Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- Find Answers
- :
- About abi2023
abi2023
Path Finder
Member since:
04-20-2023
11-01-2024
Community Statistics
| Posts | 50 |
| Solutions | 3 |
| Karma Given | 13 |
| Karma Received | 3 |
| Member Since | 04-20-2023 |
Activity Feed
- Posted I gave splunk table dashboard view. I need to highlight the "user" field all value with green. the all thefield value on Dashboards & Visualizations. 11-01-2024 08:08 AM
- Tagged I gave splunk table dashboard view. I need to highlight the "user" field all value with green. the all thefield value on Dashboards & Visualizations. 11-01-2024 08:08 AM
- Got Karma for I have high CPU utilization and memory usage after upgrading to Splunk enterprise 9.1.2 from Splunk enterprise 8.2 ?. 05-03-2024 02:14 AM
- Karma Re: How do I verify if splunk forwarder dropping event from the queue? Splunkd log _internal. for gcusello. 04-30-2024 06:07 AM
- Posted How do I verify if splunk forwarder dropping event from the queue? Splunkd log _internal. on Splunk Search. 04-29-2024 12:49 PM
- Posted Re: does Splunk UF has capability to mask data as it send to indexer? on Getting Data In. 03-29-2024 06:29 AM
- Karma Re: does Splunk UF has capability to mask data as it send to indexer? for marnall. 03-29-2024 06:27 AM
- Karma Re: does Splunk UF has capability to mask data as it send to indexer? for gcusello. 03-29-2024 06:27 AM
- Posted does Splunk UF has capability to mask data as it send to indexer? on Getting Data In. 03-27-2024 12:36 PM
- Posted Can I apply masking at host level instead of sourcetype? on Splunk Search. 03-26-2024 10:15 AM
- Tagged Can I apply masking at host level instead of sourcetype? on Splunk Search. 03-26-2024 10:15 AM
- Posted Re: Passing result.<fieldname> token on Alerting. 03-21-2024 05:44 PM
- Posted Passing result.<fieldname> token on Alerting. 03-19-2024 08:43 AM
- Tagged Passing result.<fieldname> token on Alerting. 03-19-2024 08:43 AM
- Posted Re: how do I pass search result value into email subject field in token? on Alerting. 03-06-2024 07:36 AM
- Posted how do I pass search result value into email subject field in token? on Alerting. 03-06-2024 06:59 AM
- Posted Re: help with regex for masking? on Getting Data In. 02-26-2024 11:33 AM
- Posted help with regex for masking? on Getting Data In. 02-26-2024 10:21 AM
- Tagged help with regex for masking? on Getting Data In. 02-26-2024 10:21 AM
- Posted I have high CPU utilization and memory usage after upgrading to Splunk enterprise 9.1.2 from Splunk enterprise 8.2 ? on Installation. 01-23-2024 05:21 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 0 |
08-14-2023
10:18 AM
I have two lookup table call lookup1.csv and lookup2.csv both has matching field call fullname. I want match my lookup1.csv to lookup2.csv and output the value not in the lookup1.csv byt in the lookup2.csv?
| inputlookup lookup1.csv | search NOT [| inputlookup lookup.csv | field fullname] but this SPL displaying result found in the both look table. Is any way to do this in splunk?
