Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- Find Answers
- :
- About elliotproebstel
elliotproebstel
Champion
Member since:
10-12-2017
02-15-2021
Community Statistics
| Posts | 881 |
| Solutions | 206 |
| Karma Given | 82 |
| Karma Received | 367 |
| Member Since | 10-12-2017 |
Activity Feed
- Got Karma for Re: Understanding the LOOKUP command. 12-06-2023 11:23 AM
- Got Karma for Re: License usage for one index broken down by sourcetype. 12-06-2023 05:56 AM
- Got Karma for Re: Pass value to another search. 11-04-2023 05:50 AM
- Got Karma for Re: How to display a custom field with underscore from search result. 10-30-2023 03:46 AM
- Got Karma for Re: I am using a lookup table and I only want the results that have a match in the look up table.. 09-07-2023 06:29 AM
- Got Karma for Re: how to edit the title after alert saved?. 05-24-2023 02:12 AM
- Got Karma for Re: SavedSplunker - Max alive instance count=1 reached for saved search_id. 04-07-2023 12:54 AM
- Got Karma for Re: how to edit the title after alert saved?. 03-31-2023 09:36 AM
- Got Karma for Re: Is it possible to do a lookup based on IF statement?. 01-31-2023 06:35 PM
- Got Karma for Re: Can we categorize the into fields based on the value of the field?. 01-30-2023 03:14 AM
- Got Karma for Re: Drop Down based on radio button selection. 01-15-2023 11:53 PM
- Got Karma for Re: disable the all the alert?. 11-21-2022 01:59 AM
- Got Karma for Re: I am using a lookup table and I only want the results that have a match in the look up table.. 08-19-2022 04:50 AM
- Got Karma for Re: how to edit the title after alert saved?. 07-07-2022 12:18 PM
- Got Karma for Re: Is it possible to create Time chart with search with base search?. 05-11-2022 11:30 AM
- Got Karma for Re: how to get the list of non matching values of lookup with search?. 04-27-2022 11:54 AM
- Got Karma for Re: How do I parse one large comma-delimited field into multiple fields with numbered names?. 02-17-2022 03:12 PM
- Got Karma for Re: Dashboard - Base Search not returning results into panel. 02-03-2022 06:43 AM
- Got Karma for Re: Eval field based on multiple fields?. 02-03-2022 06:37 AM
- Got Karma for Re: Understanding the LOOKUP command. 02-01-2022 11:17 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 1 |
03-09-2018
12:04 PM
How are you determining 400-200 for value1 and 300-300 for value2? It looks like max(FieldA) - min(FieldA) for value1, but why 300-300 for value2? If the logic is generalizable, I can help you write the query.
... View more
03-09-2018
11:16 AM
Yeah, great point, @starcher. As is so often true with Splunk, the "correct" approach will change based on data size/types, and you'll be best off testing a few different routes and seeing which one fits your environment best.
... View more
03-09-2018
10:52 AM
1 Karma
You can use eval(isnotnull(status)) to test for the existence of a field.
... View more
03-09-2018
10:42 AM
Well, here's the approach I'm envisioning:
Step One
You run the search as you already have it:
<Base search query to produce data without lookup>
| lookup <Lookup Name> Context_Command AS "Context+Command" Type as "TYPE" OUTPUT Tags CC_Description Threshold Alert
At this point, you'll have some events that found a match, and those lines will have values populated into the fields Tags, CC_Description, Threshold, and Alert. But you'll also have some events that contain a value for "Context+Command" and TYPE but not the others.
STEP TWO
Use an appendpipe command to deal with those events that aren't fully populated:
| appendpipe
[ | where isnull(Tags)
| rename TYPE AS BACKUP_TYPE
| eval TYPE=""
| lookup <Lookup Name> Context_Command AS "Context+Command" Type as "TYPE" OUTPUT Tags CC_Description Threshold Alert
| rename BACKUP_TYPE AS TYPE ]
STEP THREE
Then filter out the events that weren't fully populated before step two, because they will be duplicated by the events returned from step two.
| where isnotnull(Tags)
But this will only work if you expect every event entry to wind up getting fully populated. If that's not the case, you may need to use some dedup or stats magic.
