Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- About ziegfried
ziegfried
Influencer
Member since:
11-17-2009
01-26-2022
Community Statistics
| Posts | 668 |
| Solutions | 234 |
| Karma Given | 406 |
| Karma Received | 930 |
| Member Since | 11-17-2009 |
Activity Feed
- Got Karma for Re: What's the difference between where and search in the pipeline?. 01-13-2026 11:36 PM
- Got Karma for Re: Database lookup not returning all matches. 04-21-2025 03:30 PM
- Got Karma for Re: stats by date_hour add zero count for hours with no events. 04-09-2024 12:24 PM
- Got Karma for Re: Add reports to dashboards. 12-07-2023 11:17 PM
- Got Karma for Re: stats by date_hour add zero count for hours with no events. 04-18-2023 02:05 AM
- Got Karma for Re: How do you add dummy events to a search result?. 11-06-2022 11:06 PM
- Got Karma for Re: What's the difference between where and search in the pipeline?. 09-19-2022 02:38 PM
- Got Karma for Re: What's the difference between where and search in the pipeline?. 05-12-2022 04:02 PM
- Got Karma for Re: IIS FTP LOG TIMEZONE PROBLEM. 04-28-2022 04:28 AM
- Got Karma for Re: How do I list all active input stanzas in all apps?. 03-27-2022 08:43 PM
- Got Karma for Re: How do you add dummy events to a search result?. 01-11-2022 01:42 PM
- Got Karma for Re: What's the difference between where and search in the pipeline?. 11-11-2021 02:06 AM
- Got Karma for Re: How to format _time field in results email?. 10-19-2021 11:43 AM
- Got Karma for Re: How do I determine my indexing volume by host, source, or sourcetype?. 06-07-2021 08:24 AM
- Got Karma for Re: convert bytes to megabytes in report. 05-19-2021 08:15 PM
- Got Karma for Re: What's the difference between where and search in the pipeline?. 04-30-2021 10:07 AM
- Got Karma for Re: Terminate User Session. 03-16-2021 08:22 AM
- Got Karma for Re: Splunk DB Connect - dbquery inline search and time filtering not working. 03-02-2021 02:20 PM
- Got Karma for Re: how to find the earliest and latest event in an index?. 12-09-2020 09:22 AM
- Got Karma for Re: Multiple Values per Event - transforms.conf regex. 11-24-2020 06:58 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 3 | |||
| 5 |
05-30-2011
06:30 AM
index="test" sourcetype="power_test" | stats max(Power_consumption) as Max first(Power_consumption) as Recent by host
... View more
05-27-2011
02:34 PM
I've updated the answer
... View more
05-27-2011
01:45 PM
seems like you don't have the clientip_city field extracted. When you execute the search in the default search view of Splunk, are you able to see the field in the field picker (on the left side)?
... View more
05-27-2011
01:03 PM
1 Karma
If the field "clientip_city" contains the IP addresses, you can try this search instead:
SRC=* clientip_city=* | geoip clientip_city
Update:
To extract the field, you have to either configure the fields to be extracted (see http://www.splunk.com/base/Documentation/latest/Knowledge/Addfieldsatsearchtime) or extract them inline:
SRC=* | rex "(?<ip>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})" | geoip ip
This will extract the first matching IP in the event.
... View more
05-25-2011
07:41 AM
Ah, I get it 😉 Here you go:
| inputlookup ip_list | fields ip | rename ip as source_IPs | search NOT [ search source="/export/home/azubair/Audit_Report" | dedup source_IPs | fields source_IPs ]
... View more
05-25-2011
06:07 AM
source="/export/home/azubair/Audit_Report" NOT [ | inputlookup ip_list | fields ip | rename ip as source_IPs ] | stats count by source_IPs
... View more
05-25-2011
05:21 AM
What is the name of the column you want to compare it with in the lookup?
... View more
05-24-2011
12:44 PM
1 Karma
The only option I can think of is to write a custom search command which duplicates those events for you based on the count value.
... View more
05-24-2011
11:20 AM
1 Karma
The problem is that this version of the geoip command crashes on some specific IP addresses. This will be fixed in the new version that should be released really soon.
The second problem is that the old version of the geoip command does not explicitly require input fields. The new version will do this automatically and will work when there is no automatic field discovery (like when used in saved searches). As a workaround for now, you can explicitly require the field:
<your search> | fields srcip | geoip srcip
or
<your serach> srcip=* | geoip srcip
... View more
05-24-2011
11:09 AM
3 Karma
<search terms> NOT [ | inputlookup <your lookup> ]
eg.
