Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- Find Answers
- :
- About jedatt01
jedatt01
Builder
Member since:
04-22-2011
06-05-2020
Community Statistics
| Posts | 167 |
| Solutions | 7 |
| Karma Given | 14 |
| Karma Received | 40 |
| Member Since | 04-22-2011 |
Activity Feed
- Got Karma for How to exclude specific time ranges in search results. 01-10-2024 01:45 AM
- Got Karma for Can I use kvstore as a web application backend?. 06-05-2020 12:49 AM
- Karma Re: Potential bug in R Analytics App for gwobben. 06-05-2020 12:48 AM
- Karma Re: How can I determine if a field is an integer (whole number) for woodcock. 06-05-2020 12:48 AM
- Got Karma for Re: How can I add empty time buckets to my table?. 06-05-2020 12:48 AM
- Karma Re: Where to find dashboard source files in a Splunk 5.x distributed search environment on Unix? for dolfantimmy. 06-05-2020 12:47 AM
- Karma Re: comparing earliest of subsearch and main search for acharlieh. 06-05-2020 12:47 AM
- Karma Re: Sideview Utils: How to use $foo$ to select chart type from a pulldown? for sideview. 06-05-2020 12:47 AM
- Karma Re: How to use inputlookup with realtime search for martin_mueller. 06-05-2020 12:47 AM
- Karma Re: How to count how many times a field value has changed for a stream of events over a period of time? for Runals. 06-05-2020 12:47 AM
- Karma Re: How do I handle fields with no value or a blank space in a rex field extraction so they show up as null? for somesoni2. 06-05-2020 12:47 AM
- Karma Re: Can you specify timezone in a REST API search? for woodcock. 06-05-2020 12:47 AM
- Got Karma for Re: Timestamp problem with DB Connect. 06-05-2020 12:47 AM
- Got Karma for Re: How to get more than 100 rows in web framework using Django binding?. 06-05-2020 12:47 AM
- Got Karma for Re: Timestamp problem with DB Connect. 06-05-2020 12:47 AM
- Got Karma for Simple XML: How to keep dashboard from auto running. 06-05-2020 12:47 AM
- Got Karma for HTML: How to create multiple charts in a single panel on the same row?. 06-05-2020 12:47 AM
- Got Karma for HTML: Make panel clickable for hyperlinking. 06-05-2020 12:47 AM
- Got Karma for Re: HTML: Make panel clickable for hyperlinking. 06-05-2020 12:47 AM
- Got Karma for How to extract string in a field that spans multiple lines?. 06-05-2020 12:47 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 1 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
05-18-2016
11:42 AM
I want to create an alert that will trigger when the count of a certian type of event changes significantly from what it has seen in the past. See my data table below. You can see right in the middle of dataset the count jumps suddenly higher and stays there for hours. I want to be alerted when this happens, in additional I need to be able to account for datasets where the normal value is not close to 0. It may be normal to see 4000 events per time bucket but I want to know when it jumps to 8000 for example.
