Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- About rnowitzki
rnowitzki
Builder
Member since:
05-29-2020
04-17-2024
Community Statistics
| Posts | 241 |
| Solutions | 56 |
| Karma Given | 15 |
| Karma Received | 90 |
| Member Since | 05-29-2020 |
Activity Feed
- Got Karma for Re: Data visualization over the day (by hours). 01-31-2025 07:01 AM
- Got Karma for Re: Fill null values with field values from previous line/event (conditional fillnull values). 09-11-2024 05:21 AM
- Got Karma for Re: Trigger alert on multiple events. 05-07-2024 11:37 AM
- Got Karma for Re: Trigger alert on multiple events. 05-07-2024 11:37 AM
- Got Karma for Re: Trigger alert on multiple events. 05-07-2024 11:37 AM
- Posted Re: HTTP Event Collector- Is there something wrong with this curl command? on Splunk Cloud Platform. 05-31-2023 01:26 AM
- Posted Re: How to write query to get count of total volume and system errors in a single query on Splunk Search. 05-12-2023 12:31 AM
- Posted Re: Drop 9 of 10 Events (Sampling) on Getting Data In. 03-10-2023 05:16 AM
- Posted Re: Where can I find info from Splunk wiki (props attributes)? on Deployment Architecture. 01-06-2023 04:43 AM
- Posted Re: How to achieve to _time filter with transpose? on Splunk Enterprise. 11-21-2022 12:57 PM
- Got Karma for Re: Why is Windows Event Log Whitelist not working?. 11-21-2022 09:21 AM
- Posted Re: How to achieve to _time filter with transpose? on Splunk Enterprise. 11-21-2022 07:13 AM
- Posted Re: How to achieve to _time filter with transpose? on Splunk Enterprise. 11-21-2022 01:42 AM
- Posted Re: Why is Windows Event Log Whitelist not working? on Getting Data In. 11-18-2022 01:43 AM
- Posted Re: How to achieve to _time filter with transpose? on Splunk Enterprise. 11-18-2022 12:58 AM
- Got Karma for Re: Send mail to user in search results. 06-10-2022 03:00 PM
- Got Karma for Re: Average of values of duplicate entries. 05-22-2022 11:27 PM
- Posted Re: Average of values of duplicate entries on Splunk Search. 05-18-2022 06:29 AM
- Posted Re: How do you map value from inputlookup to another search on Splunk Search. 05-12-2022 02:22 AM
- Karma Re: How do you map value from inputlookup to another search for johanhakim. 05-12-2022 02:22 AM
Topics I've Started
No posts to display.
06-26-2020
06:39 AM
Hello @smahuja , Not sure what you exactly mean. If the filename/objectname is in the results of your annotation search, you can display it as the text of the Annotation. | eval annotation_label = <field> Is that what you need?
... View more
06-26-2020
04:25 AM
Hi @vamsi202 , You can reference fields from the search with $result.fieldname$ See https://docs.splunk.com/Documentation/Splunk/latest/Alert/EmailNotificationTokens Hope this helps. BR Ralph
... View more
06-26-2020
02:53 AM
Hi @smahuja , Should the text also be alligned to some time on the chart? If I understood your request correct, you could work with Event Annotation. https://docs.splunk.com/Documentation/Splunk/latest/Viz/ChartEventAnnotations You have to edit the Dashboards XML as described in the Documentation. Hope this helps. Ralph
... View more
06-25-2020
01:52 AM
You could either change "count" directly with the eval: | eval count = if(count=1, "true", "false") or you remove "count" after you evaled "countflag" (or any other fieldname of your choice) | fields - count
... View more
06-25-2020
01:19 AM
Hi @sharadrk , Is this what you are looking for? | eval countflag = if(count=1, "true", "false") ("countflag" can be anything, you could eve overwrite the count field itself.) It's not really boolean, just the strings "true" or "false". In the Documentation it says "The result of an eval expression cannot be a Boolean." But you should be able to work with that way. https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Eval
... View more
06-24-2020
11:18 AM
@mah you're welcome. I learned something myself 🙂 You might want to set my last reply as the solution, for future splunkers having similiar issues. Cheers Ralph
... View more
06-24-2020
04:56 AM
I don't get the issue on reg101 (it does not select anything outside of the "variables" section). But I updated it, by appending the closing 2 brackets at the end. https://regex101.com/r/eXmyO3/6 (?<="Variables"\:\s\\\{)(?>\"\S+?\s?\S+\"\:\s\"(\S+)\"\,\s)?(?>\"\S+?\s?\S+\"\:\s\"(\S+)\"\,\s)?(?>\"\S+?\s?\S+\"\:\s\"(\S+)\"\,\s)?(?>\"\S+?\s?\S+\"\:\s\"(\S+)\"\,\s)\\\}\\\} Getting closer - i hope 🙂
... View more
06-24-2020
02:26 AM
I just saw that you basically assked the question twice. https://community.splunk.com/t5/Splunk-Search/How-to-find-the-no-of-days-different-between-indexed-date-time/td-p/505761/jump-to/first-unread-message You are on a good way with Giuseppe, so maybe you want to remove this duplicate.
