About rnowitzki

rnowitzki · ‎03-25-2021

Hmm, so you basically want to switch the Status. Could this be enough? Add it below your current SPL: | eval status=if(status="DOWN", "UP", "DOWN") Or you change the logic already when you assign either DOWN or UP. After that you can filter to see only the DOWN ones with | where status="DOWN" Hope I got your requirement correct. BR Ralph

rnowitzki · ‎03-24-2021

Hi @mariamathewtel , Try this SPL after your search that populates the table shown in the Screenshot: | streamstats current=f window=1 last(Trend) as prev_trend | eval trendchange=if(Trend!=prev_trend,"true", "false") | where trendchange="true" | streamstats current=f window=1 last(_time) as prev_time | eval gap=tostring(_time-prev_time, "Duration") | convert ctime(prev_time) It will give you only the line where a change in Trend happened, including the gap since the last change took place. Remove the line with "where" to see the whole list, I was not sure if you wanted to filter the ones without change or not. Hope this helps. BR Ralph

rnowitzki · ‎02-25-2021

Hi @schufi01 , Try this: | stats dc(fruit) as fruitcount Field "fruitcount" will contain the distinct count of values in the field fruit. BR Ralph

rnowitzki · ‎02-10-2021

Hi @wcastillocruz , Isn't this the same use case that we discussed some weeks ago? Did it not work for you? Anyways: What should be returned at the end, do you need the total duration of downtime, or a table where you see when the service was down? In general, this should be a starting point: | timechart span=5m latest(severity) by server | filldown | eval servicedown=if(server1=2 AND server2=2,"yes","no") This will give you a table of timestamps where the service was down, because both of the servers had severity 2 at the same time. To get the duration of the downtime, you could work with transaction or streamstats for example. But please clarify what the information is that you need to report from this. BR Ralph

rnowitzki · ‎01-28-2021

Hi @wcastillocruz, What exactly does not work. No output or wrong output, errors? Some trouble shooting suggestions: Are the tokens actually working? Maybe check with this simple evals: | eval first=$earliest$ | eval last=$latest$ | table first, last If they actually contain the data, then the next thing is to check if the calculation is correct. I think you have to change the order in your math like; | eval periode = $latest$ - $earliest$ In epoch seconds, "latest" is the bigger number, so extract earliest from latest. Check these 2 items. If it still does not work, try to debug by removing one SPL line after another to check if the disired output comes. So, first remove the last line to check if | stats sum(duration) AS duration_indispo by Function results in a valid number for duration_indispo If not, remove the line also to check if periode has the corret value and so on. BR Ralph

rnowitzki · ‎01-28-2021

Hi @Mrig342 , Add this below your SPL: | eval result_id=if(Result="Ok",1,0) | stats count as total, sum(result_id) as goodones | eval good_percentage=(goodones*100)/total I think that's what you're looking for. BR Ralph

rnowitzki · ‎01-28-2021

Hi @wcastillocruz , transaction will add a "duration" field, which i think is what you are looking for. You can also subtract earliest from latest to a new field. | eval seconds=latest-earliest Or did I missunderstood? BR Ralph

rnowitzki · ‎01-26-2021

Hi @wcastillocruz , working with "transaction" as you did is also an option, yes. Dependent on how much data you look at, the performance might be not so nice...but it should give you what you need. You could add endswith=(severity=0) to the command. Maybe it gives better results. To your question on how to seperate the timestamp field from you screenshot: I see two options, please adjust to your needs. - | mvexpand timestamp => this will create 2 lines, each with one of the timestamps. - | rex field=timestamp "(?<timestampA>\d*)\n?\r?\s?(?<timestampB>\d*)" => puts the timestamps in 2 new fields. Can be seperated by new line or space. BR Ralph

