About rnowitzki

rnowitzki · ‎10-16-2020

Hi @vj_hawk21 , When you created the Job, the sid was in the response. <sid>1258421375.19</sid> Also, you can get a list of your searches with curl -u admin:changeme -k https://localhost:8089/services/search/jobs/ BR Ralph

rnowitzki · ‎10-15-2020

I don't have a good idea right now. 😕 The splunk user can read the file being monitored, right?

rnowitzki · ‎10-15-2020

Hi @dav_muel , This should work: search foobar | stats values(ip) as ips by user | eval ipcount=mvcount(ips) BR Ralph

rnowitzki · ‎10-15-2020

Hi @franciscof , You should find details in the splunkd.log Try searching for esxifw.log, or maybe "nobody" around the time you tried to create the monitor. Hope it helps. BR Ralph

rnowitzki · ‎10-15-2020

Hi @vj_hawk21, Please check the documentation about the REST API: https://docs.splunk.com/Documentation/Splunk/8.0.6/RESTTUT/RESTsearches You create a search job, get the sid back and with the sid you can get the results. To receive the results as csv, you would have to use output_mode=csv as indicated here. BR Ralph

rnowitzki · ‎10-14-2020

Not Brian here, but anyways 🙂 Can you copy&paste your SPL and the whole error message? The only 2 evals in my example are pretty straight forward, not sure what could have gone wrong. BR Ralph aka Brian

rnowitzki · ‎10-14-2020

Maybe append and also keep the timestamp. You could setup up another job that removes lines older than x months... Cheers

rnowitzki · ‎10-14-2020

Hi @waJesu , well, it really depends on your data. But to give you an example. index=<yourindex> earliest=-24h latest=now | stats count by device | eval day="yes" | appendcols [search index=<yourindex> earliest=-1h latest=now | stats count by device| eval hour="yes"] | eval status=if(hour="yes","Up","Missing") | fields - hour, day, count | stats count by status This will give you the pure count of "missing" and "up" devices based on a 24h vs 1h compare. In the visualization tab you would select pie chart and your done. You have to set the index to match your data and also you probably have to change "device" to whatever field your "device" name is stored in. Maybe "host"? If you remove the last line, you see which devices are missing/up. Hope it gives you an idea. BR Ralph

rnowitzki · ‎10-14-2020

Hi @waJesu , You would need some base to start from. Splunk doesn't really know what's not there. There are different approaches for this. I'll give you two: 1. Compare the devices that reported in the last 24h with the ones that reported in the last 1h 2. Maintain a Lookup table with all the devices that should report and compare this with the ones that reported in the last 1h. To help you with the SPL, it would be helpful to see some example data. What kind of devices are in the logs, how do you determine that they are reporting? Do you look for any kind of log from each host(?) or do you expect some specific logline? BR Ralph

rnowitzki · ‎10-14-2020

Hi @adrianrepublic You could add the alert action "Output results to lookup". So you have it in a table as long as you need it. You can then create a report based on this lookup. Hope it helps BR Ralph

rnowitzki · ‎10-14-2020

Hi @ryankrieger, Your requirement for the output is not 100% clear to me. Let's take the first line 8940 10/13/2020 07:59:58 00:23:48 10/13/2020 08:23:46 Do you need to know how many events where happening in that same timeframe with the same trunk number 8940? Or how many events across all trunk numbers? Maybe it's a "bad" example table, but all of the events were crossing times of all others. I mean, there was a timeframe around ~8:11 to 8:22 where all of this events were occuring/active... Did I get it wrong somehow? Could you provide a table that shows how the final table should look like. Will it have a column "count of parallel events"? BR Ralph

rnowitzki · ‎10-13-2020

Hi @pitmod , Should work with this simple SPL: | chart count by book, reader BR Ralph

rnowitzki · ‎10-13-2020

Hi @Sasquatchatmars The tokens are only assigned to the first row in the result set. But try to set the trigger of the alert to "for each result" instead of "once". This should trigger an alert->email for each of the search results, so an email is sent to every single user with expiring password. BR Ralph

rnowitzki · ‎10-13-2020

Yes, it's all in the alert settings. You can give the subject and body of the email and use tokens to integrate values from the search results (for example the name of the user or the number of days until the pw expires). You reference fields from the search results with $result.fieldname$, details in the link provided. Somethine like: "Hello $result.firstname$, your password will expire in $result.daysuntilexpiration$" BR Ralph

rnowitzki · ‎10-13-2020

Hi @Sasquatchatmars , Create an alert based on your search (execute the search and click on "save as > alert" above the time picker). Here you would select the email notification action. You can get the details for the configuration here: https://docs.splunk.com/Documentation/Splunk/latest/Alert/Emailnotification There is a paragraph that explains how you can send the alert to different users, based on the search results. Do you have the email in the search results? If not, you could get it from a lookup that provides the email based on the username for example. BR Ralph

rnowitzki · ‎10-13-2020

Hi @sairam1444, I guess there can be more than 2 lines (=hops) for each source/destination pair, correct? And the data will have multiple sources and destinations, right? Do you have any requirement for the visualization? I guess to put together a long string as you provided would be not a big issue (with strcat e.g.), but does it need to be "more visual" somehow. With colors based on the values, boxes around the values...fancy arrows? Basically: Is it for a Management or Operations audience? 🙂 BR Ralph

