About poojak2579

poojak2579 · ‎11-12-2017

Thanks for the reply. Here is the sample tabular data for the three panels: Changes by User Asset Root User1 User2 A1 100 5 2 A2 20 4 6 A3 50 0 8 Changes by Severity Asset Severity1 Severity2 A1 200 100 A2 100 50 A3 300 100 Changes by ChangeType Asset Added Modified A1 150 150 A2 50 100 A3 200 200 I am passing three tokens Severity,User and ChangeType to the textboxes in the drilldown. Drilldown is a single panel dashboard that will show the same details based on what user clicks. Here is sample Drilldown Data: When first panel is clicked and user info is passed : Asset Severity ChangeType User A1 Severity1 Modified User1 A1 Severity2 Added User1 Drilldown when the chart in the second panel is clicked and severity is passed to the drilldown Asset Severity ChangeType User A1 Severity1 Modified Root A1 Severity1 Added A3 Severity1 Modified User1 As we can see in the sample data there are some records that dont have user name. We want to display all the records irrespective of user name when second panel is clicked and severity is passed but want to display records associated with a user when first panel is clicked and user is passed . Please let me know how I can work without creating textbox in the drilldown.

poojak2579 · ‎11-11-2017

Thanks for the reply There is a single panel in the drilldown dashboard that will show the details based on the input. First Chart in the main dashboard passes user name and asset name whereas second chart passes severity name and asset name to the drill down dashboard There are certain records that does not have user name but if we hide it, results will not come until it gets the input for user type. When second chart is clicked there will be no input for user name ,but we want to show all the records irrespective of user name. I tried by adding this statement also: |eval a = if(isnull(user),"*",user) |where user=a It does not work when user=* as * does not work with where clause. Please suggest if there is any other way to do this.

poojak2579 · ‎11-10-2017

I want to pass tokens to the drilldown dashboard depending upon the panel that user selects. Current Code <title>Changes by User</title> <chart> <search> <query>index=a |chart count over Asset by user usenull=false</query> <earliest>-90d</earliest> <latest>now</latest> </search> <drilldown> <link> <![CDATA[/app/search/b_clone?form.Asset=$click.value$&form.user=$click.name2$]]> </link> </drilldown> </chart> </panel> <panel> <title>Changes by Severity</title> <chart> <search> <query>index=a|chart count over Asset by SeverityName</query> <earliest>-90d</earliest> <latest>now</latest> </search> <link> <![CDATA[/app/search/b_clone?form.Asset=$click.value$&form.SeverityName=$click.name2$]]> </link> </drilldown> </chart> </panel> <panel> <title>Changes by Type</title> <chart> <search> <query>index=a|chart count over asset by changetype usenull=false</query> <earliest>-90d</earliest> <latest>now</latest> </search> <drilldown> <link> <![CDATA[/app/search/b_clone?&form.Asset=$click.value$&form.ChangeType=$click.name2$]]> </link> </drilldown> I can create a drilldown with static textboxes containing tokens of severityname, changetype and user but I want to create tokens depending upon the panel that user clicks. If the user clicks on the secondchart, the drilldown should have a textbox of severity name and asset only whereas if he clicks on the secondchart, the drilldown should have user and asset tokens only. Can we add a condition which creates token depending upon what panel is clicked? My second question is if can we use tokens in the drilldown without creating input text boxes?

poojak2579 · ‎09-13-2017

I tried accelerated Datamodel and summary index but it didn't work because of some limitations . https://answers.splunk.com/answers/556349/how-to-join-data-from-two-indexes.html https://answers.splunk.com/answers/569099/lookup-fields-not-updating-in-the-datamodel.html

poojak2579 · ‎09-12-2017

Let me make it more clear. There are vulnerabilities on the assets. ID is the Vulnerability Id and First_Found is the date when it was first found on the asset. Because of some reason there are multiple First_Found for the combination of Asset+Id. I want to take earliest First_Found and assign it to the combination of Asset+Id. I have scheduled a query to run everyday which will check Earliest First_Found in last one year and it takes long time to run. Is there any way we can assign min of First_Found to Asset+Id so that I don't have to run that query over and over again?

poojak2579 · ‎09-12-2017

Thanks for the reply. I am already using the first code but it is taking long time to run the query because I have to check million of records with a time range of more than 1 year. I want to normalize it, assign the min(First_Found) to all the combos at once and then use it everywhere. Please let me know if there is any other way to do it.

poojak2579 · ‎09-09-2017

I have a field which contains first_found_date and due to some reason it keeps on changing for some of the assets. Example: If an asset "A1" has 3 first_found_date over a period of time: 2017-06-20 22:30:30 2016-05-25 22:30:30 2017-01-25 22:30:30 I want to use earliest first_found(i.e 2016-05-25 22:30:30) in all my reports. If I use the following query to check the earliest first_found , it takes more than 1 hour to get the value because it has to go through all the records over the period of time. sourcetype=a |eval combo = Asset+"_"+ID |stats min(FIRST_FOUND) as earliest_ff by combo Is there any way we can correlate the asset with its earliest first_found_date without editing props.conf?

poojak2579 · ‎09-09-2017

Thanks for the answer. I will have to ask my administrator because I don't have right to enable or disable acceleration.

poojak2579 · ‎09-09-2017

I have a summary range of 1 month. I thought fields in the datamodel are dynamically populated. Does that mean we can not take benefits of accelerated data model if the lookup is updated every day? Can we schedule it to rebuld everyday after the lookup is updated?

poojak2579 · ‎09-09-2017

Thanks for replying. I thought the dynamic lookup attribute will pick up the value change because splunk automatically rebuild datamodels when it finds that those models are outdated. Is there any way I can rebuild the datamodel everyday after the lookup is updated?

