About richgalloway

richgalloway · ‎06-06-2014

That's something I wish Splunk would change and makes your solution the better one.

richgalloway · ‎06-06-2014

Perhaps something like this? index=main_branch* | where file_size_in_bytes >= 2 | dedup email_id file_size_in_bytes | table email_id file_size_in_bytes Based on your comments, this should do the job. index=main_branch* | eval filter=email_id.tostring(file_size_in_bytes) | stats dc(filter) as rowcount | where rowcount >= 100 | table email_id file_size_in_bytes

richgalloway · ‎06-05-2014

If you get no results from the rpm command then it probably means Splunk was not installed using rpm. You would then need to uninstall it manually.

richgalloway · ‎06-05-2014

If you're willing to share your existing query, we may be able to figure out why hosts with count=0 aren't showing up.

richgalloway · ‎06-05-2014

The possibilities are limitless. It all depends on what data is available and what you want to have visibility into. Aside from logins, you might want to track disk/CPU utilization, server outages, server logs, hardware/software assets on the network, and so on.

richgalloway · ‎06-05-2014

Run the following command to find the correct package name. rpm -q -a | grep -i splunk Pass the result to the rpm -e command.

richgalloway · ‎06-04-2014

I see two options: 1) Add a ' fillnull value="null" simta_ublauthuser ' statement before ' eval simta_authuser ...' 2) Change the join to an outer join so rows that don't match are still returned.

richgalloway · ‎06-04-2014

You could convert time string this way: <your search> | eval timestr=strftime(strptime(timestr,"%m/%d/%y %I:%M:%S.$3N %p"),"%m/%d/%y %H:%M:%S.$3N) | ...

richgalloway · ‎06-04-2014

Have you tried omitting TIME_PREFIX?

richgalloway · ‎05-29-2014

I don't know how to handle that situation in a transaction, but perhaps this will help. input_event_name | join activity_id max=0 overwrite=false [ search output_event_name ] | ...

richgalloway · ‎05-29-2014

I had success in RegExr with this string: better\?q=([^&]+)&

richgalloway · ‎05-28-2014

Please accept the answer to help future readers.

richgalloway · ‎05-28-2014

I'm tempted to suggest something like (loss>'0%' AND lost<'100%') , but am not sure you can compare strings like that. I think you'll need to extract the numeric value. Have a look at convert() .

richgalloway · ‎05-28-2014

If the location of the state varies within the comments field and the format is consistent with your example, then this should find it. \s+(?<state>[A-Z]{2}[0-9]{8})\s+

richgalloway · ‎05-28-2014

... | eval field=coalesce(field1, field2, field3) | ...

richgalloway · ‎05-28-2014

Assuming the first and second IP addresses are always separated by white space, this should work for you. rex field=_raw "session (?<source_ip>[^:]*):((?<source_port>\d+)\s(?<second_ip>[^:]*):(?<second_port>\d+)"

richgalloway · ‎05-28-2014

When I tried your regex in RegExr, I did not get a match until I removed the anchor tags ( ^$ ). Have you tried that?

richgalloway · ‎05-28-2014

Please provide some sample events (data). At least the comments field.

richgalloway · ‎05-28-2014

I did not get a match in RegExr using your regex string and your sample file names. I had better luck with \/data\/log\/Core\/(.*)\.cnt\.int\.log

richgalloway · ‎05-27-2014

It should not be necessary to escape the colon characters in either the TIME_FORMAT or BREAK_ONLY_BEFORE statements. Try this regex in BREAK_ONLY_BEFORE to see if it makes a difference: \d{1,2}\.\d{1,2}\.\d{1,2} \d{1,2}:\d{1,2}:\d{1,2} [APap][Mm] \[

richgalloway · ‎05-22-2014

By comparing the props.conf stanza name to your sourcetype, which I could have done with the info you already supplied. Can you tell I'm in pre-vacation mode? 🙂

richgalloway · ‎05-22-2014

Your REGEX appears to work fine with your sample event. Have you verified the right props.conf stanza is executing?

richgalloway · ‎05-22-2014

Check your REGEX string. If you post it here with some sample events, we can check it for you.

richgalloway · ‎05-22-2014

Please share some sample events.

richgalloway · ‎05-21-2014

Maybe a transaction will help. sourcetype="brem" sanl31 eham Successfully completed | transaction MessageTime | where eventcount = 1 | ...

Posts	16775
Solutions	2989
Karma Given	2023
Karma Received	6720
Member Since	‎07-24-2012

Online Status	Offline
Date Last Visited	2 hours ago

Receiving notifications that are disabled

collectd reports "write_http plugin: curl_easy_per...

How do you restart splunk?

stats count(eval) always returns zero

Need help getting right timestamp from CSV

How to display more than 5 questions per page on A...

What will break if I set coldPath to /dev/null?

Knowledge Object Explorer won't load

How to use a field in SingleValue label?

How to move an index to another app?

Re: Get the number of similar rows in table in spl...

Re: Get the number of similar rows in table in spl...

Re: Uninstall Splunk on Linux

Re: report count from hosts in csv file INCLUDING ...

Re: Dashboard ideas

Re: Uninstall Splunk on Linux

Re: Results of a join search

Re: Converting AM/PM time to 24 hour time for a vi...

Re: Extract timestamp in db2audit

Re: transaction startswith 1, endswith multiple

Re: Need help with rex

Re: REX / REGEX question

Re: Percentage in range - numeric search?

Re: REX / REGEX question

Re: replace with a where clause on a null field

Re: use Rex to extract second IP address from mess...

Re: host regex does not seem to work

Re: REX / REGEX question

Re: host regex does not seem to work

Re: Escape backslash in TIME_FORMAT field of props...

Re: nullqueue not working

Re: nullqueue not working

Re: nullqueue not working

Re: Splunk Regex to String period from front and e...

Re: How to return events based on if else rules

Join the Conversation