Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About smanojkumar
smanojkumar
Contributor
Member since:
07-16-2021
Monday
Community Statistics
| Posts | 161 |
| Solutions | 0 |
| Karma Given | 45 |
| Karma Received | 0 |
| Member Since | 07-16-2021 |
Activity Feed
- Karma Re: Adding zoom in option to timeline chart for ITWhisperer. a week ago
- Karma Re: Adding zoom in option to timeline chart for bowesmana. a week ago
- Posted Re: Adding zoom in option to timeline chart on Splunk Search. a week ago
- Posted Adding zoom in option to timeline chart on Splunk Search. 2 weeks ago
- Posted Dowloading results of table to .csv file on Splunk Search. 2 weeks ago
- Karma Re: unset the inputput dropdown to default for ITWhisperer. 2 weeks ago
- Posted unset the inputput dropdown to default on Splunk Search. 2 weeks ago
- Karma Re: Finding the length of multivalue/singlevalue field for zksvc. 2 weeks ago
- Posted Re: Finding the length of multivalue/singlevalue field on Splunk Search. 3 weeks ago
- Posted Re: Finding the length of multivalue/singlevalue field on Splunk Search. 3 weeks ago
- Posted Finding the length of multivalue/singlevalue field on Splunk Search. 3 weeks ago
- Tagged Finding the length of multivalue/singlevalue field on Splunk Search. 3 weeks ago
- Posted Re: Passing a diffrent base search based on the selection of input dropdown on Splunk Search. 4 weeks ago
- Posted passing diffrent base search based on inputput dropdown values on Splunk Search. 4 weeks ago
- Posted Re: Passing a diffrent base search based on the selection of input dropdown on Splunk Search. 4 weeks ago
- Posted Passing a diffrent base search based on the selection of input dropdown on Splunk Search. 4 weeks ago
- Posted Re: Chart with Multiple fields on Y axis and time in X axis on Splunk Search. 10-14-2024 09:59 AM
- Posted Chart with Multiple fields on Y axis and time in X axis on Splunk Search. 10-14-2024 08:32 AM
- Karma Re: Conver to Hexadecimal code to bit value for yuanliu. 09-23-2024 04:33 AM
- Posted Re: Conver to Hexadecimal code to bit value on Splunk Search. 09-23-2024 04:26 AM
06-29-2023
03:56 AM
Hi @ITWhisperer , Thanks for your response! I'm getting total_assets_prev as 0, (My requirement is calculate the count of serial_number of time range -12 hr to -6hr and count of serial_number for the time range -6hr to now and calculate the difference) Thanks in advance! Manoj Kumar S
... View more
06-29-2023
01:37 AM
Hi Splunkers!
Good day!
I need a search which extracts the count of serial_number of different time range and i should calculate the difference, if its greater than 5000, it should trigger an alert,
index="inventory" origin="Inventory:ITSM" earliest=-6h latest=now()
| fields serial_number
| stats count(serial_number) as total_assets
| search [ search index="inventory" origin="Inventory:ITSM" earliest=-12h latest=-6h
| fields serial_number
| stats count(serial_number) as total_assets_prev]
| eval diff=total_assets_prev-total_assets
| where diff>5000
| eval message="Hello Team, the assets in ITSM origin is less than 65000 and its actual value is "
| table message, total_assets_prev, total_assets
This query is not working.
Thanks in advance!
Manoj Kumar S
... View more
Labels
- Labels:
-
stats
06-26-2023
06:34 AM
Hi @richgalloway , Thanks for your response, I'm new to the Splunk, Can you please help how to conform the access? Thanks in Advance! Manoj Kumar S
... View more
06-26-2023
01:41 AM
Hi Team,
Good day!
I need to send alert notification to teams by connectors, I had filled the mandatory fields in Alert actions in MS Teams, But I can't see notifications in MS Teams I can see as a triggered alerts,
Can any one help me to sort it out,
Thanks in Advance!
Manoj Kumar S
... View more
- Tags:
- teams
Labels
- Labels:
-
other
06-16-2023
02:11 AM
Hi There,
I need to send notification to MS Teams as a part of alert action,
How i need to configure that?
Thanks in Advance!
Manoj Kumar s=S
... View more
Labels
- Labels:
-
alert action
05-15-2023
02:57 AM
Hi @ITWhisperer , I got the same output as previous, Thanks in Advance!
