Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Are you a member of the Splunk Community?
Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- Find Answers
- :
- About hagjos43
hagjos43
Contributor
Member since:
06-08-2011
06-05-2020
Community Statistics
| Posts | 140 |
| Solutions | 10 |
| Karma Given | 51 |
| Karma Received | 44 |
| Member Since | 06-08-2011 |
Activity Feed
- Got Karma for Re: Splunk search query examples. 06-09-2023 09:15 PM
- Karma Re: Is there a good book for learning Splunk queries? for ppablo. 06-05-2020 12:50 AM
- Karma what does dedup_splitvals argument for stats command do? for manojsecsme. 06-05-2020 12:49 AM
- Karma Re: How do I filter successful events since I am getting too many? for somesoni2. 06-05-2020 12:49 AM
- Got Karma for Verbose mode returns results as expect, but not Fast mode.. 06-05-2020 12:49 AM
- Karma Re: Lat/Lon are flipped. for Rivium. 06-05-2020 12:48 AM
- Karma Re: How to correct my regex to extract multiple KB number occurrences in a windowsupdate.log, not just the first? for richgalloway. 06-05-2020 12:47 AM
- Karma Re: Convert this time format to epoch for somesoni2. 06-05-2020 12:47 AM
- Karma Re: how to better analyze web access logs (access_combined) for rsennett_splunk. 06-05-2020 12:47 AM
- Karma Re: My searches are failing on Search Head with error " Search filters specified using splunk_server/splunk_server_group do not match any search peer" for rbal_splunk. 06-05-2020 12:47 AM
- Karma Re: Moving from a single indexer/search head to indexer clustering, does the master node have to be a separate server, or can I use the deployment server? for jeffland. 06-05-2020 12:47 AM
- Karma Re: After frozen data restore, thawed data not working correctly or missing. for jkat54. 06-05-2020 12:47 AM
- Karma Re: After frozen data restore, thawed data not working correctly or missing. for jkat54. 06-05-2020 12:47 AM
- Karma Re: How to match an IP address from a lookup table of cidr ranges? for lguinn2. 06-05-2020 12:47 AM
- Karma Re: After modifying the timezone in props.conf, why has the _time field not changed? for marina_rovira. 06-05-2020 12:47 AM
- Karma Re: After modifying the timezone in props.conf, why has the _time field not changed? for jplumsdaine22. 06-05-2020 12:47 AM
- Karma Re: Any reason why Btool might be continuously logging in DEBUG mode? for MuS. 06-05-2020 12:47 AM
- Karma After upgrading Splunk from 6.2.5 to 6.3.0, why are letters/numbers in my dashboard displaying very large? How do I change this? for nicolay_koecher. 06-05-2020 12:47 AM
- Karma Re: After upgrading Splunk from 6.2.5 to 6.3.0, why are letters/numbers in my dashboard displaying very large? How do I change this? for mporath_splunk. 06-05-2020 12:47 AM
- Karma Re: Properly Extract Time from custom Data Set for schose. 06-05-2020 12:47 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 1 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
12-08-2014
09:43 AM
4 Karma
I have a time in the format of:
3:21:34 AM 12/8/2014
I'm trying to convert this to epoch time. Can anyone lend a hand?
Thanks!
... View more
12-02-2014
09:00 AM
Are you trying to ingest EVTX files?
If so it can't read directly from EVTX. Instead when you install the windows forwarder use the check boxes to select the appropriate log formats to ingest; security, system, application, etc.
... View more
11-24-2014
04:50 AM
I have something similar. Here is mine (XML directly from the dashboard). Take and modify as needed:
<title>Page Views Trend</title>
<searchString>index=* sourcetype=* host=* utma=* | timechart count | eventstats avg(count) as average | eval average=round(average,0)</searchString>
<earliestTime>$earliest$</earliestTime>
<latestTime>$latest$</latestTime>
<option name="charting.chart">line</option>
<option name="charting.legend.placement">bottom</option>
<option name="charting.legend.masterLegend">null</option>
<option name="height">250px</option>
<option name="charting.chart.overlayFields">average</option>
<option name="charting.fieldColors">{"count": 0x639BF1, "median":0xFF5A09}</option>
<option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
<option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
<option name="charting.axisTitleX.visibility">visible</option>
<option name="charting.axisTitleY.visibility">visible</option>
<option name="charting.axisTitleY2.visibility">visible</option>
<option name="charting.axisX.scale">linear</option>
<option name="charting.axisY.scale">linear</option>
<option name="charting.axisY2.enabled">false</option>
<option name="charting.axisY2.scale">inherit</option>
<option name="charting.chart.nullValueMode">gaps</option>
<option name="charting.chart.sliceCollapsingThreshold">0.01</option>
<option name="charting.chart.stackMode">default</option>
<option name="charting.chart.style">shiny</option>
<option name="charting.drilldown">all</option>
<option name="charting.layout.splitSeries">0</option>
<option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
<option name="refresh.time.visible">false</option>
</chart>
The above line charting.chart.overlayFields is what you are looking for here. I've tested this and it does also work for displaying in Area format as well as line.
