About seemanshu

seemanshu · ‎11-06-2023

Hi @smanojkumar , You could use the "IN" operator for this scenario. Let's assume the field name is "field1", so you could construct the multi-select input like following, This would have the output of the selected values like following, field1 IN("value1", "value2"), which is same as, field1="value1" OR field1="value2" If you find the solution helpful, kindly upvote. Thanks

seemanshu · ‎06-01-2023

Hi @secphilomath1 , As per your search mentioned in the question, after the by clause, you are using the following terms, _time ClientUser, DestinationDetails, MatchedItem Here, since "MatchedItem" has been used after the by clause, its only looking for the values(MatchedItem) unique to every "MatchedItem", thus you only see one MatchedItem. The correct search should be like following, index=epp "content threat" Policy="Content Aware Protection - Content Threat Detected" `comment("Creating buckets of 10 minutes")` | bin _time span=1h | stats count values(MatchedItem) by _time ClientUser, DestinationDetails | eval PotentialLeak=if(count >= 10, 1, 0) | search PotentialLeak = 1 Hope this helps. Kindly support the answer, if found helpful!

seemanshu · ‎05-09-2023

Hi @Souletting , Thanks for sharing the sample data format. Please use the following search, as per the shared data format, index=someapplication sourcetype=some_log subject="*" "folder_locations{}"="*" from_address="*" remediation_timestamp="*" received_time="*" recipient_address="*" to_addresses="*" | eval rectime=received_time | eval remtime=remediation_timestamp | eval Diff_in_Time=strptime(remtime,"%Y-%m-%d %H:%M:%S") - strptime(rectime,"%Y-%m-%d %H:%M:%S") | eventstats sum(Diff_in_Time) as TotalDiff_in_Time | table rectime remtime Diff_in_Time TotalDiff_in_Time Kindly support the answer, if found helpful.

seemanshu · ‎05-09-2023

Hi @Souletting , The real data is suppose to be different with new rows, but here just to check the search, we have used the example of sample values for rec_time and rem_time. Also, this helps in verifying that if it works for the sample format of data, then it will work for the real data as well. Hope this explains!

seemanshu · ‎05-05-2023

Hi @sekhar463 , The following Splunk blog will help you get the data from REST API. https://www.splunk.com/en_us/blog/tips-and-tricks/getting-data-from-your-rest-apis-into-splunk.html Kindly upvote the answer, if found helpful.

seemanshu · ‎05-05-2023

Hi @sbhatnagar88 , The following regex will help you with the same requirement, .+\/(?<Last_Field>\S+)$ Kindly upvote the answer, if found helpful.

seemanshu · ‎05-04-2023

Hi @jotne , The following setting in the web.conf will help in specifying the dashboard name, [settings] enable_risky_command_check_dashboard = false splunk_dashboard_app_name = <string> Here, splunk_dashboard_app_name will help in disabling the warning to the required app only. Kindly upvote, if found helpful.

seemanshu · ‎05-03-2023

Hi @gnshah12345 , You may use the following regex expression for fetching the required "remote_user" field. \d{0,3}\.\d{0,3}\.\d{0,3}\.\d{0,3}\s\-\s(?<remote_user>.+)\[ Kindly upvote, if found helpful.

seemanshu · ‎05-03-2023

Hi @yk010123 , You may use the following eval case to map the description with your status code, | eval description=case(status=="404","NOT FOUND",status==500,"INTERNAL ERROR",status=="400","INVALID Request",1=1,"NULL") Kindly support the answer if found helpful.

seemanshu · ‎05-03-2023

Hi @gnshah12345 , If the field extraction is based on user provided regex, kindly share the same in the response with a sample data, will be helpful in finding the right cause. Thanks!

seemanshu · ‎04-28-2023

Hi @Souletting , Here, in the following search, I am taking an example by makeresult command, for verifying the above search, | makeresults | eval rec_time="05/Feb/2023:03:12:03" | eval rem_time="05/Feb/2023:03:13:03" | eval Diff_in_Time=strptime(rem_time,"%d/%b/%Y:%H:%M:%S") - strptime(rec_time,"%d/%b/%Y:%H:%M:%S") | eventstats sum(Diff_in_Time) as TotalDiff_in_Time | table rec_time rem_time Diff_in_Time TotalDiff_in_Time The output of the above search is as follows, So, the search seems to be working fine, the issue seems to be in the time-format used in your search. Kindly upvote if found useful. Happy Splunking!