_time MESSAGE_TEXT msg_severity count
2016-02-10T08:00:00.000-0500 Communication with domain controller failed ERROR 7
2016-02-10T08:05:00.000-0500 Communication with domain controller failed ERROR 0
2016-02-10T08:10:00.000-0500 Communication with domain controller failed ERROR 0
2016-02-10T08:15:00.000-0500 Communication with domain controller failed ERROR 0
2016-02-10T08:20:00.000-0500 Communication with domain controller failed ERROR 0
2016-02-10T08:25:00.000-0500 Communication with domain controller failed ERROR 4
2016-02-10T08:30:00.000-0500 Communication with domain controller failed ERROR 0
2016-02-10T08:35:00.000-0500 Communication with domain controller failed ERROR 0
2016-02-10T08:40:00.000-0500 Communication with domain controller failed ERROR 0
2016-02-10T08:45:00.000-0500 Communication with domain controller failed ERROR 0
2016-02-10T08:50:00.000-0500 Communication with domain controller failed ERROR 0
2016-02-10T08:55:00.000-0500 Communication with domain controller failed ERROR 0
2016-02-10T09:00:00.000-0500 Communication with domain controller failed ERROR 6
2016-02-10T09:05:00.000-0500 Communication with domain controller failed ERROR 0
2016-02-10T09:10:00.000-0500 Communication with domain controller failed ERROR 5
2016-02-10T09:15:00.000-0500 Communication with domain controller failed ERROR 0
2016-02-10T09:20:00.000-0500 Communication with domain controller failed ERROR 0
2016-02-10T09:25:00.000-0500 Communication with domain controller failed ERROR 0
2016-02-10T09:30:00.000-0500 Communication with domain controller failed ERROR 3
2016-02-10T09:35:00.000-0500 Communication with domain controller failed ERROR 3
2016-02-10T09:40:00.000-0500 Communication with domain controller failed ERROR 0
2016-02-10T09:45:00.000-0500 Communication with domain controller failed ERROR 0
2016-02-10T09:50:00.000-0500 Communication with domain controller failed ERROR 50 <------------- start
2016-02-10T09:55:00.000-0500 Communication with domain controller failed ERROR 122
2016-02-10T10:00:00.000-0500 Communication with domain controller failed ERROR 100
2016-02-10T10:05:00.000-0500 Communication with domain controller failed ERROR 74
2016-02-10T10:10:00.000-0500 Communication with domain controller failed ERROR 93
2016-02-10T10:15:00.000-0500 Communication with domain controller failed ERROR 86
2016-02-10T10:20:00.000-0500 Communication with domain controller failed ERROR 75
2016-02-10T10:25:00.000-0500 Communication with domain controller failed ERROR 69
2016-02-10T10:30:00.000-0500 Communication with domain controller failed ERROR 67
2016-02-10T10:35:00.000-0500 Communication with domain controller failed ERROR 83
2016-02-10T10:40:00.000-0500 Communication with domain controller failed ERROR 100
2016-02-10T10:45:00.000-0500 Communication with domain controller failed ERROR 78
2016-02-10T10:50:00.000-0500 Communication with domain controller failed ERROR 89
2016-02-10T10:55:00.000-0500 Communication with domain controller failed ERROR 96
2016-02-10T11:00:00.000-0500 Communication with domain controller failed ERROR 65
2016-02-10T11:05:00.000-0500 Communication with domain controller failed ERROR 77
2016-02-10T11:10:00.000-0500 Communication with domain controller failed ERROR 74
2016-02-10T11:15:00.000-0500 Communication with domain controller failed ERROR 89
2016-02-10T11:20:00.000-0500 Communication with domain controller failed ERROR 90
2016-02-10T11:25:00.000-0500 Communication with domain controller failed ERROR 84
2016-02-10T11:30:00.000-0500 Communication with domain controller failed ERROR 63
2016-02-10T11:35:00.000-0500 Communication with domain controller failed ERROR 78
2016-02-10T11:40:00.000-0500 Communication with domain controller failed ERROR 79
2016-02-10T11:45:00.000-0500 Communication with domain controller failed ERROR 78
2016-02-10T11:50:00.000-0500 Communication with domain controller failed ERROR 56
2016-02-10T11:55:00.000-0500 Communication with domain controller failed ERROR 103
