Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- Find Answers
- :
- About musskopf
musskopf
Builder
Member since:
11-19-2013
06-05-2020
Community Statistics
| Posts | 199 |
| Solutions | 36 |
| Karma Given | 19 |
| Karma Received | 122 |
| Member Since | 11-19-2013 |
Activity Feed
- Got Karma for Re: Splunk DB Connect: Why am I getting an error on my heavy forwarder trying to add a PostgreSQL database?. 04-30-2024 12:06 PM
- Got Karma for Re: How to retrieve all apps and reports from the backup after uninstalling and reinstalling Splunk?. 08-02-2022 02:10 PM
- Got Karma for Re: How to Script a Lookup in python. 02-28-2021 03:22 PM
- Got Karma for Re: How to display earliest and latest dates of searches in a dashboard and PDF report?. 10-17-2020 01:45 PM
- Karma Re: How can I save a query data so that it does not get loaded everytime for jimodonald. 06-05-2020 12:47 AM
- Karma Re: calculate baseline for chart in different time range for martin_mueller. 06-05-2020 12:47 AM
- Karma Re: After indexing slowed down due to available space, how can I speed up Splunk forwarding and indexing to catch up? for yannK. 06-05-2020 12:47 AM
- Karma Re: Splunk DB Connect: Why Web Access data is being logged into jbridge.log? for mchang_splunk. 06-05-2020 12:47 AM
- Karma Re: Changing position of addtotals label Field for somesoni2. 06-05-2020 12:47 AM
- Karma Script error during SA-ldapsearch test connection for thebarryk. 06-05-2020 12:47 AM
- Karma Re: Has anybody been successful with configuring the Splunk Support for Active Directory app on Splunk 6.1.1? for johnjj7141. 06-05-2020 12:47 AM
- Karma Splunk Support for Active Directory: Why do I get an exception from the Python script for every ldapfilter command I try? for Othi. 06-05-2020 12:47 AM
- Karma Re: How many people login with the same IP in the same hour using stats? for somesoni2. 06-05-2020 12:47 AM
- Karma Re: loadjob Encountered an error while reading file '/opt/splunk/var/run/splunk/dispatch/scheduler[...]/results.csv.gz' for Micmac. 06-05-2020 12:47 AM
- Karma Re: Why curl command for CSV output of top 20 error messages using regex returns error " -bash: syntax error near unexpected token `(' "? for Ayn. 06-05-2020 12:47 AM
- Karma Re: How to hide or grey out Clone option under Edit on Splunk dashboard? for martin_mueller. 06-05-2020 12:47 AM
- Karma Re: What are suggested approaches/steps for Syslog to switch to another heavy forwarder when primary goes down? for MuS. 06-05-2020 12:47 AM
- Karma Access Control: Is it possible to create views based on index name and/or sourcetype that we can set permissions for individually? for javiergn. 06-05-2020 12:47 AM
- Karma Re: return command works only with numeric values? for jrodriguezap. 06-05-2020 12:47 AM
- Got Karma for Re: How to customize the width of panels in an HTML dashboard?. 06-05-2020 12:47 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 2 | |||
| 4 |
12-04-2014
06:05 PM
I don't think the access to the "_internal" index requires Admin. You can define which index each Role can access. Have a look on the "Settings -> Access Control - > Roles" options.
... View more
12-04-2014
03:31 PM
2 Karma
The join command has a limit of 50000 records. Once you run your search, have a look on the "Job" link, below the search box on the right side. It might show a exclamation saying that you reached the limit.
... View more
12-03-2014
01:22 PM
2 Karma
I suspect you're using join to combine Data1 and Data2 right? If that's the case, are you using the option type=left ?
This option basically tells the join keep events even if there is no match on the subsearch. By default join uses type=inner , which means that only joined events will be kept.