... View more
11-24-2014
04:37 AM
What Antivirus software are you using?
... View more
11-21-2014
06:11 AM
I've never tried to monitor a path with white spaces in the name. For testing purposes point it to a path with no spaces and see if you have any issues.
... View more
11-21-2014
04:50 AM
I've had issues similar to this. I tried different browsers and had success in Firefox. If you are having issues try switching browsers and seeing if it makes a difference.
... View more
11-21-2014
03:48 AM
For one if the following syntax is what you actually have in your inputs.conf it is incorrect.
You have: [monitor://D:Program Files (x86)...vCAC...Logs*]
You should have: [monitor://D:\Program Files (x86)....vCAC....Logs.....*]
you were missing the "\" after the "D:"
... View more
11-20-2014
04:31 AM
The inputs.conf file you are talking about above, is that the $splunk\etc\system\local\inputs.conf or $splunk\etc\apps\deployment....\inputs.conf?
... View more
11-18-2014
01:26 PM
1 Karma
Martin is correct! (as always) 🙂
... View more
11-18-2014
01:08 PM
Run this in a real time search (5 minute window or so):
sourcetype="iis" |dedup JSESSIONID| stats count(JSESSIONID)
Found here: http://gosplunk.com/real-time-iis-web-site-connections/
NOTE I'm assuming you are talking about user initiated web-sessions.
... View more
11-17-2014
05:41 AM
3 Karma
Yes there is now!
www.gosplunk.com
The site is in its infancy but is growing with queries daily! I'm currently signed up and an active user.
... View more
10-24-2014
09:30 AM
2 Karma
I got it!
DC worked, but I also did it in buckets of time which significantly improved the speed. Thank you all for your input.
The final query looks like this:
sourcetype=iis| bucket _time span=1mon | eval Month=strftime(_time,"%B") |eval MN=lower(Month) | eval sort_field=case(MN=="january",1, MN=="february",2, MN=="march",3, MN=="april",4, MN=="may",5, MN=="june",6, MN=="july",7, MN=="august",8, MN=="september",9, MN=="october",10, MN=="november",11, MN=="december",12) | stats dc(JSESSIONID) as Visits by Month, sort_field | sort +sort_field | fields - sort_field
... View more
10-21-2014
08:38 AM
Martin,
Thanks for the response. I'm giving it a shot now, it appears to be either the same speed as dedup or marginally faster.
Anyone else have any ideas on this one? or if anyone has a query developed that tracks visitors to a website over any period of time I'd greatly appreciate having it!
Thanks,
-hagjos43
... View more
10-20-2014
10:52 AM
I looked into it, and it appears that this needs to be a scheduled search. Does summary indexing require a static time-frame? This is a Web Analytics report, and it is typically launched by marketing teams who can run this for any time-range, will summary indexes operate in such an environment?
... View more
10-20-2014
09:14 AM
1 Karma
Is there any suggestions on how to improve search time on this particular search? This search literally takes 12-15 hours to complete when searching over the past year. Other searches do not take anywhere close to this long for the same amount of time (seconds to minutes).
The search is intended to return a search indicating the total page views per month (sorted by month):
sourcetype=IIS |dedup JSESSIONID| eval month_num=strftime(_time, "%m") | stats count(Page) by month_num, date_month | sort month_num | fields - month_num
... View more
10-02-2014
05:49 AM
I tired and unfortunately it did not work.
Do the transforms and props config files need to be modified at the indexer or the Heavy Forwarder?
