Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- Find Answers
- :
- About wmyersas
wmyersas
Builder
Member since:
06-29-2017
05-09-2023
Community Statistics
| Posts | 170 |
| Solutions | 13 |
| Karma Given | 318 |
| Karma Received | 24 |
| Member Since | 06-29-2017 |
Activity Feed
- Got Karma for Re: How to replace the special characters with Space in text field in Dashboard. 03-17-2022 06:52 AM
- Got Karma for Re: subsearch join. 07-15-2021 10:57 PM
- Posted Re: Does Splunk distribute individual member searches of a multisearch to available Slots on any/all available Search He on Splunk Search. 12-02-2020 10:35 AM
- Posted Does Splunk distribute individual member searches of a multisearch to available Slots on any/all available Search Heads? on Splunk Search. 12-01-2020 07:05 AM
- Tagged Does Splunk distribute individual member searches of a multisearch to available Slots on any/all available Search Heads? on Splunk Search. 12-01-2020 07:05 AM
- Tagged Does Splunk distribute individual member searches of a multisearch to available Slots on any/all available Search Heads? on Splunk Search. 12-01-2020 07:05 AM
- Tagged Does Splunk distribute individual member searches of a multisearch to available Slots on any/all available Search Heads? on Splunk Search. 12-01-2020 07:05 AM
- Tagged Does Splunk distribute individual member searches of a multisearch to available Slots on any/all available Search Heads? on Splunk Search. 12-01-2020 07:05 AM
- Tagged Does Splunk distribute individual member searches of a multisearch to available Slots on any/all available Search Heads? on Splunk Search. 12-01-2020 07:05 AM
- Got Karma for Re: multisearch vs append. 11-18-2020 04:23 AM
- Karma Re: Log Parsing is not happening for PaloAlto logs for jbrocks. 06-05-2020 12:51 AM
- Karma Why does the master node, peer nodes, and search head have to be on its own instance? for josegonzalezm. 06-05-2020 12:51 AM
- Karma Re: Why does the master node, peer nodes, and search head have to be on its own instance? for gfreitas. 06-05-2020 12:51 AM
- Karma Re: Why does the master node, peer nodes, and search head have to be on its own instance? for gcusello. 06-05-2020 12:51 AM
- Karma Re: How often should I upgrade Splunk Enterprise? for jmulcaster_splu. 06-05-2020 12:51 AM
- Karma Re: Splunk search basic queries for jpolvino. 06-05-2020 12:51 AM
- Karma Re: How to rename dynamic column name? for gcusello. 06-05-2020 12:51 AM
- Karma Re: need to add 45 days in a field for 493669. 06-05-2020 12:51 AM
- Karma Does Splunk support .GIF files in their dashboard system? for rfahrenbach. 06-05-2020 12:51 AM
- Karma Re: Month to date for previous month with current month date for prakashmca05. 06-05-2020 12:51 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 |
03-13-2020
06:10 AM
What do the inputs.conf entries look like?
What is the system load on your log aggregator?
How big is your Splunk env?
What network components (firewalls, load balancers, etc) are between the collector and Splunk?
... View more
03-12-2020
07:48 AM
Sounds like you may need a lookup so you can report on what's missing.
Let's say you have a csv named important_hosts.csv with a single field named host
Now you can do something like this:
index=ndx sourcetype=srctp (host="host_1" OR host="host_2")
| stats count by host
| append
[ | inputlookup important_hosts.csv ]
| fillnull
| stats max(count) as count by host
| eval status=if(count>0,"up","down")
| fields - count
... View more
03-12-2020
07:44 AM
If host1 isn't sending data, stats isn't going to find it
... View more
03-12-2020
06:48 AM
Use transpose :
search>
| table scn*
| stats values(row1) as SCNs
... View more
03-12-2020
06:36 AM
What do you want to rex out?
