Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Are you a member of the Splunk Community?
Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- About hagjos43
hagjos43
Contributor
Member since:
06-08-2011
06-05-2020
Community Statistics
| Posts | 140 |
| Solutions | 10 |
| Karma Given | 51 |
| Karma Received | 44 |
| Member Since | 06-08-2011 |
Activity Feed
- Got Karma for Re: Splunk search query examples. 06-09-2023 09:15 PM
- Karma Re: Is there a good book for learning Splunk queries? for ppablo. 06-05-2020 12:50 AM
- Karma what does dedup_splitvals argument for stats command do? for manojsecsme. 06-05-2020 12:49 AM
- Karma Re: How do I filter successful events since I am getting too many? for somesoni2. 06-05-2020 12:49 AM
- Got Karma for Verbose mode returns results as expect, but not Fast mode.. 06-05-2020 12:49 AM
- Karma Re: Lat/Lon are flipped. for Rivium. 06-05-2020 12:48 AM
- Karma Re: How to correct my regex to extract multiple KB number occurrences in a windowsupdate.log, not just the first? for richgalloway. 06-05-2020 12:47 AM
- Karma Re: Convert this time format to epoch for somesoni2. 06-05-2020 12:47 AM
- Karma Re: how to better analyze web access logs (access_combined) for rsennett_splunk. 06-05-2020 12:47 AM
- Karma Re: My searches are failing on Search Head with error " Search filters specified using splunk_server/splunk_server_group do not match any search peer" for rbal_splunk. 06-05-2020 12:47 AM
- Karma Re: Moving from a single indexer/search head to indexer clustering, does the master node have to be a separate server, or can I use the deployment server? for jeffland. 06-05-2020 12:47 AM
- Karma Re: After frozen data restore, thawed data not working correctly or missing. for jkat54. 06-05-2020 12:47 AM
- Karma Re: After frozen data restore, thawed data not working correctly or missing. for jkat54. 06-05-2020 12:47 AM
- Karma Re: How to match an IP address from a lookup table of cidr ranges? for lguinn2. 06-05-2020 12:47 AM
- Karma Re: After modifying the timezone in props.conf, why has the _time field not changed? for marina_rovira. 06-05-2020 12:47 AM
- Karma Re: After modifying the timezone in props.conf, why has the _time field not changed? for jplumsdaine22. 06-05-2020 12:47 AM
- Karma Re: Any reason why Btool might be continuously logging in DEBUG mode? for MuS. 06-05-2020 12:47 AM
- Karma After upgrading Splunk from 6.2.5 to 6.3.0, why are letters/numbers in my dashboard displaying very large? How do I change this? for nicolay_koecher. 06-05-2020 12:47 AM
- Karma Re: After upgrading Splunk from 6.2.5 to 6.3.0, why are letters/numbers in my dashboard displaying very large? How do I change this? for mporath_splunk. 06-05-2020 12:47 AM
- Karma Re: Properly Extract Time from custom Data Set for schose. 06-05-2020 12:47 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 1 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
08-13-2018
09:16 AM
Same here! I was just searching to find out what this does. Google and Splunk docs have no information on this so far. What I can comment on is that I removed the dedup_splitvals=t from my search and the data does not change.
... View more
07-25-2018
04:21 AM
I went ahead and modified this as well to clean it up a bit (assuming you don't want internal indexes, or all individual file names):
| rest /services/data/inputs/all
| search index!=_*
| stats values(sourcetype) by index
... View more
07-25-2018
04:05 AM
I modified this query slightly:
| tstats latest(_time) as Latest where index!=_internal by host sourcetype index
| eval current=now()
| eval Minimum_Age=round(((current-Latest)/60)/60,2)
| rangemap field=Minimum_Age default=Critical Normal=0-0.5 Elevated=0.5-2 Warning=2-4
| eval stIDX=tostring(index) + " -- " + tostring(sourcetype)
| stats values(stIDX) as "Index -- Sourcetype" list(Latest) as "Latest Event" list(Minimum_Age) as Minimum_Age list(range) as Threshold by host
| convert ctime("Latest Event")
| eventstats avg(Minimum_Age) as average by host
| eval average=round(average,2)
| sort - average
| rename Minimum_Age as "Hours Since Last Communication" average as "Average Time in Hours Since Last Communication"
... View more
07-09-2018
03:13 PM
This may be an instance where renaming created_time to _time and using a timechart might be best.
try:
index=abc sourcetype=xyz | rename created_time as _time | timechart span=1w count
... View more
07-09-2018
02:47 PM
1 Karma
I'll self promote here. Sorry, not sorry.
Go check out https://gosplunk.com for a repository of queries shared by a bunch of users.
Another site bbosearch has a few queries as well.
~Joe
... View more
06-11-2018
04:00 PM
Not sure if this will do the trick for you or not, but there are two queries posted on GoSplunk that might help! It's not going to get exactly what you want, but may point you in the right direction.
https://gosplunk.com/detect-username-guessing-brute-force-attacks/
https://gosplunk.com/compare-successful-internal-vs-external-connections/
... View more
05-11-2018
12:05 PM
The search is actually what is populating a summary index.
... View more
05-10-2018
08:29 AM
Thanks, unfortunately this didn't do the trick.
... View more
05-09-2018
09:27 AM
See updated original question. I've included the query.
... View more
05-09-2018
08:59 AM
Thanks for your reply, however that doesn't do the trick. I should elaborate....the interesting fields DO in-fact populate in fast mode. But when I pipe the output to a table it does not properly show the statistics table.
... View more
05-09-2018
08:03 AM
1 Karma
We are having some odd search results. When the query is ran in Verbose mode all fields return as expected, however when the same query is ran in Smart or Fast mode only the default fields are returned and the two fields extracted at search time via the "| rex" command. Anyone run into this before?