... View more
12-01-2014
02:21 PM
2 Karma
The problem is that the day of the week changes, so 02/Dec today is Tue, last year 02/Dec/2013 was Sun... so, you'll need some coding to define wish Tuesday from last year to be used, the closest "up" or closest "down".
Now, the easier option is to use something like: earliest=-364d@d latest=-365d@d
As 364/7 = 52, you'll always get the values from exactly 52 weeks ago, at the same day of the week as Today. If Today is Tuesday and you want to check the results from yesterday (Monday), just subtract one (or add 6): earliest=-363d@d latest=-364d@d
Hopefully it'll give you some direction.
... View more
11-30-2014
01:30 PM
1 Karma
Hey Marina, give a try using the join command, something like that:
index=bla source=debug.log "your search" |
join type=left IPbalan [ search index=bla source=ldap-pre.log ]
Now the results should have the joined fields. Not that the join operation is case-sensitive - doesn't really matter for IPs but is good to be aware of that anyway... have a look on the Splunk Doc to see all join options.
Another option, if you ldap-pre.log is quite static, would be exporting your ldap-pre.log and converting it to a lookup table. Lookups are normally faster than joins.
... View more
11-26-2014
03:36 PM
ok.. but is the event being split in multiple events? I mean, is a single DB row output by the query being broken into multiple events or is just the fact that the field extraction is broken?
... View more
11-25-2014
07:26 PM
Hello KindaWorking,
For the first question, could you pls provide some example of the Raw event data to assist with the Regex?
Regarding the second question, I'm assuming "image" is a field already extracted from your events, you should be able to just run a command like:
index=main "your search if applicable" | timechart count by image
Have a look on http://docs.splunk.com/Documentation/Splunk/6.2.0/SearchReference/Timechart to see all options for timechart
Cheers,
... View more
11-25-2014
03:26 PM
Yes, it might be, but there's no need to run a lookup after the search which might balance things 🙂
... View more
11-25-2014
03:01 PM
1 Karma
Another option is to split your search and use append . Something like that:
sourcetype=IPS [inputlookup additionalbadips | fields src] | eval lookup="BadIP" |
append [
search sourcetype=IPS [inputlookup malwareips | fields src] | eval lookup="Malware"
]
| table source_host,source_address, type
Cheers
... View more
11-24-2014
09:25 PM
1 Karma
Yes, it's... Create your table and chart and arrange them side by side. After that click on "Edit Source" and you'll see something similar to it:
<option name="charting.layout.splitSeries">0</option>
<option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
<option name="charting.legend.placement">right</option>
<option name="drilldown">row</option>
</table>
</panel>
<panel>
<chart>
<searchString>some search</searchString>
<earliestTime>$inputTime.earliest$</earliestTime>
<latestTime>$inputTime.latest$</latestTime>
<option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
<option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
This is basically the end of a table and start of a chart... just remove the 2 lines:
</panel>
<panel>
And both will appear on the same panel.
... View more
11-24-2014
08:28 PM
Just two more things... you probably notice you could choose any name to the "fieldA" (B, etc). Also looking to your data, should be straight forward to expand this extraction method for almost all fields.
Once you have it done, you also could configure it inside "Settings -> Fields -> Field Extraction" so you don't need to do it every search using the rex command.
Cheers
... View more
11-24-2014
08:19 PM
1 Karma
So, based on that here how you could start with:
index=bla "your search" | rex field=_raw "FIRST_NAME(?P<fieldA>\w+)BATCH_EXPIRATION.+LASt_NAME(?P<fieldB>\w+)DEVICE_LIMIT" | table fieldA, fieldB
This is just an example assuming all your events have a similar format, you should be able to extract other fields as your requirement. Again, just "past" your log into http://regex101.com and start with the Regex on my example.
