About richgalloway

richgalloway · ‎09-14-2023

The best way (IMO) to learn Splunk is to install it on your workstation/laptop and use it. Obtain the software from splunk.com. You do not need to work at a company that uses Splunk to use Splunk yourself. Free classes are available at education.splunk.com. That said, knowing Splunk does not mean you can get a job. While it will help, you will still need to convince a potential employer that you can add value to the company.

richgalloway · ‎09-14-2023

That's a difficult sentence to parse. I hope I understand the request. Instructions for installing Splunk on Linux systems are at https://docs.splunk.com/Documentation/Splunk/9.1.1/Installation/InstallonLinux . You won't find a ready-made script, but the documented steps should be easy enough to automate. Many customers use software management tools to deploy software on all machines. I don't understand what is meant by "find out the system with out Splunk."

richgalloway · ‎09-14-2023

Let's take a step back. What is the desired output of this query? Is it to list the file names that are in both the index and the lookup? Something else? My latest example is *like* what you've already done, but is different and should have a different result. Have you run it? If so, what is the exact text of the error(s)? Please eliminate the ellipsis in the stats command. The behavior of the command can change depending on the hidden arguments.

richgalloway · ‎09-14-2023

Make sure the path, type, and reg fields are not null. The stats command will not return results for null groupBy fields.

richgalloway · ‎09-14-2023

What are you trying to accomplish? What do you mean by "validate Splunk"?

richgalloway · ‎09-14-2023

richgalloway · ‎09-14-2023

As stated in my response, a saved search will have a non-empty value in the savedsearch_name field (keyword). If savedsearch_name="" then the search is ad-hoc.

richgalloway · ‎09-14-2023

Remember that subsearches run first and their results become text that replace the subsearch in the query. So, if the subsearch returns "foo.exe" (the value of file_name) then the query becomes index=toto event_id=4688 | eval file_name=if(event_id==4688, replace(NewProcessName, "^*\\\\([^\\\\]+)$","\\1"),null) foo.exe stats values(file_name) as file_name..... See the problem? "foo.exe" and the following stats command are considered part of the eval command because there is no intervening |. The fix depends on what you want the query to do.

richgalloway · ‎09-14-2023

_time is already in epoch form so it does not need to be (and cannot be) converted using strptime. | eval weeknum=strftime(_time, "%V") | chart dc(Task_num) as Tasks over weeknum by STATUS

richgalloway · ‎09-13-2023

That's a supported app. Have you contacted the developer?

richgalloway · ‎09-13-2023

The queries do not contain statistics-generating commands (stats, timechart, etc.) so there is nothing for the Statistics tab to show.

richgalloway · ‎09-13-2023

Perhaps this will help. ((index="wss_desktop_os") (sourcetype="support_remedy")) ASSIGNED_GROUP="DESKTOP_SUPPORT" STATUS_TXT IN ("ASSIGNED", "IN PROGRESS", "PENDING") earliest=-1d@d ``` Convert REPORTED_DATE to epoch form ``` | eval REPORTED_DATE2=strptime(REPORTED_DATE, "%Y-%m-%d %H:%M:%S") ``` Keep events reported more than 12 hours ago so are due in < 12 hours ``` | where REPORTED_DATE2 <= relative_time(now(), "-12h") | eval MTTRSET = round((now()-REPORTED_DATE2)/3600) | dedup ENTRY_ID | stats LAST(REPORTED_DATE) AS Reported, values(ASSIGNEE) AS Assignee, values(STATUS_TXT) as Status,values(MTTRSET) as MTTR by ENTRY_ID

richgalloway · ‎09-13-2023

We don't know your data. Ideally, your site has a data dictionary with this information, but that's rare. Consult your Splunk admin about that. You can use the metadata command to get a list of sourcetypes or use this query. | tstats count where index=* by index,sourcetype then take educated guesses about which sourcetype is more likely to contain the data you seek. Search that sourcetype to verify your guess.

richgalloway · ‎09-13-2023

No one here in the Community knows the answer to that and Splunk's policy is to not attach dates to future features. We'll know about it when it's released. Check https://ideas.splunk.com to see if others are asking the same thing and vote for it.

