About LearningGuy

bowesmana · ‎12-18-2023

You are still rounding UP with your floor(Score)+1 - is that what you intended?

LearningGuy · ‎11-27-2023

Your solution worked. Thank you so much for your help

LearningGuy · ‎11-21-2023

So, in my case if I need to put that "long search" in drop down list, just use the regular search, not base search? Thanks

bowesmana · ‎11-16-2023

What do you mean by too long? Too many lines or performance? You can combine eval statements, i.e. | eval Rank_Inc=round((pos-1)/(count-1)*100, 0), Rank_Exc=round((pos+1)/(count+1)*100, 0) From a performance point of view, as soon as you sort data, it will be running on the search head and both eventstats and streamstats must run on the search head, but your data set should be pretty small at this point regardless of how many students you have, you only need Student and Score on the search head, so if it's performance, make sure you do a fields statement to limit the fields before the sort.

ITWhisperer · ‎11-16-2023

That works although it makes little difference to the pie chart

ITWhisperer · ‎11-13-2023

* doesn't work (as a wildcard) for where only search

LearningGuy · ‎11-09-2023

Hello, I received the following error, the issue resolved itself after 4 hours. The CSV file size is 54 MB. Streamed search execute failed because: Error in 'lookup' command: Failed to re-open lookup file: 'opt/splunk/var/run/searchpeers/[random number]/apps/[app-name]/lookups/test.csv' I am aware that there already a post in regards this, but I have more questions 1) What is the cause of this error? Is it because of the bug like mentioned in the old post below? I am running 9.0.4, the bug should have been fixed https://community.splunk.com/t5/Splunk-Enterprise/Message-quot-Streamed-search-execute-failed-because-Error-in/m-p/569878 2) a) Is it because max_memtable_bytes in limits.conf is 25MB? https://docs.splunk.com/Documentation/Splunk/9.0.4/Admin/Limitsconf b) How do I check limit.conf via GUI without admin role? c) What does "Lookup files with size above max_memtable_bytes will be indexed on disk" mean? Is it a good thing or bad? d) If I see cs.index.alive file auto generated, does it mean it's an indexed on disk? [random number]/apps/[app-name]/lookups/test.csv [random number]/apps/[app-name]/lookups/test.csv_[random number].cs.index.alive 3) If I am not allowed to change any setting (increase 25MB limit), what is the solution for this issue? I appreciate your help. Thank you

ITWhisperer · ‎11-05-2023

1) eventstats adds the aggregated value (sum in this instance) to each event, stats replaces the events with the aggregated statisitcs 2) No, this is not normally possible - addtotals adds an extra event (row) to the pipeline at the end. The way the pipeline is displayed happens after the total row has been added and there is no way to predict how big the first page of the display is going to be ahead of time.

ITWhisperer · ‎11-03-2023

Correct, it is not possible in one go because you are effectively grouping by two different dimension sets.

ITWhisperer · ‎11-02-2023

| stats values(score) as score by ip vuln | stats dc(eval(if(score > 0,vuln,null()))) as dc_gt_0 dc(vuln) as dc_all sum(score) as total_score by ip

gcusello · ‎11-02-2023

Hi @LearningGuy , as I said, you don't hide fields in the base search: in base search you need to put all the fields you need in the dashboard' s panels, then in each panel yu use only the fields you need. The base search is the starting point of all the panels' searches. One additional hint: if you don't use a streming commad (as stats or timechart, etc...) the advantage of base search is limited. Ciao. Giuseppe

PickleRick · ‎10-31-2023

The "summaryindex" command is just an alias for "collect" command (I told you you're using that command, didn't I? 😉) But seriously - yes, summary indexing is a way of producing synthetic events containing some pre-aggregated values so you can later rely on those values instead of calculating the statistics from the raw data. So the idea is that you produce some set of pre-calculated fields which will be stored in the summary index in a predefined format - that's why you use the stash sourcetype and that's why this sourcetype does not incur any additional license usage.

gcusello · ‎10-30-2023

Hi @LearningGuy , sorry "it runs" I meant that I cannot test your search because if I take the values from your page it runs You have to try to use nomv and mvexpand. Ciao. Giuseppe

PickleRick · ‎10-28-2023

Question is why do you want to delete the events in the first place. As a general rule, events in Splunk are not deletable. Yes, there is a delete command but it doesn't remove the events from the buckets it just marks them as unsearcheable. But. If you need to capture just a transient state which needs to be updated often and you don't care about previous states either search for particular instance of your results (for example by creating a summary with a counter and incrementing said counter in subsequent generations of your summaries) or use a lookup instead of a summary index.