rnowitzki · ‎01-21-2021

Hi @wcastillocruz , This should do it. | makeresults count=5 | streamstats count as id | eval _time = case(id=1,_time-6000,id=2,_time-12000,id=3,_time-18000,id=4,_time-23000,id=5,_time-23000) | sort _time | eval severity=case(id=1,2,id=2,0,id=3,2,id=4,2,id=5,0) | eval host = case(id=1,"A",id=2,"B",id=3,"A",id=4,"B",id=5,"A") | timechart latest(severity) by host | filldown A,B | eval super_mega_alert=if(A=2 AND B=2,"yes","no") You will only need the last 3 lines. The others are just to make up some sample data. Add a span to the timechart that fits your need, e.g. span=5m to monitor 5 minute windows. You have the change A and B to the hostnames in your data. Try to add the commands one after another to see and understand the logic. So first only add the timechart command. You might have to change "host" to whatever fields your device name is in ("managed_entity" maybe?). You will see many lines with no values, that's where the filldown comes in. It adds the last known value to any field...which is valid because there was no change of state in the meantime. The last line just checks when both of the nodes had severity 2 in the same timeframe and puts a yes in the new field super_mega_alert which you can use to trigger your alert. Let me know if you have any further questions BR Ralph

rnowitzki · ‎01-21-2021

Hi @anandhalagaras1 You already have what you need basically. Go to settings -> Sarch, Reports and Alerts, click "new Alert" in top right. As search you would put in for example index=windows sourcetype=dns Make sure Alert Type is set to "Scheduled" and select "Run on Cron Schedule" Use this Cron Expression */15 * * * * (run every 15th minute). As Time Range select "Last 15 Minutes". As Trigger Condition set: "Number of Results" and "is equal to " 0. At the bottom you can configure the kind of alert action you need (email, webhook posting, call the police...) Hope this helps. BR Ralph Edit: Instead of returning all the Events, it would be better (from a performance/ressource usage pov) to run a stats command like: index=windows sourcetype=dns | stats count And alert based on the count field. So, once you have the alerting running, this would be a good point to optimize it.

rnowitzki · ‎01-21-2021

Hi @wcastillocruz , We could provide better help, if you'd show some example logs. But in general you could have a logic like: If condition of pair_member_1 AND condition of pair_member_2 is critical, then alert. (this is not SPL, just to write out the logic 🙂 ) You could apply this logic to a timeframe of 5 minutes for example. So, if both of the pair members are critical within a 5 minute window, an alert is triggered (or a flag is set, bulb in your office goes red... whatever you need 😛 ). If you provide some (anonymized) samples, how your data looks like, we could help you with more details, like how to implement the logic in a search and how to trigger an alert based on it. BR Ralph