... View more
03-09-2018
10:13 AM
1 Karma
So if the query result has a match in the lookup file when comparing both fields, you want that result. And if the query result does not have a match when comparing both fields, you want to match on the lookup file event that has a null value for Type - yes?
... View more
03-09-2018
09:51 AM
This can handle the very simple rename option:
| rename "*[*/*]*" AS ****
... View more
03-09-2018
09:17 AM
I think you will get the results you want if you use fillnull immediately before the lookup, because I believe the issue is that the field is NULL in the events returned from the query. Try this:
<base search>
| fillnull value="" TYPE
| lookup <Lookup Name> Context_Command AS "Context+Command" Type as "TYPE" OUTPUT Tags CC_Description Threshold Alert
... View more
03-09-2018
08:45 AM
Great!! I'm glad we got it sorted.
... View more
03-09-2018
08:22 AM
search Status="*" will look for events where a field called Status exists. It will not return any events that do not contain a field called Status.
So it should be expected that these options will narrow your search, unless you expect that all of the fields you're naming in that search will be present in every event.
... View more
03-09-2018
08:06 AM
2 Karma
You can get that value by using the addinfo command. Use | addinfo and your events will all have four new fields:
info_min_time : corresponds to the "earliest" time in your timepicker
info_max_time : corresponds to the "latest" time in your timepicker <-- the one you want
info_sid : the ID of the search you ran
info_search_time : the time you ran the search
... View more
03-09-2018
07:51 AM
1 Karma
Great! Glad you got it working.
... View more
03-09-2018
07:46 AM
2 Karma
Ah, sure! The transpose command defaults to only 5 rows. Try this:
base search
| fillnull TimesRan value=1
| bucket span=1mon _time
| stats sum(TimesRan) as timesran by source _time
| xyseries source, _time, timesran
| fillnull value=0
| rename source as "Process"
| transpose 0
| eval column=if(column!="Process", strftime(column,"%b - %Y"), column)
| transpose 0 header_field=column
| fields - column
... View more
03-09-2018
07:26 AM
2 Karma
There might be a cleaner way to do this, but this should work:
base search
| fillnull TimesRan value=1
| bucket span=1mon _time
| stats sum(TimesRan) as timesran by source _time
| xyseries source, _time, timesran
| fillnull value=0
| rename source as "Process"
| transpose
| eval column=if(column!="Process", strftime(column,"%b - %Y"), column)
| transpose header_field=column
| fields - column
... View more
03-09-2018
06:25 AM
Is the data from this file indexed into Splunk? What dictates an event break - each new line? Or is this data in a lookup file?
... View more
03-09-2018
06:20 AM
If you want to add a row at the bottom of your results that counts the number of events with totaldays<=28 and put a label of "Total Count 28 Days or Less" into the timestamp field, this should do it:
your current search
| appendpipe
[| stats count(eval(totaldays<=28)) AS totaldays
| eval timestamp="Total Count 28 Days or Less" ]
... View more
03-09-2018
06:05 AM
Well, that's quite odd. Any chance you can post a screencap (with any sensitive data covered up) or copy/paste the events and full query (again, redacted as needed) so I can see if there's anything I can spot?
... View more
03-09-2018
05:56 AM
1 Karma
It is normal (expected behavior) that a macro cannot start with a pipe, regardless of whether it's used in a scheduled search or an ad-hoc search.
... View more
03-09-2018
05:36 AM
Ok, let's back up a little bit. I assume it's always true that a ticket starts in a state with short_description="New" , moves next into short_description="In Progress" , and concludes with short_description="Complete" . If that's true, then this code snippet:
| eventstats earliest(short_description) AS old_description latest(short_description) AS new_description BY number
should result in each ticket getting a new field called old_description="New" , because that would always be the earliest state that a ticket was in. Tickets that past the state of being new would either wind up with new_description="In Progress" (if the ticket never got completed) or new_description="Complete" (if the ticket did get completed).
