Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About vn_g
vn_g
Path Finder
Member since:
01-20-2020
01-24-2024
Community Statistics
| Posts | 66 |
| Solutions | 0 |
| Karma Given | 6 |
| Karma Received | 0 |
| Member Since | 01-20-2020 |
Activity Feed
- Posted Slack Notification alert failing with Error code 1 on Alerting. 01-24-2024 04:34 AM
- Posted Re: Slack notification error code 1 on Getting Data In. 01-24-2024 04:08 AM
- Tagged Re: Slack notification error code 1 on Getting Data In. 01-24-2024 04:08 AM
- Posted Re: Query to find newly added sourcetypes on Splunk Search. 04-23-2021 04:09 AM
- Karma Re: Query to find newly added sourcetypes for woodcock. 04-23-2021 04:09 AM
- Posted Re: Appendcols - Issue in the output of the query on Getting Data In. 03-25-2021 04:03 AM
- Posted Re: Appendcols - Issue in the output of the query on Getting Data In. 03-25-2021 02:04 AM
- Posted Appendcols - Issue in the output of the query on Getting Data In. 03-25-2021 12:43 AM
- Tagged Appendcols - Issue in the output of the query on Getting Data In. 03-25-2021 12:43 AM
- Posted Re: How to create a new lookup from my local machine to clustered environment using curl command? on Splunk Search. 03-24-2021 05:12 AM
- Posted Re: How to create a new lookup from my local machine to clustered environment using curl command? on Splunk Search. 03-24-2021 05:03 AM
- Posted Re: How to create a new lookup from my local machine to clustered environment using curl command? on Splunk Search. 03-24-2021 04:55 AM
- Posted Re: How to create a new lookup from my local machine to clustered environment using curl command? on Splunk Search. 03-24-2021 04:47 AM
- Posted How to create a new lookup from my local machine to clustered environment using curl command? on Splunk Search. 03-24-2021 02:27 AM
- Tagged How to create a new lookup from my local machine to clustered environment using curl command? on Splunk Search. 03-24-2021 02:27 AM
- Posted Re: What Changes are made on Alerts , Dashboard? on Dashboards & Visualizations. 03-11-2021 11:29 PM
- Posted Re: What Changes are made on Alerts , Dashboard? on Dashboards & Visualizations. 03-11-2021 12:22 AM
- Posted What Changes are made on Alerts , Dashboard? on Dashboards & Visualizations. 03-10-2021 03:27 AM
- Karma Re: How compare multivalue field with previous and next event value of _time field ? for bowesmana. 02-05-2021 05:03 AM
- Karma Re: Match Substring in Multivalue field and return only the matched substring values for manjunathmeti. 02-05-2021 05:03 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
02-02-2021
04:56 AM
Each multi-value field (FiledName: R_time ) which has time value in epoch format should be compared to it previous event time and next event time. The epoch time should be less than previous event and greater than next event.
... View more
Labels
- Labels:
-
other
01-20-2021
12:58 AM
I have given minimum size as 0% and 0.1% and tried, but no luck. Still the same view.
... View more
01-18-2021
04:24 AM
Yes, If I run this query, I could almost more than 20 labels being displayed even if the value is too small. Can you explain how? So , I can reflect the same to my query.
... View more
01-15-2021
03:04 AM
Yes. Is there any option available in xml to increase this limit?
... View more
01-15-2021
02:09 AM
I have given minimum size as 0% , so i could see all the classifications in the piechart graph but not the labels. I do not want them to classify under Others.
... View more
01-15-2021
01:37 AM
( | stats count by app ) I have 30 apps to be displayed in a Piechart format. But in visualization i can view only 14 of them are showing the label names of the app. Why all the 30 apps not getting displayed? Mostof them which have fewer count are showing the labels.
... View more
Labels
- Labels:
-
chart
01-10-2021
11:54 PM
Hi Ralph, Thankyou so much for your time. | eval MINIMUM_VERSION="3.9.2" | eval COMPARE_VERSION="3.11.0" The above is showing incorrect results. smaller_global =
if(major_smaller="true", "true",
if(minora_smaller="true", "true",
if(minorb_smaller="true", "true",
if(minorc_smaller="true", "true",
if(minord_smaller="true", "true",
if(minore_smaller="true", "true",
if(minorf_smaller="true", "true","false"
))))))) Guess the above conditions needs to be re-valuated. Thanks, Nagasri.G
... View more
01-08-2021
01:41 AM
| makeresults | eval MINIMUM_VERSION_REQUIRED="3.9.2" | eval COMPARE_VERSION="3.12.9" | eval MINIMUM_VERSION_REQUIRED=replace(MINIMUM_VERSION_REQUIRED,"\.","") | eval COMPARE_VERSION=replace(COMPARE_VERSION,"\.","") | eval zero_count=len(COMPARE_VERSION)-len(MINIMUM_VERSION_REQUIRED) | eval MINIMUM_VERSION_REQUIRED=case(zero_count<=0,MINIMUM_VERSION_REQUIRED,zero_count=1,MINIMUM_VERSION_REQUIRED+"0",zero_count=2,MINIMUM_VERSION_REQUIRED+"00",zero_count=3,MINIMUM_VERSION_REQUIRED+"000",zero_count=4,MINIMUM_VERSION_REQUIRED+"0000") | eval COMPARE_VERSION=case(zero_count>=0,COMPARE_VERSION,zero_count=-1,COMPARE_VERSION+"0",zero_count=-2,COMPARE_VERSION+"00",zero_count=-3,COMPARE_VERSION+"000",zero_count=-4,COMPARE_VERSION+"0000") | where COMPARE_VERSION < MINIMUM_VERSION_REQUIRED In the above case it still gives incorrect results . The COMPARE_VERSION field value is not less than MINIMUM_VERSION_REQUIRED.
