About jotne

jotne · ‎08-11-2023

yuanliu · ‎08-10-2023

to know the sourcetype with the field in the lists, I haven't found a scalable method to do this. But if combinations of sourcetypes and fields of interest are few and known, and there is no identical field name in different sourcetypes, you can rename each field to contain info about its sourcetype.

livehybrid · ‎08-08-2023

I see what you are saying, on my test instance with 8.2.5 the splunk_essentials app is there and uses approx 4mb. The good news is that when Ive come to upgrade it to 9.1.x I can see that the splunk_essentials app is not there, so I wonder if this is now going to be excluded moving forwards. Hopefully for future versions you will not need to worry about this.

Simple_Search · ‎08-07-2023

Based on the tagging of SYSLOG based on the front tag, I would assume that this is being ingested into a syslog server and then sent to an Indexer or Heavy Forwarder. If this is the case, the Splunk Add-on is not going to help you in this situation if this is the case. I usually ingest the data from SYSLOG and then use regex to extract the field names when I am conducting searches. If this is being monitored on the server that is using a Universal Forwarder, then ensure that you are monitoring the /var/log locations with the splunkbase app on the forwarder and on the indexer.

Ritu · ‎08-07-2023

UPTIME,server,server,Linux,4,4,2023-08-02 16:17:28,300,1440,"16:17:28 up 90 days; 11:34; 0 users; load average: 0.04; 0.18; 0.17" --- the raw data The alert used: index=nmon host=* eventtype=uptime source=perfdata uptime=* | fields _time host uptime | eval host=upper(host) | where uptime <= 600 | sort uptime | dedup host | lookup hostscope.csv host OUTPUTNEW Application as application PLATFORM as platform Environment | search platform!=ONPREM | eval urgency=case(Environment="PROD" OR Environment="PREP", "high", isnotnull(Environment), "medium") | table host uptime application platform Environment urgency

jotne · ‎08-05-2023

You are 100% sure your HF are listening on port 8089. ss -pultan | grep LISTEN should result in some like this: tcp LISTEN 0 128 0.0.0.0:8089 0.0.0.0:* users:(("splunkd",pid=3870899,fd=4))

isxtn · ‎08-04-2023

Thanks!

jotne · ‎08-04-2023

You need the username and password. If you do not have it, but have control of your index server, you can reset it using cli, then reconnect search head to all index servere.

jotne · ‎08-04-2023

Then you make a dashbord with time picker to select 1day, 1 week or 1 month.

jotne · ‎08-04-2023

What do you mean with Dat Set Version of all Linux ?

sivakrishna · ‎07-31-2023

I tried the same thing as you suggested then Issue got Resolved. Thank you!!!

gcusello · ‎07-28-2023

Hi @KalebeRS , please try: index="" host= sourcetype=csv source=C:\\ pverProduct!="pverProduct" | table pverProduct | dedup pverProduct Ciao. Giuseppe

jotne · ‎07-28-2023

If you like a custom format, yes, then your need to use eval and not convert. PS if you can accept the answer it would be fine 🙂

isoutamo · ‎07-25-2023

Yes it should work like this. Personally I try to avoid windows dc dns, but that’s another story.

ITWhisperer · ‎07-25-2023

You will need access to the _internal index to do this, or ask you administrators to create a report or summary index for you.

jotne · ‎07-24-2023

Not still sure how it works, but you need the html section and the table id= <dashboard version="1.1" theme="dark"> <label>Table with color Based on Status</label> <row> <panel> <title>Compliance check</title> <html depends="$alwaysHideHTMLCSSPanel$"> <style> #tableColorFinalRowBasedOnData table tbody td div.multivalue-subcell[data-mv-index="1"]{ display: none; } </style> </html> <table id="tableColorFinalRowBasedOnData"> <search> <query> | makeresults | eval _raw="Version,Count,Status win 2012,20,compliance win 2008,35,Non-Compliance Xen 2.4,40,compliance win 2016,24,Non-Compliance" | multikv forceheader=1 | table Version Count Status | eval color=case(Status="compliance","#53A051",Status="Non-Compliance","#DC4E41") | foreach Version Count Status [ eval <<FIELD>>=mvappend('<<FIELD>>',color)] | fields - color </query> </search> <format type="color" field="Version"> <colorPalette type="expression">mvindex(value,1)</colorPalette> </format> <format type="color" field="Count"> <colorPalette type="expression">mvindex(value,1)</colorPalette> </format> <format type="color" field="Status"> <colorPalette type="expression">mvindex(value,1)</colorPalette> </format> </table> </panel> </row> </dashboard>

