Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Are you a member of the Splunk Community?
Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- Find Answers
- :
- About DanielFordWA
DanielFordWA
Contributor
Member since:
05-07-2013
06-05-2020
Community Statistics
| Posts | 143 |
| Solutions | 7 |
| Karma Given | 77 |
| Karma Received | 22 |
| Member Since | 05-07-2013 |
Activity Feed
- Karma Re: How do I unzip a file when pulling it from REST API? for Damien_Dallimor. 06-05-2020 12:49 AM
- Karma Re: How do I set a query to run overnight without it expiring before it completes? for mayurr98. 06-05-2020 12:49 AM
- Karma Re: Since splunk 6.4 some users do not see the "export" button anymore for yannK. 06-05-2020 12:48 AM
- Karma REST Modular Input - Cron Schedule not working. Known Issues? for Dohrendorf_Cons. 06-05-2020 12:48 AM
- Karma Re: Add power user permissions to all private Admin Reports and Lookups for nromito_splunk. 06-05-2020 12:48 AM
- Karma Re: Combine and dedup results to only show one row per user for sundareshr. 06-05-2020 12:48 AM
- Karma Re: Restrict specific users to view only certain panels for niketn. 06-05-2020 12:48 AM
- Karma Re: Spath parsing error, last event in JSON for jkat54. 06-05-2020 12:48 AM
- Got Karma for Re: REST API Modular Input: Is there a limit on JSON size before parsing?. 06-05-2020 12:48 AM
- Karma Re: How to get searches to run automatically after a lookup is updated instead of manually scheduling reports? for Richfez. 06-05-2020 12:47 AM
- Karma How to make the value to be column for chrismok. 06-05-2020 12:47 AM
- Karma Re: Splunk DB Connect v1: Database inputs not working for n00badmin. 06-05-2020 12:47 AM
- Karma Re: Parsing out raw JSON with LINE BREAKER for Damien_Dallimor. 06-05-2020 12:47 AM
- Karma Why time range picker on default Splunk 6.1.x UI shows "Earliest time cannot be greater than latest time" errors? for wpreston. 06-05-2020 12:47 AM
- Karma Re: Why real-time alerts can lead to insufficient disk space on a device and cause splunkweb to not start? for Michael. 06-05-2020 12:47 AM
- Karma Re: With IIS logs in GMT and the forwarder, indexer, and search head in UTC, what configuration do I need for a user in BST to search logs real-time? for woodcock. 06-05-2020 12:47 AM
- Karma Dashboard Input Error When Time Is Set As "All Time" for LuiesCui. 06-05-2020 12:47 AM
- Karma Re: New users per month for David. 06-05-2020 12:47 AM
- Karma Unknown search command 'gauge'. for polamarasetti. 06-05-2020 12:47 AM
- Karma Re: Will _time of raw events in an index change in the summary index if searches to summarize data are run using an admin account set to a different timezone? for woodcock. 06-05-2020 12:47 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
11-06-2013
06:40 AM
I think I have worked out the issue. If I look at an individual users activity for a day and filter descending on URL value I come to same results as from our query above.
It seems that the mvindex is ordering results on URL value (A-Z) and not time of the hit by user.
For an individuals activity I see the order (A-Z URL value)
/SearchResults/
/Toolbox/Dev Tools
/Toolbox/Dev Tools
/Toolbox/Product
/Toolbox/Product
/Toolbox/Service
I see the next pages in the above query as
nextpage1=/Toolbox/Dev Tools
nextpage2=/Toolbox/Product
nextpage3=/Toolbox/Service
How can I fix this?
... View more
11-06-2013
06:03 AM
Also the pages are not in the correct order. The page values in nextpage1 have been seen by the user but not before or after the /Search/Results/
I remove the eval m = n - 4 and added
| eval nextpage1 = mvindex(cs_uri_stem, 1)
| eval nextpage2 = mvindex(cs_uri_stem, 2)
| eval nextpage3 = mvindex(cs_uri_stem, 3)
| stats count by cs_uri_stem nextpage1 nextpage2 nextpage3 cs_username
This shows pages the user has seen but not in any correct order, I checked against some users by looking at the date time stamp of all the users hits in the logs.
... View more
11-06-2013
05:38 AM
Thanks for the response.
I have tried the below, however in the cs_uri_stem field there are all types of pages instead of just "/Search/SearchResults/"
sourcetype="iis-2" | extract auto=true | search | transaction cs_username maxspan=30m
| eval n = mvfind(cs_uri_stem, "/Search/SearchResults/")
| eval m = n + 1
| eval nextpage1 = mvindex(cs_uri_stem, m)
| stats count by cs_uri_stem nextpage1
| eval cs_uri_stem=urldecode(cs_uri_stem) | eval nextpage1=urldecode(nextpage1)
... View more
11-06-2013
03:52 AM
sourcetype="iis-2" | extract auto=true | search [ search cs_username="*123*" AND cs_uri_stem="*/SearchResults*" | fields cs_username ] | stats count(DocAction) by cs_username DocType date_mday
The above works when the date range of one day is selected. I can see who used search and what Documents were viewed and the actions taken against them.