... View more
01-07-2021
10:29 PM
I have attached the screenshot. I am using the simple query which has only index and host name. The hostname is in the format -- AAAAAANNNNNA.
... View more
- Tags:
- i
01-07-2021
09:36 PM
For example , In my case I need to compare 2 floating point numbers. Suppose 3.9.2 version is greater than 3.6.13 version and if I try to repace "." with "" and then compare , it gives incorrect results.
... View more
01-07-2021
03:51 AM
client_type = 'JDBC_DRIVER' , client_version = '3.9.2' The above is the exact value in the lookup. | rex field=clienttype_minimumversion_details max_match=0 "client_type\s=\s'(?<REPORTED_CLIENT_TYPE>.*?(?='\s,))" | rex field=clienttype_minimumversion_details max_match=0 "client_version\s=\s'(?<MINIMUM_VERSION_REQUIRED>.*?(?='))" Using the above I am extracting 2 fields | eval version= tonumber(trim(MINIMUM_VERSION_REQUIRED)) | eval type=typeof(version) The output of (MINIMUM_VERSION_REQUIRED) is Invalid I need it in number format so that I can compare it to another numeric field in the logs. I tried tonumber and convert , it doesnt work.
... View more
Labels
- Labels:
-
other
12-22-2020
09:24 PM
In Splunk Enterprise Security , Incident Review Dashboard , I am adding 2 different Investigation Option to the notables by clicking on "Add Event to Investigation". Now , my requirement is to find out the metrics of each Invegistation Option. For example , How many notables exist with a particular investigation Option. Is it possible?
... View more
Labels
- Labels:
-
audit
12-15-2020
02:52 AM
Yes , I am just using the basic search query index and host value .
... View more
12-14-2020
10:39 PM
index="win*" host="abc" -- doesnt give results index="win*" host="ABC" -- gives results But , it is not suppose to function that way , since I heard Field values are case insensitive? Kindly help
... View more
Labels
- Labels:
-
fields
12-14-2020
09:42 PM
Verified internally , our email systems allow up to 20 MB size attachments. When I try to manually download the result , it is approximately 12MB , but still it is failing when scheduled for alert notification.
... View more
12-10-2020
09:06 PM
-- index=_internal sourcetype=scheduler alert_actions=email status=success savedsearch_name="Okta_ResearchCenter_login_data_*" Above query states splunk alert action is success. -- index=_internal source=*python.log 2020-11-17 12:45:38,888 +0530 ERROR sendemail:475 - (552, '5.3.4 Message is too long.') while sending mail to: abc@xyz.com 2020-11-17 12:45:38,887 +0530 ERROR sendemail:142 - Sending email. subject="Splunk Report: Okta_ResearchCenter_login_data_SeptemberReport", results_link="https://abc-sh111.com/app/search/@go?sid=scheduler_dbmFnYXNyabkBiY2cuY29t__search__RMD54e9f54654ca73_at_1605300_47656_D3F84F-9527-4D98-AAC2-62D9B23BF8D2", recipients="[u'abc@xyz.com']", server="email-smtp.us-east-111.aws.com:587" -- settings in action.action_history.maxresults and action.email.maxresults are changed to 1000000 -- O/p of the query is 63,074 lines
... View more
Labels
- Labels:
-
alert action
-
email
12-08-2020
07:42 AM
Splunk was not auto extracting "alert_actions" field using normal key value pair extractions. App: search props.conf [scheduler] EXTRACT-alert_action = alert_actions\=\"(?P<alert_actions>.*?)\" Applying above props solved the issue.
... View more
12-08-2020
01:44 AM
Version : 8.0.4.1 Query gives below result :index=_internal sourcetype=scheduler "email" | fillnull 12-06-2020 08:05:11.189 +0000 INFO SavedSplunker - savedsearch_id="nobody;search;TimeDelayInCiscoEstreamerLogsFromHost-"10.90.78.45"", search_type="", user="abc", app="search", savedsearch_name="TimeDelayInCiscoEstreamerLogsFromHost-"10.90.78.45"", priority=default, status=success, digest_mode=1, scheduled_time=1607241900, window_time=0, dispatch_time=1607241903, run_time=6.113, result_count=2, alert_actions="email", sid="scheduler_dmFybNyaS5hZG1pbkBiY2cuY29t__search__RMD5e388bf8114eaecc6_at_160900_26417_8B358556-EC52-4F41-A194-1A98CFD37560", suppressed=0, thread_id="AlertNotifierWorker-0", workload_pool="" Query : index=_internal source=scheduler alert_actions="*email*" Above query doesnt give any results.
... View more
- « Previous
-
- 1
- 2
- Next »
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
01-24-2024
07:51 AM
|
Karma given to
