Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About mtranchita
mtranchita
Communicator
Member since:
03-06-2012
Community Statistics
| Posts | 45 |
| Solutions | 6 |
| Karma Given | 9 |
| Karma Received | 20 |
| Member Since | 03-06-2012 |
Activity Feed
- Got Karma for Re: How do I show more fields after the stats count by command?. 06-21-2023 10:45 PM
- Got Karma for Re: How to dedup a field for each day over 30 days?. 01-23-2023 12:26 PM
- Got Karma for Re: How do I show more fields after the stats count by command?. 02-15-2022 02:44 PM
- Karma O365 Duplicate events for mailmetoramu. 06-05-2020 12:50 AM
- Karma Re: How do I show more fields after the stats count by command? for mkolkebeck. 06-05-2020 12:50 AM
- Karma Re: License manager not reporting past 30 days (6.6.4) for jkat54. 06-05-2020 12:50 AM
- Karma Does Microsoft Azure Active Directory Reporting Add-on for Splunk support using proxy for akshatj2. 06-05-2020 12:50 AM
- Karma Support for Microsoft Graph endpoints in US Government cloud for tuongj. 06-05-2020 12:50 AM
- Got Karma for Re: How do I show more fields after the stats count by command?. 06-05-2020 12:50 AM
- Got Karma for Re: AWS Landing Zone - Centralize logging - how are others ingesting?. 06-05-2020 12:50 AM
- Karma Re: How do I restrict search terms (securely)? for mkolkebeck. 06-05-2020 12:48 AM
- Got Karma for Re: Distributed Management Console Setup: Do I still need to forward _internal data to search peers, or do I just add each instance as a search peer to the DMC?. 06-05-2020 12:48 AM
- Got Karma for Re: How to ignore case sensitive input in lookup files?. 06-05-2020 12:48 AM
- Got Karma for Re: How to ignore case sensitive input in lookup files?. 06-05-2020 12:48 AM
- Got Karma for Re: How to count the number of license pool violations using REST.... 06-05-2020 12:48 AM
- Got Karma for Re: Is there a search or btool command we can run from the deployment server to list all deployment client Splunk versions?. 06-05-2020 12:48 AM
- Got Karma for Re: Procedure to change License pool in cluster env. 06-05-2020 12:48 AM
- Got Karma for Re: How to dedup a field for each day over 30 days?. 06-05-2020 12:48 AM
- Got Karma for Re: How to dedup a field for each day over 30 days?. 06-05-2020 12:48 AM
- Karma Why is license usage not resetting at midnight and is rolling over to the next day? for tim_recurly. 06-05-2020 12:47 AM
Topics I've Started
No posts to display.
10-29-2019
06:19 AM
Just to clarify; am I reading it correctly that the Splunk Product best practice for getting AWS data into Splunk is not a Splunk-supported solution?
... View more
05-24-2019
09:25 AM
So you want to count the account names by multiple fields while still showing the account name?
Have you tried something like:
index=wineventlog EventCode=4740 host=* | stats c(Account_Name) as COUNT by Account_Name, ComputerName, IP
... View more
05-23-2019
05:28 PM
3 Karma
When you pipe to stats you are doing a transforming search and in effect dropping the data that isn't part of the statistical results.
In order to include additional fields you need to include them as part of the results. You could also try something like appendpipe to add more output to your base search.
References:
https://docs.splunk.com/Documentation/Splunk/latest/Search/Aboutreportingcommands
https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Append
https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Appendpipe
... View more
05-21-2019
05:04 PM
1 Karma
My organization uses this model, logs from multiple AWS Accounts are centralized into a single AWS Account purpose built for aggregation. I've found using the Splunk App for AWS to be relatively simple to implement. The key was understanding, and making use of, prefixes and multiple buckets. YMMV but I would suggest testing things.
Hope that helps...
... View more
09-09-2017
04:32 PM
If I follow the desired outcome he would need to include usenull
so something like:
| timechart usenull=1 span=1m count
... View more
03-28-2017
09:01 PM
2 Karma
While its true you can't ignore case in a lookup as part of a search, you can use the eval command and set all the values of a given field to lower (or upper) case.
I agree that the "right" way to do is to edit the transforms so that the lookup is case insensitive like 'normal' searches.
Reference:
http://docs.splunk.com/Documentation/Splunk/6.5.2/SearchReference/Eval#3._Convert_values_to_lowercase
... View more
03-22-2017
04:52 AM
1 Karma
Might not be the best way but first thing that comes to mind is mvexpand.
http://docs.splunk.com/Documentation/Splunk/6.5.2/SearchReference/Mvexpand
... View more
11-17-2016
10:08 AM
Perhaps reading too quickly but where you have "Lookahead" in your props did you mean MAX_TIMESTAMP_LOOKAHEAD?
... View more
08-18-2016
06:34 AM
Maybe not an answer but thinking this through...
Each search generates artifacts in the dispatch directory. As I understand it each search artifacts are a csv with the results of the search. Each pipe does 'something' to the csv file in a linear way.
Don't know if this is true but using that logic the csv file would need to be completed before it hit the outputlookp pipe.
... View more
08-15-2016
04:58 AM
1 Karma
The simplest path would be to add the new license file to the default pool and then delete the original.
The default pool would now have 150.
... View more
08-12-2016
03:12 PM
That DMC alert is making the rest call and alerting if the status is anything other than up. So if the server isn't accessible via the management port or the status is one of the other values in the end point reference it will fire.
