Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Are you a member of the Splunk Community?
Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- Find Answers
- :
- About marcoscala
marcoscala
Builder
Member since:
04-27-2010
2 weeks ago
Community Statistics
| Posts | 140 |
| Solutions | 4 |
| Karma Given | 191 |
| Karma Received | 45 |
| Member Since | 04-27-2010 |
Activity Feed
- Karma Re: Monotonic Time Stuck and Search_Telemetry for gearmstrong. 2 weeks ago
- Karma Re: Send alert notifications to Microsoft Teams using Splunk enterprise for jawahir007. 05-15-2025 01:30 AM
- Karma Under what configuration file and stanza do I configure CMConfig - multisite=[true|false]? for dave_maclean. 04-07-2025 07:48 AM
- Karma What is the difference between stats command version 1 and version 2? for Marta88. 04-07-2025 03:51 AM
- Karma Re: Skipped searches for Tom_Lundie. 03-13-2025 09:40 AM
- Karma Re: How to get (or generate) Splunk ES notable event titles as seen on Incident Review dashboard for smeier. 02-28-2025 08:42 AM
- Karma Re: How to remove "Missing" forwarder from Forwarder Monitoring on Splunk Light 6.5 (Not DMC) for woodcock. 11-28-2024 12:28 AM
- Karma Re: How to integrate Salesforce Marketing Cloud with Splunk for lawrence_magpoc. 10-09-2024 01:06 AM
- Got Karma for Re: How to hide all form input filters in a dashboard by default?. 09-18-2024 05:13 AM
- Posted Re: How to integrate Salesforce Marketing Cloud with Splunk on Splunk Enterprise. 09-18-2024 02:29 AM
- Karma Re: How to integrate Salesforce Marketing Cloud with Splunk for lawrence_magpoc. 09-18-2024 02:28 AM
- Karma Re: How to blacklist Windows Security Event Logs 4689 and 4688 on a universal forwarder? for cesaccenturefed. 09-10-2024 12:26 AM
- Karma Re: Splunk Enterprise Security: What conditions need to be met to generate an Original Event Window in Incident Review? for Lowell. 08-09-2024 02:56 AM
- Posted Re: Splunk Secure Gateway connection error on Splunk Enterprise. 06-10-2024 03:21 AM
- Karma How do I fix a sslv3 alert certificate error? for symoon. 05-15-2024 08:15 AM
- Karma How to set attachment name in sendemail command for daniel_splunk. 04-03-2024 05:29 AM
- Karma Re: Splunk DB Connect connection to Hana for djackson_splunk. 03-07-2024 12:44 AM
- Karma How to prevent automatic translation of input labels? for whrg. 03-06-2024 12:09 AM
- Karma disable localization in app for lweber. 03-06-2024 12:07 AM
- Karma Re: Deployment server connection to License Master for isoutamo. 11-29-2023 08:44 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 1 | |||
| 1 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 0 |
03-07-2016
12:26 AM
Sorry, but if I'm right, this transforms just STRIPS out the syslog header. It doesn't convert it to lowercase.
... View more
02-12-2016
01:23 AM
It worked also for a Customer of our who had the same problem migrating from Splunk 6.2.4 to Splunk 6.3.2 on Windows 2008R2.
In mongod.log we had:
2016-02-05T13:55:47.766Z I CONTROL Hotfix KB2731284 or later update is not installed, will zero-out data files
2016-02-05T13:55:48.359Z I CONTROL dbexit: The provided SSL certificate is expired or not yet valid. rc: 2
2016-02-10T11:45:16.558Z W CONTROL No SSL certificate validation can be performed since no CA file has been provided; please specify an sslCAFile parameter
The "splunk createssl" command refreshed the certificate and everithing is working fine again.
Thanks!
... View more
09-25-2015
12:34 AM
Jeff,
thanks for the update, but this doesn't mention Event hashing... any news about that?! Or this also resolve single event tampering?
Marco
... View more
05-15-2015
07:53 AM
hi!