rnowitzki · ‎10-12-2020

Hi @BornConfused , If I understood your requirement correct, it should be as simple as: | stats avg(processTime) by host When I add the sample table you provided as input, the given command puts out the average processing time per host: host avg(processTime) host088 71877 host123 23092 host238 76766 Hope it helps. BR Ralph

rnowitzki · ‎10-02-2020

Hi @rkishoreqa , You would setup an alert and use the trigger action "webhook". To setup the webhook url for your teams/channel, follow this documentation: https://docs.microsoft.com/en-us/microsoftteams/platform/webhooks-and-connectors/how-to/add-incoming-webhook Hope it helps. BR Ralph

rnowitzki · ‎09-09-2020

Hi @zacksoft, this seems to work: | makeresults | eval Vehicle=120, Grocery=23, Tax=5, Education=45 | untable foo Vehicle Grocery | fields - foo | rename Vehicle as Category, Tax as count While I was playing around with the data, due to a typo I added a field in the untable command that does not exist, that's why I have foo in it now. I don't fullly understand why, but it gives the result you asked for. But I am not sure about your _fields that you mentioned. I guess they won't be available, as with the transpose command. BR Ralph

rnowitzki · ‎09-09-2020

Hi @amzar96 , Sorry, I missed your question last week. Can you please give more detail, you don't get any data for which query? Thanks Ralph

rnowitzki · ‎09-09-2020

Hi @georgear7 , I don't get your requirement 100%. You want to have all error messages that ever appeared in your Websphere environment in that lookup, or all error messages that might potentially appear? (from IBM documentation?) I guess the Logs have something like "ERROR" in it, so it should be possible to identify all Error Events. And you should be able to extract the error id (like SRVE0190E) on which you could base your timechart on... But not sure if that is what you need. BR Ralph

rnowitzki · ‎09-04-2020

Hi @amzar96, Glad I could help. To explain this one: | stats values(*) as * values(*) runs the values() command on all available fields which we limited in the lines above to just the ones we need. as * ist just cosmetic. values() changes all field names to be e.g. values(total_person), and with as * we change them back to the initial name, total_person e.g. Try to run | stats values(total_person)by serial_id and you will see what I mean. Cheers Ralph

rnowitzki · ‎09-04-2020

Hi @dkgs, You could combine several ifs, or better use case | eval country= case(atomName="APAC", "India", atomName="EUR","Netherlands") So, it's a condition and the result for that condition. another condition, another result. You can extend it with more conditions and results. case has no "else" value, so you either have to give all possible values, or you put the "else" / "default" value in an eval before the case statement. | eval country="United States" | eval country=case(.....) So it would stay "United States" if none of the case conditions match. BR Ralph

rnowitzki · ‎09-04-2020

edit 10:20am: SPL had errors, fixed it. Hi @amzar96, Yes, you could join, but it's pretty slow and hungry. This should work with join: index=abc sourcetype="abc:scanning" status="new_scanning" | stats values(action) as action by serial_id | join serial_id [search index=abc sourcetype="abc:viewing" status="new_viewing" | stats values(person_in_charge) as person_in_charge, values(total_person) as total_person by serial_id] Compare it with: index=abc (sourcetype="abc:scanning" status="new_scanning") OR (sourcetype="abc:viewing" status="new_viewing") | fields person_in_charge, total_person, action, serial_id | stats values(*) as * by serial_id I assume that all values are unique and only one per serial_id and that "total_person" is already calculated in the logs. If you need to sum them up you have to use sum(total_person) for example. Hope it helps BR Ralph

rnowitzki · ‎09-03-2020

Hi @dkgs, There are some issues with your SPL, check the Documentation on geom / choropleth map. This should do it with your example: index="index=1" | stats count by atomName | eval country= if(atomName == "APAC", "India", "United States") | stats sum(count) by country | geom geo_countries featureIdField=country BR Ralph

Posts	241
Solutions	56
Karma Given	15
Karma Received	90
Member Since	‎05-29-2020

Online Status	Offline
Date Last Visited	‎04-17-2024 10:29 AM

Re: Download raw Splunk logs via api

Re: Monitor input error

Re: Count values of grouped key

Re: Monitor input error

Re: Download raw Splunk logs via api

Re: Visualization solution

Re: alert report/search showing triggered devices

Re: Visualization solution

Re: Visualization solution

Re: alert report/search showing triggered devices

Re: Counting events start\end in same event

Re: Bar chart with multiple series

Re: Send mail to user in search results

Re: Send mail to user in search results

Re: Send mail to user in search results

Re: Visualization to show hops between two servers

Re: Calculate average from two fields

Re: How to send message from Splunk to Microsoft T...

Re: How to transpose a table? (without using Trans...

Re: How do I combine query and use the certain dat...

Re: How to capture error messages using lookup fil...

Re: How do I combine query and use the certain dat...

Re: choropleth Map - how to use inputlookup geo_co...

Re: How do I combine query and use the certain dat...

Re: choropleth Map - how to use inputlookup geo_co...

Join the Conversation