Im using this search for monitoring security events: source="WinEventLog:Security" EventCode=4624 OR EventCode=4634 Account_Name=* action=success | eval User=if(mvcount(Account_Name)>1, mvindex(Account_Name,1), mvindex(Account_Name, 0)) |eval User=lower(User)| search NOT User=*$ | transaction User maxevents=2 startswith="EventCode=4624" endswith="EventCode=4634" maxspan=-1 |stats sum(duration) As Duration by User, ComputerName |eval Duration(M)=round((Duration/60), 0) |table User,Duration(M),ComputerName I want the output to be: date, user, Duration, ComputerName day1 user1 10 comp1.com day2 user1 17 comp1.com day3 user1 5 comp1.com day1 user2 17 comp2.com day2 user2 11 comp2.com day3 user2 13 comp2.com ... Any ideas? Thanks! ... View more

Is there a way to rename EventCodes xxxx field to "description" in timechart? Here is a sample search: Account_Name=* (EventCode=4800 OR EventCode=4801 OR EventCode=4768) index=blah sourcetype="WinEventLog:Security" source="WinEventLog:Security" | timechart count by EventCode Thanks! ... View more

Below is the format and I want to import. The data is showing \xA0 where there should be a £ . Please can you send through some recommended settings for props.conf? Date:\xA001/12/2015 Description:\xA0CARD PAYMENT TO BEECHCROFT,21.40 GBP, RATE 1.00/GBP ON 28-11-2015 Amount:\xA0-21.40\xA0 Balance:\xA0801.96\xA0 Date:\xA001/12/2015 Description:\xA0CARD PAYMENT TO YESSS ELECTRICAL,240.36 GBP, RATE 1.00/GBP ON 28-11-2015 Amount:\xA0-240.36\xA0 Balance:\xA0823.36\xA0 ... View more

We have a way of calculating the percentage of time the status is in the “OK” state by using transaction to find the intervals of time it was “OK” compared to when it was in “WARNING” state. (As the logs we found for the device we were searching for only had “OK” or “WARNING” events). This is what we have, but I'm wondering if it could be improved or if stats could be used instead? index=icinga_logs sourcetype=icinga hu1secsoudc1 "*status_interface*" | rex "(?i)^(?:[^;]*;){2}(?P<status>[^;]+)" | transaction startswith=(status="OK") endswith=(status="WARNING") | stats sum(duration) AS TotalGood | append [search index=icinga_logs sourcetype=icinga hu1secsoudc1 "*status_interface*" | rex "(?i)^(?:[^;]*;){2}(?P<status>[^;]+)" | transaction startswith=(status="WARNING") endswith=(status="OK") | stats sum(duration) AS TotalBad] | append [search index=icinga_logs sourcetype=icinga hu1secsoudc1 "*status_interface*" | rex "(?i)^(?:[^;]*;){2}(?P<status>[^;]+)" | head 1 | eval TotalGood = if(status=="OK" OR status=="STOPPED", now()-_time, 0) | eval TotalBad = if(status="WARNING", now()-_time, 0)] | stats sum(TotalGood) AS TotalGood sum(TotalBad) AS TotalBad | eval Total = (TotalGood+TotalBad) | eval Percentage = (TotalGood/Total)*100 | table Percentage ... View more

