About POR160893

POR160893 · ‎02-10-2023

Hey, This query helped but I still do not get the upper and lower bounds in the final output: What do you think?

POR160893 · ‎02-10-2023

Hi, I am unable to use strptime() here correctly. My code is: index="ABC" | eval time=strptime(_time, "%Y-%m-%dT%H:%M:%S") | bin time span=15m | table time But the table has no output ..... Can you please help? Thanks!

POR160893 · ‎02-10-2023

Hi, My overall goal is to create a resulting data table with headings including HourOfDay, BucketMinuteOfHour, DayOfWeek, and source, as well as creating an upperBound and lowerBound. My current query is as follows: index="akamai" sourcetype=akamaisiem | eval time = _time | eval time=strptime(time, "%Y-%m-%dT%H:%M:%S") | bin time span=15m | eval HourOfDay=strftime(time, "%H") | eval BucketMinuteOfHour=strftime(time, "%M") | eval DayOfWeek=strftime(time, "%A") | stats avg(count) as avg stdev(count) as stdev by HourOfDay,BucketMinuteOfHour,DayOfWeek,source | eval lowerBound=(avg-stdev*exact(2)), upperBound=(avg+stdev*exact(2)) | fields lowerBound,upperBound,HourOfDay,BucketMinuteOfHour,DayOfWeek,source | outputlookup state.csv However, it produces zero results. Can you please help? I am using the following article as a guide as this is for an anomaly detection project: https://www.splunk.com/en_us/blog/platform/cyclical-statistical-forecasts-and-anomalies-part-1.html I appreciate any help. tHANKS!

POR160893 · ‎02-10-2023

Hi, I am running the following query to check seasonality in my index: index="ABC | timechart count by _time | timechart Error in 'timechart' command: Repeated group-by field '_time'. The search job has failed due to an error. You may be able view the job in the Job Inspector.However, I am receiving the following error and I do not understand it at all: Can you please help? Many thanks!

POR160893 · ‎02-10-2023

Thanks, I changed my query to this then:

POR160893 · ‎02-10-2023

I assumed Splunk has a lag function. I use it quiet a lot in my SQL queries. I need it to calculate the time difference between each event and the previous event. This is because I would then alculats the average value of the "time_diff" field, giving you an estimate of the expected frequency of data in the index.

POR160893 · ‎02-10-2023

Hi, I am writing a query here to calculate the expected frequency of data in an index : index=ABC | eval time_diff=_time-lag(_time) | stats avg(time_diff) as avg_time_diff However, when I try and run it, I receive the following error message: Error in 'eval' command: The 'lag' function is unsupported or undefined. The search job has failed due to an error. You may be able view the job in the Job Inspector. Can you please help?

POR160893 · ‎02-01-2023

Hi. I have a dataset and one of the index columns is "X". I need to check whether or not this "X" feature is normally-distributed by plotting a histogram. I tried doing this but this doesn't plot the actual actual values: Can you please help?

POR160893 · ‎01-16-2023

Hi, I created a Splunk app with React but when I symlinked into Splunk's application directory, I receive the expected message as follows: BUT .... even after restarting my Splunk instance, the Splunk app does not appear on my list of apps on my Splunk instance. Why would this be and how can I fix this? Many thanks.

POR160893 · ‎01-08-2023

So I need to add “earliest=0 latest=now | stats count” to mr current query? Would that look at just the data for the last 24 hours though?

POR160893 · ‎01-08-2023

The search is as follows:: index="corp_security" sourcetype="dns_rpz" The alert should send an email per day for every subsequent day when there are 0 logs in the last 24 hours

POR160893 · ‎01-08-2023

Hi, I have an alert that is supposed to trigger an email each subsequent day when there are 0 logs in the last 24 hours against a particular search. However, when there ARE 0 logs in the past 24 hours, my alert does not get triggered for some reason. My alert is as follows: Can you please help as I do not understand why this alert is not working as expected? Many thanks!

POR160893 · ‎01-06-2023

OK, so that is my weekend work then: Configuring a trial deployment on my personal computer. MY only qualm with that though is ..... is there a set of steps on what to do and in what order when installing Splunk, configuring indexer and forwarder and search head. I ask as I have all the notes but just do not know the SEQUENCE of steps to execute this ..... 😞 Can you offer any advice please?

POR160893 · ‎01-06-2023

Hi, I have recently got a standalone instance of Splunk on AWS and it is not fully configured yet. I am trying to set up my server.conf on $SPLUNK_HOME/etc/system/local but I cannot locate the pass4SymmKey. When I try and find it on the Splunk GUI, I receive the following: Can you please help? Thanks

POR160893 · ‎01-05-2023

Hi, I need to create an index called "assets" from a JSON data file that I have. However, wen I try and create such an index and navigate to the given data file, I receive the following error: The index in question does not currently exist on my Splunk instance and I am trying to create a new index and populate this index with this data. Can you please help? Thanks.