In the below I am trying to understand the users that used search and how many documents were viewed in the same session for a larger time period, week , month, year etc.
I do not have a session ID, I use transaction cs_username maxspan=30m.
With this in mind will the "count" below give me the total number of sessions for a user and the documents viewed for all sessions, not just sessions with search "/SearchResults" as I am using the cs_username instead of a session ID?
Do I need to create session ID? If so how could I do this before or after indexing?
sourcetype="iis-2" | extract auto=true | search [ search cs_username="*123*" AND cs_uri_stem="*/SearchResults*" | transaction cs_username maxspan=30m | fields cs_username ] | transaction cs_username maxspan=30m | stats count count(DocAction) by cs_username DocType date_mday
... View more
11-06-2013
02:12 AM
I try the following.
sourcetype="iis-2" | extract auto=true | search | transaction cs_username maxspan=30m
| eval n = mvfind(cs_uri_stem, "/SearchResults.*")
| eval m = n - 4
| eval prevpage4 = mvindex(cs_uri_stem, m)
| table cs_uri_stem prevpage4
| eval cs_uri_stem=urldecode(cs_uri_stem)
The data looks a bit odd. I would expect to have /SearchResults/ in the cs_uri_stem field however this is populated with all different types of page.
It would be good to see the number of hits on the Search results page the a list of all previous 4 pages combinations and hits against them?
... View more
11-06-2013
01:40 AM
Sorry the error was due to my poor regex, thanks for the answer, works great.
... View more
11-06-2013
01:36 AM
Hi, I am trying your solution, thanks for the response.
I use the cs_username field instead of session ID and look at the data over a 1 day range.
I get the below error.
Error in 'eval' command: Regex: nothing to repeat
... View more
11-06-2013
01:34 AM
Hi, Currently I have no session ID, I break the data down by user by day.
... View more
11-05-2013
09:08 AM
1 Karma
Hi,
I use iis server logs and in each hit I have the flowing parameters.
cs_uri_stem= Page user is on
cs_Referer=Previous page
What I would want to do is track back or forward by 3 or 4 steps.
Every users is identified by the cs_username field.
The question I want to answer is as follows....
For all users that looked at a product page "/Product//Product*/", what were the previous 4 pages looked at before arriving at the product page?
Any ideas?
Thanks,
Dan
... View more
11-05-2013
09:00 AM
Hi, I am still having issues with getting the above to work, I have even managed to crash Splunk a few times 🙂 Any advice would be much appreciated.
... View more
11-01-2013
04:10 AM
Thanks for the reply. When you put it like that it seems a lot simpler.
I am looking at between 3500-400 users in daily time frame for this type of user.
I guess I could get a list of users that use search, put this list in a lookup and query the rest of the data.
I would look at using the search user group to see what content they consume and actions they perform in a day, with this in mind instead of getting all pages for every users I could ask it to search against a specific field or cs_uri_stem.
Is there an easier way than using a lookup as I would have to alter this for each day.
... View more
11-01-2013
02:42 AM
I use iis server logs, each user has a unique ID (cs_username) as authentication is required on the site.
Does Splunk have the ability to query the data as you would in GA Custom Variables or eVars in Omniture?
As I understand it the following query will return data from all logs when the fields match "cs_username" and "cs_uri_stem=/SearchResults/" and give me a unique count of the users visiting the "SearchResults/" page.
sourcetype="iis-2" | extract auto=true | search cs_username="*" AND cs_uri_stem="*/SearchResults/*" | stats dc(cs_username) by cs_uri_stem | eval cs_uri_stem=urldecode(cs_uri_stem)
What I want to get to is showing all the cs_uri_stem values when a user has visited the "SearchResults/" page in a given time period.
I could then segment the data and see all pages for all users that have visited the "SearchResults/" page in a given time period.
Is this possible?
... View more
10-30-2013
09:57 AM
Sorry for the late reply, this does seem to work for some months and not others, I'll investigate a bit and see what the issue is. Thanks for the response.
... View more
10-30-2013
04:44 AM
Is it possible to combine this in a query where I am also using eval on the cs_uri_stem,
eval Contact=if(match(cs_uri_stem,"/Contacts/*Contact*Profile/"),1,null()) |
... View more
10-30-2013
03:49 AM
I just added /Product/Product.*Overview/. to the query and it works great.
... View more
10-30-2013
03:44 AM
This works great, however I do need the....
/Product/Product.*Overview/
It used to be the case that this page was split by geo location and it is now not the case, so to do a query over the year I would need to include the below page but no pages underneath it.