ADDVANCE Thanks
... View more
07-19-2023
08:17 AM
I do not have the color range option in format visualization. that why I am try in to modify in XML
... View more
07-19-2023
08:03 AM
I calculated i month percentage for status online. and I table to date percentage. displaying it into visualization column chart. I want my chart to reflect different color base on the percentage range e,g 0-40 red 40-60 orange 60-80 yellow 80-100 green. I modify in source <option name="charting.fieldColors">Percentage:0-40:#f13f56,40-60:#f1813f,60-80:#f1da3f,80-100:#72ae0d</option> but no success can someone assist me is the doable in Splunk visualition. Thanks in advance
... View more
Labels
- Labels:
-
chart
-
simple XML
-
timechart
07-17-2023
07:46 AM
I have spl in splunk index=demo search compliance= standard1 | timechart span=1week count by status | add totals row=t enable not_enable fieldname= "total" | eval percentage = round((enable / total ) * 100 , 0) . " %" | reverse | table _time percentage above spl show percentage week over week I want to show anther column show percentage different between last week and week before how do I show this next to last week row? If week before is 56% percentage and last week percentage 70% it need show next last week row 14% how can I do this? I try join append it did not work for me. Thanks in advance
... View more
- Tags:
- timechart
06-27-2023
09:39 AM
I have ServiceNow developer instance. Can I integrate with my Splunk dev environment. The Splunk Add on I am try in use is https://splunkbase.splunk.com/app/1928
... View more
Labels
- Labels:
-
workload management
06-27-2023
07:35 AM
Can I use same token concept in Splunk ES adaptive response action send email action if my notable event return the field?
... View more
06-27-2023
07:33 AM
Can I use same token concept in ES adaptive respond send email action. if my notable event search return the field?
... View more
06-26-2023
08:44 AM
I want to send customize email from Splunk ES adaptive response action. How do i add custom templet for email Message. second can I make To and Subject dynamic for each notable. pick up from event field? Thanks
... View more
Labels
06-20-2023
09:31 AM
I have correlation search creating notable event. the name correlation search testemail. I want to notifying all the mail address in user_email field email address. and I want go from my specified mailbox I create for such alert. how do I configure that. I am not looking change in Mail Server Settings and Send emails as.
... View more
Labels
- Labels:
-
alert action
-
email
06-07-2023
10:22 AM
I am try add to my notable event in correlation search next step analyst need to take. I am see some issue.
when I list next step action for analyst to take. I am getting my my next step action getting truncated in notable event in incident review page.
step 1 and step 2 are in same line even after I separate them by line.
... View more
- Tags:
- es
05-04-2023
05:56 AM
When I try to open ES incident review I am getting saying error "KV Store is initializing. Please try again later."
why I am getting this and How do I resolve the issue?
... View more
Labels
- Labels:
-
using Enterprise Security
05-02-2023
03:54 PM
| chart sum(count) as "Total Calls" by path, auditJsonMessage.Code | rename path as "EndPoint"
... View more
05-02-2023
03:36 PM
index=this_is_demo source="demo-kv" script=demo.ps1 hostname IN (*) | rex "(?<key>\w+)\s+-\s+(?<value>[^\r\n]+)" | kv | stats values(*) as * by hostname
... View more
05-02-2023
03:25 PM
| makeresults | eval limits=json_object("process1", json_array(123), "process2", json_array(234), "process3", json_array(0.12)), total=0 | eval processes = json_array("process1", "process2") | eval new_data_limits = json_object() | foreach processes [ | eval key = tostring(<<FIELD>>), value = json_extract(limits, key), new_data_limits = if(isnull(new_data_limits), json_object(key, value), json_set(new_data_limits, key, value)) ] get average base search | stats avg(*) as * by process1, process2
... View more
05-02-2023
03:20 PM
Click on the "Actions" button for that notable and select "Download notable events". In the "Download Notable Events" dialog box, select the format you want to use for the download (CSV or Text). you need admin privilege
... View more
05-02-2023
03:08 PM
1 Karma
basesearch | rex field=field1 "^(?<field2>[^_]+)_"
... View more
05-02-2023
03:02 PM
1 Karma
basesearch | replace "port 80 blocked" with "port 80 not allowed" in network_config this SPL change the value
... View more
05-02-2023
07:29 AM
I use if and replace command but when use | eval network_config = if(network_config="port 80 not allowed","port 80 blocked", network_config) after this I do not see no value for the field network_config.
... View more
05-02-2023
05:42 AM
my field value name got modify. under network config field name. field value used to be "port 80 blocked" now it got changed to "port 80 not allowed" I don't want to lose my history data. is any way I can use SPL to make "port 80 blocked" and "Port 80 not allowed" same so I can show in chart all the data.
