Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- Find Answers
- :
- About krish3
krish3
Contributor
Member since:
12-19-2013
09-03-2025
Community Statistics
| Posts | 86 |
| Solutions | 6 |
| Karma Given | 11 |
| Karma Received | 16 |
| Member Since | 12-19-2013 |
Activity Feed
- Got Karma for Re: Failed to execute KV Store lookup. 07-28-2021 10:34 PM
- Karma Why are my tokens not getting set when a scheduled PDF is produced? for paddygriffin. 06-05-2020 12:48 AM
- Got Karma for Re: Splunk DB Connect 3: Why am I unable to login using Windows authentication?. 06-05-2020 12:48 AM
- Karma How to troubleshoot "Unspecified upload Error" when trying to upload a simple txt file for Splunk Cloud 6.2? for ljhughes. 06-05-2020 12:47 AM
- Karma Re: Is it possible to make an app that can save information to an index that is input by a user? for stephanefotso. 06-05-2020 12:47 AM
- Karma is there any way to block a splunk community user like bji598 for paramagurukarth. 06-05-2020 12:47 AM
- Karma How to detect a deleted log for pkeller. 06-05-2020 12:47 AM
- Got Karma for Re: I need help writing monitor stanza for a particular type of windows log files. 06-05-2020 12:47 AM
- Got Karma for Re: is there any way to block a splunk community user like bji598. 06-05-2020 12:47 AM
- Got Karma for Re: is there any way to block a splunk community user like bji598. 06-05-2020 12:47 AM
- Got Karma for Re: Monitor vs Batch Job for inputting data. 06-05-2020 12:47 AM
- Got Karma for Re: Top 10 values and other to be Grouped in "OTHERS"..??. 06-05-2020 12:47 AM
- Got Karma for Re: Top 10 values and other to be Grouped in "OTHERS"..??. 06-05-2020 12:47 AM
- Got Karma for Re: splunk maps plotting using IP address. 06-05-2020 12:47 AM
- Got Karma for Re: splunk maps plotting using IP address. 06-05-2020 12:47 AM
- Got Karma for Re: splunk maps plotting using IP address. 06-05-2020 12:47 AM
- Got Karma for What is the criteria for the correlation rules present in the Splunk Enterprise Security app?. 06-05-2020 12:47 AM
- Got Karma for Re: Where to place app-specific macros for proper later app-packaging?. 06-05-2020 12:47 AM
- Got Karma for Re: Where to place app-specific macros for proper later app-packaging?. 06-05-2020 12:47 AM
- Got Karma for Re: I disabled a transforms.conf stanza in Splunk Web, but why is the regex field extraction still effective?. 06-05-2020 12:47 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 0 |
11-10-2015
02:00 AM
1 Karma
Hi,
I was looking at the logic behind the correlation rules that are built-in to the Splunk Enterprise Security app, but it was not so clear. For example, I would like to know the criteria for triggering the bruteforcing rule.
By editing the rule, I am able to see it runs every five min, but on what basis does this rule match the events to trigger as bruteforcing? (example :Number of login failure more than 10 times in a minute. etc.)
Similarly, I would like to know the criteria for the rules present in the ES App.
Thanks
... View more
10-29-2015
02:37 AM
OK try to open the search and apply the eval on the search and you can save it as report/Dashboard.
AFAIK calculation on the pivot editor not possible, never tried let me check it out.
... View more
10-29-2015
02:25 AM
Did you try...
your search ... key!=value
This should give the events which doesnt have the values for the key specified above.
... View more
10-29-2015
02:20 AM
You can do this by editing props and transforms.conf
In props.conf set the TRANSFORMS-null attribute:
[source::/path/to/your/access.log*]
TRANSFORMS-null= setnull
And in transforms.conf add these lines
[setnull]
REGEX = \"GET\s\/pictures
DEST_KEY = queue
FORMAT = nullQueue
Thanks,
And let me know how it goes.
... View more
10-29-2015
02:08 AM
Add a calculated field using eval expression to your data model.
App-> pivot->choose datamodel-> Edit->disable acceleration(if enabled) -> Edit --> Add attribute --> Choose Eval ( enter below eval condition & Preview, submit)
eval Column3=Cloumn2/Column1
And also you can find more information for adding calculated fields here.
Calculated Fields
Defining calculated fields
... View more
10-29-2015
01:48 AM
Hi Dimitris,
You could try exporting logs to specific location from websense and pick it up using a forwarder.
Or
You could try to pull data from SQL database using DBconnect app. (Since it is a proxy it might not be a good idea to put additional load on database.)
