Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About dannili
dannili
Communicator
Member since:
06-21-2018
06-05-2020
Community Statistics
| Posts | 57 |
| Solutions | 0 |
| Karma Given | 26 |
| Karma Received | 3 |
| Member Since | 06-21-2018 |
Activity Feed
- Got Karma for Inputlookup in dropdown to display different columns. 09-02-2020 12:19 PM
- Karma Metric value= is not valid Metric event data with an invalid metric value would not be indexed. Ensure the input metric data is not malformed. for smitra_splunk. 06-05-2020 12:50 AM
- Karma Re: Integrating Splunk Dashboard With Python for niketn. 06-05-2020 12:49 AM
- Karma Re: Find difference between time now and last event time for somesoni2. 06-05-2020 12:49 AM
- Karma Re: How to get city or county names using latitude and longitude values in Splunk? for MuS. 06-05-2020 12:49 AM
- Karma Re: How do you add a Python script to Splunk Enterprise? for anjambha. 06-05-2020 12:49 AM
- Karma Re: Error 'Could not find all of the specified lookup fields in the lookup table.' for CarsonZa. 06-05-2020 12:49 AM
- Karma Re: How to split multiple lines of data into a single individual line in splunk? for Hemnaath. 06-05-2020 12:49 AM
- Karma Re: How to convert an IP address to lat and long and to use the Missile Map? for MuS. 06-05-2020 12:49 AM
- Got Karma for Re: How to extract a string from a long field containing special characters?. 06-05-2020 12:49 AM
- Got Karma for Re: How can I get stacked bar chart value?. 06-05-2020 12:49 AM
- Karma Re: How to make a bar graph with multiple bars for a category for adonio. 06-05-2020 12:48 AM
- Karma Re: line-break issues in events for aakwah. 06-05-2020 12:48 AM
- Karma Re: Plotting Normal Distribution using a column for Richfez. 06-05-2020 12:48 AM
- Karma line-break issues in events for fisuser1. 06-05-2020 12:48 AM
- Karma Re: How to troubleshoot why IMAP Mailbox is not indexing any email in our production Linux environment? for ragingwire. 06-05-2020 12:47 AM
- Karma Re: Convert this time format to epoch for somesoni2. 06-05-2020 12:47 AM
- Karma Re: I'm struggling with how I SHOULD be doing inputs and also props/transforms/etc stuff within Splunk Cloud. for khourihan_splun. 06-05-2020 12:47 AM
- Karma Re: IMAP on Shared Mailbox Windows for cpt12tech. 06-05-2020 12:47 AM
- Karma Re: Display images instead of field values for linu1988. 06-05-2020 12:46 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 0 | |||
| 0 |
03-20-2019
12:47 AM
Right now my workaround solution is using eval :
| eval _time = _time -28800
| bucket _time span=24h
| eval _time = _time +28800
| stats count by _time
Because I checked the only event on 18th is on 8 AM but I wonder if there's any better solution?
... View more
03-20-2019
12:36 AM
I was trying to compare events from the last two days respectively (and it should be last 24 hours instead of the day before 00:00) I used bucket _time to get the count result from each two day by setting time range in the search box as Last 2 days . However, the count produced have three results instead of 2:
index=*
| *** base search ***
| bucket _time span=24h
| stats count by _time
Here's my result:
_time count
2019-03-18 08:00 1
2019-03-19 08:00 11
2019-03-20 08:00 15
But the correct result should be:
_time count
2019-03-19 08:00 12
2019-03-20 08:00 15
Does anyone know what's the problem? Thank you so much for the help!
... View more
01-09-2019
09:47 PM
Thanks for your comment but the problem remains. I have checked the file and there are no hidden chars. Any other suggestions?
... View more
01-09-2019
07:49 PM
Hi all, I have a CSV lookup file to map with one field in my indexed data. The search was working perfectly before, but today, my search returned 0 results with this alert:
[hdfsprovider] Error in 'lookup' command: Could not find all of the specified lookup fields in the lookup table.
