Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- Find Answers
- :
- About khanlarloo
khanlarloo
Explorer
Member since:
06-02-2017
05-18-2022
Community Statistics
| Posts | 119 |
| Solutions | 1 |
| Karma Given | 3 |
| Karma Received | 0 |
| Member Since | 06-02-2017 |
Activity Feed
- Posted Re: Route and filter data on Getting Data In. 05-17-2022 10:00 PM
- Posted Re: Route and filter data on Getting Data In. 04-11-2022 12:58 AM
- Posted Re: Route and filter data on Getting Data In. 04-11-2022 12:37 AM
- Posted Re: Route and filter data on Getting Data In. 04-10-2022 10:30 PM
- Posted Re: Route and filter data on Getting Data In. 04-03-2022 03:28 AM
- Posted Is it possible to filter specific field values in indexers without HeavyForwarder in indexer cluster ? on Getting Data In. 04-03-2022 01:17 AM
- Posted Re: two search result at the same time on Splunk Search. 01-31-2022 03:15 AM
- Posted Re: two search result at the same time on Splunk Search. 01-31-2022 03:09 AM
- Posted two search result at the same time on Splunk Search. 01-31-2022 02:48 AM
- Posted hidden user in users on Security. 09-26-2021 02:18 AM
- Posted Re: data model field extraction on Splunk Enterprise. 07-31-2021 05:33 AM
- Posted data model field extraction on Splunk Enterprise. 07-20-2021 01:49 AM
- Karma Re: How can I index Netflow logs? for nickhills. 06-05-2020 12:49 AM
- Karma Re: add icon to app for niketn. 06-05-2020 12:49 AM
- Karma Re: Can we use regex for counting fields? for 493669. 06-05-2020 12:49 AM
- Posted Re: extract json files fields on Splunk Search. 05-26-2020 11:54 PM
- Posted Re: extract json files fields on Splunk Search. 05-19-2020 08:10 PM
- Posted Re: extract json files fields on Splunk Search. 05-19-2020 08:06 PM
- Posted Re: extract json files fields on Splunk Search. 05-19-2020 03:38 AM
- Posted Re: Different sourcetype with one hostname on Getting Data In. 05-19-2020 01:04 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
05-15-2019
08:10 AM
i want to show active directory created user and show deleted users.
what is the query for searching in ldapsearch ?
install windows infrastructure app,but when i create user in ad the app doesn't show the created user in users -- >new user
and also when i delete user account it doesn't show my deleted user.
... View more
05-05-2019
10:05 PM
Thank You so mush,i was really confused.you help me very much.
... View more
05-05-2019
04:17 AM
main Dashboard
<title>Success Login ON Devices</title>
<chart>
<search>
<query>(index="fortigate" OR index="fortiweb" subtype=system status=success) |stats count by index </query>
<earliest>$time.earliest$</earliest>
<latest>$time.latest$</latest>
</search>
<condition field="fortigate">
<set token="tok_ear">$earliest$</set>
<set token="tok_lat">$latest$</set>
<link target="_blank" >
<![CDATA[/app/search/Success_login_on_fortigate?form._earliest=$earliest$&form._latest=$latest$]]>
</link>
</condition>
... View more
05-05-2019
04:09 AM
i reed this and i do it but didn't work, i don't know where is my mistake
... View more
05-05-2019
03:13 AM
thanks.it works. now i have another question:
i have time token in my main dashboard,when i choos specific time range when i click on chart value it goes to other dashboard with other time range,i want to show the result base on my time range on main dashboard how can i do that?
... View more
05-04-2019
11:49 PM
can you help?
... View more
05-04-2019
11:49 PM
i read this but i didn't understand.