Using Splunk Enterpise 6.2, I'm trying to get the fields extracted using search-time props.conf / transforms.conf and the issue is a variable value in the last field. Can anyone tell me what the settings would be ensure these values are taken care of? The message that logs are delimited by semicolon, but unfortunately, the different messages have different amount of fields and almost constant in size 40 characters except the last field that is variable, but also not more than 300 characters. Is there a way to take care of this situation, at search-time? Log sample: [1445004534] SERVICE ALERT: madmsc03j1;Status_Host_ID-0104;OK;HARD;2;PING OK - Packet loss = 0%, RTA = 47.89 ms [1445004568] SERVICE ALERT: de2secimpmx001;Resource_System_Load_ID-0108;OK;HARD;1;4 CPU, average load 70.8% < 75% : OK [1445004576] SERVICE ALERT: pt1secimpmx001;Resource_System_Load_ID-0108;CRITICAL;HARD;1;2 CPU, average load 91.0% > 90% : CRITICAL [1445004576] SERVICE FLAPPING ALERT: pt1secimpmx001;Resource_System_Load_ID-0108;STARTED; Service appears to have started flapping (12.4% change >= 10.0% threshold) [1445004586] SERVICE ALERT: it1sec02mibi-002;Resource_Memory_ID-0011;OK;SOFT;2;OK - Physical memory: 98.0% used (7.5GiB/7.7GiB) [1445004592] SERVICE ALERT: it1sec02mibi-002;Status_Interfaces_ID-0017;OK;SOFT;2;OK - No valid historical dataset... <a href="https://mydomain.com/interfacetable_v3t/tables/it1sec02mibiQ2D002--Interfacetable.html" target="_self">[details]</a> [1445004634] SERVICE FLAPPING ALERT: it1sec04mibi-001;Resource_System_Load_ID-0109;STOPPED; Service appears to have stopped flapping (0.0% change < 1.0% threshold) [1445004673] SERVICE ALERT: nl2secsou3d001;Status_Process_SS_Min2_ID-0101;UNKNOWN;SOFT;1;ERROR: Alarm signal (Nagios time-out) Currently I have props.conf: TIME_FORMAT=%s TIME_PREFIX=\[ TZ=GMT MAX_TIMESTAMP_LOOKAHEAD=10 SHOULD_LINEMERGE=true NO_BINARY_CHECK=true LINE_BREAKER=([\r\n]+) TRUNCATE=10000 Cheers! ... View more

I'm using a gauge in a dashboard which is showing space used by total size on disk: | dbinspect index=* OR index=_* | where splunk_server like("splunkindexername%") | eval SizeOnDiskGB=sizeOnDiskMB/1024 | eval RawSizeGB=rawSize/1024/1024/1024 | stats sum(SizeOnDiskGB) AS TotalSizeOnDiskGB | eval TotalSizeOnDiskGB=round(TotalSizeOnDiskGB, 0) | gauge TotalSizeOnDiskGB 0 42000 51000 60000 I want to show percentage of space used instead.. Any ideas? Thanks ... View more

Having issue importing csv, the Data format looks like this in CSV: ,Transactions,,,,,,,, ,XXXX XXXX XXXX 7282: ,,30/10/2014 to 30/04/2015,,,,,, ,,,,,,,,, ,Date,,Description,,Money in,Money Out,Balance,, ,,,,,,,,, ,30/04/2015,,"CARD PAYMENT TO SPOTIFY SPOTIFY PREMIU,9.99 GBP, RATE 1.00/GBP ON 28-04-2015",,,_9.99,"_1,579.75",, ,29/04/2015,,"CARD PAYMENT TO THE SOUTHERN CO-OP,4.95 GBP, RATE 1.00/GBP ON 27-04-2015",,,_4.95,"_1,589.74",, ,28/04/2015,,"CARD PAYMENT TO HOMEBASE LTD 107,34.99 GBP, RATE 1.00/GBP ON 25-04-2015",,,_34.99,"_1,594.69",, Im using TIME_FORMAT = %d/%m/%y and im seeing error: could not use the strptime to parse the time stamp from ",," Thanks! ... View more

How can i search on this Key Value pair to display PricingInfo / PriceCount An example log entry may look like the below. 1001=25, 1011=10 Made up of these values: PricingInfo PricingCount 0000 Contains an int from 0-99 0001 Contains an int from 0-99 0010 Contains an int from 0-99 0011 Contains an int from 0-99 0100 Contains an int from 0-99 0101 Contains an int from 0-99 0110 Contains an int from 0-99 0111 Contains an int from 0-99 1000 Contains an int from 0-99 1001 Contains an int from 0-99 1010 Contains an int from 0-99 1011 Contains an int from 0-99 1100 Contains an int from 0-99 1101 Contains an int from 0-99 1110 Contains an int from 0-99 1111 Contains an int from 0-99 ... View more