About nabeel652

nabeel652 · ‎12-04-2017

Hi Guys I am having problem calculating application outages. I am polling for application state and data looks like this: _time ---------------------- Application--------------Status 1/12/17 1:20pm-----------App1 --------------------Up 1/12/17 1:20pm -----------App2--------------------Up 1/12/17 1:25pm -----------App1-------------------- Down 1/12/17 1:25pm -----------App2 -------------------- Up 1/12/17 1:30pm -----------App1-------------------- Down 1/12/17 1:30pm-----------App2--------------------Up 1/12/17 1:35pm-----------App1--------------------Up 1/12/17 1:35pm -----------App2--------------------Up 1/12/17 1:40pm -----------App1 --------------------Down 1/12/17 1:40pm-----------App2 --------------------Up 1/12/17 1:45pm-----------App1 --------------------Up ...So on Now the problem is I want to calculate: 1. For what intervals App1 was Up and down 2. For how long overall App1 was Up and down I've tried | stats range(_time) but it doesn't work as I think it calculates the range from earliest and latest times when app was down so calculates the intervals as "Down" when the app was Up in between two Down intervals. I have around 60 apps and two statuses (Up/Down) - Note: The data is not coming in at regular intervals so I cannot do a count and calculate each value as 5mins - It was just to make the example more readable.

nabeel652 · ‎09-27-2017

Yes, thats just for explaining. I was bit lazy not copying the actual values 🙂

nabeel652 · ‎09-27-2017

I have a field in Windows Backup Events named VolumesInfo Sample: <VolumeInfoItem Name="System" OriginalAccessPath="" State="14" HResult="0" DetailedHResult="0" PreviousState="9" IsCritical="1" IsIncremental="0" BlockLevel="1" HasFiles="0" HasSystemState="1" IsCompacted="0" IsPruned="0" IsRecreateVhd="0" FullBackupReason="0" DataTransferred="54001664" NumUnreadableBytes="0" TotalSize="54001664" TotalNoOfFiles="0" Flags="554" BackupTypeDetermined="1" SSBTotalNoOfFiles="0" SSBTotalSizeOnDisk="0" /><VolumeInfoItem Name="C:" OriginalAccessPath="C:" State="14" HResult="0" DetailedHResult="0" PreviousState="9" IsCritical="1" IsIncremental="0" BlockLevel="1" HasFiles="0" HasSystemState="1" IsCompacted="0" IsPruned="0" IsRecreateVhd="0" FullBackupReason="0" DataTransferred="35564748800" NumUnreadableBytes="0" TotalSize="35564748800" TotalNoOfFiles="0" Flags="1576" BackupTypeDetermined="1" SSBTotalNoOfFiles="0" SSBTotalSizeOnDisk="0" /><VolumeInfoItem Name="D:" OriginalAccessPath="D:" State="14" HResult="0" DetailedHResult="0" PreviousState="9" IsCritical="0" IsIncremental="0" BlockLevel="1" HasFiles="0" HasSystemState="0" IsCompacted="0" IsPruned="0" IsRecreateVhd="0" FullBackupReason="0" DataTransferred="3730767872" NumUnreadableBytes="0" TotalSize="3730767872" TotalNoOfFiles="0" Flags="8" BackupTypeDetermined="1" SSBTotalNoOfFiles="0" SSBTotalSizeOnDisk="0" /></VolumeInfo> This contains information about all the volumes backedup on a certain Computer. However I am struggling to extract all the multiple Volumes and related information like in the sample data there are three volumes "System", "C:" and "D:". I have tried field extractions but it only returns the first one. makemv and mvexpand is also not helping. I need results in this format: Compuer VolumeName TotalSize DataTransferred Server1 System 1212 12 Server1 C: 7575 77 Server1 D: 7676 66 Server2 C: 767 7 and So on…

nabeel652 · ‎07-18-2017

Best way to get logs from Avamar is to get data from it's back-end PostgreSQL database using DB-Connect or custom scripts. That's how we are doing it.

nabeel652 · ‎06-07-2017

I am monitoring WinEventLogs for Direct Access Troubleshooting using stanzas like: [WinEventLog://Microsoft-Windows-Base-Filtering-Engine-Connections/Operational] disabled = 0 index = myindex I am successfully getting all events but the information I can see in Windows Event Viewer's Details tab is not received. The information in the logs in Splunk is pretty basic and almost useless. I've uploaded two screenshots. DA_Logs shows what I am getting using the above stanza whereas DA_Logs2 is the what I actually need under "Details" tab from the Event Viewer.