jotne · ‎07-24-2023

Have a look at this: https://www.splunk.com/en_us/blog/tips-and-tricks/exporting-large-results-sets-to-csv.html?locale=en_us

jotne · ‎06-19-2023

A better way to do this that will always works correctly: (tested in 9.0.5) <option name="charting.fieldColors">{"error":#FF0000,"warn":FFFF00,"info":00FF00}</option>

jotne · ‎06-01-2023

Updated link: https://docs.splunk.com/Documentation/Splunk/latest/Admin/Configurationparametersandthedatapipeline

ssanplunk · ‎05-29-2023

If you change authorization of splunk folder, you can access splunk folder on Windows. You can follow the step below. 1. Right click - splunk folder 2. Click - property menu 3. Move - Security Tab 4. Click - Edit 5. Click - Add 6. Search and Add - Users Group 7. Confirm

seemanshu · ‎05-04-2023

Hi @jotne , The following setting in the web.conf will help in specifying the dashboard name, [settings] enable_risky_command_check_dashboard = false splunk_dashboard_app_name = <string> Here, splunk_dashboard_app_name will help in disabling the warning to the required app only. Kindly upvote, if found helpful.

woodcock · ‎04-06-2023

This question is a bit of a mess and I cannot make sense of it. Probably you should start over and be more clear. We usually do not care much about your existing SPL. What we REALLY care about is CLEAR SAMPLE DATA (preferably with generation SPL, like I show below) and CLEAR DESIRED OUTPUT. It looks VERY much like your data is being sent in wrong and that each current event is actually multiple events. You should reindex it and break up these event clumps into single events. If the problem is that each clumped event lacks a correlation ID (so if you split them, the relationship is lost), then you should take a look at cribl because it has a feature to do this. You can contact me directly because that discussion is more complicated than we can do here. In any case, here is what I have for a start: | makeresults | eval _raw=" 2023-03-31 05:14:16,447 - __main__ - INFO - {\"Id\": \"123456JKL\", \"Table1\": \"employee\", \"Time1\": \"3.04\"}" | append [| makeresults | eval _raw="2023-03-31 05:14:16,393 - __main__ - INFO - {\"Id\": \"123456JKL\", \"Table2\": \"salary\", \"Time2\": \"4.05\"}"] | append [| makeresults | eval _raw=" 2023-03-31 05:20:16,393 - __main__ - INFO - {\"Id\": \"123456JKL\", \"Table3\": \"salary1\",\"PayLoad\": {\\\"type\\\":\\\"test\\\",\\\"name\\\":\\\"jas\\\"}"] | eval _time = strptime(_raw, "%Y-%m-%d %H:%M:%S,%3N") | kv pairdelim="{,}" kvdelim=":"

jotne · ‎03-30-2023

Here is a solution that seems to work for us to find origin of those error messages. This search should show if you have problem with too long fields. index=_internal source="*splunkd.log" "Received metadata string exceeding maxLength" This is due to that Splunk tries to create a indexed field that has more than 1000. Looking trough the logs its not easy to see where this come from. So with some tips from mmccul I have made this search. index=<your index> | table [| walklex index=<your index> type=field | search NOT field IN (_indextime date_* punct time*pos) | stats count by field | table field | mvcombine field | return $field ] | foreach * [| eval <<FIELD>>_Len=len(<<FIELD>>)] | table *_Len | stats max(*) as * | transpose header_field=column | rename "row 1" as count | sort -count | rename count as Length, column as FieldName | head 10 | rex mode=sed field=FieldName "s/_Len$//" What it does: `walklex` will list all indexed fields for an index. Then with some commands make a list of all interesting fields and return it to the table `| foreach * [| eval <<FIELD>>_Len=len(<<FIELD>>)]` Calculate the length of each field. Then we find the the max length for each field and final get the top 10 field with largest bytes. If there are field with 1000 bytes, there are for sure some fields that are longer, so go trough the raw data and see if there are some regex that do eat to much of the line.This may not be the best/fastest way but seems to work for us.