... View more
Labels
- Labels:
-
metadata
05-01-2023
11:18 AM
my lookup table is history data for the search I am running. from my search and my lookup table I have command field is ID. I am trying to match the ID from my search to lookup table and display the result from lookup that not match to my search table.
lookup table name save.csv
my spl base search | table _time field1 ID field2
_time
field1
ID
field2
02/23/23
DEMO1
1054
xyc
02/23/23
Demo2
1426
xyd
below is my lookup table
_time
field1
ID
02/23/23
DEMO1
1054
02/10/23
DEMO2
1426
02/05/23
DEMO3
8746
... View more
Labels
- Labels:
-
lookup
05-01-2023
09:10 AM
my spl base search |transaction ID | table date field1 field2 ID
my result
Date field1 fiel2 ID 02/20/23 CCC 2k 10
02/20/23 c2 4k 11
02/10/23. CC 2k 08
02/01/23 C 5k 01
but I only want to output latest result which 02/20/23 assuming begin of the I don't date for latest event.
... View more
Labels
- Labels:
-
table
05-01-2023
08:39 AM
for the same spl but If I only want latest result show. how can I modify the search? assuming I don't know last event date.
... View more
05-01-2023
07:37 AM
my Spl is my base search | transaction ID | stats count values(Date) as Date value(field1) as field1 by ID
I get result
Date field1 ID 02/20/23. CCC 10 02/10/23 02/05/23
02/10/23. CC 08 02/05/23
02/01/23 C 01
Is there anyway in Splunk to search in Date field?
I am try to display result without Date 02/20/23
I try search Date!="02/20/23" and where Date="02/20/23" can anyone help is do able in splunk?
... View more
04-24-2023
08:04 AM
Where do I add this in source type. event breaks or Advance.
... View more
- Tags:
- e
04-20-2023
06:54 AM
Below I listed How I received my info. I want OS as field and "Android Server 2019" field value. similar for all .
OS: Android Server 2019 Time: Mar. 31, 2014 12:35:55 AM EDT (Mar. 31, 2014 04:35 AM UTC) Host: Demohost1 Number: VMware-00 00 a0 c0 d0 ed 05 df-0r 0c 00 00 00 11 3p 0 Host ID: 65456zDasdsA4+64+ADSD66S Local IP: XX.XXX.XXX.XXX Username: fakeuser1547 Command Line: xadwd \\fdsffd\w$\vfddd\fdfdsz<fxvx://cvfvxcv/w$/vcxzvxcv/vxvcx> D:\SADSSDF /b /SZCZXC /fed /R /GJGKL:DDV /W:87 /Q:90 action info: "C:\Windows\system32\cmd.exe" Action: HFDSHFSA SYDFYUSDFI GUIDFGIUSG dEMO ACTION has been detected. Action Taken: demoand, usual action Associated Value: 67A1790DCA55B8803AD024EE28F616A284DF5DD7B8BA5F68B4B252A5E925AF79"); (hash_sha256 on file_write) intersted file: syagdisg\hdisahiuhds\hsihisdaf\fbkjdsbfa\hjdjsab\ URL: Falcon Link<https://demourl.com/e3/__https://hdsudh.ndsjnds.bdjsabd.outlook.com/?url=httpsfgfdjkbdbfbfs;dfbabsjdbfasbdd cxvbdiufbduifbdfubbd8jknnd890jndnfd8nbjnbfjdf9jnfd88bfjdfbn90dhfdjnkfd980bfdjbfd0bfdjkfb8bjkdsbfjdbf9ibfdsjubf0nbjfdknbsf09nbsdifbnd89*nvkjdnbfd99JKBNDS9NKSNKJ9njknbdikjs9NKJNJK9nkmnksa0jcjisnbidhcdsi0> Demo Action Teken: Has not sdwewdn wdnw Verual hash: Hash value is provided as empty
... View more
- « Previous
-
- 1
- 2
- Next »
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
11-01-2024
11:29 AM
|