... View more
05-15-2023
01:53 AM
Here is the actual data in JSON format, {"preview":false,"lastrow":true,"result":{"serial":"5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn\n5cd022g2wn ","src_name":"item-s1028501","length":"2718"}}
... View more
05-15-2023
01:37 AM
Hi @ITWhisperer , After applying the comamand, I got this, The data is from lookup, serial src_name length unique 5cd022g2wn 5cd022g2wn 5cd022g2wn 5cd022g2wn 5cd022g2wn 5cd022g2wn 5cd022g2wn item-s1028501 2718 5cd022g2wn 5cd022g2wn 5cd022g2wn 5cd022g2wn 5cd022g2wn 5cd022g2wn 5cd022g2wn
... View more
- Tags:
- removing duplicates
05-15-2023
01:04 AM
Hi There!
Good day,
I need to remove repeated entries of same values in single field, I'm unable to separate into single values by using values() , mvsplit commands,
Actual one -
src_name serial
item-s1028501
5cd022g2wn 5cd022g2wn 5cd022g2wn 5cd022g2wn 5cd022g2wn 5cd022g2wn 5cd022g2wn 5cd022g2wn
Expected one -
src_name serial
item-s1028501
5cd022g2wn
I just mentioned only one values in src_name, we are having multiple values in src_name to work with,
Thanks in Advance !
... View more
Labels
- Labels:
-
other
05-01-2023
01:26 AM
Hi @richgalloway ! Thanks for your resposne, The field max_check_date is not working as expected, it is not calculating the values, Here the samples of check_date Thanks in Advance!
... View more
04-28-2023
04:21 AM
Hi There,
Im having several fields and multiple values for same src_name and email, I need latest date in check_date and its associated values for that respective src_name, these things are there in lookup, so I need those data of latest in check_date for that specific src_name,
... View more
Labels
- Labels:
-
search
04-27-2023
05:22 AM
Hi There!
I need to add a specific field in the lookup and keeping the all old data as it is,
I'm having lookup1_kvstore , which consists of several fields and check_date as well also lookup2.csv consists of check_date, src_name , I need to update check_date from lookup2.csv to lookup1_kvstore and keeping all the old fields as it is except check_date.
Thanks in Advance!
... View more
Labels
- Labels:
-
search
04-27-2023
02:06 AM
Hi There!
I'm having the query, In the station_check_kvstore lookup , the field check_date consists of 180 values for a single src_name, we are having many src_name
For instance, when src_name = 51363 , check_date consists of 180 values,
If we are using this query, it fetched only 100 values of check_date for a single src_name, we need all values or the latest date in check_date,
Solution for both ways is welcome,
| inputlookup check_kvstore
| search src_name = 51363
| lookup station_check_kvstore src_name Email OUTPUT check_date
| table src_name Email check_date
Thanks is Advance!!
... View more
Labels
- Labels:
-
search
04-12-2023
03:24 AM
Hi @Manasa_401 Still, I didn't get the expected after removing the command.
... View more
04-12-2023
01:31 AM
Hi @Manasa_401 Even after adding range field in table command, i cant see the color change, My requirement is to check the soc_check field value color based on its values OK- green KO-Red
... View more
04-10-2023
04:32 AM
Hi @ITWhisperer The query is working but the color is still not changed. Thanks!
... View more
04-10-2023
04:20 AM
Hi @ITWhisperer , If the soc_check is "OK", the result should be in green color, if the soc_check is "KO", the result should be in red color, with the above query
... View more
04-10-2023
12:13 AM
Hi All,
I had a panel "OS", that gives the value os in single value visualization,
based on the value of os,
if it were "*windows*" it should display a panel "defender version", not "Agent version" panel,
If it were "MAC" or "OS X" or "IOS" it should display "Agent version" panel, not "defender version" panel,
I don't need drop down by selecting the values in "OS" panel, The os values wants to make impact on choosing the panel.
