Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About ngwodo
ngwodo
Path Finder
Member since:
09-15-2020
12-02-2021
Community Statistics
| Posts | 57 |
| Solutions | 0 |
| Karma Given | 6 |
| Karma Received | 8 |
| Member Since | 09-15-2020 |
Activity Feed
- Posted Data Model Authentication sucessful splunk query alerts on Security. 11-15-2021 01:33 PM
- Tagged Data Model Authentication sucessful splunk query alerts on Security. 11-15-2021 01:33 PM
- Posted Mitre Dashboard on Getting Data In. 10-26-2021 02:20 PM
- Tagged Mitre Dashboard on Getting Data In. 10-26-2021 02:20 PM
- Posted Authentication Data model duplication of logs issue from 2 sourcetypes on Splunk Enterprise Security. 10-16-2021 03:11 PM
- Tagged Authentication Data model duplication of logs issue from 2 sourcetypes on Splunk Enterprise Security. 10-16-2021 03:11 PM
- Posted Re: The issue is that we have so many windows authentication failures after creating Authentication Data model on Building for the Splunk Platform. 10-13-2021 03:17 PM
- Posted Re: The issue is that we have so many windows authentication failures after creating Authentication Data model on Building for the Splunk Platform. 10-13-2021 02:38 PM
- Posted The issue is that we have so many windows authentication failures after creating Authentication Data model on Building for the Splunk Platform. 10-12-2021 12:42 PM
- Tagged The issue is that we have so many windows authentication failures after creating Authentication Data model on Building for the Splunk Platform. 10-12-2021 12:42 PM
- Posted Duplication of logs between sourcetype:good-audit and good-audit-admin on Building for the Splunk Platform. 10-12-2021 09:33 AM
- Tagged Duplication of logs between sourcetype:good-audit and good-audit-admin on Building for the Splunk Platform. 10-12-2021 09:33 AM
- Posted Re: I am setting up Authentication datamodel that have Default, insecure and Privileged Authentication on Splunk Enterprise Security. 10-11-2021 10:57 AM
- Posted I am setting up Authentication datamodel that have Default, insecure and Privileged Authentication on Splunk Enterprise Security. 10-11-2021 10:01 AM
- Tagged I am setting up Authentication datamodel that have Default, insecure and Privileged Authentication on Splunk Enterprise Security. 10-11-2021 10:01 AM
- Posted Detailed step-by-step processes to deploy Splunk Apps and Addons using Github from generating SSH keys to the last step on Getting Data In. 05-14-2021 09:52 AM
- Tagged Detailed step-by-step processes to deploy Splunk Apps and Addons using Github from generating SSH keys to the last step on Getting Data In. 05-14-2021 09:52 AM
- Posted Re: How can I get Ansible script to automate installation of splunk universal forwarder on 1000 Linux Red Hat Servers?? on Getting Data In. 05-14-2021 09:38 AM
- Posted Re: How can I get Ansible script to automate installation of splunk universal forwarder on 1000 Linux Red Hat Servers?? on Getting Data In. 05-13-2021 11:55 PM
- Posted How can I get Ansible script to automate installation of splunk universal forwarder on 1000 Linux Red Hat Servers?? on Getting Data In. 05-13-2021 10:22 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
12-28-2020
07:08 AM
I need help on how I can compare 1 day security metric to another day and also generate a metric report that shows low and high and compare it to the security metric in the spreadsheet. Below is the splunk query I have: index=security sourcetype="Computers" "Computer Status"=Enabled earliest=-12mon@mon | bin _time span=1day | dedup _time sAMAccountName | timechart span=1day count | stats avg(count) AS avg stdev(count) AS stdev min(count) AS min max(count) AS max latest(count) AS latest_count | eval min_thres=5000, max_thres=7500 | eval alert=if((latest_count<min_thres OR latest_count>max_thres), 1, 0)
... View more
- Tags:
- metric report
Labels
- Labels:
-
other
12-23-2020
09:09 AM
I need help on how to create splunk rule query to determine when volatility rate changes from low to high and to be able to be alerted. I have a splunk query below on the parameters/threshold that are used to determine metric "Volatility" Here it is: index=security sourcetype="Computers" "Computer Status"=Enabled earliest=-12mon@mon | timechart span=1day count | timechart span=1month earliest(count) AS count | stats avg(count) max(count) min(count)
... View more
- Tags:
- alert condition
Labels
- Labels:
-
alert action
12-02-2020
02:14 PM
Thanks. I had already figure it out. Thanks again for your help.
... View more
12-02-2020
12:36 PM
Please what about if I add up the totals of filled and empty will this query below do it? | eventstats sum(filled, empty) AS total | table filled empty
... View more
12-02-2020
12:34 PM
It worked very well. Thanks.
... View more
12-01-2020
02:39 PM
I need help on splunk query that will count both filled and empty cells in excel spreadsheet differently and give the values in percentages. I am trying to track down the percentage of the cells left to be filled out in the excel spreadsheet using |inputlookup David_metrics_temp.csv
... View more
11-23-2020
10:22 AM
Please I need help with ingesting data to do the Splunk Fundamental 2 Lab Exercises. The problem is that I have all the PDF documents for the Splunk fundamental 2 lab exercises but do not have the PDF that tells me all the files I need to download to do all the 14 lab exercises in the Splunk fundamental 2 Lab exercise. I did the training over 2 years ago and I wanted to go through the lab training exercises again without purchasing the material from Splunk. Please assist with all the files I need to do all the 14 lab exercises.
