About rnowitzki

rnowitzki · ‎08-25-2020

Hi @paulw10 , This is now more flexible, it captures everything between (start of the line)"The " and the words "service entered". So it can have multiple strings and also may have numbers or special characters. | rex field=message "(?<=^The\s)(?<service>.*)\s(?=service\sentered)service\sentered\sthe\s(?<state>\w+)\sstate$" I was not sure if the message has a dot (.) at the end of the line. If yes, you would have to add it like: | rex field=message "(?<=^The\s)(?<service>.*)\s(?=service\sentered)service\sentered\sthe\s(?<state>\w+)\sstate\.$" BR Ralph -- Karma and/or Solution tagging appreciated.

rnowitzki · ‎08-24-2020

Hi @paulw10 , It would probably make sense to add an extracted field for this information. Check the documentation how to achieve this. You can also do with the rex command: | eventid=7036 | rex field=Message "The\s(?<service>\w+)\sservice\sentered\sthe\s(?<state>\w+)\sstate" | transaction service | where state="stopped" AND state!="running" BR Ralph -- Karma and/or Solution tagging appreciated.

rnowitzki · ‎08-24-2020

Hi @adcom53 , Here is an approach that introduces another csv and another saved search. This is the search for the alert: | inputlookup all_services.csv | lookup up_services.csv service OUTPUT service as upservice | lookup down_services.csv service OUTPUT service as downservice | where isnull(downservice) AND isnull(upservice) | fields service | outputlookup append=true down_services.csv It detects services that are not up and where an alert was not yet triggered. The result is appended to down_services.csv Just before you run the alert search (like 1 minute earlier) you run this saved search: | inputlookup all_services.csv | lookup up_services.csv service OUTPUT service as upservice | lookup down_services.csv service OUTPUT service as downservice | where isnull(upservice) and NOT isnull(downservice) | fields service | outputlookup down_services.csv This removes already reported services that are up again, but keeps the already reported (and still down) services in down_service.csv Hope it works for you. BR Ralph -- Karma and/or Solution tagging appreciated.

rnowitzki · ‎08-24-2020

Hi @robertlynch2020 , Not sure if this is a good idea in your environment, but you could probably write a wrapper script that stops the forwarder and in the alert use the Trigger Action "run a script" that calls this script. The problem i see is, that you would sometimes trigger this alert when there a lot of "good" events, so just a peak in "normal" events. Maybe you can combine the amount of events with some strings that are unique for the "bad" events and only trigger the alert when both is true. Hope it gives you an idea. BR Ralph -- Karma and/or Solution tagging appreciated.

rnowitzki · ‎08-24-2020

Hi @paulw10 , The event contains the service name and the status, correct? If both of them are not yet extracted to fields, than this would be the first step. If you need help with that, let us know. Once you have the fields you can run a search like: | eventid=7036 | transaction service | where state="stopped" AND state!="running" The transaction creates a mv field of the state for each service and with the where you're making sure you find events where there is only "stopped", but not "running" in it. Now you can set the alert to check every 15 minutes a timeframe of the last 15 minutes (or maybe somtething like -16m to -1m to allow some delay). Hope this helps. BR Ralph -- Karma and/or Solution tagging appreciated.

rnowitzki · ‎08-24-2020

Hi @sweiland , The timechart as recommended by @gcusello helps to create a row for each hour of the day. It will add a row even if there are no values for an hour. In addition, this will split/sumup by Hour, does not matter how many days the search timeframe is: index=_internal | timechart span=1h count | eval Hour = strftime(_time,"%H") | chart sum(count) as count by Hour Hope it helps, BR Ralph -- Karma and/or Solution tagging appreciated.

rnowitzki · ‎08-21-2020

Hi @jerinvarghese , If I understand your requirement correct now, you should be able to get this with timechart: | timechart span=1d count by sitecode BR Ralph -- Karma and/or Solution tagging appreciated.