<form theme="dark">
<label> ASSET STATUS</label>
<fieldset submitButton="false" autoRun="true">
<input type="radio" token="category" searchWhenChanged="true">
<label>Category</label>
<choice value="work">Work</choice>
<choice value="auto">Auto</choice>
<choice value="server">Server</choice>
<search>
<query/>
<earliest>-24h@h</earliest>
<latest>now</latest>
</search>
<default>work</default>
<change>
<condition value="work">
<set token="Work">"Work"</set>
<unset token="Auto"></unset>
</condition>
<condition value="auto">
<set token="Auto">"Auto"</set>
<unset token="Work"></unset>
</condition>
<condition value="server">
<set token="Server">"Server"</set>
<unset token="Work"></unset>
<unset token="Auto"></unset>
</condition>
</change>
</input>
<input type="text" token="src_name" searchWhenChanged="true">
<label>src_name</label>
<default>*</default>
</input>
</fieldset>
<row>
<panel>
<title>OS</title>
<single>
<search>
<query>| inputlookup $category$_sanity_check_kvstore
| fields src_name, os
| search src_name IN ($src_name$)
| table os</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
</search>
<option name="colorMode">block</option>
<option name="drilldown">all</option>
<option name="rangeColors">["0xdc4e41","0x53a051"]</option>
<option name="rangeValues">[0]</option>
<option name="refresh.display">progressbar</option>
<option name="useColors">1</option>
</single>
</panel>
</row>
<row>
<panel depends="$Work$">
<title>Defender Sig Version</title>
<single>
<search>
<query>| inputlookup $category$_sanity_check_kvstore
| fields src_name, defender_sig_version_check
| search src_name IN ($src_name$)
| table defender_sig_version_check</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
</search>
<option name="colorMode">block</option>
<option name="drilldown">none</option>
<option name="rangeColors">["0xdc4e41","0x53a051"]</option>
<option name="rangeValues">[0]</option>
<option name="refresh.display">progressbar</option>
<option name="useColors">1</option>
</single>
</panel>
<panel>
<title>Agent Version</title>
<single>
<search>
<query>| inputlookup $category$_sanity_check_kvstore
| fields agentVersion_value,base_agentVersion_value, src_name
| search src_name IN ($src_name$)
| eval edr_mac_check=if(agentVersion_value>=base_agentVersion_value,3,0)
| table edr_mac_check</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
</search>
<option name="colorMode">block</option>
<option name="drilldown">none</option>
<option name="rangeColors">["0xdc4e41","0x53a051"]</option>
<option name="rangeValues">[0]</option>
<option name="useColors">1</option>
</single>
</panel>
</row>
Thanks in Advance!
... View more
Labels
- Labels:
-
other
04-07-2023
02:25 AM
Error in the sense, how to select panel based on the output of OS, I need that as well, we are done with passing the result and need help to select panel based on the output of OS
... View more
04-07-2023
02:20 AM
In the above query, I added eval range command, since i didn't get the expected one, Same, If the soc_check is "OK", the result should be in green colour, if the soc_check is "KO", the result should be in red colour
... View more
04-07-2023
02:07 AM
Hi @ITWhisperer , Can you please help me here, where i need to make change, i just made in query, i'm having some error <form theme="dark">
<label> ASSET STATUS</label>
<fieldset submitButton="false" autoRun="true">
<input type="radio" token="category" searchWhenChanged="true">
<label>Category</label>
<choice value="work">Work</choice>
<choice value="auto">Auto</choice>
<choice value="server">Server</choice>
<search>
<query/>
<earliest>-24h@h</earliest>
<latest>now</latest>
</search>
<default>work</default>
<change>
<condition value="work">
<set token="Work">"Work"</set>
<unset token="Auto"></unset>
</condition>
<condition value="auto">
<set token="Auto">"Auto"</set>
<unset token="Work"></unset>
</condition>
<condition value="server">
<set token="Server">"Server"</set>
<unset token="Work"></unset>
<unset token="Auto"></unset>
</condition>
</change>
</input>
<input type="text" token="src_name" searchWhenChanged="true">
<label>src_name</label>
<default>*</default>
</input>
</fieldset>
<row>
<panel>
<title>SOC CHECK</title>
<single>
<search>
<query>| inputlookup $category$_sanity_check_kvstore
| fields src_name, soc_check
| search src_name IN ($src_name$)
| eval soc_check=if(soc_check=1,"OK","KO")
| eval range=if(value=="OK","low","severe")
| table soc_check</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
</search>
<option name="colorMode">block</option>
<option name="drilldown">none</option>
<option name="rangeColors">["0xdc4e41","0x53a051"]</option>
<option name="rangeValues">[0]</option>