my xml code is :
<panel>
<title>Failed Login ON Devices</title>
<chart>
<search>
<query>(index="fortigate" OR index="fortiweb" subtype=system status=failed) OR (index="cisco" mnemonic=LOGIN_FAILED)|stats count by index |rename index as Host | transpose header_field="Host" column_name="Host"| reverse</query>
<earliest>$time.earliest$</earliest>
<latest>$time.latest$</latest>
</search>
<option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
<option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
<option name="charting.axisTitleX.text">Host</option>
<option name="charting.axisTitleX.visibility">visible</option>
<option name="charting.axisTitleY.text">Count</option>
<option name="charting.axisTitleY.visibility">visible</option>
<option name="charting.axisTitleY2.visibility">visible</option>
<option name="charting.axisX.scale">linear</option>
<option name="charting.axisY.scale">linear</option>
<option name="charting.axisY2.enabled">0</option>
<option name="charting.axisY2.scale">inherit</option>
<option name="charting.chart">bar</option>
<option name="charting.chart.bubbleMaximumSize">50</option>
<option name="charting.chart.bubbleMinimumSize">10</option>
<option name="charting.chart.bubbleSizeBy">area</option>
<option name="charting.chart.nullValueMode">gaps</option>
<option name="charting.chart.showDataLabels">all</option>
<option name="charting.chart.sliceCollapsingThreshold">0.01</option>
<option name="charting.chart.stackMode">default</option>
<option name="charting.chart.style">shiny</option>
<option name="charting.drilldown">all</option>
<drilldown>
<condition field="Host">
<link>$click.value2$</link>
</condition>
</drilldown>
<option name="charting.layout.splitSeries">0</option>
<option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
<option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
<option name="charting.legend.placement">top</option>
<option name="charting.fieldColors">{"fortigate": 0x68d112, "fortiweb":0x42db2b, "cisco":0x12c7db}</option>
</chart>
</panel>
... View more
05-04-2019
10:47 PM
Hi
if i want to say if index=a then go to specific page how can i say ?
my query is :
index= a or index=b | stats count by index
i using bar chart
when it shows b and then i click on b go to my savedsearch and the same for a.
... View more
- Tags:
- splunk-enterprise
05-04-2019
02:49 AM
if i want to say if index=a then go to specific page how can i say ?
my query is :
index= a or index=b | stats count by index
i using chart
... View more
04-28-2019
02:21 AM
i want to send alert between 7am to 7 pm from saturday until wednesday and 7am to 14pm on thursday how can i do that?
... View more
- Tags:
- splunk-enterprise
04-26-2019
11:55 PM
THank You . It works
... View more
04-24-2019
02:29 AM
Hi
I have several fields with different values in my dashboard. When I click on any of the values, I want to go to the page corresponding to that amount .
How can I do that?
A
1
2
3
When I click on 3 go to page that shows the result for 3. and when click on 2 go to page that show result for 2 ...
each of them have different page on my app.
... View more
02-15-2019
11:54 PM
it doesn't show the correct bandwidth
... View more
02-13-2019
02:17 AM
i want to show the how much user send and receive from the internet to my ftp server,is my search command right?
index="fw" policyid=143 |eval send=round((bytes_out)/131072,2) |eval receive=round((bytes_in)/131072,2) |search send > 0 |timechart span=1m count by send receive
it shows the count of the send but i don't want to show send based on count
... View more
- Tags:
- splunk-enterprise
01-21-2019
05:04 AM
i have one server that is for antivirus, in installed uf and windows add-on on it that send logs to hf,
i have one problem, it doesn't show server security event on my indexer,but it shows other server security events.
my input.conf on UF is:
[default]
host = NPESET
index= eset
sourcetype = eset:ra
and in windows add-on inputs.conf
[WinEventLog://Security]
disabled = 0
start_from = oldest
current_only = 0
index = wineventlog
renderXml=false
why i don't recieve any security event log ?
... View more
12-31-2018
01:08 AM
i want to know the bandwidth usage per user in my firewall logs. Can you tell me how to search my firewall logs:
devname="fg" type="traffic" subtype="forward" level="notice" srcname="NP" dstport=161 dstintfrole="lan" proto=17 action="accept" user="user X" authserver="FSSO" policytype="policy" service="SNMP" dstcountry="Reserved" " duration=960 sentbyte=78270 rcvdbyte=120261 sentpkt=622 rcvdpkt=621 appcat="unscanned" sentdelta=6755 rcvddelta=10247osname="Windows 8.1 / 2012 "
... View more
09-28-2018
11:43 PM
no my problem didn't solved
... View more
09-28-2018
11:36 PM
i want to extract the field with the name of http_agent from my logs
the raw field is :
"http_host=""nts.mapnanyp.com""","http_agent=""Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:62.0) Gecko/20100101 Firefox/62.0""",http_retcode=200,"msg=""HTTP get request from,content_switch_name="none",server_pool_name="NTS","user_name=""Unknown""","http_refer=""https://mysite/dashboard/new/datalist.aspx?
i want just show the result before http_retcode, the result should be
(http_agent=""Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:62.0) Gecko/20100101 Firefox/62.0)
can you tell me how can i do that?
... View more
- Tags:
- splunk-enterprise
09-10-2018
01:02 AM
just install TA-SQLServer, SA-PowerShell and Windows TA-s ? nothing else?
... View more
09-10-2018
12:58 AM
my splunk version is 6.4, should i do just these steps?
... View more
