Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- Find Answers
- :
- About HeinzWaescher
HeinzWaescher
Motivator
Member since:
10-22-2013
2 weeks ago
Community Statistics
| Posts | 527 |
| Solutions | 19 |
| Karma Given | 174 |
| Karma Received | 96 |
| Member Since | 10-22-2013 |
Activity Feed
- Got Karma for Timechart - Running Total By Product. 09-21-2023 03:09 PM
- Got Karma for Re: Change Pie Chart Labels. 01-19-2023 12:38 PM
- Posted Re: Enterprise Security Threat Intelligence - Lookup population on Splunk Enterprise Security. 10-13-2022 07:31 AM
- Posted Enterprise Security Threat Intelligence - Lookup population? on Splunk Enterprise Security. 10-13-2022 04:20 AM
- Got Karma for Renaming Reports. 08-25-2022 08:54 PM
- Got Karma for Re: How to rename column values when making a chart. 02-01-2022 02:34 PM
- Got Karma for Re: How to rename column values when making a chart. 11-08-2021 01:58 PM
- Got Karma for How do I extract a field value after a specific string in unstructured data?. 06-10-2021 05:09 PM
- Posted Alert Manager - Save results to KV store or index? on Alerting. 05-24-2021 12:53 AM
- Got Karma for Re: How to rename column values when making a chart. 08-24-2020 05:20 AM
- Got Karma for Re: Change Pie Chart Labels. 08-05-2020 09:00 AM
- Karma Re: How to update apps correctly via the command line? for nickhills. 06-05-2020 12:51 AM
- Got Karma for How to update apps correctly via the command line?. 06-05-2020 12:51 AM
- Karma Re: pass quotes inside of tokens for dashboard for kamlesh_vaghela. 06-05-2020 12:50 AM
- Karma Re: How do you evaluate the difference between 2 multivalue fields? for tiagofbmm. 06-05-2020 12:50 AM
- Karma Re: BOTSv2 capture the flag app does not work properly for arjunpkishore5. 06-05-2020 12:50 AM
- Karma Re: Is it possible to define multiple evals as default for each search? for kamlesh_vaghela. 06-05-2020 12:50 AM
- Karma Re: Is it possible to define multiple evals as default for each search? for adonio. 06-05-2020 12:50 AM
- Karma Re: What is the difference between == and = in SPL ? for richgalloway. 06-05-2020 12:50 AM
- Karma Re: Why are only some indexes listed in the available indexes pane under roles? for lycollicott. 06-05-2020 12:49 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 1 |
04-24-2018
05:24 AM
You could for example query the license usage of a common field per sourcetype/index
your sourcetype
| eval b=len(_raw)
| timechart span=1h avg(b) as b by yourfieldname
| foreach * [eval <>=round('<>'/1024/1024/1024,10)]
... View more
04-24-2018
05:11 AM
For 1) you could use a workaround in the search and transform the _time field like this
index=maillog
| timechart span=1d，count（eval（IP=×××）） as IP1
| eval _time=strftime(_time, "%Y-%m-%d")
| outputcsv IP1
Regarding 2), I don't understand your need here.
... View more
04-20-2018
06:56 AM
1 Karma
In your example you are removing field2 before using the filter
Have you tried out:
yourbase search
| search field2="testvaluexyz"
| table field1 field2 field3
In general you should filter as soon as possible. So if possible, filter it directly in the base search.
... View more
04-20-2018
06:01 AM
3 Karma
Have you tried out to merge the parameters to unique combinations before the timechart?
| eval combination=sid."-".did."-".lun
| eval res = readio / 1
| timechart span=60min avg(res) By combination
... View more
04-20-2018
12:24 AM
Try this:
| eval date=strptime(date,"%d-%m-%Y %H:%M:%S,%3N")
| stats min(date) AS start, max(date) AS max_date BY transactionId
| eval duration=max_date-min_date
... View more
04-19-2018
07:41 AM
2 Karma
How does you search look like?
I assume you need to do this a the end of your search
| replace 1 WITH "Audio", 0 WITH "Not Audio" IN yourfieldname
... View more
04-12-2018
05:36 AM
2 Karma
Try add this to your base search
| transpose
| addtotals
| search Total>0
| fields- Total
| transpose header_field=column
| fields - column
... View more
04-12-2018
04:54 AM
1 Karma
I would try something like:
index=yourindex sourcetype=yoursourcetype
| stats count(eval(LoginStatus="succeeded")) as succeeded_logins, count(eval(LoginStatus="failed")) as failed_logins, count(LoginAttemptDateTime) AS total_attempts BY User
With this you can set filters like:
| search succeeded_logins=0 AND failed_logins>0
2.
| search succeded_logins>0
| stats count avg(total_attempts) AS avg_attempts
... View more
03-12-2018
01:30 AM
this works fine, thanks 🙂
... View more
03-09-2018
07:39 AM
Hi,
I would like to use the "latest" time modifier that is defined by the the timerange picker or in my base search as a value for calculations. Is there a field that includes this timestamp and can be used?