To get rid of "VALUE", you can use an eval like this:
...| iplocation .... | eval Region=if(Region=="", "NA", City) | geostats ....
Marco
... View more
05-08-2015
02:30 AM
Rob,
first keep in mind that you can also segregate data access using, besides indexes, also a search term restriction for each role.
Second, if you split your indexes to keep just one sourcetype, it's not enough specify "sourcetype=x", but for better performances, also add "index=X". otherwise, as Ayn already wrote, your search will cause Splunk to check in ANY other index if the terms are present in that index. And it takes some time as well.
Moreover, keep in mind the kind of searches you'll have to make. Are you just searching ONE sourcetype at time? No cross sourcetype correlation? In that case, again, having data split in several indexes is not the best case.
Happy Splunking!
Marco
... View more
04-13-2015
12:15 AM
Yep...... too quick to answer from my iPad....
here's a sample using the OIDemo DataModel
<title>Pivot - Sales</title>
<search>
<query>| pivot OIDemo Sales count(Sales) AS "Numero di Sales" SPLITROW _time AS _time PERIOD auto FILTER planType is * FILTER networkProviderName is $networkProvider$ SORT 100 _time ROWSUMMARY 0 COLSUMMARY 0 NUMCOLS 0 SHOWOTHER 1</query>
<earliest>-30d@d</earliest>
<latest>now</latest>
</search>
...
But you can also use directly the "tstats" command, which is more powerful and flexible in setting conditions and let you manipulate freely the results:
<query>|tstats avg(Orders.Sales.planPrice) AS ARPU FROM datamodel=OIDemo WHERE (nodename=Orders.Sales) $networkProvider$ $planType$ | eval avg=59 | eval ARPU=round(ARPU,2) | transpose | rename "row 1" as ARPU | fields ARPU | rangemap field=ARPU low=60-999 elevated=53-59 high=43-52 severe=0-42 default=low</query>
<earliest>-30d@d</earliest>
<latest>now</latest>
</search>
... View more
04-07-2015
01:25 AM
Use regex to override the field extraction and set the correct value, depending on the number of IPs in the different kind of logs....
... View more
03-28-2015
05:53 AM
1 Karma
In the Data Summary you see events from your (the user your using) default indexes. If index A is not among your default indexes, you won't see the number of events in the summary data.
To add it as default index, go to Settings - user management and change the role setting the user belongs to. that apples also for Admin user.
... View more
03-28-2015
05:42 AM
Sure you can't! Use the "|pivot " command to drive your pivot table and add the custom condition driven by the input fields in your search.
... View more
12-16-2014
02:49 AM
Hi Stephane and thanks for your try. You basically split the rex in several rex to capture any single piece of the data, but there is still the same problem: in your search you just captured the first JOB line. Instead I have to capture ALL the JOBs lines under the first header line containing CPU, SCHEDULE and the other fields. If you try for instance with Schedule CF14330AAAAAAAAF (the first of the file), you'll extract only the first JOB line out of 20.
Thanks,
Marco
... View more
12-11-2014
07:16 AM
PS: if anybody wants to play with this file, pls let me know and I'll email it!