nabeel652 · ‎05-31-2017

No, unfortunately they get the file out of the system the first/second day of the month so the timestamp is current month

nabeel652 · ‎05-31-2017

No, unfortunately they get the file out of the system the first/second day of the month so the timestamp is current month

nabeel652 · ‎05-31-2017

I am getting some csv files in start of each month but actually they are the billing data for the last month. I want to set the timestamp to last month not the month it is being ingested in. Any ideas how this can be done? PS: there is no field in the files that I can set as timestamp neither I want to change the files.

nabeel652 · ‎03-07-2017

I have a lookup table for exclusions. that updates when user clicks on a value and it is added in the lookup table. However, if the user clicks on the row in lookup table it is removed from the lookup. It works fine but the problem is that when the user clicks on last row present in the lookup table the table disappears and I have to populate the lookup table again using: | stats count | eval Ignore="" | eval Publisher="" | eval Product="" | eval Append="" | eval Version="" | fields - count| outputlookup exclusions.csv Question is that can I add some code in my search to avoid this thing to happen. My search is: | inputlookup exclusions | append [| stats count | eval Publisher="Igor Pavlov" | eval Product="7-Zip 16.00 (x64 edition)" | eval Version = "16.00.00.0" | eval Ignore = 1 | eval Append="0"] | sort by Append | dedup Publisher Product Version | where Append="1" | table Publisher Product Version Ignore Append | outputlookup exclusions.csv All evals are drilldown tokens from the previous/same page.

nabeel652 · ‎01-27-2017

The data is stored on the indexers. DBConnect will just run your queries and if successful will forward data to the indexers/indexer group you have set in outputs.conf file. Any data that is indexed is licensed. Any compressed data sent to indexers is decompressed and indexed. The licensing is only applied after data is decompressed and indexed.

nabeel652 · ‎01-26-2017

Try | rex field=uri "(?<uri>.*[^\d])" will extract a uri that doesn't end with digits or ignore the digits if it ends with digits.

nabeel652 · ‎01-26-2017

So if the url ends with digits you want to ignore them but if it ends with Alpha-numeric values you want to leave them as is? Also, is CCSID something that repeats in every url at the same place? If you could send few possible variations of url string it would be easier. Cheers

nabeel652 · ‎01-26-2017

Yes, If you are sure that there will always be a number at the end: ... your search | rex field=uri "(?<uri>.*\/)\d+$" | ... or if you are not sure about the last part after "/": ... your search | rex field=uri "(?<uri>.*\/).*$" | ...

nabeel652 · ‎01-26-2017

I was working with timecharts and this worked for me: | eval _time = _time + (3600 - tonumber(strftime(now(),"%M"))*60) | timechart span=1h avg(SampleValue) as average because we have a limitation with timechart that it only works with _time.

nabeel652 · ‎01-24-2017

I'm trying to get hourly averages and compare the last to the previous one. ...some search | timechart span=60m avg(SampleValue) However, this tends to count hourly events starting 00 minutes of every hour up to 59 mins. So if it is 5:01pm now and I have not received any event for SampleValue yet, It will show zero (or null) for this hour. Whereas I want it to start -60 minutes from now so if it 5:23pm now it should calculate an average on 4:24pm to 5:23pm and so on for last 24 hours. currently it seems to calculate 4:00pm to 5:00pm and 5:00pm to 5:23pm (or 6:00pm theoratically). In short it snaps to an hour whereas I want it to snap to a minute at the most...

nabeel652 · ‎01-22-2017

Are you trying to get scripted inputs in to Splunk using PowerShell Scripts?

nabeel652 · ‎01-18-2017

This can only be attained by using HTML. Consider using jquery and jquery-ui. Convert the dashboard to HTML and add the slider. The information about slider can be found here: http://jqueryui.com/slider/

nabeel652 · ‎01-18-2017

If this is the behaviour you want then consider using batch instead of monitor. [batch://<path>] disabled = false move_policy = sinkhole index = yourindex sourcetype = somesourcetype This will index any file put in that directory and delete it once ingested (so keep that in mind that you may lose the file once indexed). However the move_policy set to sinkhole will reindex the same file if put in that folder with different timestamp instead of following the tail.