POR160893 · ‎01-04-2023

Hi, I have a query that outputs a table with the following 3 fields: Latitude, Longitude, Count How can I turn this query into a JSON format so that I can use it with React? Many thanks, Patrick

POR160893 · ‎01-02-2023

The version of Splunk is 8.2.7. I am using Splunk Enterprise, on-prem version of Splunk. Version of MLTK is 5.3.1. My user role is admin.

POR160893 · ‎12-26-2022

Hi, For the MLTK app on Splunk, I need to change the number of distinct values for logistic regression, based on my data. However, when I try and configure these settings, the following button is greyed out: Why would this be and how can I resolve this please? Thanks,

POR160893 · ‎12-08-2022

Hi, I need to use a number of regression models on some index data. This index data is in an app called "XY". However, thus far, I have only been able to use the regression modelling on the Splunk MLTK app. Is it possible to call such functionality in the Splunk MLTK app while inside another app which has the data you wish to model on? Otherwise, what alternatives can I do in this situation? Many thanks,

POR160893 · ‎11-28-2022

Hey, I read the suggested article you sent but I am running into the following problem: Can you please help? Thanks!

POR160893 · ‎11-27-2022

Hi, I have a dashboard where one row has the panels appearing overlapping: This is the current HTML code for this row: How can I fix this? Thanks as always!

POR160893 · ‎11-24-2022

Hi, I have a row on a dashboard with a number of panels with metrics. However, the panels appear off-set and the metrics are not centered: Currently, the row is defined as follows: <row> <panel id="tn"> <title>Total</title> <html> <style> single{ width: auto; font-size=20%; } </style> </html> How can I fix this? Thanks,

POR160893 · ‎11-23-2022

Hey, I have a big query and I need to have a command on the query that would filter all Asset_State!="Development" OR Asset_State!="Pre-Production", bit for ONLY Asset_Environment!="PKI AND Offline" Status="2". If tried the following command: | if( Asset_Environment!="PKI AND Offline" Status="2".,search NOT (Asset_State!="Development" OR Asset_State!="Pre-Production")) I know the syntax is wrong, can you help ? Many thanks

POR160893 · ‎11-22-2022

Hey, I have a big base search and I want to add a condition in the search that would remove/ filter out Asset_State if either Development or "Pre-Production" ONLY IF Asset_Environment!="PKI Offline" Status="2. At the moment, this is the line in the query I have for this: .......| if(Asset_Environment!="PKI Offline" Status="2, search NOT (Asset_State!="Development" OR Asset_State!="Pre-Production") |.... Syntactically, I know this is incorrect .... can someone please help??? Many thanks as always!!!

POR160893 · ‎11-21-2022

I added fields at the start of my chain searches like as follows with a generic stats count by host at the end of my base search: But no results ....

Posts	288
Solutions	2
Karma Given	141
Karma Received	6
Member Since	‎11-16-2021

Online Status	Offline
Date Last Visited	‎06-19-2023 09:56 AM

How to tend graph overlay on Dashboard Studio?

Why is alert not triggering when string value is e...

How to calculate distinct count for present values...

How to write a query to check IP addresses in Subn...

Cannot open search on Splunk Dashboard Studio

Change textbook to search on multiple values?

Why am I unable to search with string tokens again...

How to combine two lookups?

How to join where a macro is used in the search?

How to resolve Time Error Message in Python in Spl...

Re: Cannot generate data table of statistics

Why am I unable to use strptime() function?

Why can't I generate data table of statistics?

Why can't I plot timechart to investigate seasonal...

Re: Difficulty finding the expected frequency of a...

Re: Difficulty finding the expected frequency of a...

How to find the expected frequency of an index?

How to plot normally distributed points from a ind...

Why is Symlink app not working?

Re: Alert not been triggered as expected

Re: Alert not been triggered as expected

Why is the alert not been triggered as expected?

Re: Cannot find pass4SymmKey for server.conf

Why can I not find pass4SymmKey for server.conf?

How to populate new index from data file?

How can I turn this query into a JSON format so th...

Re: Why can't I change settings on MLTK app on Spl...

Why can't I change settings on MLTK app on Splunk?

Using Splunk MLTK functionality while in another S...

Re: How to fix Dashboard panels' that appear overl...

How to fix Dashboard panels' that appear overlappi...

Unable to center metrics on Dashboard Row?

Unable to filter based on 2 fields- Help with synt...

Help with filtering on base search with If query

Re: Generic transfoming command for base search