rnowitzki · ‎01-11-2021

Hi @vn_g , I guess I need more testing on my side 🙂 Version 0.4 of my SPL: | makeresults | eval MINIMUM_VERSION="3.9.2" | eval COMPARE_VERSION="3.11.0" | eval MINIMUM_VERSION_major=mvindex(split(MINIMUM_VERSION,"."),0), MINIMUM_VERSION_minora=mvindex(split(MINIMUM_VERSION,"."),1), MINIMUM_VERSION_minorb=mvindex(split(MINIMUM_VERSION,"."),2), MINIMUM_VERSION_minorc=mvindex(split(MINIMUM_VERSION,"."),3), MINIMUM_VERSION_minord=mvindex(split(MINIMUM_VERSION,"."),4), MINIMUM_VERSION_minore=mvindex(split(MINIMUM_VERSION,"."),5), MINIMUM_VERSION_minorf=mvindex(split(MINIMUM_VERSION,"."),6), COMPARE_VERSION_major=mvindex(split(COMPARE_VERSION,"."),0), COMPARE_VERSION_minora=mvindex(split(COMPARE_VERSION,"."),1), COMPARE_VERSION_minorb=mvindex(split(COMPARE_VERSION,"."),2), COMPARE_VERSION_minorc=mvindex(split(COMPARE_VERSION,"."),3), COMPARE_VERSION_minord=mvindex(split(COMPARE_VERSION,"."),4), COMPARE_VERSION_minore=mvindex(split(COMPARE_VERSION,"."),5), COMPARE_VERSION_minorf=mvindex(split(COMPARE_VERSION,"."),6), COMPARE_VERSION_minora = if(isnull(COMPARE_VERSION_minora),"0",COMPARE_VERSION_minora), COMPARE_VERSION_minorb = if(isnull(COMPARE_VERSION_minorb),"0",COMPARE_VERSION_minorb), COMPARE_VERSION_minorc = if(isnull(COMPARE_VERSION_minorc),"0",COMPARE_VERSION_minorc), COMPARE_VERSION_minord = if(isnull(COMPARE_VERSION_minord),"0",COMPARE_VERSION_minord), COMPARE_VERSION_minore = if(isnull(COMPARE_VERSION_minore),"0",COMPARE_VERSION_minore), COMPARE_VERSION_minorf = if(isnull(COMPARE_VERSION_minorf),"0",COMPARE_VERSION_minorf), MINIMUM_VERSION_minora = if(isnull(MINIMUM_VERSION_minora),"0",MINIMUM_VERSION_minora), MINIMUM_VERSION_minorb = if(isnull(MINIMUM_VERSION_minorb),"0",MINIMUM_VERSION_minorb), MINIMUM_VERSION_minorc = if(isnull(MINIMUM_VERSION_minorc),"0",MINIMUM_VERSION_minorc), MINIMUM_VERSION_minord = if(isnull(MINIMUM_VERSION_minord),"0",MINIMUM_VERSION_minord), MINIMUM_VERSION_minore = if(isnull(MINIMUM_VERSION_minore),"0",MINIMUM_VERSION_minore), MINIMUM_VERSION_minorf = if(isnull(MINIMUM_VERSION_minorf),"0",MINIMUM_VERSION_minorf), major_bigger = if(COMPARE_VERSION_major > MINIMUM_VERSION_major,"true","false"), minora_bigger = if(COMPARE_VERSION_minora > MINIMUM_VERSION_minora,"true","false"), minorb_bigger = if(COMPARE_VERSION_minorb > MINIMUM_VERSION_minorb,"true","false"), minorc_bigger = if(COMPARE_VERSION_minorc > MINIMUM_VERSION_minorc,"true","false"), minord_bigger = if(COMPARE_VERSION_minord > MINIMUM_VERSION_minord,"true","false"), minore_bigger = if(COMPARE_VERSION_minore > MINIMUM_VERSION_minore,"true","false"), minorf_bigger = if(COMPARE_VERSION_minorf > MINIMUM_VERSION_minorf,"true","false"), major_smaller = if(COMPARE_VERSION_major < MINIMUM_VERSION_major,"true","false"), minora_smaller = if(COMPARE_VERSION_minora < MINIMUM_VERSION_minora,"true","false"), minorb_smaller = if(COMPARE_VERSION_minorb < MINIMUM_VERSION_minorb,"true","false"), minorc_smaller = if(COMPARE_VERSION_minorc < MINIMUM_VERSION_minorc,"true","false"), minord_smaller = if(COMPARE_VERSION_minord < MINIMUM_VERSION_minord,"true","false"), minore_smaller = if(COMPARE_VERSION_minore < MINIMUM_VERSION_minore,"true","false"), minorf_smaller = if(COMPARE_VERSION_minorf < MINIMUM_VERSION_minorf,"true","false"), smaller_global = if(major_smaller="true", "true",if(major_bigger="true", "false", if(minora_smaller="true", "true",if(minora_bigger="true", "false", if(minorb_smaller="true", "true",if(minorb_bigger="true", "false", if(minorc_smaller="true", "true",if(minorc_bigger="true", "false", if(minord_smaller="true", "true",if(minord_bigger="true", "false", if(minore_smaller="true", "true",if(minore_bigger="true", "false", if(minorf_smaller="true", "true",if(minorf_bigger="true", "false","versions_are_equal" )))))))))))))) | fields MINIMUM_VERSION, COMPARE_VERSION, smaller_global Now checking both for each major/minorversion: If it's bigger or smaller. If either or is true, it breaks out. If not then the minor is equal and it goes to the next one... It prints "versions_are_ equal" if everything is equal. You could change that to "false", since equal is still "not smaller"... Please run some tests again. BR Ralph