2016-02-10T12:00:00.000-0500 Communication with domain controller failed ERROR 101
2016-02-10T12:05:00.000-0500 Communication with domain controller failed ERROR 87
2016-02-10T12:10:00.000-0500 Communication with domain controller failed ERROR 90
2016-02-10T12:15:00.000-0500 Communication with domain controller failed ERROR 74
2016-02-10T12:20:00.000-0500 Communication with domain controller failed ERROR 64
2016-02-10T12:25:00.000-0500 Communication with domain controller failed ERROR 74
2016-02-10T12:30:00.000-0500 Communication with domain controller failed ERROR 84
2016-02-10T12:35:00.000-0500 Communication with domain controller failed ERROR 91
2016-02-10T12:40:00.000-0500 Communication with domain controller failed ERROR 87
2016-02-10T12:45:00.000-0500 Communication with domain controller failed ERROR 78
2016-02-10T12:50:00.000-0500 Communication with domain controller failed ERROR 61
2016-02-10T12:55:00.000-0500 Communication with domain controller failed ERROR 117
2016-02-10T13:00:00.000-0500 Communication with domain controller failed ERROR 80
2016-02-10T13:05:00.000-0500 Communication with domain controller failed ERROR 62
2016-02-10T13:10:00.000-0500 Communication with domain controller failed ERROR 40
2016-02-10T13:15:00.000-0500 Communication with domain controller failed ERROR 66
2016-02-10T13:20:00.000-0500 Communication with domain controller failed ERROR 63
2016-02-10T13:25:00.000-0500 Communication with domain controller failed ERROR 59
2016-02-10T13:30:00.000-0500 Communication with domain controller failed ERROR 79
2016-02-10T13:35:00.000-0500 Communication with domain controller failed ERROR 33
2016-02-10T13:40:00.000-0500 Communication with domain controller failed ERROR 46
2016-02-10T13:45:00.000-0500 Communication with domain controller failed ERROR 56
2016-02-10T13:50:00.000-0500 Communication with domain controller failed ERROR 70
2016-02-10T13:55:00.000-0500 Communication with domain controller failed ERROR 44
2016-02-10T14:00:00.000-0500 Communication with domain controller failed ERROR 60
2016-02-10T14:05:00.000-0500 Communication with domain controller failed ERROR 47
2016-02-10T14:10:00.000-0500 Communication with domain controller failed ERROR 63
2016-02-10T14:15:00.000-0500 Communication with domain controller failed ERROR 54
2016-02-10T14:20:00.000-0500 Communication with domain controller failed ERROR 43
2016-02-10T14:25:00.000-0500 Communication with domain controller failed ERROR 87
2016-02-10T14:30:00.000-0500 Communication with domain controller failed ERROR 48
2016-02-10T14:35:00.000-0500 Communication with domain controller failed ERROR 38
2016-02-10T14:40:00.000-0500 Communication with domain controller failed ERROR 66
2016-02-10T14:45:00.000-0500 Communication with domain controller failed ERROR 29
2016-02-10T14:50:00.000-0500 Communication with domain controller failed ERROR 72
2016-02-10T14:55:00.000-0500 Communication with domain controller failed ERROR 87
2016-02-10T15:00:00.000-0500 Communication with domain controller failed ERROR 40
2016-02-10T15:05:00.000-0500 Communication with domain controller failed ERROR 45
2016-02-10T15:10:00.000-0500 Communication with domain controller failed ERROR 61
2016-02-10T15:15:00.000-0500 Communication with domain controller failed ERROR 43
2016-02-10T15:20:00.000-0500 Communication with domain controller failed ERROR 52
2016-02-10T15:25:00.000-0500 Communication with domain controller failed ERROR 44
2016-02-10T15:30:00.000-0500 Communication with domain controller failed ERROR 53
2016-02-10T15:35:00.000-0500 Communication with domain controller failed ERROR 61
2016-02-10T15:40:00.000-0500 Communication with domain controller failed ERROR 62 <-------- end
2016-02-10T15:45:00.000-0500 Communication with domain controller failed ERROR 3
2016-02-10T15:50:00.000-0500 Communication with domain controller failed ERROR 0
2016-02-10T15:55:00.000-0500 Communication with domain controller failed ERROR 0
