Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About nabeel652
nabeel652
Builder
Member since:
04-15-2015
03-20-2024
Community Statistics
| Posts | 182 |
| Solutions | 16 |
| Karma Given | 38 |
| Karma Received | 38 |
| Member Since | 04-15-2015 |
Activity Feed
- Posted Re: Providing relative Path to a js or css files in a dashboard on Dashboards & Visualizations. 03-19-2024 11:07 PM
- Posted Providing relative Path to a js or css files in a dashboard on Dashboards & Visualizations. 03-19-2024 10:06 PM
- Got Karma for Re: How to hide or grey out Clone option under Edit on Splunk dashboard?. 08-16-2023 02:04 AM
- Got Karma for Re: How to hide a column in a table if every value in that column is null?. 04-11-2022 02:28 PM
- Got Karma for Re: How to monitor Microsoft CA logs on Server 2008 R2?. 10-05-2021 11:31 AM
- Posted What's the difference between nomv and mvcombine? on Splunk Search. 12-27-2020 05:34 PM
- Got Karma for Re: How to hide a column in a table if every value in that column is null?. 12-07-2020 05:45 PM
- Got Karma for Re: How to hide or grey out Clone option under Edit on Splunk dashboard?. 08-01-2020 12:46 AM
- Posted Re: Source Override on Getting Data In. 07-06-2020 07:54 PM
- Posted Re: Source Override on Getting Data In. 07-06-2020 04:19 AM
- Posted Re: Source Override on Getting Data In. 07-06-2020 03:37 AM
- Posted Re: Source Override on Getting Data In. 07-06-2020 03:26 AM
- Posted Re: Source Override on Getting Data In. 07-06-2020 12:47 AM
- Posted Re: Source Override on Getting Data In. 07-05-2020 11:46 PM
- Posted Re: Source Override on Getting Data In. 07-05-2020 11:26 PM
- Posted Re: Source Override on Getting Data In. 07-05-2020 11:21 PM
- Posted Re: Source Override on Getting Data In. 07-05-2020 11:18 PM
- Posted Re: Source Override on Getting Data In. 07-05-2020 11:15 PM
- Posted Sourcetype Override on Getting Data In. 07-05-2020 11:04 PM
- Karma Re: How can I fix Symantec Endpoint Protection (SEP) field extractions (again)? for gf13579. 06-05-2020 12:50 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 0 |
07-25-2019
04:48 PM
For JSON type logs it is better to tell the source that is collecting logs that field extractions are of type JSON. On the source machine (or wherever you are ingesting logs from under props.conf add this stanza:
[your:sourcetype]
TRUNCATE = 0
NO_BINARY_CHECK = true
SHOULD_LINEMERGE = false
KV_MODE = JSON
Splunk will automatically extract all the fields for you and show you nicely highlighted in the _raw as well.
... View more
07-23-2019
04:04 PM
From what I have understood, this example may help you with some modifications:
index=_internal sourcetype=splunkd_access | streamstats count | table _raw count | eval selected_event = 5 | where count>=selected_event | head 2
... View more
07-23-2019
03:58 PM
What do you mean by select? How are you selecting the event?
... View more
07-22-2019
04:54 PM
I think you need to add session_id in your query otherwise it will not differentiate between different sessions/users.
... View more
07-22-2019
04:19 PM
1 Karma
I'm afraid I couldn't understand properly what your exact requirement is 🙂
However, this gives your desired output with a slight change
| makeresults | fields - _time | eval data="2019-06-01 1349511.54 105472800|2019-06-08 1498691.33 105472800|2019-06-15 1447368.29 105472800|2019-06-22 1379824.64 105472800" | makemv delim="|" data | mvexpand data | rex field=data "^(?<_time>[^\s]*)\s(?<minutes>[^\s]*)\s(?<bizMinutes>[^\s]*)$" | table _time, minutes, bizMinutes | eval result=round(100*minutes/bizMinutes,3)
... View more
07-22-2019
04:08 PM
1 Karma
BTW the location of the file would be:
[SPLUNK_HOME]/etc/apps/splunk_TA_stream/local/inputs.conf
... View more
07-22-2019
04:07 PM
1 Karma
On all of your UF's (either manually or through config manager/deployment server) change the splunk_stream_app_location to new heavy forwarder. It should look like this:
[streamfwd://streamfwd]
splunk_stream_app_location = http://hf03:8000/en-US/custom/splunk_app_stream/
stream_forwarder_id = <Your fwdr id>
disabled = false
... View more
07-16-2019
04:25 PM
2 Karma
This search will give you a cumulative sum over time time. This search can help you changing the fields according to your's.
index=_internal sourcetype!=splunkd earliest="-15m" latest=now | timechart span=1m count by sourcetype | untable _time sourcetype count | streamstats sum(count) as count by sourcetype | xyseries _time sourcetype count
... View more
07-15-2019
11:12 PM
Awesome, that worked. Can you please explain this?
| rename column as query
... View more
07-15-2019
09:47 PM
Nope, this will group everything up in one cell which is not the desired outcome 🙂
... View more
07-15-2019
08:51 PM
Wondering if we can do something like this:
... | table * | sort by <1>
Where <1> refers to the first field in the table as the field names are dynamic and subject to change.