rnowitzki · ‎01-08-2021

Solved it one simple eval statement 😛 The SPL I have looks a bit too much for the use case. But it works now (I know, I said this earlier...so please double check 🙂 ) | makeresults | eval MINIMUM_VERSION="3.9.2" | eval COMPARE_VERSION="3.5.2.1" | eval MINIMUM_VERSION_major=mvindex(split(MINIMUM_VERSION,"."),0), MINIMUM_VERSION_minora=mvindex(split(MINIMUM_VERSION,"."),1), MINIMUM_VERSION_minorb=mvindex(split(MINIMUM_VERSION,"."),2), MINIMUM_VERSION_minorc=mvindex(split(MINIMUM_VERSION,"."),3), MINIMUM_VERSION_minord=mvindex(split(MINIMUM_VERSION,"."),4), MINIMUM_VERSION_minore=mvindex(split(MINIMUM_VERSION,"."),5), MINIMUM_VERSION_minorf=mvindex(split(MINIMUM_VERSION,"."),6), COMPARE_VERSION_major=mvindex(split(COMPARE_VERSION,"."),0), COMPARE_VERSION_minora=mvindex(split(COMPARE_VERSION,"."),1), COMPARE_VERSION_minorb=mvindex(split(COMPARE_VERSION,"."),2), COMPARE_VERSION_minorc=mvindex(split(COMPARE_VERSION,"."),3), COMPARE_VERSION_minord=mvindex(split(COMPARE_VERSION,"."),4), COMPARE_VERSION_minore=mvindex(split(COMPARE_VERSION,"."),5), COMPARE_VERSION_minorf=mvindex(split(COMPARE_VERSION,"."),6), COMPARE_VERSION_minora = if(isnull(COMPARE_VERSION_minora),"0",COMPARE_VERSION_minora), COMPARE_VERSION_minorb = if(isnull(COMPARE_VERSION_minorb),"0",COMPARE_VERSION_minorb), COMPARE_VERSION_minorc = if(isnull(COMPARE_VERSION_minorc),"0",COMPARE_VERSION_minorc), COMPARE_VERSION_minord = if(isnull(COMPARE_VERSION_minord),"0",COMPARE_VERSION_minord), COMPARE_VERSION_minore = if(isnull(COMPARE_VERSION_minore),"0",COMPARE_VERSION_minore), COMPARE_VERSION_minorf = if(isnull(COMPARE_VERSION_minorf),"0",COMPARE_VERSION_minorf), MINIMUM_VERSION_minora = if(isnull(MINIMUM_VERSION_minora),"0",MINIMUM_VERSION_minora), MINIMUM_VERSION_minorb = if(isnull(MINIMUM_VERSION_minorb),"0",MINIMUM_VERSION_minorb), MINIMUM_VERSION_minorc = if(isnull(MINIMUM_VERSION_minorc),"0",MINIMUM_VERSION_minorc), MINIMUM_VERSION_minord = if(isnull(MINIMUM_VERSION_minord),"0",MINIMUM_VERSION_minord), MINIMUM_VERSION_minore = if(isnull(MINIMUM_VERSION_minore),"0",MINIMUM_VERSION_minore), MINIMUM_VERSION_minorf = if(isnull(MINIMUM_VERSION_minorf),"0",MINIMUM_VERSION_minorf), major_smaller = if(COMPARE_VERSION_major < MINIMUM_VERSION_major,"true","false"), minora_smaller = if(COMPARE_VERSION_minora < MINIMUM_VERSION_minora,"true","false"), minorb_smaller = if(COMPARE_VERSION_minorb < MINIMUM_VERSION_minorb,"true","false"), minorc_smaller = if(COMPARE_VERSION_minorc < MINIMUM_VERSION_minorc,"true","false"), minord_smaller = if(COMPARE_VERSION_minord < MINIMUM_VERSION_minord,"true","false"), minore_smaller = if(COMPARE_VERSION_minore < MINIMUM_VERSION_minore,"true","false"), minorf_smaller = if(COMPARE_VERSION_minorf < MINIMUM_VERSION_minorf,"true","false"), smaller_global = if(major_smaller="true", "true", if(minora_smaller="true", "true", if(minorb_smaller="true", "true", if(minorc_smaller="true", "true", if(minord_smaller="true", "true", if(minore_smaller="true", "true", if(minorf_smaller="true", "true","false" ))))))) | fields MINIMUM_VERSION, COMPARE_VERSION, smaller_global The 2 blocks with mvindex are assigning the major and minor versions to fields. Next 2 blocks fills "0" for the minor versions that don't exist. Then we compoare the major and minor versions one by one and in the last eval for the smaller_global field is the main logic...if major is smaller = true, else if minora is smaller=true, else.... I guess the SPL can be shortened with some FOREACH magic, or when you skip assigning the major and minor versions to fields and work with the mvindex statement directly . But it would be less readable I think...