Down
Blacklisted
Not a Splunk server
Free Splunk server
Authentication Failed
Duplicate License
Duplicate Servername
Inconsistent bundles
... View more
08-10-2016
05:05 PM
right, sorry.
Have you tried setting mgmtHostPort in web.conf?
... View more
08-10-2016
04:43 PM
Guessing that splunk is confused about what IP it should be using. I would try setting the IP for interface that you want use by setting SPLUNK_BINDIP= in the splunk-launch.conf.
Note that this conf file is not in apps but rather $SPLUNK_HOME/etc/splunk-launch.conf.
Double check the spec, http://docs.splunk.com/Documentation/Splunk/latest/Admin/Splunk-launchconf, for syntax.
Hope this helps!
... View more
08-08-2016
05:04 AM
I dont think you can 'swap out' splunkweb in a modular way.
You set up a local proxy in front of splunkweb http://docs.splunk.com/Documentation/Splunk/latest/Admin/Specifyaproxyserver if that would give the functionality you wanted.
Alternately you could turn off splunkweb via web.conf and build something custom for yourself, like create web application(s) that can do the searching you want to do via the REST api http://docs.splunk.com/Documentation/Splunk/latest/RESTTUT/RESTsearches
... View more
07-12-2016
05:22 AM
It is configurable in multiple conf files.
for example in web.conf you can set cipherSuite and sslVersions in the [settings] stanza or sslCipher in outputs.conf.
You should review minimally:
http://docs.splunk.com/Documentation/Splunk/latest/Admin/Inputsconf
http://docs.splunk.com/Documentation/Splunk/latest/Admin/Serverconf
http://docs.splunk.com/Documentation/Splunk/latest/Admin/Webconf
http://docs.splunk.com/Documentation/Splunk/latest/Admin/Outputsconf
... View more
06-26-2016
11:55 AM
I'm likely misunderstanding the question, but are you looking at the statics tab and not the visualization - or can you change the visualization type?
I think that the example from the command reference shows what you are describing.
... View more
06-25-2016
10:18 AM
2 Karma
I don't see your image but you could try throwing a dedup before your stats. Something like:
index = ib_dhcp_lease_history dhcpd OR dhcpdv6 r - l - e ACTION = Issued LEASE_IP = 10. jdoe | dedup LEASE_IP date_mday |convert ctime(_time) as Time | stats dc(LEASE_IP) by Time, LEASE_IP, OPTION12HOST, date_mday | table Time, LEASE_IP, OPTION12HOST |rename LEASE_IP as "Leased IP", OPTION12HOST as "Host Name"
that will return the last instance so maybe something like:
index = ib_dhcp_lease_history dhcpd OR dhcpdv6 r - l - e ACTION = Issued LEASE_IP = 10. jdoe | reverse | dedup LEASE_IP date_mday | table Time, LEASE_IP, OPTION12HOST |rename LEASE_IP as "Leased IP", OPTION12HOST as "Host Name"
probably a better way to do it, but hope that helps
... View more
06-25-2016
09:23 AM
1 Karma
if you try a distinct count of the IP by the other fields I think that you will get what you are looking for. That should also show if someone gets a new IP during the day.
index = ib_dhcp_lease_history dhcpd OR dhcpdv6 r - l - e ACTION = Issued LEASE_IP = 10.* jdoe* |convert ctime(_time) as Time | stats dc(LEASE_IP) by Time, LEASE_IP, OPTION12HOST, date_mday | table Time, LEASE_IP, OPTION12HOST |rename LEASE_IP as "Leased IP", OPTION12HOST as "Host Name"
... View more
06-16-2016
03:56 PM
http://docs.splunk.com/Documentation/Splunk/6.4.1/Data/Configureeventlinebreaking#Merge_multiple_lines_into_a_single_event
... View more
06-16-2016
09:45 AM
Might not be exaclty what you are looking for but you should be able to model your Splunk configuration after the example from the SSO configuration:
http://docs.splunk.com/Documentation/Splunk/6.4.1/Security/ConfigureSplunkSSO
... View more
06-11-2016
12:17 PM
1 Karma
If I were you I would keep forwarding all of your internals to the indexers and add all of the systems (SHs, Is & HFs) to the DMC as search peers.
One reason you want to add all of them as search peers even though you have forwarded all of the internals is because a number of the searches and precanned alerts from the DMC make use of REST calls as well as looking at the internal indexed data.
The reasons to forward the internals to the indexers doesn't change with the DMC so keep doing that.
... View more
05-17-2016
08:08 PM
1 Karma
Lots of variables but an oversimplified rough cut would be to make a lot of assumptions and look at what is recorded in the metrics log.
Try the following search and then clean it up to suit your needs:
index=_internal source=\*metrics.lo\* group=tcpin_connections version=* | table hostname version
... View more
05-17-2016
03:19 PM
from the way the question is written it isn't clear that this a UI artifact of the search or the actual value of the source field. is it possible to provide more info?
... View more
02-03-2016
03:43 PM
if I follow what your doing, why not use list with the stats or chart command instead of table?
you can then do something like
your search | stats list(measInfoId) by c*
or
your search | chart list(measInfoId) by c*
... View more
02-03-2016
05:13 AM
I've seen a similar issue where the host the logs were being forwarded from had ntp out of sync (and the host was undersized). We had to adjust the monitor stanza in the inputs.conf and add a time_before_close value. Once we increased the value over the default we stopped truncating.
time_before_close =
* Modtime delta required before Splunk can close a file on EOF.
* Tells the system not to close files that have been updated in past
seconds.
* Defaults to 3.
... View more
Contact Me
Karma from