... View more
07-10-2019
05:43 PM
Not sure about an API but you could do a powershell script like this:
$computers = "Computer1", "Computer2", "Computer3", "Computer4"
foreach ($computer in $computers){
try {
$result = Get-Service -ComputerName $computer | where {$_.Name -like "SplunkForwarder"}
}
catch {
Write-Host "Some problem occured accessing" $computer -ForegroundColor Red
}
if ($result -ne $null) {
Write-Host $computer "Has Splunk Forwarder Installed" -ForegroundColor Green
}
$result = $null
}
... View more
07-10-2019
04:31 PM
Under
<form>
<init>
<set token="my_var_threshold">1000</set>
</init>
.... Your other xml code
</form>
Define the token and then use it anywhere in your searches just like a variable.
... View more
07-10-2019
04:26 PM
Put your conditions under <done> </done> instead of <progress></progress> and it will work.
However @Vijeta is right. your token will cause both panels to disappear as you're using same token name.
<dashboard>
<label>Hide dashboard test</label>
<row>
<panel depends="$panel_show$">
<title>This panel has results</title>
<table>
<search>
<query>| makeresults
| eval a=1
| table a </query>
<earliest>0</earliest>
<latest></latest>
<done>
<condition match="'job.resultCount' > 0">
<set token="panel_show">true</set>
<unset token="panel_hide"></unset>
</condition>
<condition>
<set token="panel_hide">true</set>
<unset token="panel_show"></unset>
</condition>
</done>
</search>
<option name="drilldown">none</option>
</table>
</panel>
<panel depends="$panel_show$">
<title>This panel has "No results found"</title>
<table>
<search>
<query>| makeresults
| eval a=a+1
| table a</query>
<earliest>0</earliest>
<latest></latest>
<done>
<condition match="'job.resultCount' > 0">
<set token="panel_show">true</set>
<unset token="panel_hide"></unset>
</condition>
<condition>
<set token="panel_hide">true</set>
<unset token="panel_show"></unset>
</condition>
</done>
</search>
<option name="drilldown">none</option>
</table>
</panel>
</row>
</dashboard>
... View more
07-10-2019
04:05 PM
Not being able to send splunkd logs is strange.
Have you tried the command
./splunk list forward-server (on linux)
splunk list forward-server (on Windows) under $SPLUNK_HOME/bin directory
... View more
07-09-2019
06:15 PM
1 Karma
I don't know much about your requirements but this might be helpful with some modifications
| makeresults | eval data = "hello my name is mark and I am happy---hello my name is mark and I am sad" | makemv delim="---" data | eval field1= mvindex(data,0), field2=mvindex(data,1) | makemv delim=" " field1 | makemv delim=" " field2 | eval field = mvzip(field1,field2) | table field | mvexpand field | makemv delim="," field | eval field1= mvindex(field,0), field2=mvindex(field,1) | eval diff = if(field1==field2,"",field1."/".field2)
... View more
07-09-2019
05:23 PM
can you check the level of permission on "script.sh". does it have execute permissions?
... View more
07-08-2019
08:10 PM
1 Karma
Assuming all your fields are of fixed length across all events, this regex whould work in the field extractions
^(?<CentreCode>\w)(?<Mode>\w)(?<ID>\d{10})(?<Application>\w{3})(?<SourceCode>\w{2})(?<Version>\w{11})(?<Department>.{2})(?<Day>\d{2})(?<Month>\d{2})(?<Year>\d{4})(?<Sequence>.{2})\s+(?<UID>.*)$
... View more
07-08-2019
06:43 PM
are the fields like ID and SourceCode or Version of same length in each event?
... View more
06-09-2019
11:59 PM
try wrapping your token in tonumber function like
| eval health = tonumber($tok_health|s$)
... View more
05-30-2019
08:54 PM
You can do this by powershell scripts and schedule them on one of your universal forwarders. For that purpose you will require to install SPClient_x64.msi on a windows system. Can share details if you need.
... View more
05-30-2019
07:54 PM
Check your inputs. You may be running some inputs (especially Windows Events) that may be consuming high CPU. Disable that and see if it gets any better
... View more
05-30-2019
07:49 PM
<your search> | top 10 application by sourceIP
... View more
05-30-2019
04:52 PM
2 Karma
The best option will be running scripts and just looking for the changed bits and sending to Splunk though HEC (or writing to file and monitoring). then dedup on the "unique key" in your data will give you all unchanged old records + changed new records. However, there is no out of the box solution for this other than dbconnect
... View more
