About ITWhisperer

ITWhisperer · ‎08-29-2020

Your base query should be a superset of the queries in your dashboards <form theme="dark"> <label>2808 Leandro Matos</label> <search id="web"> <query>index=web | stats count by host, clientip, categoryid </query> <earliest>-7d@d</earliest> <latest>@d</latest> </search> Your panel searches can then be based on this search further refining it to your needs <panel> <chart> <search base="web"> <query>search categoryId=$listcategoria$ | stats sum(count) as count by categoryId</query> </search>

ITWhisperer · ‎08-28-2020

Have you tried transpose?

ITWhisperer · ‎08-28-2020

You need to evaluate the status of each step and recombine them into a single row per event (stats), then evaluate your success condition ... | eval status1=if(step=1,status,null) | eval status2=if(step=2,status,null) | eval status3=if(step=3,status,null) | eval status4=if(step=4,status,null) | eval status5=if(step=5,status,null) | eval status6=if(step=6,status,null) | stats values(status1) as status1, values(status2) as status2, values(status3) as status3, values(status4) as status4, values(status5) as status5, values(status6) as status6 by event | eval overall=if(status1="SUCCESS" AND status2="SUCCESS" AND status4="SUCCESS" AND status5="SUCCESS", "SUCCESS", "IN PROGRESS") | table event, overall

ITWhisperer · ‎08-28-2020

Try adding | xyseries date, ss_name, count

ITWhisperer · ‎08-28-2020

You could use a hidden panel to set up your styles <row depends="$STYLES$"> <panel> <html> <style> .main-section-body { background:greenyellow !important; } </style> </html> </panel> </row> Use a different style for each environment

ITWhisperer · ‎08-28-2020

How about something like index=_audit action="alert_fired" | convert timeformat="%m-%d" ctime(_time) AS date | stats count by ss_name, date Then use a stacked bar chart in your dashboard panel

ITWhisperer · ‎08-28-2020

Hi @dkgs You can only provide the expression LINE\":\"\|(?<user>[^\s]*)\s Unfortunately, I can't see a way of providing the max_match=0 part so you will only be able to extract the first match. To get all the instances in a multivalue field on a more permanent basis, you may have to adopt the transforms and props configuration approach

ITWhisperer · ‎08-28-2020

... | eval deployment=case(in(server,"srv1","srv7","srv9"),"Fin",in(server,"srv15","srv19","srv21"),"Jpn",in(server,"srv100","srv102","srv110"),"Bra")

ITWhisperer · ‎08-28-2020

Looks like you need something like ... | rex max_match=0 field=_raw "LINE\":\"\|(?<user>[^\s]*)\s" | mvexpand user

ITWhisperer · ‎08-27-2020

You could edit the dashboard and switch to source mode, then add a hidden panel with css for the relevant attributes prior to the first row <row depends="$STYLES$"> <panel> <html> <style> .results-table .wrapped-results td{ border:2px solid #FF0000; } </style> </html> </panel> </row>

ITWhisperer · ‎08-27-2020

See duplicate question and answer here

ITWhisperer · ‎08-27-2020

| rex field=_raw "\.com/(?<uri>[^\"]*)\":" Extract from _raw to a field called uri

ITWhisperer · ‎08-27-2020

Are you sure lookup tables are the way to go? Why not schedule daily reports?

ITWhisperer · ‎08-27-2020

You possibly don't want to change _time itself, but you can change the way it is displayed e.g. fieldformat _time=strftime(_time,"%d/%m/%y %H:%M:%S")

ITWhisperer · ‎08-27-2020

| stats values(policies{}.packages{}.name) as "Failed to install", values(patches{}.name) as "Patches to be installed" by name

ITWhisperer · ‎08-27-2020

In your first 2 queries, you are removing fields where distinct count is 1, but you don't appear to be doing this in the last query. Would this not account for the "missing" fields?