So how about identifying two tickets in your records - one that did get completed, and one that never reached completion, and running a search like this:
whatever search finds all events involving those two tickets
| eventstats earliest(short_description) AS old_description latest(short_description) AS new_description BY number
Do you wind up with the expected values for old_description and new_description ?
... View more
03-08-2018
04:41 PM
The most common ways people incorporate python into Splunk are by writing custom search commands or external lookups. Do you have a use case? If you describe it, I'm happy to help you figure out the best way to approach it.
... View more
03-08-2018
01:44 PM
Yes, it's definitely possible. But since you asked, I'm guessing you've been trying and have had issues. If you can share what you've been trying to do and the problems you've encountered, we can try to help.
... View more
03-08-2018
11:57 AM
1 Karma
Step One: Create and upload lookup file
For your purposes, you can turn that list into a CSV by ensuring you have one IP address per line and prepending a header row by adding a single row at the top of the file containing the name you'd like to call that field - something like ip , probably. Save the file with a .csv extension, and then use the Splunk UI to add it as a Lookup table file: Settings > Lookups > Lookup table files > Add new . Upload the file into the app in which you plan to use it, and remember the name you give it (the name should end in .csv). Let's say you named it campus_ips.csv so I can reference it later.
Step Two: Use lookup in search
If you want to use the list of IP addresses as a search filter across your Palo Alto logs and retain only events from those IPs whose severity=high, then this should work:
index="something palo alto" sourcetype="something palo alto" severity=high
[| inputlookup campus_ips.csv
| fields ip
| format ]
... View more
03-08-2018
11:36 AM
If you have successfully extracted the dates into SNDateCreated and want to sort reverse-chronologically and retain only those in the last 14 days:
your search
| where date>=strftime(relative_time(now(), "-14d"), "%m/%d/%Y")
| sort - date
... View more
03-08-2018
11:27 AM
1 Karma
You can avoid returning an error by using fillnull to populate the field with an empty string:
index=*sourcetype=* "Invalid"
| rex field=_raw ".*for\sinvalid\s(?<id>.*?(?=:))"
| table id
| fillnull value="" id
| map maxsearches=5 search="dbxquery query=\"select id, name,cell,email, date from idx where id='$id$'\" connection=sql"
... View more
03-08-2018
11:19 AM
I'm trying to wrap my head about this, but I am not sure I get it. My best guess is that we need to separate the depends and rejects statements. Does it work if you replace the final <row> element with this:
<row>
<panel depends="$showOne$">
<table rejects="$show_html1$">
<search base="search_1">
<query>
my_query
</query>
</search>
<option name="count">100</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">none</option>
<option name="percentagesRow">false</option>
<option name="rowNumbers">false</option>
<option name="totalsRow">false</option>
<option name="wrap">true</option>
</table>
<html depends="$show_html1$">
<p style="color:green;margin-left:30px;font-size:30px">No Errors</p>
</html>
</panel>
<panel depends="$showTwo$">
<table rejects="$show_html2$">
<search base="search_2">
<query>
my_search
</query>
</search>
<option name="count">100</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">none</option>
<option name="percentagesRow">false</option>
<option name="rowNumbers">false</option>
<option name="totalsRow">false</option>
<option name="wrap">true</option>
</table>
<html depends="$show_html2$">
<p style="color:green;margin-left:30px;font-size:30px">No Errors</p>
</html>
</panel>
</row>
... View more
03-08-2018
09:12 AM
Given your goal, I think you will get what you're looking for if you replace this:
| streamstats current=true last(short_description) AS old_description, first(short_description) AS new_description BY number
with this:
| eventstats earliest(short_description) AS old_description latest(short_description) AS new_description BY number
... View more
