About anmolpatel

anmolpatel · ‎03-09-2020

This what you need: | makeresults | eval _raw = "_time, Last_Received, Minutes_Ago, Panel, Status 03/09/2020 18:30:00 +0000, 2020-03-09 18:10:20 GMT, 20, Panel-1, normal 03/09/2020 18:30:00 +0000, 2020-03-09 18:10:20 GMT, 20, Panel-2, degraded 03/09/2020 18:30:00 +0000, 2020-03-09 18:10:20 GMT, 20, Panel-3, normal 03/09/2020 18:30:00 +0000, 2020-03-09 18:10:20 GMT, 20, Panel-4, degraded 03/09/2020 18:30:00 +0000, 2020-03-09 18:10:20 GMT, 20, Panel-5, normal 03/09/2020 18:30:00 +0000, 2020-03-09 18:10:20 GMT, 20, Panel-6, normal 03/09/2020 18:30:00 +0000, 2020-03-09 18:10:20 GMT, 20, Panel-7, normal 03/09/2020 18:30:00 +0000, 2020-03-09 18:10:20 GMT, 20, Panel-8, normal 03/09/2020 18:30:00 +0000, 2020-03-09 18:10:20 GMT, 20, Panel-9, normal 03/09/2020 18:30:00 +0000, 2020-03-09 18:10:20 GMT, 20, Panel-10, normal 03/09/2020 18:30:00 +0000, 2020-03-09 18:10:20 GMT, 20, Panel-11, normal 03/09/2020 18:25:00 +0000, 2020-03-09 18:10:20 GMT, 20, Panel-1, normal 03/09/2020 18:25:00 +0000, 2020-03-09 18:10:20 GMT, 20, Panel-2, normal 03/09/2020 18:25:00 +0000, 2020-03-09 18:10:20 GMT, 20, Panel-3, normal 03/09/2020 18:25:00 +0000, 2020-03-09 18:10:20 GMT, 20, Panel-4, degraded 03/09/2020 18:25:00 +0000, 2020-03-09 18:10:20 GMT, 20, Panel-5, normal 03/09/2020 18:25:00 +0000, 2020-03-09 18:10:20 GMT, 20, Panel-6, degraded 03/09/2020 18:25:00 +0000, 2020-03-09 18:10:20 GMT, 20, Panel-7, normal 03/09/2020 18:25:00 +0000, 2020-03-09 18:10:20 GMT, 20, Panel-8, normal 03/09/2020 18:25:00 +0000, 2020-03-09 18:10:20 GMT, 20, Panel-9, degraded 03/09/2020 18:25:00 +0000, 2020-03-09 18:10:20 GMT, 20, Panel-10, normal 03/09/2020 18:25:00 +0000, 2020-03-09 18:10:20 GMT, 20, Panel-11, normal" | multikv forceheader=1 | table _time, Last_Received, Minutes_Ago, Panel, Status | streamstats count by Panel | where count <= 2 `comment("The above streamstats and where command is so that include only the last two results")` | stats list(Status) as status by Panel | eval state = case(match(mvindex(status,0), "normal") AND match(mvindex(status,1), "normal"), "System status has not changed", match(mvindex(status, 0), "normal"), "System has returned to normal", match(mvindex(status, 0), "degraded"), "System is degraded") Use the list(Status) to get them in the order they arrived

anmolpatel · ‎03-09-2020

Q: Do I need to worry about "ulimits" or the similar setting in the Windows environment? For Splunk core and Forwarders? Q: Do I need to modify the ulimits like feature in all of the windows components and forwarders or just the indexers? A: Ulimits is for Linux based system only. On windows system, you would want to to disable scanning of Splunk directory from the AV system if that is installed Q: I'm assuming I will be able to push the limits.conf down to the forwarders if I need to set those limits? A: limits.conf is to set the bandwidth for search commands and the thruput from Universal Forwarder. Q: I've modified the phone_home to 5 minutes. Should I expect a huge bandwidth spike in phase 1 or phase 2 A: Splunk will be able to handle the load for phase 1 and 2. The maximum I've taken it to is approx 5000 endpoints and upto 15 mins of interval. I know the recommended max is 15 mins for phone home interval. At that point, I added a new DS. Q: Any other configurations I should review to make this deployment smoother and/or not crash the gibson? A: - look at outputs.conf from the UF's and check that you've it well load balanced using both time and frequency based setting. - deploy to a much smaller set of endpoints first and ensure the right eventid's are coming through and you've blacklisted any that are not needed - the data is being parsed correctly and you've the windows TA installed across the tiers as per the installed requirements - Configure a base app, so that the right set of deployment config can be send to each of the UF's - Check this document, this way you can pack the base app, beforehand so when splunk UF is turned on the first time, it contacts the DS https://docs.splunk.com/Documentation/Forwarder/8.0.2/Forwarder/InstallaWindowsuniversalforwarderfromaZIPfile This modular approach to deploying apps will also assist with adding other config later on, such as ssl. You just create a new app with ssl config and push that out - Create the right server classes - Ensure you've the necessary inputs.conf configured in the local directory of the TA and not in default directory - Distributed search configured