... View more
09-30-2014
04:54 AM
Here is our situation:
Universal forwarders(UF) on hosts (50-ish) are sending data to a heavy forwarder(HF) configured to store AND forward which is sending data to our Indexer. Our data is currently coming into the "main" index, however we would like it to go into a different index we'll call it "norris".
For simplicity let's just say we cannot modify the Universal Forwarders Inputs.conf.
I modified the props.conf and tranforms.conf on my indexer and had zero luck. Here is what I modified:
#props.conf
[host::chuck01]
TRANSFORMS-routing_for_norris_index = route_to_norris_index
#Transforms.conf
#Route to an alternate Index:
[route_to_norris_index]
DEST_KEY = _MetaData:Index
REGEX=(.*)
FORMAT = norris
Do I need to add this to the HF transforms and props as well?
... View more
09-10-2014
04:08 AM
By "another dashboard" do you mean a different panel within the same dashboard?
... View more
09-09-2014
04:57 AM
5 Karma
We are seeing the following errors on our Heavy Forwarder side:
09-05-2014 13:39:06.483 - 0400 INFO TcpOutputProc - Connected to idx= 23.42.214.219:9997
09-05-2014 13:39:06.484 - 0400 WARN TcpOutputProc - Forwarding to indexer group default-autolb-group blocked for 600 seconds.
09-05-2014 13:39:36.493 - 0400 INFO TcpOutputProc - Connected to idx= 23.42.214.219:9997
09-05-2014 13:40:06.501 - 0400 INFO TcpOutputProc - Connected to idx= 23.42.214.219:9997
09-05-2014 13:40:36.509 - 0400 INFO TcpOutputProc - Connected to idx= 23.42.214.219:9997
09-05-2014 13:40:39.510 - 0400 WARN TcpOutputProc - Forwarding to indexer group default-autolb-group blocked for 700 seconds.
09-05-2014 13:41:06.517 - 0400 INFO TcpOutputProc - Connected to idx= 23.42.214.219:9997
09-05-2014 13:41:36.524 - 0400 INFO TcpOutputProc - Connected to idx= 23.42.214.219:9997
09-05-2014 13:42:06.533 - 0400 INFO TcpOutputProc - Connected to idx= 23.42.214.219:9997
09-05-2014 13:42:19.536 - 0400 WARN TcpOutputProc - Forwarding to indexer group default-autolb-group blocked for 800 seconds.
This continues to repeat through the current date. Anyone else experience this or have any suggestions?
... View more
07-08-2014
10:32 AM
Hello, I'm trying to create a query to monitor when users create accounts and then within a given time window delete the account.
I've got this so far:
sourcetype=WinEventLog:Security (EventCode=630 OR EventCode=4726 OR EventCode=624 OR EventCode=4720) | eval status=case(EventCode=630, "Account Creation", EventCode=4726, "Account Creation", EventCode=624, "Account Deletion", EventCode=4720, "Account Deletion") |
The Pseudo code for what I'm looking for would be:
. . . | where Account Creation AND Account Deletion occur within x hours
Thanks!
... View more
06-02-2014
12:53 PM
I figured out my own issue. fillnull fixed it!
Below is the working query:
| iplocation ClientIP | fillnull value="Unknown" Country | eval GeoLocation=case(Country="United States", "Views from the United States", Country="Unknown", "Views from Unknown Origins", Country!="United States" AND Country!="Unknown", "International Views") | top limit=3 GeoLocation | eval percent = round(percent,2) . " %"
... View more
06-02-2014
12:20 PM
1 Karma
Splunk 6.1 has changed the iplocation a bit.
.... | iplocation clientip | stats count by Country, Region
works natively now 🙂
... View more
06-02-2014
11:36 AM
try this to help diagnose your problem.
Apply a _time bucket within your query and do a |stats count by _time
| bucket _time span=24h | stats count by _time
... View more
06-02-2014
10:29 AM
Hello,
I have the following query:
. . . | iplocation ClientIP | eval GeoLocation=case(Country="United States", "United States", Country=" ", "Views from Unknown Origins", Country!="United States" AND Country!=" ", "International") | top limit=3 GeoLocation | eval percent = round(percent,2) . " %"
The output of this query returns results like this:
GeoLocation count percent
United States 900 90%
International 100 10%
However it is not returning if the value for Country is null, I've ran the search and I know for the given time range null values exist for the country field. Can this work within the eval case() query?
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:03 AM
|
