval b=b/1024/1024/1024
| timechart useother=f span=30m sum(b) as b by idx limit=0
... View more
04-24-2018
02:35 AM
Could you try this:
| tstats count as LastWeek where index=<your_index> earliest=-2w@d latest=-1w@d by host
| join host [ | tstats count as ThisWeek where index=<your_index> earliest=-1w@d latest=-0d@d by host]
... View more
04-23-2018
02:08 AM
Well actually, if the URL2 is not in any event returned by the search it is normal it does not appear.
Is it only 3 URLs you are searching for? If so, try
index=<your_index> field=URL1 OR field=URL2 OR field=URL3
| stats count(eval(field="URL1")) AS URL1 count(eval(field="URL2")) AS URL2 count(eval(field="URL3")) AS URL3
| transpose column_name="List of URL"
| rename "row 1" as Status
| eval Status=case( Status == 0, "Failed",
true(), "Passed")
Inspired from @woodcock answer below
... View more
04-20-2018
09:45 AM
Whoops i've missed something, edited my answer (sorry was "air splunking")
... View more
04-20-2018
09:40 AM
1 Karma
Hi Pete,
I took a quick look at the code for the latest version .
I believe this error message is due to a missing import statement in input_module_oms_inputs.py
The missing import would be:
from splunklib.modularinput import *
which holds definition of the Event class.
Not sure if your tag was taken into account there, so I'll tag the author again so he can have a look and confirm if that is indeed the problem.
@jkat54
... View more
04-20-2018
09:10 AM
2 Karma
Could you try the following?
index=<your_index> field=URL1 OR field=URL2 OR field=URL3
| stats count as Status by field
| eval Status=case( Status == 0, "Failed",
true(), "Passed")
| rename field as "List of URL"
... View more
04-20-2018
09:04 AM
You wrote sys.stdn , but i assume it's just a typo?
... View more
04-20-2018
08:59 AM
I've experienced a similar issue. It seems to be due to Splunk UI failing to load user context (looking at top menu bar i don't see App next to the Splunk logo or Username next to Messages dropdown).
It's very strange because it happens to me on one of the Splunk environments only, not on others - and none of my colleagues seem to have experienced that issue.
Most of the time i can mitigate it by refreshing the page totally (Ctrl-F5).
I don't know if your problem will be the same though...
... View more
04-20-2018
07:17 AM
Hey,
Good news, the fix is very easy!
By default ResultsReader is limited to 100 raws, just add count=0 in job.results() arguments and you should get the whole thing!
for result in results.ResultsReader(job.results(count=0)):
... View more
04-19-2018
08:52 AM
Could you show us how you want the final table to look like?
... View more
04-19-2018
08:18 AM
Can you try
index=dhcp
| lookup dhcp_hosts hostname OUTPUT hostname as filter
| where is null(filter)
... View more
04-19-2018
02:48 AM
Glad you found something that works for you!
I've converted my comment to an answer.
Could you please accept it so the question can be marked as closed?
Have a nice day and happy Splunking! (:
... View more
04-19-2018
02:43 AM
Hi etric,
Are you sure domain field and url field hold the same kind of values?
For example:
http://www.splunk.com/home is a url
splunk.com is a domain
If you have a field in your mcafee:webgateway sourcetype holding domain values, you should use that instead:
index=mcafee:web gateway [|inputlookup URL_TWO | rename domain as <domain_field> | fields <domain_field>]
| stats count by usrName, time_taken, httpStatus, method, dstIP, urlCategories
... View more
04-19-2018
02:30 AM
I could be missing something, but I can't see how addinfo would help here, it would just add fields to your existing search, not change time range the alerts run on.
... View more
04-19-2018
02:28 AM
Could you share the alert configuration settings such as expiration time?
... View more
04-18-2018
09:02 AM
Let's try with an example.
The search runs at 13:45 for events between 13:40 and 13:45 .
It finds 1 error event so an alert link is sent to your slack channel.
Whatever the time is when you click the link it should load the job which ran at 13:45 for events between 13:40 and 13:45 .
The time range would change only if you re-run the job manually.
... View more
04-18-2018
08:58 AM
Yea it is like that for jobs. But in case of a triggered alert it should be kept longer, i think expiration time is 24h by default for a triggered alert.
... View more
04-18-2018
08:36 AM
Is the alert condition "Number of results > 0"?
If so the job results should be saved and clicking the link should display the results without having to run the job once more.
... View more
04-18-2018
08:33 AM
Have a look at the collect command:
http://docs.splunk.com/Documentation/Splunk/7.0.3/SearchReference/Collect
... View more
04-18-2018
08:20 AM
You can create a field and assign a value for each case (if you want to hardcode it):
| eval description=case(
source == "Test", "testcases",
source == "Flows", "flow",
source == "Jobs", "job")
Otherwise use lookup like specified above by @somesoni2
... View more
04-18-2018
08:20 AM
You can create a field and assign a value for each case (if you want to hardcode it):
| eval description=case(
source == "Test", "testcases",
source == "Flows", "flow",
source == "Jobs", "job")
Otherwise use lookup like specified above by @somesoni2
... View more
04-18-2018
08:12 AM
Wait, is it a real-time search you are talking about?
... View more
04-18-2018
07:17 AM
Note: you might want to look at @FrankVI comments, you may well be able to retrieve stats without converting to numeric in the first place (unless what you wanna do is very specific and original 🙂 )
... View more
04-18-2018
07:14 AM
Glad it worked!
I have converted my comment as an answer.
Could you please accept it to close the question?
... View more
04-18-2018
06:45 AM
| table <your_field>
| sort <your_field>
| streamstats dc(<your_field>) as num
Where is the field containing url
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
04-27-2021
06:20 AM
|
Karma given to