* NOT [ | inputlookup ip_list ]
To inspect which search string is generated by the subsearch, you can execute
| inputlookup ip_list | format
... View more
05-23-2011
05:10 PM
Ah, I unintentionally wrote the examples with the source field. You just have to append "in host" instead of "in source".
... View more
05-20-2011
02:31 AM
1 Karma
If you want to be able to search for this field you have to either make it an indexed field (better performance)
http://www.splunk.com/base/Documentation/latest/Data/Configureindex-timefieldextraction
props.conf
[xyz]
TRANSFORMS-extract-domain = extract-domain-name
transforms.conf
[extract-domain-name]
SOURCE_KEY = MetaData:Source
REGEX=source::\w+\.([\w\.]+)$
FORMAT = domain_name::$1
WRITE_META = true
fields.conf
[domain_name]
INDEXED = true
or tell Splunk that the event content (_raw) might not contain the field value:
fields.conf
[domain_name]
INDEXED_VALUE = false
If you want to use this field just for reporting, the it should be sufficient to just extract the field:
props.conf
[xyz]
EXTRACT-domain-name = \.(?<domain_name>[\w\.]+) in source
... View more
05-13-2011
05:25 AM
2 Karma
You can use the MV_ADD option in your transforms stanza:
[get-emails]
REGEX = EMAIL:(\S+)
FORMAT = Emails::$1
MV_ADD = true
... View more
04-15-2011
06:03 AM
I would suggest to use a LINE_BREAKER instead of line merging:
[db_audit]
TIME_FORMAT = %a %b %d %H:%M:%S %Y
SHOULD_LINEMERGE = false
LINE_BREAKER=([\r\n]+)\w+ \w+ \d{2} \d{2}:\d{2}:\d{2} \d{4}[\r\n]
And make sure the props.conf settings are on the indexer (when using an LWF).
... View more
04-15-2011
04:58 AM
You could either use the join or transaction command to combine the metadata of 2 searches.
Or use stats to aggregate the information on a unqiue key:
<search maching both events> | stats first(Command) as Command first(Username) as Username by PID
Another, more complicated option is to write a scripted lookup or a command which can execute searches in Splunk. But I don't think this is necessary.
... View more
You could do this in the command-line:
splunk search "sourcetype=syslog" -preview 0 -maxout 0 -output rawdata > out.log
... View more
04-12-2011
05:04 PM
Did you upgrade to 4.2 or was it a fresh install?
... View more
04-12-2011
02:45 PM
Are you sure, you placed the file into the correct directory? It's working for me... Try to modify some other part of the file (eg. a label or something) and see if the change takes effect. An app reload is sufficient to reload the view (ie. navigate to the home app and back to search)
... View more
04-12-2011
09:17 AM
Make a copy of the file $SPLUNK_HOME/etc/apps/search/default/data/ui/views/dashboard_live.xml to $SPLUNK_HOME/etc/apps/search/local/data/ui/views/ and remove all <param name="earliest">rt</param> and <param name="latest">rt</param> occurrences. After reloading your app, the view should show the view without the real-time information.
As an alternative you could copy the dashboard.xml from a 4.1.x package to your installation and modify the navigation to use it as the default view.
... View more
04-12-2011
09:10 AM
3 Karma
As of Splunk 4.2 you can specify a match_type for a lookup in transforms.conf. See http://www.splunk.com/base/Documentation/latest/Admin/Transformsconf
Setting the match_type to CIDR for your IP range field is probably what you are looking for.
transforms.conf:
[mylookup]
filename = isp.csv
match_type = CIDR(network-range)
... View more
04-06-2011
07:18 PM
There will be a new version soon which will leverage the Maxmind GeoCity Light database instead of the one from ipinfodb.com.
... View more
04-06-2011
07:16 PM
1 Karma
The current geoip command does not work with the new format of the ipinfodb database. Since they also changed their terms there will be a new version soon which leverages the GeoCity Light database from Maxmind.
... View more
04-06-2011
07:14 PM
A distinct locations is a unique combination of the latitude and longitude values (ie. the values of the fields _lat and _lng). It's calculated by appending | stats count as _geo_count by _lat,_lng as a postprocess to the search.
The only reason I can imagine that would explain those results is that the geoip commands somehow failed (crashed) on some of those IP values. The next version should fix this though.
Also in the upcomming version of the Google Maps there will be a single field _geo which will contain both latitude and longitude values separated by comma.
... View more
04-06-2011
07:06 PM
3 Karma
With regex="log" you're actually performing a field search on the field regex. You probably want to use the regex command instead.
index=test | regex _raw="log"
... View more
03-02-2011
10:10 AM
Yes, it can be done. But it's note quite straight-forward. You have to either create a custom Module to do it or alter the behaviour of a SimpleResultTable using an application.js in your app.
... View more