jotne · ‎03-30-2023

If you have may fields and do not know the name of them or variable number of fields, you can run it like this: | stats max(*) as max_*

yuanliu · ‎03-01-2023

The sample messages you posted are conformant JSON. I don't understand why you need to use rex to extract - or why you need extraction at all. If these are _raw, Splunk would have automatically recognized it and give you a field named locationCategoryCodes{}.locationCode. As I always say, do not treat structured data as text. If for whatever reason Splunk doesn't give you that field, you can use spath to extract all fields ("nodes" in JSON lingo) in these messages. Here is emulation using your sample data: | makeresults | fields - _time | eval test=split("{\"Item Id\": \"1\", \"locationCategoryCodes\": [{\"categoryCodes\": [{\"categoryCode\": \"CAT_1\", \"ruleID\": [\"138563\"]}], \"locationCode\": \"ABC\"}, {\"categoryCodes\": [{\"categoryCode\": \"CAT_1\", \"ruleID\": [\"138563\"]}], \"locationCode\": \"XYZ\"}, {\"categoryCodes\": [{\"categoryCode\": \"CAT_2\", \"ruleID\": [\"138561\"]}], \"locationCode\": \"DEF\"}, {\"categoryCodes\": [{\"categoryCode\": \"CAT_3\", \"ruleID\": [\"138614\"]}], \"locationCode\": \"IJK\"}], \"timestamp\": \"2023-01-27T00:10:32.367 +0000\"}|||{\"Item Id\": \"2\", \"locationCategoryCodes\": [{\"categoryCodes\": [{\"categoryCode\": \"CAT_1\", \"ruleID\": [\"138563\"]}], \"locationCode\": \"ABC\"}, {\"categoryCodes\": [{\"categoryCode\": \"CAT_3\", \"ruleID\": [\"138614\"]}], \"locationCode\": \"IJK\"}], \"timestamp\": \"2023-01-27T00:10:32.367 +0000\"}", "|||") | mvexpand test | eval isgood = if(json_valid(test), "yes", "no") ``` quick test to see if message is conformant ``` | rename test as _raw ``` data emulation above ``` | spath ``` use this if Splunk doesn't give you locationCategoryCodes{}.locationCode ``` | stats count by locationCategoryCodes{}.locationCode | rename locationCategoryCodes{}.locationCode as "Location Code" Location Code count ABC 2 DEF 1 IJK 2 XYZ 1

Posts	156
Solutions	9
Karma Given	16
Karma Received	43
Member Since	‎10-29-2019

Online Status	Offline
Date Last Visited	2 weeks ago

Merging apps from deployment server?

IIS logs: why the error WARN FilesystemChangeWatc...

Deployment Server vs. Deployer- Can I send apps fr...

Formalizing MAC address to XX:XX:XX:XX:XX:XX forma...

Tagging Heavy Forwarders

How do I fix "This dashboard view is deprecated an...

How to deactivate SPL safeguards on Splunk Enterpr...

Remove syslog data in transforms.com

Received metadata string exceeding maxLength warni...

Show dashboard location

Re: Correct syntax of eval string case

Re: Discover fields that have the same values

Re: Why is Splunk Essentials for Cloud and Enterpr...

Re: UNIX log parsing issue

Re: Uptime data which created alert where the serv...

Re: Splunk Heavy forwarder problem on port 9997

Re: Returning a url only to the 2nd slash?

Re: splunk search head disconnected to indexer

Re: How to show Average time for last 7 days in mi...

Re: Linux Dat Set Version

Re: Splunk Search head is not getting Restarted..

Re: How to remove unwanted row?

Re: Help to convert a unix time

Re: Retrieve Windows DNS Logs - best practices ?

Re: Need a query to check number of times a dashbo...

Re: change the color of row based on cell value in...

Re: Need to export the records morethan 50,000 fro...

Re: How to assign colors to slices of a pie chart ...

Re: Where do I configure my various Splunk setting...

Re: Not able to open Splunk folder available in C:...

Re: Deactivate SPL safeguards on Splunk Enterprise

Re: Why is there a change of dropdownlist?

Re: Received metadata string exceeding maxLength w...

Re: how do I get the max from each column

Re: How to extract rex specific data from Splunk l...