<option name="refresh.display">progressbar</option>
<option name="useColors">1</option>
</single>
</panel>
</row>
... View more
04-07-2023
01:40 AM
I tried using, I'm having some error, here is the full query I need Agent version panel when os is "MAC" or "OS X" or "IOS" , i need defender sig version if the os is "windows" or "windows 7" or "windows*" <form theme="dark">
<label> ASSET STATUS</label>
<fieldset submitButton="false" autoRun="true">
<input type="radio" token="category" searchWhenChanged="true">
<label>Category</label>
<choice value="work">Work</choice>
<choice value="auto">Auto</choice>
<choice value="server">Server</choice>
<search>
<query/>
<earliest>-24h@h</earliest>
<latest>now</latest>
</search>
<default>work</default>
<change>
<condition value="work">
<set token="Work">"Work"</set>
<unset token="Auto"></unset>
</condition>
<condition value="auto">
<set token="Auto">"Auto"</set>
<unset token="Work"></unset>
</condition>
<condition value="server">
<set token="Server">"Server"</set>
<unset token="Work"></unset>
<unset token="Auto"></unset>
</condition>
</change>
</input>
<input type="text" token="src_name" searchWhenChanged="true">
<label>src_name</label>
<default>*</default>
</input>
</fieldset>
<row>
<panel>
<title>OS</title>
<single>
<search>
<query>| inputlookup $category$_sanity_check_kvstore
| fields src_name, os
| search src_name IN ($src_name$)
| table os</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
</search>
<option name="colorMode">block</option>
<option name="drilldown">all</option>
<option name="rangeColors">["0xdc4e41","0x53a051"]</option>
<option name="rangeValues">[0]</option>
<option name="refresh.display">progressbar</option>
<option name="useColors">1</option>
</single>
</panel>
</row>
<row>
<panel depends="$Work$">
<title>Defender Sig Version</title>
<single>
<search>
<query>| inputlookup $category$_sanity_check_kvstore
| fields src_name, defender_sig_version_check
| search src_name IN ($src_name$)
| table defender_sig_version_check</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
</search>
<option name="colorMode">block</option>
<option name="drilldown">none</option>
<option name="rangeColors">["0xdc4e41","0x53a051"]</option>
<option name="rangeValues">[0]</option>
<option name="refresh.display">progressbar</option>
<option name="useColors">1</option>
</single>
</panel>
<panel>
<title>Agent Version</title>
<single>
<search>
<query>| inputlookup $category$_sanity_check_kvstore
| fields agentVersion_value,base_agentVersion_value, src_name
| search src_name IN ($src_name$)
| eval edr_mac_check=if(agentVersion_value>=base_agentVersion_value,3,0)
| table edr_mac_check</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
</search>
<option name="colorMode">block</option>
<option name="drilldown">none</option>
<option name="rangeColors">["0xdc4e41","0x53a051"]</option>
<option name="rangeValues">[0]</option>
<option name="useColors">1</option>
</single>
</panel>
</row>
... View more
04-03-2023
03:53 AM
<form theme="dark"> <label> Check Decision</label> <fieldset submitButton="false" autoRun="true"> <input type="dropdown" token="Category" searchWhenChanged="true"> <label>Category</label> <choice value="work">Work</choice> <choice value="server">Server</choice> <choice value="auto">Auto</choice> <default>work</default> </input> </fieldset> <row> <panel> <title>Total Number - $Category$</title> <single> <title>Total Count in $Category$</title> <search> <query>| inputlookup $Category$_kvstore | fields src_name, serial_number | search src_name IN ($Src_name$) | search serial_number IN ($Serial_number$) OR NOT serial_number!="" | stats count(src_name) as "Total"</query> <earliest>-24h@h</earliest> <latest>now</latest> </search> <option name="drilldown">all</option> <option name="refresh.display">progressbar</option> <drilldown> <set token="form.Total">$click.value$</set> </drilldown> </single> </panel> <row> <panel depends="$form.Total$"> <title>Total Asserts details of $form.Total$</title> <table> <title>Total Asserts details of count $form.Total$</title> <search> <query>| inputlookup $Category$kvstore | fields src_name, serial_number | search src_name IN ($Src_name$) | search serial_number IN ($Serial_number$) OR NOT serial_number!="" | table src_name</query> <earliest>-24h@h</earliest> <latest>now</latest> </search> <option name="drilldown">none</option> <option name="refresh.display">progressbar</option> </table> </panel> </row> I need only second panel only when i click the value in panel 1, if the category is changed, it should not display the panel 2
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
Monday
|