poojak2579 · ‎09-09-2017

Thank you.

poojak2579 · ‎09-08-2017

I have built an accelerated datamodel with lookup fields. There is a report that is scheduled to run everyday to populate the lookup. The datamodel does not get updated when lookup file is updated. But if I disable acceleration, I can see the fields updated. Do I have to rebuild the datamodel every time lookup file is updated or it is rebuild automatically?

poojak2579 · ‎07-18-2017

Dont know why it is not working for me. I guess I have to use another approach than the summary indexing to make those queries faster that checks for earliest first found among million of records. Thanks everyone for your help.

poojak2579 · ‎07-18-2017

So you are getting events for yesterday and today only and not 30 days?

poojak2579 · ‎07-18-2017

Please ignore that. I am using summary for all my queries. Please ignore that mistake.

poojak2579 · ‎07-18-2017

I shows me both the sourcetypes if I use "append" but only one sourcetype if I use "OR"

poojak2579 · ‎07-18-2017

I think we cant use earliest like that. I tried this query on the same index and got today's results only. (index=I earliest=-3d@d latest=now) OR (index=I earliest=-5d@d latest=now). Is there any other way to get data from two different indexes with different time frame and without using join or append?

poojak2579 · ‎07-18-2017

Thanks Dal Jeanis I have that initial open parenthesis in my query. (index=I earliest=-1d@d latest=now) OR (index=summary earliest=-1Y@Y latest=now) Actually I was also not sure when I posted this question if we can use earliest like that with two different values in two different parenthesis.

poojak2579 · ‎07-18-2017

If I am not wrong "OR" should return everything from the index=I as well as Index=summary. (index=qualys_summary earliest=-1Y@Y latest=now) returns 8000 Assets (index=I earliest=-1d@d latest=now) returns 6000 Assets (index=I earliest=-1d@d latest=now) OR (index=summary earliest=-1Y@Y latest=now) returns 2500 Assets from Index=I only Both the indexes have different fields. But Asset and Id is common to both.

poojak2579 · ‎07-17-2017

It will be great if anybody can help me understand why Or is not working for me.

poojak2579 · ‎07-17-2017

Thanks for the reply.

poojak2579 · ‎07-17-2017

Thanks for the reply. Not sure why OR is not working for me. I tried this but it is not showing all the Assets. index=I earliest=-1d@d latest=now) OR (index=summary earliest=-1Y@Y latest=now)

poojak2579 · ‎07-17-2017

Thanks for the reply. I tried it with append also but results are truncated to maxout of 50000.

poojak2579 · ‎07-17-2017

am sorry for the mistake, I wrote just part of the query . Index=I has many other fields along with Asset and Date. I want to get the Earliest Date when that asset was tracked. Here is the query index=I earliest=-1d@d latest=now |eval combo = Asset+""+ID |stats min(First_Found_Date) as Earliest_FF by combo |join type=left combo[search index=summary earliest=-1Y@Y latest=now|eval combo=Asset+""+ID|stats min(Earliest_FF) as Earliest_FF by combo|eval combo1=combo] |where isnull(combo1)

poojak2579 · ‎07-17-2017

I want to get data from joining two indexes out of which one is summary index. Summary Index has more than 500000 records I have two fields Asset and Date in the summary index as well as in the other index. I am planning to schedule a query that will check for any new asset in today's records and if it is a new, it will insert that record in the summary index. I tried to do it by leftjoin but it works if I specify a particular value for the Asset. Below is the query that works(ASSETNAME is the hard coded value) index=I ASSETNAME earliest=-1d@d latest=now |fields Asset Date |join type=left Combo(index=summary ASSETNAME earliest=-1Y@Y latest=now|eval Asset1=Asset |where isnull(Asset1) The same query does not work if I remove the asset name and run it with all the records in the Summary Index. It shows me null values in the column 'Asset1' for the assets that are there in the summary index. I am not sure if it is because of the the limit of the records a subsearch can return. Please suggest that if there is a better way of querying instead of using join. I tried to do it by this way also but it is not showing me complete set of records. (index=I earliest=-1d@d latest=now) OR (index=summary earliest=-1Y@Y latest=now)

Posts	50
Solutions	0
Karma Given	12
Karma Received	0
Member Since	‎04-22-2015

Online Status	Offline
Date Last Visited	‎02-05-2025 05:01 PM

Regex to extract letters only

Capture similar strings in the logs

Submit button functionality not working

Login page Banner Message

Can you help me Join 3 source types using OR?

How to create tokens dynamically

How to get earliest datetime

Lookup Fields not updating in the Datamodel

How to join data from two indexes

Re: How to create tokens dynamically

Re: How to create tokens dynamically

How to create tokens dynamically

Re: How to get earliest datetime

Re: How to get earliest datetime

Re: How to get earliest datetime

How to get earliest datetime

Re: Lookup Fields not updating in the Datamodel

Re: Lookup Fields not updating in the Datamodel

Re: Lookup Fields not updating in the Datamodel

Re: Lookup Fields not updating in the Datamodel

Lookup Fields not updating in the Datamodel

Re: How to join data from two indexes

Re: How to join data from two indexes

Re: How to join data from two indexes

Re: How to join data from two indexes

Re: How to join data from two indexes

Re: How to join data from two indexes

Re: How to join data from two indexes

Re: How to join data from two indexes

Re: How to join data from two indexes

Re: How to join data from two indexes

Re: How to join data from two indexes

Re: How to join data from two indexes

How to join data from two indexes

Are you a member of the Splunk Community?