rnowitzki · ‎08-21-2020

Hi @jerinvarghese , You don't tell us what your issue is. The SPL looks ok. I guess it is related to the fieldname "count" which could cause Problems with the operator "count" in SPL. Because all the counts are "1" in your example, it does not make a difference, but try if you want to addup all the counts and you have cases where it's not "1" for all rows.: | stats sum(count) by Time, sitecode Hope it helps. BR Ralph -- Karma and/or Solution tagging appreciated.

rnowitzki · ‎08-21-2020

Hi @bitnoise, I you take a closer look, you will notice, that the fields are called "row 1" and "row 2", and you base your where statement on "row1" and "row2" (without blanks). Therefore my comment to rename the fields. So first do this: | rename "row 1" as count1, "row 2" as count2 And than base the where command on count1 and count2 BR Ralph -- Karma and/or Solution tagging appreciated.

rnowitzki · ‎08-20-2020

Hi @bitnoise , Let's say your result is time count Thu Aug 20 13:05:00 2020 618 Thu Aug 20 13:10:00 2020 525 Than you can just add... | table count | transpose ...to make both of the counts available as a token. Does even work without the | table count, but you will have some (2) internal fields in the table as well...but actually they shouldn't care. The 618 will be in the field "row 1" the 525 in "row 2". For some cosmetic you could add e.g.: | rename "row 1" as count1, "row 2" as count2 edit: Not only for cosmetic reasons you should add the | rename. I am not sure if the token reference works with a field that has a space in the name... Glad I could help BR Ralph

rnowitzki · ‎08-20-2020

Hi @mah , This should work: | makeresults | eval ENI = "eni-1234 eni-9012 eni-9013 eni-9015" | makemv ENI | mvexpand ENI | lookup pubip.csv "ENI" OUTPUT "Public IP" as IP | where IP!="" You only need the lines starting with the lookup command. The ones above that are just to create some sample data. Sidenote: I recommend to output your "Public IP" field as "IP" (or maybe "PublicIP"), because spaces in field names cause issues. I could not get the "where" command to work correct with "Public IP" as fieldname... Hope it helps. BR Ralph -- Karma and/or Solution tagging appreciated.

rnowitzki · ‎08-20-2020

Hi @bitnoise , Change the time range to earliest -11m@m latest -1m@m (under advanced in the time range picker), this way you look at a 10m timeframe. You could just make it -10m@m and @m, it depends if you see some delay until all the data is ingested and searchable. Just gives you some buffer. Accordingly change the span to 10m | timechart span=10m count by sender| where isnull(count) OR count < 400 BR Ralph -- Karma and/or Solution tagging appreciated.

rnowitzki · ‎08-20-2020

Hi @K2 , This should work if you only have 1-4 characters in the string. If it's more, you would have to extend the case statement. | eval length=len(value) | eval timestamp=case(length=1,"00:0"+value,length=2,"00:"+value,length=3,"0"+substr(value,1,1)+":"+substr(value,2,2),length=4,substr(value,1,2)+":"+substr(value,3,2)) | fields - length The input field is "value" in my case. I just saw that yours is called "time", looking at your table, so you will have to exchange "value" with "time" in the SPL... Hope it helps BR Ralph -- Karma and/or Solution tagging appreciated.

rnowitzki · ‎08-19-2020

Hi @bitnoise , How about a timechart with span=5m with a search timeframe of from -10m to now (or maybe -11m@m to -1m@m to allow some delay). If you get 2 events, you know that it happened 2 times in a row. BR Ralph -- Karma and/or Solution tagging appreciated.