... View more
11-24-2014
08:11 PM
Ok, so just clarify, what you mean by extract "first and second as $field1::$field2"? What are the parts of the text you wish to extract as fields, pls give me an example, like:
fieldA=jacob
fieldB=Gomatham
fieldC=???
etc
Cheers
... View more
11-24-2014
08:03 PM
Hey Raghav, you definitely need to use regular expressions... Before I suggest anything, is the text you paste correct? looks like is missing "whitespaces" and the line breaking is wrong... Try to paste the text and use the "code sample" icon on the top of the form to format it correctly, like this:
test 123
As regular expression suggestion, I always recommend to use the site http://regex101.com/ to play with.
... View more
11-24-2014
06:40 PM
Have a look on this answer, seems very similar to the error message you're getting:
http://answers.splunk.com/answers/105645/splunk-ssl-input-app-not-hashing-password.html
... View more
11-24-2014
05:19 PM
have you specified a password when creating the key/certificate? If not, just remove the password = ... line. If you entered a password, you'll need to use password = [password_you_defined]
... View more
11-24-2014
03:40 PM
ok, so add | eval eventTime=_time before the transaction command:
(status="uploading" OR status="completed") | eval eventTime=_time | transaction id | table id, _time, eventTime
But as I mentioned, Splunk will show it as seconds, you should be able to convert it back using somenthing like: | convert timeformat="%F %T" ctime(eventTime) at the end.
... View more
11-24-2014
03:25 PM
If you take the transaction command off, is your search returning duplicated values on the id column? The transaction command should just "group" all the events having the same "id" and create multi-value fields for cases where the same field has distinct values.
http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Transaction
... View more
11-24-2014
03:13 PM
Try using:
(status="uploading" OR status="completed") | transaction id mvlist=t | table id, _time
or
(status="uploading" OR status="completed") | transaction id mvlist=_time | table id, _time
... View more
11-24-2014
02:08 PM
Ok, now things changed a bit... You might are looking for the command transaction , which will add the field duration that is exactly the time from the first event till the last event. But in your example, the IDs are different. Should they be the same?
... View more
11-24-2014
02:03 PM
The timestamp should be automatic placed inside the field "_time". Splunk store time as seconds, but if you use it names "_time" it'll automatic format for you.
index=bla "your search" | table _time, id
Remember that Splunk stores the Time in seconds, but it'll auto-format to a more human readable if the field name is "_time". For example:
index=bla "your search" | eval time2=_time | table _time, time2, id
But you might be looking to do something like:
index=bla "your search" | transaction id | table _time, id, duration, status
Have a look on the transaction command documentation, there are plenty of option...
... View more
11-23-2014
08:14 AM
Hello,
I' using the multi-line key-value format. Here it looks inside $SPLUNK_HOME/etc/apps/dbx/local/inputs.conf :
[dbmon-tail://KKK/KKK Alerts]
index = ws_kkk_alerts
interval = 240
output.format = mkv
output.timestamp = 1
output.timestamp.column = LastModifiedUTC
output.timestamp.parse.format = yyyy-MM-dd' 'HH:mm:ss' 'Z
output.timestamp.format = yyyy-MM-dd' 'HH:mm:ss' 'Z
query = SELECT bla bla bla.... {{AND av.$rising_column$ > ?}}
sourcetype = kkk_alerts
tail.rising.column = LastModified
disabled = 0
table = KKK Alerts
Note the output.format = mkv .
... View more
11-20-2014
09:34 PM
Can you start by monitoring a Text file and keep writing you notes there?
... View more
11-20-2014
08:10 PM
Could pls paste here raw events from both firewall that happen at similar time?
Normally Splunk will convert to local time zone if no time zone has been provided. The only exception if I'm not wrong is if the timestamp is presented as epoch seconds Splunk will interpret as being in UTC (as far I remember).
... View more
11-20-2014
05:10 PM
Use a Regex, like that:
index=bla "something to search" | rex field=_raw "x-ms-forwarded-client-ip (?P<clientIP>(\d{1,3}\.){3}\d{1,3})"
Now you can see that a new field, named clientIP , will be available for you.
Cheers,
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:03 AM
|
Karma given to