anmolpatel · ‎03-09-2020

I did some search and saw these potential alternatives. Unsure if they are what you're looking for https://answers.splunk.com/answers/590067/how-do-i-map-my-personally-tz-adjusted-time-to-ano.html#answer-590068 https://answers.splunk.com/answers/4279/timezone-and-timestamp-modification-at-search-report-time.html I'm not across any other alternative. Please share if you find the solution

anmolpatel · ‎03-09-2020

@thomasvanhelden please look at @woodcock's response below

anmolpatel · ‎03-09-2020

@damucka I've inserted the code using the sample code option, it should work now. I've this timeline viz installed: event-timeline-viz 1.4.0

anmolpatel · ‎03-09-2020

Look at this answer, the author does just that https://answers.splunk.com/answers/764023/help-with-custom-search-command-wait-needed-1.html

anmolpatel · ‎03-09-2020

Unsure if there is a max limit to the dropdown. There is one way to test this out. 1) Write the current list of unique values to a lookup table index=test | stats count by Unique_values | outputlookup Unique_values.csv 2) now create the dropdown | inputlookup Unique_values.csv | fields Unique_values This overcomes any issues that could be happening due to slow search output or any other performance hit. If it populates all values, job done, otherwise there might be a newly discovered feature (limit on dropdown values).

anmolpatel · ‎03-09-2020

Without know the details about which Uber agent version is installed, if it is standalone or on a UF, best i can do is point to this article: https://uberagent.com/docs/uberagent/latest/about-uberagent/system-requirements/ Also if it is installed along with UF, review this: https://docs.splunk.com/Documentation/Forwarder/8.0.2/Forwarder/Compatibilitybetweenforwardersandindexers

anmolpatel · ‎03-09-2020

Have you reviewed this: https://docs.splunk.com/Documentation/Splunk/8.0.2/Data/MonitorWMIdata

anmolpatel · ‎03-09-2020

Don't really understand the question. Can you please elaborate or provide an example?

anmolpatel · ‎03-09-2020

I'm based in AEST time zone so the time difference between AEST and EST is 14 hours. Any event that happens at midnight EST occurs at 1400 hours AEST. So say its 1800 in AEST and I want to search for logs from midnight EST for last 24 hours, then in my search I would set the time modifier as follows: latest = -4h@h ### this would reset it to 1400 hours AEST, which is midnight EST earliest = -28h@h ### taking into the account the 4 hour shift from latest if you had to go for last 7 days, then the time parameters would be: latest = -4h@h earliest = -7d@-4h Note: for this to work, make sure you've set your timezone to your local time.

anmolpatel · ‎03-08-2020

Did you enable to configuration ? Read through the "Enable the data and scripted inputs with configuration files" section in the below link. https://docs.splunk.com/Documentation/AddOns/released/UnixLinux/Enabledataandscriptedinputs Note on the install, you also need it on the Search Head and Indexers. You may need to raise a Splunk Support ticket for this https://docs.splunk.com/Documentation/AddOns/released/UnixLinux/Install

anmolpatel · ‎03-08-2020

@damucka Sample Query: | makeresults | eval raw = "Channel1%Show1%6:00:00 PM%7:00:00 PM;Channel1%Show2%7:00:00 PM%8:00:00 PM;Channel1%Show3%8:00:00 PM%9:00:00 PM;Channel2%ShowA%5:00:00 PM%6:00:00 PM;Channel2%ShowB%6:00:00 PM%6:30:00 PM;Channel2%ShowC%6:30:00 PM%8:00:00 PM;Channel3%ShowA%7:00:00 PM%8:00:00 PM;Channel3%ShowB%8:00:00 PM%8:30:00 PM;Channel3%ShowC%8:30:00 PM%9:00:00 PM" | makemv raw delim=";" | mvexpand raw | rex field=raw "(?<Channel>[^\%]+)%(?<Show>[^\%]+)%(?<Start_Time>[^\%]+)%(?<Finish_Time>[^\%]+)" | eval time_1 = strptime(Start_Time, "%H:%M:%S %p") | eval time_2 = strptime(Finish_Time, "%H:%M:%S %p") | eval duration = "Duration = ".round((time_2 - time_1)/3600, 1)." hr" | eval group = Channel, label = Show, start = time_1, end = time_2, tooltip = Show."\n".duration | makemv tooltip delim="\n" | table group, label, start, end, tooltip Result:

anmolpatel · ‎03-08-2020

1) Install the Event Timeline Viz https://splunkbase.splunk.com/app/4370/ 2) Here is a sample query. After execution, go to Visualisation, and select Event Timeline Viz. You will see the result displayed like a TV guide. | makeresults | eval raw = "Channel1%Show1%6:00:00 PM%7:00:00 PM;Channel1%Show2%7:00:00 PM%8:00:00 PM;Channel1%Show3%8:00:00 PM%9:00:00 PM;Channel2%ShowA%5:00:00 PM%6:00:00 PM;Channel2%ShowB%6:00:00 PM%6:30:00 PM;Channel2%ShowC%6:30:00 PM%8:00:00 PM;Channel3%ShowA%7:00:00 PM%8:00:00 PM;Channel3%ShowB%8:00:00 PM%8:30:00 PM;Channel3%ShowC%8:30:00 PM%9:00:00 PM" | makemv raw delim=";" | mvexpand raw | rex field=raw "(?P<Channel>[^\%]+)%(?P<Show>[^\%]+)%(?P<Start_Time>[^\%]+)%(?P<Finish_Time>[^\%]+)" | eval time_1 = strptime(Start_Time, "%H:%M:%S %p") | eval time_2 = strptime(Finish_Time, "%H:%M:%S %p") | eval duration = time_2 - time_1 | eval group = Channel, label = Show, start = time_1, end = time_2, tooltip = Show | table group, label, start, end, tooltip

anmolpatel · ‎03-08-2020

This: | inputlookup test_multiValue.csv | stats values(*) as * by Column3 | makemv delim="\n " Column4 | rex mode=sed field=Column4 "s/ /, /g"

anmolpatel · ‎03-05-2020

I added the above capabilities to a new authorize.conf file and then created a new user assigning the moncon_user role. I had no issues. I'm using Splunk 7.3.4

anmolpatel · ‎03-05-2020

If the printer is an extracted key, the solution i've provided above will solve your query. Just change the variables as required.

anmolpatel · ‎03-05-2020

@aojie654 If you want to look at log collection and the data indexed, the LM has the capability and you can just extract that search and modify it to meet client requirement. Maybe create another dashboard out of it For status, Splunk writes quite a few logs about itself https://docs.splunk.com/Documentation/Splunk/8.0.2/Troubleshooting/WhatSplunklogsaboutitself Decide which is important to the client and you can write an outputs.conf stanza to send the log to an external source https://docs.splunk.com/Documentation/Splunk/8.0.2/Forwarding/Forwarddatatothird-partysystemsd Hope this helps

anmolpatel · ‎03-05-2020

If the name is WING[digit]RCA you can go with | makeresults | eval raw = "Printer1%WING1RCA%;Printer2%WING2RCA;Printer3%WING;Printer4%RCA" | makemv raw delim=";" | mvexpand raw | rex field=raw "(?P<Printer>[^\%]+)%(?P<Location>[^\%]+)" | eval channel = if(match(Location, "WING\dRCA"), "Remote Office", "Office") | table Printer Location channel If there is more text in between, WING[text]RCA, you can break it down to | eval channel = if(match(Location, "WING.*"), if(match(Location, ".*RCA"), "Remote Office", "Office"), "Office")

anmolpatel · ‎03-05-2020

Quite a long way, though with some HTML and JS it can be done. This is at a high level. To get started, you would want to explore the KV store to save the updated data. Also look at NiketNilay's reponse to creating textboxes. https://answers.splunk.com/answers/682183/how-to-add-a-textbox-as-a-cell-in-a-splunk-table.html You can effectively replace the textbox with a dropdown with some JS or if you would want to populate it from existing data from an index, you can look at using the search manager https://dev.splunk.com/enterprise/docs/developapps/webframework/addsearches/howtocreatesearchmngr/ You will then replace the last column for each row with a "Save" button. The onclick() action for save button would be to update a KV store row column. https://answers.splunk.com/answers/617305/how-can-i-give-the-to-the-users-to-save-their-sele.html Once you've all that in place, you will need to update the searches to retrieve data from both the index and the KV store