Marco
... View more
12-11-2014
07:15 AM
Hi All,
I'm trying to parse multiline structured tabular events like this:
CPU Schedule Job State Pr Start Elapse Dependencies Return Code
APP10CNHL #CF14330AAAAAAAAG *LIM 5* STUCK 10 11/27 [NHIPPK600S90 ,11/26/14]
SPK6009001 SUCC 10 11/27 00:01 #J10175 0
SPK60090CP ABEND 10 11/27 00:01 #J10416 5
IPK6009003 HOLD 10(11/26) SPK60090CP
IPK6009004 HOLD 10(11/26) SPK60090CP
IPK6009005 HOLD 10(11/26) SPK60090CP
IPK6009006 HOLD 10(11/26) SPK60090CP
FPK60090ZZ HOLD 10(11/26) IPK6009003; IPK6009004; IPK6009005
IPK6009006
APP10CNHL #NHIPPK605GCL *LIM 4* SUCC 10 15:00 00:19 [Carry]
GPK605_RMDIR SUCC 10 15:00 00:01 #J32208 0
GPK605_RMDIR_GC1 SUCC 10 15:00 00:01 #J32210 0
(IVPRPTEC#)GPK605_STOP_LSNR_U SUCC 10 15:00 00:01 #J17236184 0
(IVPRPTEC#)GPK605_STOP_LSNR SUCC 10 15:00 00:01 #J39714998 0
(IVPRPTEC#)GPK6_SHOW_SESSION SUCC 10 15:00 00:01 #J57409632 0
(IVPRPTEC#)GPK605_KILL_SESSION SUCC 10 15:00 00:01 #J57409644 0
(IVPRPTEC#)SLEEP_60 SUCC 10 15:01 00:02 #J57409672 0
GPK605_MAIL_OFF SUCC 10 15:02 00:01 #J1133 0
(IVPRPTEC#)GPK605_START_LSNR SUCC 10 15:02 00:01 #J39714862 0
(IVPRPTEC#)SLEEP_300 SUCC 10 15:02 00:06 #J39714878 0
(IVPRPTEC#)GPK6BK0001_EXPORT SUCC 10 15:07 00:11 #J14352512 0
GPK605_MKDIR SUCC 10 15:18 00:01 #J30532 0
FINERETE SUCC 10 15:18 00:01 #J1647
Each event starts with a ScheduleID line, then followed by one or more JOBs lines.
Event braking works fine, as well field extraction for the first line. But my problem is to extract fields from the following JOB lines, with a sort of recurring regex.
Here's field extraction for ScheduleID first line:
[batch_prp]
EXTRACT-batch-schedule-header = (?mi)^(?<CPU>\w+)\s+(?<SCHEDULE>#\w+)\s+\*\w+\s+\d\*\s+(?<STATE>\w+)\s+(?<PR>\d+)(\s|\()(?<START>\d\d\S\d\d)?.*(\[(?<RETURN>.*)\])?
I was then trying to extract multi-value event "job-line" with this rex:
sourcetype=batch_prp |rex "(?m)^((\s+(?<Line>.*)$))+"
but this extracts only the last occurrence of Line in each event.
Any idea on how to write the regex to extract all the different value of the "Line" field?
Thanks a lot!!!
Marco Scala
... View more
12-01-2014
02:30 AM
Hi,
I suggest you to check this document section:
http://docs.splunk.com/Documentation/Splunk/6.2.0/Search/Parsemultivaluefields
As you can see, I think that one simple solution could be to use "makemv" command, like this:
sourcetype=buonopasto CMD=noop| makemv delim="|" PARAMS
that works in the simple scenario where you just have one separator (the PIPE char). It this works for you at least in that case, you can then work on a "append" of two searches, like this:
sourcetype=buonopasto CMD=noop| makemv delim="|" PARAMS | append [search sourcetype=buonopasto CMD=puttrans| makemv delim=" " PARAMS ]
Hope it helps,
Marco
... View more
11-20-2014
06:42 AM
beware that that solution works until you have AT LEAST one blank between two fields. It you have adjacent fields, with no space in between, then Splunk has problems in handling the two fields as two different strings.
I had that problem in a case where the log had fixed lenght fields but with adjacent fields(no separators).
For instance, envent il something like
xxxxxyyyyyyyyy....... where field1 are the first 5 chars, then field2 and so on.
In that case, fields extractions works, but if you try a search line "field1=xxxxx", that Splunk returns no result. To have some result you should write "field1=xxxxx*".
This is because Splunk indexes just one string made of "xxxxxyyyyyyy...." And if you have to search for field2, it's event worst: you must write "field2=yyyyyyyyy". As you can imagine, performance implications are terrible!
The solution I tried (and it worked perfectly) was to use a transform during the parsing phase and write the _raw adding a separator (. or | or a blank) between fields. Then Splunk indexes correctly the fields.