2016-02-10T16:00:00.000-0500 Communication with domain controller failed ERROR 0
2016-02-10T16:05:00.000-0500 Communication with domain controller failed ERROR 0
2016-02-10T16:10:00.000-0500 Communication with domain controller failed ERROR 4
2016-02-10T16:15:00.000-0500 Communication with domain controller failed ERROR 0
2016-02-10T16:20:00.000-0500 Communication with domain controller failed ERROR 0
2016-02-10T16:25:00.000-0500 Communication with domain controller failed ERROR 0
2016-02-10T16:30:00.000-0500 Communication with domain controller failed ERROR 0
2016-02-10T16:35:00.000-0500 Communication with domain controller failed ERROR 9
2016-02-10T16:40:00.000-0500 Communication with domain controller failed ERROR 0
2016-02-10T16:45:00.000-0500 Communication with domain controller failed ERROR 1
2016-02-10T16:50:00.000-0500 Communication with domain controller failed ERROR 0
2016-02-10T16:55:00.000-0500 Communication with domain controller failed ERROR 10
2016-02-10T17:00:00.000-0500 Communication with domain controller failed ERROR 0
2016-02-10T17:05:00.000-0500 Communication with domain controller failed ERROR 0
2016-02-10T17:10:00.000-0500 Communication with domain controller failed ERROR 5
2016-02-10T17:15:00.000-0500 Communication with domain controller failed ERROR 0
2016-02-10T17:20:00.000-0500 Communication with domain controller failed ERROR 0
2016-02-10T17:25:00.000-0500 Communication with domain controller failed ERROR 9
2016-02-10T17:30:00.000-0500 Communication with domain controller failed ERROR 0
2016-02-10T17:35:00.000-0500 Communication with domain controller failed ERROR 0
2016-02-10T17:40:00.000-0500 Communication with domain controller failed ERROR 0
2016-02-10T17:45:00.000-0500 Communication with domain controller failed ERROR 0
2016-02-10T17:50:00.000-0500 Communication with domain controller failed ERROR 12
2016-02-10T17:55:00.000-0500 Communication with domain controller failed ERROR 0
2016-02-10T18:00:00.000-0500 Communication with domain controller failed ERROR 1
2016-02-10T18:05:00.000-0500 Communication with domain controller failed ERROR 2
2016-02-10T18:10:00.000-0500 Communication with domain controller failed ERROR 10
2016-02-10T18:15:00.000-0500 Communication with domain controller failed ERROR 7
2016-02-10T18:20:00.000-0500 Communication with domain controller failed ERROR 0
2016-02-10T18:25:00.000-0500 Communication with domain controller failed ERROR 5
2016-02-10T18:30:00.000-0500 Communication with domain controller failed ERROR 0
... View more
05-13-2016
09:59 AM
I get where you are coming from with this, but my example table was probably too simplistic. There is a possibility that the normal value of MY_EVENT is not 0. I need a way to detect a consecutive series of abnormal values for count.
... View more
05-11-2016
08:02 AM
I'm trying to create an alert that will trigger when the count of events is changed drastically from one time bucket to another and that change persists for a certain amount of time....say 30 minutes. I have been able to detect a change using streamstats, but I'm getting stuck on how to detect when the change persists for a certain amount of time.
The following command works to detect the change...
streamstats window=2 global=f current=t first(count) As p_count
But how do I expand that to detect a persistent change over more than two time buckets?
example:
time event count
9:00 AM MY_EVENT 0
9:05 AM MY_EVENT 75
9:10 AM MY_EVENT 90
9:15 AM MY_EVENT 80
9:20 AM MY_EVENT 85
9:25 AM MY_EVENT 75
9:30 AM MY_EVENT 95 <------------ I want alert to trigger here
9:35 AM MY_EVENT 74
9:40 AM MY_EVENT 0
But I don't want to trigger an event if I see the following..
time event count
9:00 AM MY_EVENT 0
9:05 AM MY_EVENT 75
9:10 AM MY_EVENT 80
9:15 AM MY_EVENT 0
9:20 AM MY_EVENT 0
9:25 AM MY_EVENT 0
9:30 AM MY_EVENT 0
9:35 AM MY_EVENT 0
9:40 AM MY_EVENT 0
... View more
05-04-2016
10:46 AM
1 Karma
bawood is correct! It works to use lang=code.