EDIT
Query used:
(index=foo sourcetype=bar) OR (index=metrics sourcetype=stats
[ search index=foo sourcetype=bar
| mvexpand combine
| rex field=combine (?<id>\d+)=(?<hits>\d+)
| dedup id site
| fields id site] earliest=-1y)
| fillnull combine
| mvexpand combine
| rex field=combine (?<id>\d+)=(?<hits>\d+)
| eventstats latest(ip) as IP latest(info_id) as Info_ID by id, site
| where isnotnull(hits)
| table _time hits id site IP Info_ID
When my search runs in Verbose mode I see all fields "_time hits id site IP Info_ID" However when I run it in Fast mode I am missing IP and Info_ID.
If I remove the "| table" section altogether and run it in fast mode the query runs and all interesting fields are populated on the left side of the events.
... View more
10-10-2017
05:11 AM
Appreciate your help so far but this still didn't work. Does it matter that this is a csv that it is ingesting? I would think field extractions didn't care what extension a file has.
... View more
10-09-2017
07:46 PM
12bca842-2f11-494c-b016-7668beda8bfd-1633657","2017-10-09T21:32:15.164Z","access","12bca842-2f11-494c-b016-7668beda8bfd-1633650","Scheduled activeSynchroniser_systemExternalOu-Mon Oct 09 17:32:15 EDT 2017",,,,,,"CREST","ScheduledTask","{""taskName"":""scheduler-service-group.activeSync_systemExternalOu""}",,,,,,,,"SUCCESSFUL",,,"12","MILLISECONDS",
... View more
10-09-2017
07:25 PM
This works if you | rex "EXTRACT-json_data=.+\"(?<json_data>{.+})\""
But when I try to move it over to props.conf as:
[mysourcetype]
EXTRACT-json_data=.+"(?<json_data>{.+})
It doesn't work.
Any ideas on what I'm doing wrong?
Thanks!
-Joe
... View more
03-30-2017
04:09 AM
We had a lot of issues with this an abandoned it. We ended up going to Cacti and had success there. Cacti was incredibly easy to implement.
... View more
02-02-2017
01:16 PM
Looks like I had an issue with my REGEX, and it worked after the REGEX fix.
Thanks!
... View more
01-31-2017
10:56 AM
We have SNMP data being sent from a heavy forwarder to our indexers into an index that we'll call cacti.
We want SOME of the data (specifically traffic data) to go to another index. My inputs.conf on some test logs (fake data) is set to send data to the main index with a sourcetype of cacti:test1.
I've done a test that looks like the following with zero luck (These have been placed on the Heavy Forwarder):
TRANSFORMS.conf:
[IndexRedirect_traffic]
REGEX = rrdn\Straffic
DESKT_KEY = _MetaData:Index
FORMAT = index::cacti_traffic
PROPS.conf:
[cacti:test1]
TRANSFORMS-indexredirect = IndexRedirect_traffic
... View more
08-12-2016
10:44 AM
Run this query. It'll output what is hitting your license.
index=_internal source=*license_usage.log type="Usage" splunk_server=* earliest=-1w@d | eval Date=strftime(_time, "%Y/%m/%d") | eventstats sum(b) as volume by idx, Date | eval MB=round(volume/1024/1024,5)| timechart first(MB) AS volume by idx
... View more
04-15-2016
06:06 AM
We are replacing (upgrading to new hardware) an indexer that is part of an indexer cluster. In the cluster there are two indexers with replication factor of 2 and search factor of 2. When the new indexer is online and joined to the cluster, will the indexes and all associated historical buckets be auto-magically copied over?
Thanks!
-Joe
... View more
02-17-2016
12:45 PM
So the user thing was exactly it! I created a new user account with GMT as the timezone associated with the account and it came back as expected.
Is there a simple way for this particular source/sourcetype to be viewed with the "local" timestamp of GMT even if a user has a timezone set to Eastern Standard, or any other timezone?
... View more
02-17-2016
08:18 AM
So if I want it to stay local time do I set TZ = local?
... View more
02-17-2016
06:42 AM
I've got a variety of customers sending data in to our Splunk indexer. One particular customer has all of their servers set to GMT time (coincidentally our only Linux customer on this particular indexer).
I've modified the props.conf to reflect the following:
[linux_secure]
TZ = GMT
The _time field has not changed. Is this the local (Splunk indexer time) when the event was indexed? Will the _time field never change regardless of TZ change?
The reason for this question is that I have a time reporting in within the event of 2016-02-17T13:44:15.717997+00:00 and a _time field of 2016-02-17T08:44:15.717-05:00 obviously an offset of 5 hours.
Thanks!
... View more
02-02-2016
11:19 AM
Thanks so much!
... View more
02-02-2016
10:01 AM
I suppose this is a multi-question post.
We have a clustered environment and are replacing the hardware our search head lives on currently. We have 1 search head, 2 indexers (clustered), and a deployment server/cluster master/license master all in one. Our environment is entirely Windows and last I checked, Search head clustering on Windows is not an option.
The new box will have a new IP and a new hostname.
My question is: Has anyone done this in the past? If so, is it as simple as transferring all of the Splunk files ( d:\program files\splunk\*.* ) to the new box? Or is there a subset of files/directories that I can simply transfer (user's/searches/stuff like that).
The issue I see standing out is obviously the name change, and probably why transferring all files over would be a bad idea 🙂
Thanks!
... View more
01-20-2016
06:23 AM
Thanks for the response!
I couldn't post an imagine in the comment section so please see my "Answer" below".
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:03 AM
|