nabeel652 · ‎01-18-2017

From your data I can see Your timestamp should be like this TIME_FORMAT = %b %d %Y %I:%M %p %Z Dec 15 2016 8:12 AM MST Maybe this is causing you problems

nabeel652 · ‎01-18-2017

Yes, install it as any normal Universal Forwarder installation except the account name should be the domain account (svc_splunk). It is preferable to install the Universal Forwarder on a Windows machine if your shared directory to monitor is on a Windows Server. Once the Forwarder is successfully installed open the System\Local folder and edit inputs.conf and paste the following stanza. Replace the parameter values with your desired ones. Restart Splunk and it should start indexing the data in the files. [monitor://\\xyzglobal.local\Apps\Agent\Dev\logs\Dev\*] disabled = false recursive = true sourcetype = s_type index = someindex

nabeel652 · ‎01-18-2017

Not sure why it is not giving you desired results. I have tested your queries and they work fine.

nabeel652 · ‎01-18-2017

Well, it is the account your Splunk instance is running as. While installing Splunk forwarder/instance it asks whether you want to install it as a domain account or local account. Here you should give the xyzglobal\svc-splunkab account. Unfortunately, it will not work with this method if you have installed Splunk with local system account. However, you can install a universal forwarder on any domain joined machine with this service account and start monitoring this directory.

nabeel652 · ‎01-17-2017

You can do all sorts of reformatting through the SQL provided in the Inputs in DB Connect. So change all the formats like timestamp, field values based on case statement etc while providing the query in database inputs. Below is my query that I use for getting SCOM ACS logs form the SCOM ACS DB through DB Connect. Note all sorts of data formatting done through convert and case commands: SELECT convert(varchar,dvA.CreationTime,120) + ' +0000' AS CreationTimeUTC, dvA.EventId, dvA.EventMachine AS Server, dvA.TargetUser AS Username, CASE dvA.ClientDomain WHEN 'n/a' THEN PrimaryDomain ELSE dvA.ClientDomain END AS Domain, CASE dvA.String02 WHEN 'n/a' THEN NULL ELSE dvA.String02 END AS SourceMachine, dvA.CollectionTime FROM AdtServer.dvAll5 AS dvA WHERE dvA.EventId IN (4624,4648,4672,4634,4737,4740,4625,4767,4771,4738,644) AND CreationTime > convert(datetime, '2016-10-03 16:00:37.207')

nabeel652 · ‎01-17-2017

assuming in your results "result_field" starts with word message and ends with last word of the message. I have assumed that your result field can start with message ... message= ... message = ... etc Blockquote your search ... | rex field=result_field "message\s*\=*\s*(?<Msg>.*)$" | stats count by Msg Blockquote

nabeel652 · ‎01-17-2017

you can monitor shared folders/Directories same as local ones. The stanza in inputs.conf will be like this: [monitor://\xyzglobal.local\Apps\Agent\Dev\logs\Dev\*] disabled = false recursive = (true|false) sourcetype = s_type index = someindex make sure you have the read access to the file share.

Posts	196
Solutions	16
Karma Given	40
Karma Received	41
Member Since	‎04-15-2015

Online Status	Offline
Date Last Visited	‎04-06-2026 10:11 PM

Regex match in a Splunk lookup

Matching a substring with a lookup field

Cron schedule in Splunk Cloud to run every second ...

Embedding Splunk Cloud dashboard into a SharePoint...

Change both Background and Text Colour in Single V...

Select last week as default in the dropdown

Count values changes only when value in a column c...

Providing relative Path to a js or css files in a ...

What's the difference between nomv and mvcombine?

Sourcetype Override

How can I calculate application outages based on t...

Re: Extracting multiple values from a Field

Extracting multiple values from a Field

Re: Getting syslogs from Avamar

WinEventLogs Cannot get Event Details

Re: Setting timestamp to minus one month of ingest...

Re: Setting timestamp to minus one month of ingest...

Setting timestamp to minus one month of ingestion

Lookup table disappears after deleting all rows

Re: Splunk DB Connect: After establishing a connec...

Re: How to remove numbers from events at search ti...

Re: How to remove numbers from events at search ti...

Re: How to remove numbers from events at search ti...

Re: timechart span=60m snaps to hour whereas I wan...

timechart span=60m snaps to hour whereas I want it...

Re: How can I learn to use PowerShell in Splunk?

Re: How can we have a slider as an input option in...

Re: Reindex Duplicates / Reindex duplicate data

Re: Why does importing CSV files from a server dir...

Re: How can I arrange an input from file share?

Re: Why does the Average Event Count not calculate...

Re: How can I arrange an input from file share?

Re: Can Splunk DB Connect reformat data before ind...

Re: How to generate a search for specific words in...

Re: How can I arrange an input from file share?

Join the Conversation