... View more
06-24-2020
02:21 AM
Hi @karunagaraprabh , Looking at your screenshot, it looks like printedA_epoch an printedA_epoch are MV (Multi Value) fields, is that correct? So something in your SPL (that is not visible in your Screenshot) puts all the timestamps belonging to one host in a MV field. So the calculation does not work. You have to know/define which timestamp you want to calculate against the indextime, or (if you need to calculate against all) you have to change the SPL so that there is a line for each A and B timestamp pair. We might need the full SPL and/or some sample data to help more detailed.
... View more
06-24-2020
02:04 AM
Hi @connoroni2 , You could just exchange streamstats with timechart, directly after the Base Search. + You were using "t-f" to eval "s", but "f" was not defined, so I changed it to "t-Failed". (this is just a question of taste, but I like "speaking" Variables. Why don't you use "total" instead of "t"and "success" instead of "s" in the first place?) ...BASE SEARCH...
| timechart count(eval(match(job_result, "FAILURE"))) AS Failed,
count(eval(match(job_result, "SUCCESS"))) AS Passed,
count(eval(match(job_result, "ABORTED"))) AS Aborted
count as t
| eval s = t-Failed, percF = (Failed/t)*100, percS=100-percF
| rename t as Total, percF as FailureRate, percS as SuccessRate Also, as a side note: You don't account for the Aborted; the SuccessRate now is just taking the Total minus the Failed ones, but the Aborted ones are not calculated in.... Now the (visual) problem might be, that the Failure- and SuccessRate are just flat lines in the chart, depending on how much Total is. Maybe you want to show the real numbers of Failed and Passed (and Aborted) in another chart as the percentages. Or you check how it looks like with changing the format of the Y-Axis to "Log" instead of "Linear"... Hope this helps.
... View more
06-24-2020
01:29 AM
1 Karma
Hi @Pdingema , Available at https://partnereducation.splunk.com/ But the Accreditations are not available at the moment, being updated until June 26.
... View more
06-24-2020
12:51 AM
Hi @mah, Ok, then we have to add optional space and optional second word to the regex. (?<="Variables"\:\s\\\{)(?>\"\w+?\s?\w+\"\:\s\"(\S+)\"\,\s)?(?>\"\w+?\s?\w+\"\:\s\"(\S+)\"\,\s)?(?>\"\w+?\s?\w+\"\:\s\"(\S+)\"\,\s)?(?>\"\w+?\s?\w+\"\:\s\"(\S+)\"\,\s)? The question marks before \s and \w+ mean: there might or might not be a space and another word after the first word.... The example shown above works with max 4 key value pairs. If you expect more, append more of these: (?>\"\w+?\s?\w+\"\:\s\"(\S+)\"\,\s)? Hope this works better.
... View more
06-23-2020
02:26 AM
1 Karma
Hi @gcusello , Just to show you how you can work with " the date string" as a date: | eval Date = strptime(Date, "%Y-%m-%d")
| eval Year = strftime(Date, "%Y")
| eval Month = strftime(Date, "%m")
| eval Day = strftime(Date, "%d") With the strptime() you convert your yyyy-mm-dd to Unix time and afterwards you can derive Year, Month and Day with strftime from it. https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/DateandTimeFunctions https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Commontimeformatvariables
... View more
06-22-2020
01:38 AM
1 Karma
Hi @rock_s , This is now comparing the current time with the SLA start and end time including date, hour, minute: | eval SLA_start_datetime=strptime(SLA_start_date+SLA_start_time, "%m%d%y%H:%M")
| eval SLA_end_datetime=strptime(SLA_end_date+SLA_end_time, "%m%d%y%H:%M")
| eval curr_datetime = now()
| eval status=case(SLA_start_datetime>curr_datetime, "NOT_STARTED", SLA_start_datetime<curr_datetime AND SLA_end_datetime<=curr_datetime, "COMPLETED",SLA_start_datetime<=curr_datetime AND SLA_end_datetime>curr_datetime, "RUNNING")
| eval SLA_start_datetime=strftime(SLA_start_datetime, "%m%d%y %H:%M")
| eval SLA_end_datetime=strftime(SLA_end_datetime, "%m%d%y %H:%M")
| eval curr_datetime = strftime(curr_datetime, "%m%d%y %H:%M")
| fields job SLA_start_datetime SLA_end_datetime curr_datetime status The first block adds together start/end date and time and converts it to unix time, also adds the current time as unix time. The second block sets the status. The third block converts the date fields back to human readable format. And the last line, with fields just puts together the final output table.