rnowitzki · ‎08-19-2020

Hi @ips_mandar, So you don't talk about the geo vizualisations that come with Splunk, but some app like this ? Never used something like that, but I guess they are customizable to the needs that you describe. You can color based on the "value" on a country level with out-of-the-box Splunk features, but that doesn 't seem to be your request and with your data it would only color Antarctica as a whole. | lookup geo_countries latitude longitude OUTPUT featureId AS country | stats sum(value) by country | geom geo_countries featureIdField=country BR Ralph

rnowitzki · ‎08-19-2020

Hi @ips_mandar , Your sample locations are pretty close to each other and on the Antarctic Ice shield. 🙂 If you want color regions with Choropleth Map other than on country- or us-states level you will need a lookup for your regions like the ones delivered with Splunk (see | inputlookup geo_countries) You could use clustered map with your data. I created some examples that are a little bit more away from each other: | makeresults | eval value = "5 51 25" | makemv value | mvexpand value | eval latitude = case(value=5,-78.123,value=51,-57.223,value=25,-47.323) | eval longitude = case(value=5,128.123,value=51,113.223,value=25,111.323) | geostats sum(value) latfield=latitude longfield=longitude To color the bubbles, you would have to put the map on a dashboard and edit the source of the dashboard. Here is an example that you can get inspiration from. Hope it helps BR Ralph -- Karma and/or Solution tagging appreciated.

rnowitzki · ‎08-19-2020

Hi @adcom26 , This took some cpu time from my brain :). Not sure if is possible with less SPL, but it should work with: | makeresults | eval ID = "1 2 3 4 5 6 7 8 9 10 11 12 13" | makemv ID | mvexpand ID | eval action = case(ID=1,"success",ID=2,"success",ID=3,"fail",ID=4,"fail",ID=5,"fail",ID=6,"success",ID=7,"fail",ID=8,"fail",ID=9,"fail",ID=10,"fail",ID=11,"fail",ID=12,"fail",ID=13,"fail") | eval user = case(ID=1,"admin",ID=2,"user2",ID=3,"user2",ID=4,"user2",ID=5,"user2",ID=6,"user2",ID=7,"admin",ID=8,"admin",ID=9,"user2",ID=10,"user2",ID=11,"admin",ID=12,"user2",ID=13,"user2") | sort - user, ID | streamstats count BY action, user reset_after="("match(action,\"success\")")" | streamstats current=false window=1 first(action) as prev_action first(count) as prev_count first(user) as prev_user | eval success=if(action="success" AND prev_action="fail" AND prev_count>=3 AND user=prev_user,"true","false") | eval fail=if(action="fail" AND prev_action="fail" AND prev_count>=3 AND user=prev_user,"true","false") | where success="true" OR fail="true" | fields - prev* fail success | sort ID You only need the lines starting with the first sort command. The lines above that are just to create a table with your sample data. I think there is one problem with the "failed" ones. The SPL would output all lines after one user "collected" 3 fails, as I don't reset the "fails" after the first 3 where found. So what I mean is, that it would show the 4th "fail" for a user, but also the 5th and the 6th etc., if there is no "success" in between....If that is wrong, the "reset after" clause would have to be somehow extended. Hope it helps. BR Ralph -- Karma and/or Solution tagging appreciated.

rnowitzki · ‎08-19-2020

Hi @bitnoise , Your requirement is not 100% clear to me. Do you want to trigger the alert, when you search a timeframe of 5 minutes and it finds (at least) 2 "sender" with a count of 0 - 99, or do you want to run the search every 5 minutes and trigger the alert when it finds something 2 times in a row? BR Ralph

rnowitzki · ‎08-18-2020

Hi @vinod0313 , @to4kawa's option is dynamic like that. You only need the part starting with | kv The lines above were just to make up some sample data. You can change ABC to ACB or ACAB or whatever your data will have - only the ones with "true" as value will be listed. Give it a try 🙂 BR Ralph

rnowitzki · ‎08-17-2020

Hi @priya0709 , Well, there has to be something "unique" to identify them. Do they always start with a capital "W"? Is there a min/max length of the string? Are the subjects where they appear always look the same. You gave 2 examples, are there more possible subjects where they appear? The following, simple RegEx would work if there are never no other words/strings that start with a capital "W" in the subject and if servername always has "W" as first character: | rex field=subject "(?<servername>W\S+)" You could make it more sensitive with adding words/characters that appear around the servername, if that is limited. Or you could specify a min and max length of the servername string. Hope it helps. BR Ralph -- Karma and/or Solution tagging appreciated.