anmolpatel · ‎03-05-2020

My two cents worth. An event will be of various size which will be dependent upon day and time of day. So imbalance is inevitable when dealing with 100's of GB to TB+ data. Don't rely on the default values for the data spread to have minimise imbalance. Would configure to have smaller burst of data across various indexers in the cluster. EG: [tcpout] autoLBFrequency = 15 autoLBVolume = 500000 ### the max data size you would want to send to and IDX incase frequency threshold isn't met forceTimebasedAutoLB = true ### Note: you would also want to check you've the right props key/value pair in place for Event_Breaker. Is rebalancing something to do regularly, would say yes. Frequency, that will be environment dependent where you would have set maintenance windows. There is also criticality of the data when it comes to security data sources, so would carry our risk analysis to weight in. Here is a splunk .conf presentation that explains it quite well: https://conf.splunk.com/files/2016/slides/rebalancing-data-across-an-indexer-cluster.pdf

anmolpatel · ‎03-05-2020

You can use the sed to replace the space. I've taken the time from above and created the below example | makeresults | eval t = "03/05/2020 09:01:58 AM" | eval stime = "2020 - 03 - 04T23:01:58.500000000Z" | eval epoch_time_t = strptime(t, "%d/%m/%Y %H:%M:%S %p") | eval human_time_t = strptime(epoch_time, "%d/%m/%Y %H:%M:%S %p") | rex mode=sed field=stime "s/ //g" | eval epoch_time_stime = strptime(stime, "%Y-%m-%dT%H:%M:%S") | eval human_time_stime = strftime(epoch_time_stime, "%d/%m/%Y %H:%M:%S")

anmolpatel · ‎03-05-2020

I've taken @to4kawa 's initial query and made modification to what you're looking for | makeresults count=10000 | eval COMMENT= "Randomly generate file names with the below string names" | eval File="string_1L_".(random() % 8) | eval File="string_L_".(random() % 8) | eval COMMENT= "For filename with string_1L_2 create file in series from 20-28" | append [| makeresults | eval counter=mvappend("0",mvrange(1,8),"8") | mvexpand counter | eval File=trim("string_1L_2".counter,"1") | table File] | stats count by File | eval COMMENT = " Have replaced searchmatch function with match function using regex to check if you've a file with the particular string. This avoids multiple checks. You can replace the regex .*string_1L_2.* with .*string_1L_ .* and this will match with all values that get generated above, to test further." | eval FileExists=if(match(File, ".*string_1L_2.*"),"Yes", "No") | table File FileExists The eval I've above for File Exists, effectively replaces what you're doing here: | eval keyword=case(searchmatch("string_1L_2"),"string_1L_2",searchmatch("string_1L_21"),"string_1L_21",searchmatch("string_1L_22"),"string_1L_22",searchmatch("string_1L_23"),"string_1L_23",searchmatch("string_1L_24"),"string_1L_24") | eval Filestatus=if(like(keyword, "string_1L%"), "fileFound", "Filenotfound") You can add in your Filesize check after that.

anmolpatel · ‎03-05-2020

Unfortunately do not know of a solution for Cyrillic script. If it is of high importance, you could reach out to the author of the app and see if they can give you direction to make changes to the app to support the font and or they might add it to their pipeline for future release.

anmolpatel · ‎03-05-2020

@iKate glad you found it helpful

Posts	151
Solutions	20
Karma Given	25
Karma Received	18
Member Since	‎08-21-2017

Online Status	Offline
Date Last Visited	‎02-19-2022 10:41 PM

Re: Help generating a dynamic alert

Re: Ulimits or limits.conf - Windows Servers

Re: How to specify midnight time in EST time using...

Re: CIM Data Model Best Practices - What (not) to ...

Re: help with timeline viz needed

Re: How start a dashboard search based on a token ...

Re: What is the maximum limitation of drop-down va...

Re: Agent upgrade for splunk

Re: Get windows Local login logs using WMI

Re: I am running an import script for an interval ...

Re: How to specify midnight time in EST time using...

Re: Linux Forwarder Shows up Monitor, but Can't ad...

Re: help with timeline viz needed

Re: Display TV guide style UI in dashboard

Re: How to merge multiple lookup lines into one

Re: New "role" cannot be added to any users due to...

Re: Conditional searching using eval command with...

Re: Log collect status monitoring and

Re: Conditional searching using eval command with...

Re: Can I add columns to past events with a dashbo...

Re: Is load balancing in UF/HF bound to cause data...

Re: Unseen character in wineventlog message

Re: Splunk query to exclude the searched strings b...

Re: Change text size when exporting PDF

Re: How to setup scheduled search to run after ful...

Join the Conversation