It's JSON - and should be coming at least mostly preparsed into Splunk
Are you sure something like the following won't work:
index=schoolindex sourcetype=dev studentInfo.subjects{}=*
| stats values(studentInfo.subjects) by studentInfo.id
... View more
03-10-2020
02:47 PM
1 Karma
It's legal - but seems to be pointless
You're doing a | join , ostensibly to get more fields, and then immediately throw them all away with a | stats count by
... View more
03-09-2020
01:49 PM
1 Karma
Additionally, multisearch searches are run (more-or-less) simultaneously, not sequentially as they are with append
If the search slots are available, multisearch should finish dramatically faster
... View more
03-06-2020
06:00 AM
I'll presume raw_host is a multivalue field
Presuming that is the case, do the following:
index=email sourcetype=email_links
| search
[ search index=sinkholed sourcetype=bad_http
| mvexpand raw_host
| stats count by raw_host
| fields - count
| rename raw_host as <field-in-outer-search> ]
| <rest of search>
That should only show you email_links to domains that were sinkholed
... View more
03-04-2020
07:16 AM
Sure there is: |eval check_cat=if(cat="Command & Control" OR cat="Reconnaissance" OR cat="Lateral Movement" OR cat="Botnet Activity" OR cat="Exfiltration","true",null())
... View more
03-04-2020
07:13 AM
Filter early, filer often
Any time it's possible, use the form index=ndx sourcetype=srctp ...
Using merely index=ndx ... , and NOT including sourcetype=srctp will still allow Splunk to try to look in EVERY sourcetype (even the 291 that aren't in that index)
... View more
03-04-2020
07:10 AM
Per https://splunkbase.splunk.com/app/2935/#/overview, it doesn't officially support anything newer than 7.1
Will it work? Probably
But it's not a guarantee
... View more
03-04-2020
07:08 AM
When you use a lookup, you're finding data in the table based on a field in your search data
Therefore, if you're doing a lookup on field1 , you won't see it added in your output - because it was already there in your event data
... View more
03-03-2020
05:46 AM
Directories have to be executable in order to do anything inside them
It's the nature of *nix permissioning
... View more
03-03-2020
05:44 AM
Why use case() here instead of if() ?
... View more
03-03-2020
05:43 AM
You should probably be trying to deploy the Windows UF, and not the Linux one 🙂
... View more
02-21-2020
10:50 AM
There's no need to dedup host following immediately with stats count by host 🙂
... View more
02-21-2020
10:48 AM
First, you don't need two calls to your lookup - you can do this:
| lookup Friendly_Name.csv Friendly OUTPUT FullHost FullHostHSB
Secondly, what prevents you from doing this:
eventtype=eop_WinEventLog:Application `FriendlyEval`
| <rest of your search>
... View more
02-21-2020
10:45 AM
1 Karma
Knowing that the greater than ( > ) symbol is illegal in Windows filenames, you could modify you regex thusly:
| rex field=Threat_resource_path "(?<fname>[\w\:\.\\\-\s]+)\>?"
Then you merely need to pull the final hyphen ) - ), if there is one:
| eval fname=rtrim(fname,"-")
There's probably an even snazzier way to do this with just a regex - but this works
... View more
02-12-2020
10:31 AM
Use the <done> tag inside your searches:
<search>
<done>
<set token="thispanelstoken">done</set>
</done>
</search>
Relying on $job.resultCount$>0 is not a good practice: what happens when the search returns no values? Your condition would fail, but it would be "done".
What are you trying to do with these "completed" tokens?
... View more
02-11-2020
07:45 AM
Sort of
You could create an Alert
You could schedule a Report
Or you can use the email PDF feature of a dashboard
The last option, if someone clicks on the link in the email, will load the dashboard "now" (though the PDF will be as-of when it was sent)
But Splunk searches are generally intended to be look at "live" (ie relative time window) data, and not "snapshotted" (fixed time window) data (more or less - that's not absolute, there are exceptions, etc)
... View more
02-11-2020
07:34 AM
You're close - you need to change the regex in replace() from "\n\n" to "[\n\r\f]"
Then replace() will change any form of a newline to a blank.
Alternatively, you could do | eval description=replace(replace(description,"[\n\r\f]"," "),"\s{2,}"," ")
Which will replace newlines with a space, and then replace any sequential whitespace with a single space.
... View more
02-11-2020
07:32 AM
Please share the search you have currently, and, if possible some sample data
... View more
01-31-2020
10:44 AM
where is used to compare fields and search is used to compare a field to a value. You can only evaluate one function with the where. You can do multiple with a search
That's not true. You can use multiple conditions in a where clause. You can do | where like(field,"%value%") AND field2<$token$ AND match(field3,"<regex>")...
... View more
01-31-2020
10:42 AM
Now you are =D
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
05-09-2023
10:18 AM
|
Karma from
Karma given to