... View more
03-29-2016
12:41 PM
To my knowedge you cannot do this with an eval. I know this is not as convenient as a calculated field, but have you considered writing a rex command like the below and save it as a macro? That way you can invoke the extraction very quickly when needed.
mysearch | rex field=SourcePath "\/\w*\/\w*\/[a-zA-Z]*\_(?<domainName>[a-zA-Z0-9]*)"
... View more
03-29-2016
11:27 AM
1 Karma
I just figured out the solution. Somesoni2's response gave me hint. Since msg_severity is always the same for each message, I combined the fields, then ran it through the timechart command. Then untable and wa-lah!
index=myindex msg_severity=* | eval message_severity = message + "|" + msg_severity | timechart span=1m count by message_severity | untable _time message_severity count | eval temp = split(message_severity,"|") | eval message = mvindex(temp,0) | eval msg_severity = mvindex(temp,1) | table _time message msg_severity count
... View more
03-29-2016
11:10 AM
time range is only 2 minutes. Total message - msg_severity combinations is one. It's always unique. Hope that helps.
... View more
03-29-2016
06:12 AM
Not quite there yet. Let me try to explain a little better. Not all of the values of message have entries every minute, so they won't show up in all time buckets. In my resulting table the entries for those time buckets are just missing, example below
_time message msg_severity count
9:00 message1 error 10
9:01 message1 error 6
9:00 message2 warning 3
9:01 message2 warning 4
9:01 message3 notice 6
The 9:00 entry for message3 is missing. I want the table to look like
_time message msg_severity count
9:00 message1 error 10
9:01 message1 error 6
9:00 message2 warning 3
9:01 message2 warning 4
9:00 message3 notice 0
9:01 message3 notice 6
... View more
03-28-2016
08:31 AM
I have a dataset which I cannot use timechart because i'm splitting by two fields. Not all of the values of message have events in all time buckets. Is there a way to add 0 time buckets for each of value of message?
index=myindex msg_severity=* | bucket span=1m _time | stats count by message msg_severity _time
... View more
03-11-2016
12:01 PM
I have a list of hosts that are assigned to a tag so the user doesn't have to input the list of hosts manually in search. These hosts are changed occasionally and I have an external system that manages those changes. Is there any way to pull the host changes from the external system (which has an api) and dynamically populate my tags instead of manually changing them.
... View more
03-09-2016
01:14 PM
Exactly what i needed!
... View more
03-09-2016
12:33 PM
I would like to display the original earliest and latest of a search as fields in my table results. My query below.
index=myindex msg_severity=ERROR | timechart span=15m count by field_TEXT | untable _time field_TEXT count | eval count = if(count=0,1,count) | streamstats window=2 global=f current=t first(count) As p_count by field_TEXT | eval percent_change=((count-p_count)/(p_count))*100
I would like to add something like this to the end of my search to show the earliest and latest of the search on every row
| eval start=$earliest | eval end=$latest
Is this possible?
... View more
03-08-2016
01:22 PM
I want to use a dropdown to change the field that the stats command function uses in calcuation. my token is called my_token.
example:
index=myindex mysearch | stats dc($my_token$) by mylocation
Is this possible?
... View more
02-19-2016
06:05 AM
Worked perfectly! I didn't know about the replace command.
... View more
02-18-2016
11:02 AM
That didn't quite handle it, but I was able to get of rid of the spaces by changing my rex command a bit.
rex "\d*\:\d*:\d*\,\d*\|(?<event>[^\|]*)\|\s(?<subject>[^\|]*)\|\s(?<ip>[^\|]*)\|\s(?<app>[^\|]*)\|\s(?<connectionid>[^\|]*)\|\s(?<protocol>[^\|]*)\|\s(?<host>[^\|]*)\|\s(?<role>[^\|]*)\|\s(?<status>[^\|]*)\|\s(?<adapterid>[^\|]*)\|\s(?<description>[^\|]*)\|\s(?<responsetime>.\d*)"
Now I just need to be able to handle where myfield=""
Any ideas?