... View more
06-19-2020
04:15 AM
You could use your SPL as is and: set the search time to either 3 minutes ago or (to allow some buffer) to something like from -4m@m to -1m@m in the alert use a trigger condition of "is equal to" 0 have it run with the cron schedule */3 * * * * and you should be good. BR edit: @gcusello was quicker 🙂
... View more
06-19-2020
04:02 AM
1 Karma
Hi @shlomihertzberg , This works, but I guess there are smarter ways: index=windows_auth EventID=4720 OR EventID=4726
| dedup EventID, User
| stats count by User
| where count>1
| fields - count The dedup is just for the (I guess) rare case where a User is being created and/or deleted more than just 1 time within 10 minutes. Now you just have to put your search to a 10 minute timeframe. Edit 22/6: Needs to be "OR" in the first line instead of "AND" of course 🤐 (thx @isoutamo)
... View more
06-18-2020
12:22 AM
You're welcome. And you actually changed props.conf with that, but using the UI instead of CLI/vi 🙂 Happy splunking.
... View more
06-17-2020
08:38 AM
Hi @spkriyaz , As you don't use sort or any subsearch (which are by default limited to 10.000) my best guess is that it is affected by this setting in the savedsearches.conf action.email.maxresults = <integer> * This value affects all methods of result inclusion by email alert: inline,
CSV, and PDF. https://docs.splunk.com/Documentation/Splunk/latest/Admin/Savedsearchesconf Does it work if you executre it manually?
... View more
06-17-2020
08:19 AM
Hi @mah, I created a RegEx that might work. I could not find a way to make it super-dynamic, but if you know the max number of key:value pairs in the data, it should work: (?<="Variables"\:\s\\\{)(?>\"\w+\"\:\s\"(\S+)\"\,\s)?(?>\"\w+\"\:\s\"(\S+)\"\,\s)?(?>\"\w+\"\:\s\"(\S+)\"\,\s)?(?>\"\w+\"\:\s\"(\S+)\"\,\s)? This example works if you have 4 or less Key/Value pairs. They will be assigned to group1, group2 etc. If you expect more than 4, you have to append more of these: (?>\"\w+\"\:\s\"(\S+)\"\,\s)? Note: This does work with the format where the values are in quotes, in your initial post you had an example where the values were not within quotes. Reg101 link
... View more
06-17-2020
12:53 AM
1 Karma
Hi @peterkn , Can you share a few lines of the csv? Splunk tries to get a time for each event / row. It seems that is uses a field that not really is a timestamp or fails to get the correct values from it. Maybe some number that could be interpreted as a unix/epoch timestamp. You have to tell Splunk where the timestamp is and how to interprete it. Either in the UI or in props.conf. => Explained here. The "current time" / time when indexing is the last option being used. If there is no timestamp, you could add one to each row with (e.g.) sed. If a script copies the file, it would be an easy enhancement. Or you configure props.conf as decribed here to really use the current time/index time.
... View more
06-16-2020
08:23 AM
The alert will have a schedule, so it runs every hour, day, week etc. So, the timeframe of the search just has to cover that range + maybe some buffer and it should catch every change. So, when you have your alert set to run every hour, you look back something like 65 minutes in your search. That way you shouldn't miss a change to the field values. If you run it daily, you maybe want to look back 25 hours. Not even sure if that buffer is needed. It should work with the exact same range/timeframe as you set the alert to. Maybe I miss something/missunderstood you.
... View more
06-15-2020
04:32 AM
Well, it seems to me as if your date fields are not refering to the sla end/start time. So, you actually have only the hour for the sla times. In that case, I can not think of another solution than already posted above. (to assume the end_hour is refering to the next day if it is "smaller" than the start_hour) Did you try my last SPL?
... View more
06-15-2020
04:22 AM
Hi @jerinvarghese , Add this at the very end and it should sort correct. | eval sort_time=strptime(Time,"%b-%d")
| sort 0 sort_time
| fields - sort_time edit: you should remove your first sort, based on "Time".
... View more
06-15-2020
03:42 AM
I adjusted the SPL a bit, so it does work. I would still suggest to integrate the date, if you access to the date for sla start- and endtime. | eval status=if(curr_date_hour>substr(SLA_start_time,1,2) AND curr_date_hour>=substr(SLA_end_time,1,2) AND SLA_start_time < SLA_end_time, "COMPLETED", if(curr_date_hour<substr(SLA_start_time,1,2),"NOT_STARTED", if(curr_date_hour>=substr(SLA_start_time,1,2) AND (curr_date_hour<substr(SLA_end_time,1,2) OR SLA_start_time > SLA_end_time),"RUNNING", "ERROR_IN_STATUS_DETECTION"))) I adjusted the detection of COMPLETED by adding "AND SLA_start_time < SLA_end_time" and for RUNNING ones by adding "OR SLA_start_time > SLA_end_time", assuming the sla end hour is smaller when it is refering to the next date. This might not work for all cases. It would be more clean to work with the whole date. Also it might be more readable working with case instead of ifs.
... View more
- « Previous
- Next »
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
04-17-2024
10:29 AM
|
Karma given to
