Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About haraksin
haraksin
Path Finder
Member since:
04-11-2018
2 weeks ago
Community Statistics
| Posts | 22 |
| Solutions | 0 |
| Karma Given | 20 |
| Karma Received | 1 |
| Member Since | 04-11-2018 |
Activity Feed
- Karma Re: How to show the key from an inputlookup command from a KVStore? for elliotproebstel. 2 weeks ago
- Karma Re: How do I check my KV store size? for realsplunk. 2 weeks ago
- Posted Re: Bucket replication issues - No possible srcs for replication on Deployment Architecture. 08-26-2021 01:49 PM
- Karma Bucket replication issues - No possible srcs for replication for damode. 08-26-2021 01:26 PM
- Posted Re: What is the role of calculationID at datamodel json file? on Knowledge Management. 08-20-2021 04:33 PM
- Karma What is the role of calculationID at datamodel json file? for brandy81. 08-20-2021 04:32 PM
- Posted Re: Error while assigning/ updating notable events. on Splunk Enterprise Security. 08-06-2021 01:30 PM
- Karma Error while assigning/ updating notable events. for inayath_khanin. 08-06-2021 01:29 PM
- Karma Re: Adaptive Response Action Send email not sending results for teunlaan. 07-29-2021 05:50 PM
- Posted Re: How to extract the key value pairs? on All Apps and Add-ons. 07-27-2021 05:19 PM
- Karma base64 decoding fails because of padding for Log_wrangler. 06-25-2021 03:05 AM
- Karma Re: How can I find out the length of a line in a log file? for southeringtonp. 05-18-2021 08:05 PM
- Karma Re: Metrics indexes missing in REST-API listing? for thaggie_splunk. 04-22-2021 04:14 PM
- Posted Re: Stats count as a percentage as the total on Splunk Search. 03-17-2021 01:39 PM
- Got Karma for Re: How to fill null value of multi value fields with other value in search output. 02-17-2021 03:11 AM
- Posted Re: How to fill null value of multi value fields with other value in search output on Splunk Search. 02-15-2021 05:23 PM
- Karma Re: How to fill null value of multi value fields with other value in search output for to4kawa. 02-15-2021 05:18 PM
- Posted Re: mcatalog causing ERROR SearchPhaseGenerator - Fallback to two phase search failed:Term based search is not supported on Splunk Enterprise. 01-26-2021 04:03 PM
- Posted Re: Using a sparkline with tstats on Dashboards & Visualizations. 01-08-2021 12:23 AM
- Karma Re: How to get a complete list with descriptions of correlation searches in the Splunk Enterprise Security app? for martinr8. 10-29-2020 04:08 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 |
08-26-2021
01:49 PM
It appears that the best fix for this is to restart the Splunk process on the indexer master - note that restarting via the GUI does not work.
... View more
08-20-2021
04:33 PM
This really needs to be answered - I get an "invalid JSON" note when running it without the calculationID, but when I have it, Splunk says "error in datamodeledit handler: invalid field name"
... View more
08-06-2021
01:30 PM
I am having this issue too - the docs aren't clear about what causes this error, as it's clearly not caused by hitting the event limit, at least not that I can see.
... View more
07-27-2021
05:19 PM
I used the following to help with this at search time with key-value pairs that had space delimiters and = key delimiters: | extract pairdelim=" " kvdelim="=" This also works when your KV pairs optionally have quotation marks for data that contains whitespace.
... View more
03-17-2021
01:39 PM
In addition to this, in order to avoid using multiple stats stanzas, I use this type of structure with a stats then an eval: | search (message="Polling" OR message="No data" OR message="503" OR message="Pushing")
| timechart count(eval(message="Polling")) as Total_Polls count(eval(message="No data")) as Dataless_Polls count(eval(message="503")) as Error_Polls count(eval(message="Pushing")) as Successful_Polls
| eval Percent_Successful=(((Successful_Polls)/Total_Polls)*100)
| fields _time Percent_Successful This allows you to just compute one stats function and then evaluate any combination of percentages across your dataset. Of course this is a timechart, so you can just replace this with stats to get the desired functionality.
... View more
02-15-2021
05:23 PM
1 Karma
Fantastic answer; I made a simpler version without REX, since it is a compute hog, with test examples (if you get an error with the comment macro, just delete those lines): | makeresults
`comment("Setting up fields to compare")`
| eval mv_more=mvappend("yes", "no", "not", "you"), mv_less=mvappend("maybe", "later")
`comment("Begin here")`
| eval null_fill = mvrange(mvcount(mv_less),mvcount(mv_more))
| eval null_fill=mvmap(null_fill, "N/A")
| eval mv_less_new = mvappend(mv_less,null_fill) By taking the range from the length of the lesser field to the length of the greater field, we're able to eleminate a few eval statements crunching the difference with mvindex. You can try this by adding fields to mv_more; it will give you the same result each time.