/Product/Product.*Overview/
... View more
10-30-2013
03:38 AM
Hi, Thanks for the response, I am just testing them now.
The first query comes back with...
Error in 'eval' command: The operator at ')' is invalid.
The Non-nested version come back with...
Error in 'eval' command: The operator at ',null())' is invalid.
... View more
10-25-2013
04:25 AM
Thanks for the reply. I have not done this before, how would I go about doing this?
... View more
10-25-2013
04:09 AM
I am trying to do a search match based on a number of different criteria.
The below does not work.
sourcetype="iis-2" | extract auto=true | search cs_username | eval Product=if(searchmatch("cs_uri_stem=*/Product/Product*Overview/|*/Product/Product*Overview/Global*|*/Product/Product*Overview/EMEA/*|*/Product/Product*Overview/APAC/|*/Product/Product*Overview/Americas/"),1,null()) | stats count(Product) as Product by date_month
The below does return results but I want to combine Product 1-5 into one column and add the results.
sourcetype="iis-2" | extract auto=true | search cs_username |
eval Product1=if(searchmatch("cs_uri_stem=*/Product/Product*Overview/ |
eval Product2=if(searchmatch("cs_uri_stem=*/Product/Product*Overview/Global*"),1,null()) |
eval Product3=if(searchmatch("cs_uri_stem=*/Product/Product*Overview/EMEA/*"),1,null()) |
eval Product4=if(searchmatch("cs_uri_stem=*/Product/Product*Overview/APAC/*"),1,null()) |
eval Product5=if(searchmatch("cs_uri_stem=*/Product/Product*Overview/Americas/*"),1,null()) |
stats count(Product1) as Product1 count(Product2) as Product2 count(Product3) as Product3 count(Product4) as Product4 count(Product5) as Product5 by date_month
I cant use */Product/Product*Overview/* as there are pages other than the ones above I do not want to include.
I am stuck, hope you can help.
... View more
- Tags:
- eval
- searchmatch
07-05-2013
03:33 AM
I was being a bit of a fool. The below worked for me.
sourcetype="iis-2" earliest=-0d@d latest=+1d@d | extract auto=true | search | timechart dc(cs_username) AS Today | appendcols [search earliest=-3d latest=-2d | timechart dc(cs_username) AS Yesterday] | appendcols [search earliest=-8d latest=-7d | timechart dc(cs_username) AS Last_Week]
I need to edit it a bit further in regards to formatting. The above gives me a time chart for one day with data points every 30mins.
Thanks,
Dan
... View more
06-21-2013
08:29 AM
Thanks for the response, I could not get this to work.
I think the problem I have is how to select today in the earliest and latest values.
For today I would like it to start at 00:00:00 and end at 23:59:59 and to look at yesterday and 7 days ago.
So at 10 am there will be a complete data set for the entire day for Yesterday and 7 days ago but Today would only have the first 10 hours and more will populate throughout the day.
I expect there is a simple solution but I have missed it.
... View more
06-21-2013
07:22 AM
I have a time chart that looks back over the last 24hr and compares the data to Yesterday and 7 days ago.
My live data is delayed by 2hrs coming into Splunk, I use the below search.
sourcetype="iis-2" earliest=-26h latest=-2h | extract auto=true | search | timechart dc(cs_username) AS Today | appendcols [search earliest=-50h latest=-26h | timechart dc(cs_username) AS Yesterday] | appendcols [search earliest=-194h latest=-170h | timechart dc(cs_username) AS Last_Week]
This is fine but I want to get to the day and not 24hrs from now.
I would like the scale to be 00:00:00 – 23:59:59 (or Hours 1-24) and Yesterday and 7 days ago data to be populated in full, as Today progresses the chart refreshes and populates with Todays data as it comes in.
Thanks,
Dan
... View more
06-19-2013
03:38 AM
Hi Kristian thanks for the response.
I have discovered that Splunk does index the most recent logs which are created every 10mins, however these logs have a GMT time stamp, I am currently on BST (GMT +1).
The server Splunk sits on is also BST.
Therefore instead of a 10min delay it looks like a 1hr10mins delay, even though the logs are indexed every 10mins.
Is there an easy way to resolve this?
... View more
06-18-2013
09:27 AM
Hi,
I have splunk sitting on a server indexing log files from a dir \weblog
When I initially added the folder all the logs were indexed and the data appears correctly, however the new logs are not being indexed.
The logs initially start at 0kb size and grow and then a new log is created every 10min, these logs are not being indexed.
I understand that the standard setting is to monitor the folder and as a log grows splunk will index the new information, this does not seem to be happening. I expect this is a basic error on my part.
They are iis-2 log format.
Hope you can help,
Dan
... View more
- « Previous
- Next »
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:03 AM
|
Karma from
Karma given to