rnowitzki · ‎01-08-2021

Ah, shoot. That's right. You challenge me 😛 I guess we have to define something like major version, minor version a, minor version to make it work... Is there a max number of dots that you expect? I mean, you seem to have 3.12.9 (major version + minor version a + minor version b) ...can there also be 3.12.9.4? (minor version c)?

rnowitzki · ‎01-08-2021

Hi @vn_g There might be a more dynamic solution that I can't think of right now, but this should work for you: | makeresults | eval MINIMUM_VERSION_REQUIRED="3.9.209767" | eval COMPARE_VERSION="3.6.105" | eval MINIMUM_VERSION_REQUIRED=replace(MINIMUM_VERSION_REQUIRED,"\.","") | eval COMPARE_VERSION=replace(COMPARE_VERSION,"\.","") | eval zero_count=len(COMPARE_VERSION)-len(MINIMUM_VERSION_REQUIRED) | eval MINIMUM_VERSION_REQUIRED=case(zero_count<=0,MINIMUM_VERSION_REQUIRED,zero_count=1,MINIMUM_VERSION_REQUIRED+"0",zero_count=2,MINIMUM_VERSION_REQUIRED+"00",zero_count=3,MINIMUM_VERSION_REQUIRED+"000") | eval COMPARE_VERSION=case(zero_count>=0,COMPARE_VERSION,zero_count=-1,COMPARE_VERSION+"0",zero_count=-2,COMPARE_VERSION+"00",zero_count=-3,COMPARE_VERSION+"000") If the length (~count of numbers) is different between the two version fields, it will add trailing zeros to make it match. Now you can compare. This works with up to 3 more (or less) numbers in the two version fields (like compare 3.9.1. with 3.5.12.32) If you expect even more sub/minor versions to compare, you would have to extend the two case statements with zero_count=4, VERSION_FIELD+"0000" etc. BR Ralph

rnowitzki · ‎01-07-2021

Hi @vn_g , Replace the dots with nothing I tested it with this - the output of "typeofversion" was "number" 🙂 : | makeresults | eval MINIMUM_VERSION_REQUIRED="3.9.2" | eval MINIMUM_VERSION_REQUIRED=replace(MINIMUM_VERSION_REQUIRED,"\.","") | eval typeofversion=typeof(MINIMUM_VERSION_REQUIRED) BR Ralph