... View more
01-26-2021
04:03 PM
I am having this same problem; not sure what's going on...
... View more
01-08-2021
12:23 AM
If you already have your tstats command outputting the format of events you want, you can just tack on this to the tstats command if you don't already have a BY clause: by _time span=10m
| eventstats sparkline(sum(count), 10m)
| fields - _time If you already do have a BY clause, just tack on the _time field and span argument. Then your results will have a sparkline just like as above, except that you don't need to change your tstats to use prestats or any other changes to avoid a double-transforming command.
... View more
10-27-2020
10:04 PM
Is there a source for not needing bin directories and lookup files in the knowledge bundle? I thought you needed them for search commands and non-automatic lookups? Am I wrong?
... View more
04-16-2020
01:04 PM
This doesn't work if you have a different index defined under the [monitor] stanzas... so it won't be forced really
... View more
03-23-2020
07:34 PM
You can also solve this using the sendemail command in a search-type workflow action:
| sendemail to=$owner@my.url$ subject="New Notable in: $title$" message="How are you guys doing? This has src $src$ dest $dest$ and severity $urgency$"
... View more
03-20-2020
04:52 PM
In case anyone else is wondering the answer to this question, there is now a way to do this deployment-wide as of version 4.*
Set the following flag globally in $SPLUNK_HOME/etc/system/local/web.conf (under [settings] stanza) and in $SPLUNK_HOME/etc/system/local/server.conf (in [default] stanza):
sendStrictTransportSecurityHeader = true
... View more
03-17-2020
05:58 PM
This doesn't have to be in the search bar, it could even be in the network_tools.conf file...
... View more
03-17-2020
05:57 PM
Similar to https://answers.splunk.com/answers/642213/nslookup-on-network-tools-app-with-specified-dns-s.html
First off, fantastic app; I'm really getting a lot of use out of specifically the prebuilt workflow actions!
I'm curious if there is any way I can specify a whois server with the command? I have a bunch of non-public data on my personal whois server that isn't getting read... I'm not sure I'm good enough to make a PR for this in the repo.
Thanks for the help!
... View more
01-06-2020
05:54 PM
There's a visual studio code extension with syntax highlighting, but no linting yet available here:
https://marketplace.visualstudio.com/items?itemName=arcsector.vscode-splunk-search-syntax&ssr=false#review-details
And an extension with hovers and command description and syntax here:
https://marketplace.visualstudio.com/items?itemName=arcsector.vscode-splunk-search-linter
... View more
06-25-2019
11:29 AM
Thanks for your response. I'm not trying to submit an event, as you can see there is no event field in the dictionary nor is there any existing HEC token that I'm passing through the headers. I'm trying to CREATE an HEC token, although this is probably my fault, as I should've put it in the description of the issue. My fault.
Also I took a look at the github repo you linked and the documentation appears to be lacking, so for now I'm going to be using my own scripts. But thanks for the heads up!
... View more
03-05-2019
01:51 PM
And I can use a curl command with all of the inputs i have in the hecdict
... View more
03-05-2019
01:03 PM
And yes, I have removed everything except the "name" argument in the hecdict and I have tried removing the "?output_mode=json" from the request and it still doesn't work.
... View more
03-05-2019
01:01 PM
Hello all,
I am running python 3.4.9 on CentOS 7. The issue I am having is with the following python script:
from yaml import load
from requests import session
from pprint import pprint
from json import dumps
with open('creds.yml', 'r') as cred:
credsdict = load(cred.read())
s = session()
s.auth = (credsdict['username'], credsdict['password'])
hecdict = {
'name':'test-hec-1',
'index':'test_index_one',
'description':'my test hec',
'sourcetype':'test_hec',
'source':'hectest'
}
hectest = s.post("https://splunk-url.com:8089/services/data/inputs/http?output_mode=json", json=hecdict, verify=False)
I keep getting the return payload:
{"messages": [{"text": "Cannot perform action "POST" without a target name to act on.","type": "ERROR"}]}
This makes me think that Splunk cannot handle python's request library posts. Is this a known bug?
... View more
- Tags:
- splunk-enterprise
04-11-2018
12:51 PM
I wasn't aware this is the case; thanks for the help! If you have any suggestions without the subsearch, then that would be awesome, but if not, I still appreciate your help.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
2 weeks ago
|
Karma given to