ITWhisperer · ‎08-27-2020

How about something along these lines: index=_internal | head 1 | eval _raw="<BLAdets> <Bladetsmeta> <Metadata><Key>FIELD_1</Key><Label>FIELD 1 test</Label><Value>this is the value of field 1</Value></Metadata> <Metadata><Key>FIELD_2</Key><Label>FIELD 2 test</Label><Value>this is the value of field 2</Value></Metadata> <Metadata><Key>FIELD_3</Key><Label>FIELD 3 test </Label><Value>this is the value of field 3</Value></Metadata> </Bladetsmeta> </BLAdets>" | spath BLAdets.Bladetsmeta.Metadata output=Metadata | rex field=Metadata "\<Key>(?<key>[^\<]*)\</Key>.*\<Value>(?<value>[^\<]*)\</Value>" | eval meta=mvzip(mvzip(key,value,">"),key,"</") | eval meta=mvmap(meta,"<"+meta+">") | spath input=meta

ITWhisperer · ‎08-27-2020

It looks like you need to replace "/n" with "\n" or perhaps "\n\t"

ITWhisperer · ‎08-26-2020

Just take it back to 1 spath ... | spath certificates{} output=certificates | mvexpand certificates | table certificates

ITWhisperer · ‎08-26-2020

Something like set your span to 8h and then trigger the alert on custom condition of "search TradeCount < 2000"

ITWhisperer · ‎08-26-2020

Try this: | rex max_match=0 field=FieldA "\/(?<FieldB>[^\/]*)(https:|\n|$)" | mvcombine delim=" " FieldB

ITWhisperer · ‎08-26-2020

How are the URLs delimited in FieldA? it looks like in some instances there is a space but not others. Try: | rex max_match=0 field=FieldA "\/(?<FieldB>[^\/]*)( |$)" | mvexpand FieldB If there is no space between in some instances, use: | rex max_match=0 field=FieldA "\/(?<FieldB>[^\/]*)(https:| |$)" | mvexpand FieldB

ITWhisperer · ‎08-26-2020

I am not sure what your base data is but let's assume it is a log of logins with timestamps. So, something like: ... base search ... | bin _time span=1h | stats count by _time | sort -count | where count >= 200 | head 5 That is, bucket events into 1h bins, count events in those bins, sort counts descending, only take counts above 200, just take the top 5

ITWhisperer · ‎08-26-2020

Try limiting the number of events with head index="cx_aws" source="notification-service" | head 1 | spath ... I am not sure if this is the right query but it seems to be the one from your image. The point is that head will reduce the number of events from the base search, in this case to 1 i.e. the latest event

ITWhisperer · ‎08-25-2020

Have you looked at this answer from the archives? Essentially, the escaping is removed from the escaped double quotes, and the embedded field is unquoted, before parsing with spath, allowing the whole log to be parsed as you were hoping for.

Posts	11323
Solutions	2293
Karma Given	72
Karma Received	3377
Member Since	‎2020-08-18

Dashboards: Hiding charts while search is being ex...

Buttercup Games: Further Dashboarding Techniques (...

Buttercup Games: Further Dashboarding Techniques (...

Buttercup Games: Further Dashboarding Techniques (...

Buttercup Games: Further Dashboarding Techniques (...

Buttercup Games: Further Dashboarding Techniques (...

Buttercup Games: Further Dashboarding Techniques (...

Buttercup Games: Further Dashboarding Techniques (...

Buttercup Games: Further Dashboarding Techniques (...

Buttercup Games: Further Dashboarding Techniques

Re: Multiple Base searches in a dasboard

Re: Modification in CSV report

Re: How to get Success, In Progress and Failure Co...

Re: Chart

Re: How can we change the color scheme for differe...

Re: Chart

Re: Extracting multiple values from single unstruc...

Re: How to group search results?

Re: Extracting multiple values from single unstruc...

Re: how to format table grid in simple XML?

Re: How to extract content between two strings?

Re: Use rex to extract a field

Re: How to add the splunk search results to an exi...

Re: Sort not working when change the time format

Re: Consolidating results on to one line

Re: stats values(*) missing columns / truncated c...

Re: XML parsing question

Re: splunk delims

Re: Data PArsing json

Re: What should be the search string and trigger a...

Re: How to extract the last part of all the combin...

Re: How to extract the last part of all the combin...

Re: Trend Login Time Captures - Timechart Report f...

Re: latest

Re: Azure: Is there a way Splunk, by default, extr...

Are you a member of the Splunk Community?