... View more
02-18-2016
07:43 AM
I have a data source that is pipe delimited, but some of the fields contain no data or even a blank space. I've created a regex expression that is able to extract all the fields, but is there a way to have the fields with no value or a blank space show up as null so I can handle them with fillnull? Currently the show up as blank such as event="" or with a space like subject=" "
Raw data:
2016-02-18 09:35:09,491|OAuth| USER1| 1.1.1.1 | |USER1| OAuth20| pingfedserver4| AS| success| | | 18
2016-02-18 09:35:09,267|SSO| USER2| 2.2.2.2 | | https://testsite.test.com| SAML20| pingfedserver4| IdP| success| testuser| | 92
My rex statement:
rex "\d*\:\d*:\d*\,\d*\|(?<event>[^\|]*)\|(?<subject>[^\|]*)\|(?<ip>[^\|]*)\|(?<app>[^\|]*)\|(?<connectionid>[^\|]*)\|(?<protocol> [^\|]*)\|(?<host>[^\|]*)\|(?<role>[^\|]*)\|(?<status>[^\|]*)\|(?<adapterid>[^\|]*)\|(?<description>[^\|]*)\|(?<responsetime>[^\|]*)"
... View more
02-12-2016
01:43 PM
wow, hod no idea it was so easy! thanks
... View more
02-12-2016
01:25 PM
I have time series data that I want to bucket into 15 minute chunks with corresponding counts like so....
mysearch | bucket span=15m _time | stats count by groups _time
What I need next is for every value of groups that is null for a particular time bucket to be replaced with a 0
Basically I need the functionality of a timechart but I need to keep the groups field intact instead of each value of groups being split out into it's own field
This is what I would like my output table to look like:
_time | groups | count
10:00 am | group1 | 75
10:00 am | group2 | 0
10:00 am | group3 | 16
10:15 am | group1 | 14
10:15 am | group2 | 15
10:15 am | group3 | 0
10:30 am | group1 | 0
10:30 am | group2 | 105
10:30 am | group3 | 24
10:45 am | group1 | 1
10:45 am | group2 | 0
10:45 am | group3 | 75
... View more
01-27-2016
05:23 AM
This worked with one change in the syntax, Remove the MacAddress from after | append
index=my_index UserName=myuser | table _time UserName MacAddress Message
| append [search index=my_index [search index=my_index UserName=myuser | stats count by MacAddress | table MacAddress ]| table _time UserName MacAddress Message]
... View more
01-26-2016
03:08 PM
From what I understand the join command will join the fields of two events together. What I need to to be able to append the events but the append needs to be based on a common field
... View more
01-26-2016
12:28 PM
I have a use case where a user will input a username and Splunk should return results for that username. But, there are seperate events related that username which do not contain the username field, but instead have the same mac address field. The following command is what I wish would work, but I know the append command doesn't allow you to pass data from the main search.
index=my_index UserName=myuser | table _time UserName MacAddress Message | append MacAddress [search index=my_index | table _time UserName MacAddress Message]
Does anybody know how I can acomplish this?
... View more
12-08-2015
01:00 PM
I need my app to wait until the search has completed before it executes additional code. I'm using the following method to see when my search has completed......but I can't figure out how stop additional code from running until this on method is complete.
myResults = [];
search1.on("search:done", function(properties) {
myResults = search1.data("results", {count: 0});
});
After this, I want to iterate through the myResults.data().rows and run additional code.
Please help!
... View more
11-25-2015
05:53 PM
I tried this and it first it didn't work. I waited some more time though then restarted my webserver and cleared cache on my client and now its working. Thank you!
... View more
11-25-2015
10:17 AM
2 Karma
I'm using the REST API with a one-shot search to pull back some previously summarized information. The summary indexing was done with EST timezone so the events show up as 00:00:00 EST. The server i'm doing the REST API call from is on CST timezone. When I get the results back from the search they show up as the previous day because the timestamp ends up being 1 hour before at 23:00:00 CST - 1Day. This is completely screwing up my search results. Is there a way to force the API call to use EST timezone instead of the system default?
Note:
Changing the timezone on my server is not an option because it's a shared server.
... View more
11-24-2015
08:44 AM
when you use the eval command it will create a new field. In this case it's called mytime. You can use mytime just like you would use Timestamp or date_mday.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:02 AM
|
Karma given to