Thanks in advance
Heinz
... View more
02-08-2018
05:39 AM
Very nice approach to add a "useless" token into the search query 🙂 That solves my issue, thanks a lot!
... View more
02-08-2018
12:43 AM
Hi,
I would like to implement some options to show/hide panels in a dashbaord.
Currently the plan to have an option for each panel at the top of the dashboard, so that Splunk users can decide what they want to see.
< input type="checkbox" token="panel_1" searchWhenChanged="true">
<label>Overview</label>
<choice value="true">Show</choice>
<change>
<condition label="Show">
<set token="panel_1">true</set>
</condition>
</change>
<default>true</default>
</input>
< panel depends="$panel_1$">
As far as I understand this, Splunk is running ALL searches when I open the dashboard, no matter what is selected in this option. Is it possible to only start the search of a panel, when the user selects the show option? This would reduce loading times and load caused by the dashboard.
Thanks in advance
... View more
11-22-2017
06:20 AM
Same problem here, we are on 7.0.0 as well.
The search mentioned by somesoni2 does not show all available indexed on my SH as well. But I can search more indexes shown in the search result & in roles.
... View more
11-15-2017
12:29 AM
Hi,
is it possible to calculate the license usage in GB grouped by specific events? Let's say I want to know the usage by the parameter eventName. If no eventName is set, I want to use the sourcetype. So the result should be a calculation grouped by fieldA=coalesce(eventName, soucetype)
Thanks in advance Heinz
... View more
Labels
- Labels:
-
license
09-01-2017
07:55 AM
yes.
the example mentioned above does not work on my side
... View more
09-01-2017
07:28 AM
Here is the part of a sample event. Seems to make a difference
payload: { [-]
consumablesUsed: { [-]
Consumable_Grenade: 0
Consumable_Healthpack: 0
}
So the mv should include every fieldname that starts with payload.consumablesUsed.Consumable_
... View more
09-01-2017
06:53 AM
thanks, this works fine and is easier to handle than the workaround mentioned above 🙂
... View more
09-01-2017
06:25 AM
Hi,
is it possible to create a multivalue field out of fieldnames with a specific pattern?
Let's say we have several product fields in an event:
productA=20
productB=50
productC=100
...
Can we create a multivalue field that includes all fieldnames that start with "product"?
mv_field={productA productB productC}
Cheers
Heinz
... View more
09-01-2017
06:15 AM
The token for fieldA is set this way:
<drilldown>
<condition>
<set token="cluster_message_token">$row.message$</set>
</condition>
</drilldown>
In a second panel it used as a filter in a later search:
base search and pipes...
| search cluster_message="$cluster_message_token$"
It is set as fieldA="this is a "test" value", so not working correctly.
I fixed it with the workaround mentioned above, but am wondering why escaping is not handled automatically here.
... View more
08-24-2017
12:14 AM
1 Karma
Hi,
some of my values have quotes in the string. Using the fieldlist for filtering, Splunk is automatically escaping these characters in the base search.
fieldA=this is a "test" value ---> fieldA="this is a \"test\" value"
When I try to use fieldA as token drilldown, it does not work for values with quotes because these characters are not automatically escaped. What it the best way to handle this situation?
My first approach would be to use:
| eval fieldA=replace(fieldA,"\"","")
| search fieldA="this is a test value"
Is there a better one or a more automized one?
... View more
08-14-2017
01:49 AM
Hi,
I want to import a growing .csv every week, so there will be duplicate events. In the report I only want to analyse the latest version of the csv/the latest dataset.
My first thought is to filter the latest indextime
my base search
| eventstats max(_indextime) AS max_indextime
| where _indextime=max_indextime
But I'm not sure whether the imported events will always have the same indextime per import. Or can the indextime vary for large csv files?
Thanks in advance
... View more
08-04-2017
07:28 AM
I think I got it.
I created two dashboards. The first included saved non-scheduled searches, the second includes the same searches as inline searches.
I opened both dashboards:
The first dashboard started calculating results for max limit of concurrent searches, the rest was cancelled.
In the second dashboard all inline searches were queued and finalized step by step, nothing was cancelled. So it depends how the search in implemented in the dashboard.
... View more
08-04-2017
07:04 AM
ah okay 🙂 that works fine, starting instantly and finalizing fast.
... View more
08-04-2017
06:39 AM
The error appears instantly when the dashboard is opened and Splunk tries to run to many searches. So there is no time until a timeout so that I could crosscheck it.
(Or I just don't understand what you mean :))
... View more
08-04-2017
06:02 AM
I can't click the "open in search" button for these searches. The job Inspector says "unknown sid"
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
2 weeks ago
|
Karma given to