... View more
Labels
- Labels:
-
other
09-27-2020
07:15 PM
Thanks the starter pack works. I am working on building on it since I have more broader requirements.
... View more
09-27-2020
07:13 PM
Thanks for your help. I will work on it and probably may have questions. Thanks again.
... View more
09-25-2020
09:24 AM
Please is there anyway you can assist me with any of those?
... View more
09-25-2020
09:06 AM
This is the 2 splunk query that I have: | tstats latest(_time) as latest where index=* earliest=-48h by host | eval minutesago=round((now()-latest)/60,0) | tstats latest(_time) as latest where index=* earliest=-10m by host | eval minutesago=round((now()-latest)/60,0) I need the Splunk Query to do the following: The log feeds by the actual device products instead of just IPs. Deeper review of the logs by sourcetypes and sources (not just index=*) given that some tools are sending multiple feeds that are stored on the same index files. Tracking short term and long term outages instead of just last 10 min and last 24 hrs. The use of charts to show visual state of the devices health check instead of tables. Line charts to show logs feeds baseline vs spikes for last 24hrs/7d/30d. Ability to drill down under specific stats. Assets pivoting from an IP/hostname to show full device info (there are multiple lookup tables that have the necessary data). Please I need your help with the splunk query to do the above task.
... View more
- Tags:
- dashboard
Labels
- Labels:
-
drilldown
09-22-2020
06:51 AM
I also created 2 Alerts in Splunk web to send me an email based on the threshold of 24 hours and 10 minutes. Is that the correct way of doing it? Please let me know.
... View more
- Tags:
- alerts
09-22-2020
06:48 AM
Thanks. It works. I will keep you updated when I get a feedback from customer.
... View more
09-22-2020
06:41 AM
Thanks. I believe the color is now working. I will keep you updated.
... View more
09-22-2020
06:33 AM
Thanks. Do I also set the minuteago for 10 mins just like the 48 hours?
... View more
09-22-2020
05:48 AM
Please see below: <dashboard> <label>24 HOUR LOG FEED MONITOR</label> <description>Log feed monitor for 24 hour monitoring</description> <row> <panel> <title>24_hour_log_feed_monitor</title> <table> <search> <query>| tstats latest(_time) as latest where index=* earliest=-48h by host | eval minutesago=round((now()-latest)/60,0)</query> <earliest>-24h</earliest> <latest>now</latest> <sampleRatio>1</sampleRatio> </search> <option name="drilldown">none</option> </table> </panel> </row> <row> <panel> <title>10 MINUTES LOG FEED MONITOR</title> <table> <search> <query>| tstats latest(_time) as latest where index=* earliest=-10m by host | eval minutesago=round((now()-latest)/60,0)</query> <earliest>-10m</earliest> <latest>now</latest> <sampleRatio>1</sampleRatio> </search> <option name="count">20</option> <option name="dataOverlayMode">none</option> <option name="drilldown">none</option> <option name="percentagesRow">false</option> <option name="rowNumbers">false</option> <option name="totalsRow">false</option> <option name="wrap">true</option> </table> </panel> </row> </dashboard>
... View more
- Tags:
- xml
09-21-2020
08:38 PM
I created a dashboard for 24 hours and also 10 mins dashboard which I merged to the existing one. I need the dashboard colors to be based on threshhold (last seen 24 hours red, last seen 10 mins green). I know I can enter the color entries by editing XML. I entered it but I am having invalid error message. Please how can I do it in XML edit or maybe Format visualization? My splunk queries are: For 24 hour monitoring: | tstats latest(_time) as latest where index=* earliest=-48h by host | eval minutesago=round((now()-latest)/60,0) For 10 mins monitoring: | tstats latest(_time) as latest where index=* earliest=-10m by host | eval minutesago=round((now()-latest)/60,0)
... View more
- Tags:
- table
Labels
- Labels:
-
simple XML
09-21-2020
04:55 PM
Thanks. The set colors from visualization single value 42 are not working for -24h and -10 mins. I need your help.
... View more
09-21-2020
04:44 PM
The following is what I need to achieve: you are to create a dashboard that tracks log feeds so I imagine it would look like a table and have things like log feed | last seen and it would be colored based on some threshhold (last seen 24 hours red, last seen 10 mins green). It will include: color for categorizing critical levels email alerting can start with small features I have this splunk Query: | tstats latest(_time) as latest where index=* earliest=-48h by host | eval minutesago=round((now()-latest)/60,0) DO you think this query would be very proper for what I am trying to achieve? I have some issues with the color part of it. I did try using visualization single value 42 for the color but I do not see it. I need your help all it.
... View more
- Tags:
- dashboard
09-21-2020
11:48 AM
I set the color using the single value 42 but the color did not work. Please what is the screenshot or configurations on how I can set the color for threshold of 24 hours with color "Red" and the threshold of 10 minutes with the color "Green" ?
... View more
- « Previous
-
- 1
- 2
- Next »
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
12-02-2021
12:02 PM
|