seemanshu · ‎04-27-2023

Hi @woodlandrelic , In the above shared search, you need to mention a common field among the fields (ip "Operating System" "Component Type") in order to make the join work. So, the updated search should look like, here i am assuming "ip" to be the common field for joining, | inputlookup compliance_data_high_severity.csv |join type=inner max=0 ip[ |inputlookup KononKV_system |where isnotnull(devices) |eval devices=split(devices, "|delim|") |eval data=split(data, "|delim|") |mvexpand devices |spath input=devices "IP Address" output=ip |spath input=devices "Component Type" |spath input=devices "Operating System" |spath input=data "System Acronym" `is_server("Operating System", "Component Type", is_server)` |search is_server="*" |fields ip "Operating System" "Component Type" ] Kindly upvote the answer, if found useful. Happy Splunking!

seemanshu · ‎04-27-2023

So far from my experience there is no such defined limit in serverclass.conf, neither have I faced any issue related to limit in serverclass.conf. Also, in case if you faced any such issue, I would suggest using "inclusive" serverclasses.

seemanshu · ‎04-26-2023

Hi @Nraj87 , You could use one of the following methods for excluding the data from a specific IP in your infrastructure, Modifying syslog-ng.conf filter f_all { not (<ip_address_to_be_excluded>);}; Modifying transforms.conf and props.conf in transforms.conf [setnull] REGEX = <regex for the ip to be excluded> DEST_KEY = queue FORMAT = nullQueue in props.conf [sourcetype_name] TRANSFORMS-null = setnull Kindly support the answer, if find it useful. Happy Splunking!

seemanshu · ‎04-25-2023

Hi @Vish , Thanks for the update. As per the recent requirement, if the rows with similar COMPONENT are required to be combined in a single row, then one of the following options could be used, if the BASKET is required in the final result, then use the following search, index=<index_name> sourcetype=<sourcetype_name> | table COMPONENT, BASKET, AGE | search BASKET=$tok_basket$ | stats values(AGE) as AGE, values(BASKET) as BAKSET by COMPONENT if BASKET is NOT required in the final results, then use the following search, index=<index_name> sourcetype=<sourcetype_name> | table COMPONENT, BASKET, AGE | search BASKET=$tok_basket$ | stats values(AGE) as AGE by COMPONENT Here, the filter $tok_basket$ passes the BASKET number as the user selects and filters out the results. Kindly support the answer if found helpful.

seemanshu · ‎04-25-2023

Hi @Vish , As per the requested query, the following search could be used, index=<index_name> sourcetype=<sourcetype_name> | table COMPONENT, BASKET, AGE | search BASKET=$tok_basket$ | fields - BASKET Here, the filter $tok_basket$ passes the BASKET number as the user selects and filters out the results. Kindly support the answer if found helpful.

seemanshu · ‎06-13-2022

Hi Dayane_tr, In Splunk Cloud, you could submit a support ticket asking for the app's savedsearches.conf files. You could learn more about the alert configurations in savedsearches.conf files, here Configure alerts in savedsearches.conf - Splunk Documentation. If this reply helps you, an upvote would be appreciated.

seemanshu · ‎01-09-2020

I tried the above mentioned solution, but it doesn't seem to work. Is there any other method?

seemanshu · ‎12-16-2019

Hi Snigdha95, The count option is in some how affecting the results. You should first check all the results without applying the limit on the count of results. Hopefully, that would help!

Posts	19
Solutions	5
Karma Given	0
Karma Received	10
Member Since	‎05-15-2018

Online Status	Offline
Date Last Visited	‎02-22-2024 04:01 AM

Re: Passing two values in condition based on selec...

Re: How to stats count but get all values?

Re: How to find the difference or delta in the two...

Re: How to find the difference or delta in the two...

Re: How to get data from external website data usi...

Re: Can any one help me with regex to fetch value ...

Re: Deactivate SPL safeguards on Splunk Enterprise

Re: Why does extracted field search work for certa...

Re: Can I add constant field/value conditionally?

Re: Why does extracted field search work for certa...

Re: How to find the difference or delta in the two...

Re: Using Join for 2 CSV files

Re: Is there a limit to the number of white/blackl...

Re: What is the easiest way to exclude ingestion o...

Re: Dashboard filter should work on a tabular pane...

Re: Dashboard filter should work on a tabular pane...

Re: Is it possible to export alerts from splunk cl...

Re: $click.name$ returns "result" instead of the t...

Re: Why is base search only showing several hours ...