LearningGuy · ‎10-23-2023

Hello, There would be no difference because I converted your suggestion to my real data, so I already fixed any details Please suggest. Thanks, Marius

tej57 · ‎10-23-2023

Hey @LearningGuy, This currently is a limitation for the Dashboard studio. The inputs will always stay on top of the dashboards only.

inventsekar · ‎10-22-2023

Yep, thats a valid and nice SPL(the eval(score>0)). or the "!=" also should do the trick... | stats count(eval(score!=0)) as Total_Non_Zero_Vuln by ip the stats, eval commands give us so many options, very nice!

richgalloway · ‎10-11-2023

I'm curious about why you thought eval would not work after stats. There's nothing particularly magical about stats. It's a transforming command so only the fields used in the command are available to later commands. They are still fields, however, and can be processed as such. Note that some stats functions produce multi-value fields, which don't work well in all commands so they may require additional processing.

LearningGuy · ‎10-11-2023

Thank you for your help for this question Can you also help this related question? Thank you so much https://community.splunk.com/t5/Splunk-Search/How-to-calculate-total-when-aggregating-using-stats-max-field/m-p/660403#M227978

LearningGuy · ‎09-27-2023

Hello, Thanks for your help. There was a workaround to use condition value using a drilldown https://community.splunk.com/t5/Dashboards-Visualizations/Condition-value-using-a-drilldown/m-p/255914 It worked fine when I tested it, but the issue is it's difficult to read and it's not transferrable to Dashboard Studio <eval token="dmp">if(like($row.VulnerableIPs$,":"), "| search ip=\"" . $row.VulnerableIPs$ . "\" | rex mode=sed field=ip \"s/<regex>/<replacement>/<flags>"", "ip=" . $row.VulnerableIPs$ ) </eval>

LearningGuy · ‎09-21-2023

It worked!! Thank you..

LearningGuy · ‎09-19-2023

Hello, Thank you for your suggestion. On your suggestion, when using index=vulnerability_index, Doesn't the search still correlate 100k IPs with the CSV? Is it possible to create a historical data or index or DB to bypass the original vulnerability index? For example: index=new_vulnerability_index The old vulnerability_index has total 100k IPs, but this new index only has 2 IPs and 4 rows because it's already pre-calculated ip_address vulnerability score 192.168.1.1 SQL Injection 9 192.168.1.1 OpenSSL 7 192.168.1.2 Cross Site-Scripting 8 192.168.1.2 DNS 5

LearningGuy · ‎09-15-2023

Your suggestion worked!! Thank you so much for your help

yuanliu · ‎09-08-2023

Splunk does not have a IP version check per se. But you can hack ipmask to your advantage. ipmask only works with IPv4. So, if you are confident that your query returns legitimate IP addresses, you can tell IPv4 from IPv6. | dbxquery query="select IP from tableCompany" | eval IP = if(isnull(ipmask("255.255.255.255", IP)), IP . "/128", IP . "/32") Here is a snippet to help you observe how ipmask works in this context: | makeresults | eval ip = mvappend("10.11.12.13", "::") | mvexpand ip | eval hostmask4 = ipmask("255.255.255.255", ip) Netmask 255.255.255.255 also serves as an IPv4 validator. IPv6 can be validated using regex, but if your database is trustworthy, you can save this trouble.

richgalloway · ‎09-05-2023

That documentation doesn't apply in this case. It refers to the join command, which is not being used in the sample query. The query uses the SQL JOIN operator, which is not the same as the SPL join command. As I mentioned in my earlier response, everything in the dbxquery command is processed by the remote database, not by Splunk. Splunk only sees the results of the query.

Posts	301
Solutions	1
Karma Given	263
Karma Received	6
Member Since	‎02-25-2023

Online Status	Offline
Date Last Visited	‎05-20-2025 08:23 AM

How to change dataSource dynamically based on toke...

How to display JSON tree structure in a summary in...

How to create sample JSON data and display it in a...

stats count include zero

Splunk doesn't display extra spaces

How do I send email alert if one or more subsearch...

change Font size and display 0 on column chart in ...

dedup or filter row with condition

summary index timestamp follows earliest time

How do I "Left join" by appending CSV to an index ...

Re: How to round Totals for Statistics under Forma...

Re: How to put comment on the Splunk Dashboard Stu...

Re: long base search does not work in drop down li...

Re: How to calculate percentrank in Splunk?

Re: How to display one row table in a pie chart?

Re: How to filter row if some fields are empty?

Streamed search execute failed because: Error in '...

Re: How to use addcoltotals to calculate percentag...

Re: How to calculate sum of a field based on other...

Re: How to calculate distinct count with condition...

Re: How to hide a field of a table but keep it for...

Re: summary index merges multiple line values into...

Re: Does stats values command combine unique value...

Re: delete report data from the summary index

Re: How to create total average/median/max of fiel...

Re: How do I add a dropdown or text on any locatio...

Re: How to count total row number of non-zero fiel...

Re: How to calculate total when aggregating using ...

Re: How to display other fields on the same row wh...

Re: run different filter in an index search based ...

Re: How to replace string using rex with partial m...

Re: How to pre-calculate and search historical dat...

Re: How to outputlookup csv with permission?

Re: How to perform lookup on inconsistent IPv6 for...

Re: Does "WHERE" SQL clause have the same row limi...

Are you a member of the Splunk Community?