rnowitzki · ‎08-14-2020

Hi @priya0709 , That's what @isoutamo 's first command does. You can add the field if you like: | rex field=subject "(?<wholeInc>INC\d+)" The second command was just to strip the pure number (without "INC) from the whole Incidend ID. BR Ralph

rnowitzki · ‎08-13-2020

@SabariRajanT , Ok, if it is always and for sure 4 or 5 or 6 digits, then this will work. Due to the heat in my office, I couln't come up with something more smart 🙂 But it should work: | eval length=len(employeeid) | rex field=employeeid "(?<digit4_1>\d)(?<digit4_2>\d)(?<digit4_3>\d)(?<digit4_4>\d)" | rex field=employeeid "(?<digit5_1>\d)(?<digit5_2>\d)(?<digit5_3>\d)(?<digit5_4>\d)(?<digit5_5>\d)" | rex field=employeeid "(?<digit6_1>\d)(?<digit6_2>\d)(?<digit6_3>\d)(?<digit6_4>\d)(?<digit6_5>\d)(?<digit6_6>\d)" |eval checksum=case(length=4,digit4_1+digit4_2+digit4_3+digit4_4,length=5,digit5_1+digit5_2+digit5_3+digit5_4+digit5_5,length=6,digit6_1+digit6_2+digit6_3+digit6_4+digit6_5+digit6_6) | fields - digit* length Hope it helps BR Ralph -- Karma and/or Solution tagging appreciated.

rnowitzki · ‎08-13-2020

Hi @SabariRajanT , Is the employee ID always 5 digits? In that case, this here works: | makeresults | eval employeeid="12345" | rex field=employeeid "(?<digit1>\d)(?<digit2>\d)(?<digit3>\d)(?<digit4>\d)(?<digit5>\d)" |eval checksum=digit1+digit2+digit3+digit4+digit5 (you will only need the last 2 lines) But as mentioned, only works with 5 digits. So maybe not the most smartest way. BR Ralph

rnowitzki · ‎08-13-2020

Hi @karthi2809 , I am not sure why Saturday works, because your field "dayweek" actually holds the Hour as a number (%H) and not the name of the weekday. The full weekday name is "%A". Or you work with %w (0 = Sunday, ..., 6 = Saturday). BR Ralph -- Karma and/or Solution tagging appreciated.

rnowitzki · ‎08-13-2020

Hi @priya0709 , Can you share an/some example(s) what the subject might look like? BR Ralph

Posts	241
Solutions	56
Karma Given	15
Karma Received	90
Member Since	‎05-29-2020

Online Status	Offline
Date Last Visited	‎04-17-2024 10:29 AM

Re: Comparing contents of separate but related eve...

Re: Comparing contents of separate but related eve...

Re: get alert when service is down / just once

Re: Blacklist Dynamically when alert it thrown

Re: Comparing contents of separate but related eve...

Re: Data visualization over the day (by hours)

Re: Time based counting.

Re: Time based counting.

Re: Trigger alert on multiple events

Re: Trigger alert on multiple events

Re: How to compare a search field value with a fie...

Re: Trigger alert on multiple events

Re: how to chnage "mmss" format strings to mm:ss f...

Re: Trigger alert on multiple events

Re: Change geo heatmap color based on values

Re: Change geo heatmap color based on values

Re: get row value when the last 3 value is the sam...

Re: Trigger alert on multiple events

Re: Splunk

Re: Query for split or replace command to just fet...

Re: Query for split or replace command to just fet...

Re: Split the numbers and perform addition

Re: Split the numbers and perform addition

Re: How to set message for status for job not run ...

Re: Query for split or replace command to just fet...

Join the Conversation