Thanks,
... View more
10-25-2015
01:25 AM
Hey Guys,
Thanks. I was able to make it work using like function of eval command.
But still not sure why it was not able work on using field=value condition
... View more
10-24-2015
11:51 PM
Below is my query to separate priority accounts of AD based on group name but I am unable to assign any priority based on groups...
|ldapsearch domain=domain.com search="(&(objectclass=user)(!(objectClass=computer)))"
|makemv userAccountControl
|search userAccountControl="NORMAL_ACCOUNT"
|eval priority=if(memberOf="Executive Account","high","medium")|stats count by priority
And also i would like to mention that below search gives me results without if condition
|ldapsearch domain=domain.com search="(&(objectclass=user)(!(objectClass=computer)))"
|makemv userAccountControl
|search userAccountControl="NORMAL_ACCOUNT"
|search "Executive Accounts"
Also please let me know if any other alternative queries for importing the identities to ES App based on group wise priority.
Thanks,
... View more
10-21-2015
05:22 AM
Can you post few more lines of your logs I do not see any issues with the regex pattern....
Check your regex here
... View more
10-21-2015
04:20 AM
Can you please share what is the value of field detail.output-cid-response
... View more
05-13-2015
06:08 AM
Nope. I believe it cannot be changed.
... View more
05-12-2015
01:12 PM
Just edit the report and choose edit schedule and make sure attach as PDF is checked for your second query.
Click here for Screen Shot
... View more
05-12-2015
12:41 PM
Yes standalone and SH cluster can co exist. But the knowledge objects,users and roles will be limited to SHC or standalone depending where they exist. You cannot use the knowledge objects created on Standalone in SHC and vice versa.
... View more
05-12-2015
11:23 AM
3 Karma
Yes you can try using iplocation command.
your search query |iplocation IPaddress_fieldname
For more details go through the search reference manual here.
... View more
05-12-2015
06:10 AM
can you confirm these??
No space between these values and name 01Q0009000054146746SAHEER SHAIK12
Is ID you specified is off alphabet followed by 8 digits out of this P43833244199105
... View more
We might need Hulk for this.;)
... View more
05-11-2015
10:17 AM
One more chances is your indexers might not be able to communicate to license master do check this connection if you are sure if you didn't exceed the license limit or didn't get any warning for license violation.
... View more
05-11-2015
07:24 AM
1 Karma
Usually Batch input is used for large historical data. It is not a good practice for small and continuously updating files.
Consider a case where i faced using batch input i fed splunk a large files and folders and in between the license limit was reached and stopped splunk to wait 24 hours and later i couldn't start indexing from where it stopped because the file was deleted. Due to move_policy = sinkhole policy that is mandatory for batch inputs. And I had no clue till what point the data was indexed all i did was i flushed the index and reindex whole data using monitor.
It depends on the size of the data and its availability you should be able to choose the best one.
... View more
05-11-2015
07:06 AM
Probably macros should the job for you.
Create a macro for your common search like this:
index=dotcom sourcetype=dotcom_access_log |eval traffictype=
case(
searchmatch("uri_path=/wcs/resources/store/10001 AND NOT uri_path=kiosk"),"API HITS US",
searchmatch("uri_path=/wcs/resources/store/20001 AND NOT uri_path=kiosk"),"API HITS CA",
searchmatch("uri_path=/cat_CL OR uri_path=/directory_"),"SEARCH HITS",
searchmatch("uri_path=/product_"),"PRODUCT PAGE HITS",
searchmatch("uri_path=daily*deals"),"DAILY DEALS HITS",
searchmatch("uri_path=kiosk"),"KIOSK HITS", 1==1, "DESKTOP HITS") to a macro named as you need.
And you can call it in search like this:
(tilde symbol)macro_name(tilde symbol) |timechart count by traffictype
(tilde symbol)macro_name(tilde symbol) | timechart avg(eval((response_time/1000)/1000)) as "Response Time" by traffictype
You can know more about macro here.
... View more
05-11-2015
06:27 AM
2 Karma
I believe you are looking for this..
your search string |top limit=10 state useother=1
... View more
Up Vote. Those guys are irritating please let us know if we can block them
... View more
05-11-2015
03:57 AM
I believe you are looking something like eventlog filtering.
Checkout EventLog filtering using inputs.conf here
... View more
05-11-2015
01:08 AM
Hi Jeff,
I am looking at monitoring admin activity on the server i thought single dashboard with swimlane would perfectly do the job so i was looking for how it is done.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
09-03-2025
07:25 PM
|
Karma from
Karma given to