Marco
... View more
10-31-2014
01:53 AM
Mahamed,
please note that Event Hashing still works in Splunk 6.2. I've just tested it yesterday.
Please also note that removing features that give some kind of certification about data integrity is a mayor problem for many big customers and installations.
As Distributors, we already received lots of really worried emails from Partners that don't know how to manage this with their Customers.
We all do hope that Splunk will come out with some solution in a very near future: TBD is not an answer we can give to our Partners and Customers.
Regards,
Marco Scala
... View more
10-30-2014
03:12 AM
This is a major problem for every implementation where data integrity is Mandatory! Also a lot of Security Implementations require that the Solution must guarantee that collected data is not modified.
Is Splunk going to add new features to accomplish the same goal or is leaving the Compliance and Security field?
Marco
... View more
10-20-2014
08:07 AM
2 Karma
Take care! the rex in the "replace" commando is wrong because the backslash before "d+" and before "1" is truncated by this editor!!!
Il should be
index=myindex | eval BID = replace(_cd, "('backslash'd+):'backslash'd+", "'backslash'1") | top BID
Marco
... View more
10-16-2014
03:45 AM
Great! I'd like to use the same method to crete a macro to create a condition in a search to analyze Twitter data.
I have a form with some inputs fields the user can fill to select filters in a search. I have a "Hashtag" fiel with a default "" value, but if the user doesn't specify a value, I want add the "" condition, not the "entities.hashtags{}.text=*" condition, because I want to extract tweets even if the entities.hashtags{}.text is not present (if the tweet hasn't any hashtag, there's no field at all).
I've tried something like:
index=twitter lang=* [search * | head 1| eval query = if("$field$" == "*","*","entities.hashtags{}.text=$field$") | fields query | format "" "" "" "" "" ""]
which works only if $field$=="*", otherwise if the value in the input field is "myhashtag" the subsearch returns
"entities.hashtags{}.text=myhashtag" which doesn't match (Splunk looks for the STRING "entities.hashtags{}.text=myhashtag"
Basically I should find a way to strip the "" at the beginning and end of the field "query".
Any idea?
Regards,
Marco
... View more
10-16-2014
02:30 AM
Filtering on indexes actually is not necessary, but can be usefull. maybe you have to specify "index=xxx" just because that index is not among your default indexes (see Settings - Access Control - Roles - and check the indexes available in "Indexes searched by default").
As for efficiency, you can always check your search performance in the Job Inspector.
Marco
... View more
06-26-2014
01:29 AM
Damien,
I've been playing a bit with Zendesk APIs but the bad thing is that if for instance you ask for recent updates ( GET /api/v2/tickets/recent.json) you get a huge JSON with a single root element "tickets" and then all the tickets info hierarchy beneath.
ZenDesk APIs provide means to get info about the specific ticket, but then you need a more elaborate form of scripted input to get info in a more precise way.
Thanks,
Marco
... View more
06-25-2014
07:25 AM
1 Karma
Did anyone tried to import in Splunk info from ZenDesk? I'd like to import infos about ticket status using the ZenDesk Api but it looks not so easy.
Thanks,
Marco
... View more
06-04-2014
01:22 AM
Antonio,
I'm afraid but that's not the case either. In his/her case, date and time are splitted in the event data, so usual timeformat is more complex to manage. Unfortunately we can't use REGEX for TIME_FORMAT, otherwise that was the solution.
Marco
... View more
05-15-2014
03:25 AM
Hi Lisa,
I have the same problem too in Splunk 6.1, as many others, for a quite important prospect. I also had as last resort the idea of adding at the beginning of the _raw data the timestamp extracted from the source file, with date and time of the generation of the informations.
I only have a doubt: isn't timestamp assigned during the parsing phase before the Custom configurations in props.conf, like transforms and so on? We tried that but with no results...
Regards,
Marco
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
2 weeks ago
|
Karma given to