richgalloway · ‎09-13-2023

I'm curious about why a sourcetype can no longer be used. Sourcetypes never expire. Perhaps it's an add-on that can't be used? The inputs.conf file to check is the one that references the file or directory we're talking about. Use btool to find it. splunk btool --debug inputs list | grep "<<CSV file or directory name>>" Have you checked the logs? Have you tried the search I suggested? Have you tried looking in other indexes?

richgalloway · ‎09-13-2023

Searches are in the audit log. Saved searches will have a non-empty value in the savedsearch_name field. The user name is in the user field. index=_audit action=search | table user savedsearch_name search

richgalloway · ‎09-13-2023

You have the right steps, but perhaps something in the details is amiss. Verify the inputs.conf stanza points to the correct file/directory. Verify the file permissions allows reading by the HF. Check the splunkd.log files on the HF to see if any messages might explain why the file is not uploaded. Confirm the CSV file has timestamps for each event and that the timestamps are correctly extracted. Timestamps that are in the future or too far in the past will not be found by Splunk. Try searching a wide time range to see if the data has bad timestamps index=web earliest=0 latest=+10y

richgalloway · ‎09-13-2023

Check out the timewrap command.

richgalloway · ‎09-13-2023

Untested, but try the chart command. | eval weeknum=strftime(strptime(yourdatefield,"%d-%m-%Y"),"%V") | chart dc(Task_num) as Tasks over weeknum by STATUS

richgalloway · ‎09-12-2023

Splunk cannot compare timestamps as strings. They must be converted to epoch (integer) form first. | inputlookup abc.csv | eval _time = strptime(_time, "%Y-%m-%d") | search _time >= strptime("2023-09-10", "%Y-%m-%d")

richgalloway · ‎09-12-2023

All searches expire. The default is 10 minutes, but shared searches are automatically extended to 7 days. I'm not aware of a way to extend search results past that.

richgalloway · ‎09-12-2023

If the dashboards somehow found their way into the /default folder then you will not be able to delete them using the UI. Otherwise, check the permissions on the dashboards to make sure you have write access to them. Failing that, the CLI may be your best answer.

richgalloway · ‎09-12-2023

By "use case" I presume you mean "search". If so, you can get all saved searches with this query | rest /servicesNS/-/-/saved/searches

richgalloway · ‎09-12-2023

Disabling an app in the UI should disable it in all SHC member nodes. To disable it on the HFs, set state=disabled in the [install] stanza of $SPLUNK_HOME/etc/deployment-apps/splunk_assist/local/app.conf and wait for the HFs to download the update.

richgalloway · ‎09-12-2023

Go to Settings->Tokens on the receiving Splunk instance to create a new token. Copy the token text to the Authentication header.

Posts	16784
Solutions	2989
Karma Given	2039
Karma Received	6728
Member Since	‎07-24-2012

Online Status	Offline
Date Last Visited	10 hours ago

Receiving notifications that are disabled

collectd reports "write_http plugin: curl_easy_per...

How do you restart splunk?

stats count(eval) always returns zero

Need help getting right timestamp from CSV

How to display more than 5 questions per page on A...

What will break if I set coldPath to /dev/null?

Knowledge Object Explorer won't load

How to use a field in SingleValue label?

How to move an index to another app?

Re: Hello, if I learn splunk only can I get a job....

Re: What is Splunk Security Software's Validation...

Re: help on eval command

Re: SPlunk queries not returning anything in table

Re: What is Splunk Security Software's Validation...

Re: help on eval command

Re: How to get the list of Adhoc Search and Saved ...

Re: help on eval command

Re: How to get the calender week from the date?

Re: PSA: latest broken hosts app 4.2.2 has a bug

Re: SPlunk queries not returning anything in table

Re: Need help with custom time report

Re: How to choose the index and sourcetype

Re: Splunk DB Connect FIPS

Re: Send File monitored data input from HF to Splu...

Re: How to get the list of Adhoc Search and Saved ...

Re: Send File monitored data input from HF to Splu...

Re: compare two date\time range in one timechart

Re: How to get the calender week from the date?

Re: search by _time from inputlookup csv file

Re: How to share a non expiring search

Re: Can't delete deprecated 'advanced XML' dashboa...

Re: Splunk query to get the list of Use Cases

Re: Turn off Splunk Assist in search head cluster ...

Re: Intergrating the tanium module with splunk

Join the Conversation