Hello I am setting up netflow ticket collection on splunk. I am a very occasional user, and I come to you ask help. What interests me are specific dialogs of my network infrastructure : src=net_A to dest=net_B or src=net_B to dest=net_A All the rest i don't want splunk to keep it and store it, for example net_B to net_B, net_B to net_C, ..... I think I must use CIRDMATCH for my need, to do the filtering I think it must be done on the forwarder but not sure Is there any possibility of doing this ? My splunk infrastructure: splunk 8.1.1 2 Forwarder 2 Indexer 2 Search Head 1 server deployment / license thank you ... View more

Hello, I'm trying to make a report to count the number of interfaces available and used. I found the query that matches my need. index=centreon check_command="Cisco-SNMP-Interfaces-Global-Status" service_description="Status_All-Interfaces" src_interface!="Ethernet*.*" src_interface!="Vlan*" src_interface!="mgmt*" src_interface!="port*" src_interface!="Null*" src_interface!="loopback*" | rex field=host "ZSE-(?<loc>\w+)-(?<room>\w+).*" | replace "1H" WITH "UC1"| replace "1E" WITH "UC1"| replace "2H" WITH "UC2"|replace "2F" WITH "UC2"| replace "6E" WITH "C6"| replace "6F" WITH "C6"| replace "6T" WITH "C6"| replace "4B" WITH "C4"| replace "4T" WITH "C4"| replace "4E" WITH "C4" | eval site=loc+"-"+room | stats count(src_interface) as tot_int by site | appendcols [search index=centreon check_command="Cisco-SNMP-Interfaces-Global-Status" service_description="Status_All-Interfaces" src_interface!="Ethernet*.*" src_interface!="Vlan*" src_interface!="mgmt*" src_interface!="port*" src_interface!="Null*" src_interface!="loopback*" state_interface="up" | rex field=host "ZSE-(?<loc>\w+)-(?<room>\w+).*" | replace "1H" WITH "UC1"| replace "1E" WITH "UC1"|replace "2H" WITH "UC2"|replace "2F" WITH "UC2"| replace "6E" WITH "C6"| replace "6F" WITH "C6"| replace "6T" WITH "C6"| replace "4B" WITH "C4"| replace "4T" WITH "C4"| replace "4E" WITH "C4" | eval site=loc+"-"+room | stats count(state_interface) as tot_up by site] | eval tot_free=tot_int-tot_up My concern is the frequency of data reception by SPLUNK is not stable (plus or minus 10 minutes) How to make so that my dream is based only on the last events received? Thank's       ... View more

Hello, I have an excel file like this : And I wanna do this on splunk, but I can't / don't know how to do it My request :   index=centreon host="xxxxxx" | bucket _time span=1d | convert ctime(_time) AS date timeformat="%Y/%m/%d" | contingency host date usetotal=false | appendcols [search index=centreon host="xxxx" | bucket _time span=1d | convert ctime(_time) AS date timeformat="%Y/%m/%d" | stats avg(_raw) AS AVG by host | stats stdev(_raw) AS STDEV by host | eval ratio=(stdev/avg) | fields avg,stdev,ratio]   I'm sure my research is bad, someone could help me ? Thank's ... View more