This is my search:
index=skype_session | rex "FromIPAddr\"\"\:\"\"(?<FromIPAddr>[^\"]+)\"\"\,\"\"ToIPAddr\"\"" | rex "ToIPAddr\"\"\:\"\"(?<ToIPAddr>[^\"]+)\"\"\,\"\"FromBssid\"\"" | rex "MediaStartTime\"\"\:\"\"(?<MediaStartTime>[^\"]+)\." | rex "MediaEndTime\"\"\:\"\"(?<MediaEndTime>[^\"]+)\." | rex "(?<FromUri>[a-zA-Z0-9_\-\.]+@[a-zA-Z0-9_\-\.]+\.[a-zA-Z]{2,5})\",\"(?<ToUri>[a-zA-Z0-9_\-\.]+@[a-zA-Z0-9_\-\.]+\.[a-zA-Z]{2,5})" |
lookup staff.csv email AS FromUri | dedup FromUri | where FromIPAddr!="" | stats count by department | sort - count
staff.csv looks like this (denoted with comma UTF-8): I wanted to check if indexed field FromUri exists in an email field in the lookup, and if yes, output the department field in the lookup.
|email|department|
|--------|-----------------|
|--------|-----------------|
I checked other questions and there are some stating maybe the Splunk version and .conf issues. But I didn't change .conf and my Splunk version is 6.5.2.
Does anyone know how to solve this? Thanks!
... View more
12-02-2018
06:07 PM
Hi all, I'm using standard geostats then count country in cluster map for one of my dashboard map display. I wonder if it's possible to change one of country's font size displayed on map? Just one, not all.
I have admin access and it's ok if we need to change server config files.
Thanks a lot!
... View more
11-06-2018
12:21 AM
Thanks for your response.This worked!
... View more
11-05-2018
07:25 PM
I have index =s1 with a field called city, and an uploaded CSV file with fields like "office", "latitude" and "longitude". I wanted to find matching values where city == office and then use input lookup's latitude and longitude to visualize a map.
My search now is like this but it's not working.
index=s1 | append [| inputlookup cosco_mapping.csv | rex field=formatted_address "^(?<city>[^,]++)" | fields city, latitude, longitude ] | rex field=group_name "^(.*[\\\\])(?<office>.+)" | table office, city, latitude, longitude | where office==city | geostats latfield=latitude longfield=longitude count
Does anyone know how to solve this? Thanks!
... View more
10-31-2018
01:42 AM
This worked perfectly, thanks a lot! also suggestion noted.
... View more
10-30-2018
11:40 PM
Hi all, I have some raw data looking like this.(just a part)
....."","10/30/2018 7:31:08 AM","10/30/2018 7:41:52 AM","natalie.someone@email.com","andrew.someone@email.com","UCCAPI/3823.323.10827.* OC/16.0.10827.20150 (Skype for Business)","UCCAPI/16.0.10730.2342342 OC/16.0.10730.20088 (Skype for Business)","","","","****-5042-5F76-A879-***7","","","","","200","[IM]","{""RequestType"":""BYE"",""RequestTime"":""2018-10-30T07:41:52.2147589"",""ContentType"":"""",""ResponseCode"":""200"",..
I want to extract two email addresses from each raw event ( natalie.someone@email.com , andrew.someone@email.com in this case) to be my two fields caller_email and receiver_email.
Does anyone know to do this? Thanks a lot!
... View more
08-26-2018
11:51 PM
Hi all, I have an OUTLOOK email account that receives real-time email notifications on PC backup and I wanna index all these emails into my installed IMAPmailbox APP for data analysis and visualization. But now my index=mail return 0 events. Could someone help me with this?
In my inputs.conf , I only changed unix systems disabled attribute to true and windows one to false. Also, I modified configuration using Splunk UI and checked the imap.conf. These all looks normal.