rnowitzki · ‎12-30-2020

Hi @jjarevalo , This DB query lists the status of all Jobs. qsh -c "db2 -S \"SELECT JOB_NAME, AUTHORIZATION_NAME, SUBSYSTEM, SUBSYSTEM_LIBRARY_NAME, JOB_STATUS, JOB_TYPE,ELAPSED_CPU_TIME,ELAPSED_CPU_PERCENTAGE FROM TABLE (QSYS2.ACTIVE_JOB_INFO()) \"" You can combine the one I posted earlier with this one in one script. So you have a general status and details on the jobs as well. BR Ralph

rnowitzki · ‎12-28-2020

If there is an error that indicates this, you could trigger an alert when you find this error. Or when you see an increased number of jobs. Either you set a hard limit, or you calculate the average count of jobs and alert when the current number is, let's say, 50% higher.

rnowitzki · ‎12-28-2020

In the setup I described earlier, there is nothing Splunk related on the AS400. The script sshs to the AS400 and executes the qsh command/script. (ssh user@as400_host "/path/to/script") In Production this might not be the best option.

rnowitzki · ‎12-28-2020

Hi @jjarevalo , Don't you have test/integration systems within your company/customer? Can't really help here. The AS400s that I worked with were provided by the customers and were running for decades already 🙂 BR Ralph

rnowitzki · ‎12-11-2020

Hi @yoan , Maybe there is a more direct approach, but this should work. | where date_hour=22 OR date_hour=23 OR date_hour=0 OR date_hour=1 | where NOT (date_hour=22 and date_minute<50) | where NOT (date_hour=1 and date_minute>30) BR Ralph

rnowitzki · ‎12-07-2020

Hi @jjarevalo, You could also run the SQL via DB Connect, which would be maybe even better, because you don't need to ssh into the AS400 and you have control from Splunk over the Query (content and schedule). In our case DB Connect was not an option, so I set it up as described. The script could run as cronjob, piping the results to a file which is monitored by a UF. Or you call the script as a scripted input, which would ingest the stdout to Splunk. So, 3 options: - Call the SQL with DB Connect - Run the script as cron, monitor result file with UF. - Call the script as scripted input. BR Ralph

rnowitzki · ‎12-03-2020

The stanza to refer to the source should be [source::xyz] Besides that, it looks fine. Maybe test it local with a single file, before pushing to production. BR Ralph

rnowitzki · ‎12-03-2020

Hi @anandhalagaras1 , This seems to work: (.*)=(.*?)(?=\s+[a-zA-Z]\w+=|$) BR Ralph

rnowitzki · ‎12-01-2020

Hi @jianw223 , I am not a Cribl employee or in any other way related. Just a happy Cribl user who set it up for the exact same use case for a customer. Not slow, not buggy in my experience. BR Ralph

Posts	241
Solutions	56
Karma Given	15
Karma Received	90
Member Since	‎05-29-2020

Online Status	Offline
Date Last Visited	‎04-17-2024 10:29 AM

Re: Time from a search

Re: Time from a search

Re: Count number of diefferent field values

Re: calculates the availability of a service with ...

Re: Calculation of availability

Re: Need help with query

Re: Calculation of availability

Re: Calculation of availability

Re: Calculation of availability

Re: Sourcetype not reporting in Splunk query

Re: Calculation of availability

Re: Need to compare 2 float values , after convert...

Re: Need to compare 2 float values , after convert...

Re: Need to compare 2 float values , after convert...

Re: Need to compare 2 float values , after convert...

Re: Need to compare 2 float values , after convert...

Re: Splunk DB2 / AS400 Integration

Re: Splunk DB2 / AS400 Integration

Re: Splunk DB2 / AS400 Integration

Re: Splunk DB2 / AS400 Integration

Re: Find event every days betwen 10:50 PM and 01:3...

Re: Splunk DB2 / AS400 Integration

Re: Regex Help Required

Re: Regex Help Required

Re: Anonymize data and keep original aside

Join the Conversation