[IMAP Configuration]
debug = 0
deleteWhenDone = 1
disabled = 0
fullHeaders = 0
includeBody = 1
noCache = 0
port = ****
server = ****p
useSSL = 1
user = *****notification@oworkspace.onmicrosoft.com
Also, not sure if this is related but the inbox of the email account receives 0 emails. All notifications are shown in the Status Report section as the same level of Inbox. They are divided into Success, Failed, Warning and Test.
But still my search returns nothing and I would like to know if extra modifications need to be done for this to wok? Thanks for your help!
*******UPDATE************
just saw this question and the solution was to change 0 and 1 to characters, I just tried but nothing changed. Any other ideas? Also, if the server value is server name but not ip address it's still working right?
reference answer
... View more
08-13-2018
07:12 PM
1 Karma
Hi all, I'm creating a dashboard that contains drop downs that allow viewers to select a field user_id and the table will display a list of user_ids and other columns' value regarding the id. But due to security issues, I am only given a search index=version_search and when I edit dynamic options in drop downs, search strings return no result.
All information I have now is:
Index general settings:
/home/data/version_search/db
My source file:(pretty sure the inputlookup search_version is not correct because not sure if lookup tables being created)
<input type="dropdown" token="user_id">
<label>Select a user ID</label>
<choice value="*">All</choice>
<default>*</default>
<fieldForLabel>user_id</fieldForLabel>
<fieldForValue>user_id</fieldForValue>
<search>
<query>| inputlookup version_search | dedup "user_id" | fields "user_id"</query>
<earliest>0</earliest>
<latest></latest>
</search>
</input>
Does anyone know any possible solutions? Thanks in advance!
... View more
08-09-2018
01:06 AM
I think I know why it did not work before, the SHOULD_LINEMERGE needs to be all lowercase? anyway thanks
... View more
08-07-2018
10:51 PM
yes I restarted. So you mean these changes will not affect already ingested data? Then guess this could be the reason
... View more
08-07-2018
10:39 PM
Hi Thanks for your response. But I just tried, it's still not working.
... View more
08-07-2018
09:05 PM
Hi all, this is one sample I'm trying to extract in order to visualize them in table. But when I select a sample field 8/2/2018 and name it as date , the extracted fields only has one single value instead of 6 dates as I expected.
Date,Spam Detected,Malware Detected,Phishing Email,ATP Safe Links,ATP Safe Attachments,Total Mail Received
8/2/2018,66456,872,1046,3,6,328550
8/3/2018,99360,317,1593,1,2,370798
8/4/2018,81288,58,826,1,0,136444
8/5/2018,60885,75,625,0,0,109609
8/6/2018,59562,851,1595,0,24,344166
8/7/2018,55283,350,460,2,13,284023
This is my props.config:
[****_security]
INDEXED_EXTRACTIONS = csv
FIELD_DELIMITER=,
[source::/log/***/****/****_security_stat.csv/*/*/*]
sourcetype = ****_security
Does anyone know how to solve this problem? Thanks in advance!
... View more
07-25-2018
05:55 PM
thanks for ur response. Turns out it's the setup issue. System team helped fix it.
... View more
07-25-2018
02:40 AM
Thanks for your response. Tho the rex was a bit off but the whole search string worked perfectly after I made a minor change. Your explanation was very thorough.
... View more
07-25-2018
12:15 AM
I have a column named Target that contains several values where some ends with @myemail.com , but when I just used stats count by Target it became really messy as there are many email users.
So I want to sum all the values that end with @myemail.com and then display in the Pie chart with other value counts. But I tried stats sum(eval) return no result while the case wouldn't work as the total type of string values changes along time.
Does anyone know how to search this? Thanks!
... View more
07-24-2018
06:03 PM
I just moved my whole dashboard to production environment but when I tried to test using a search string, following exception and error occur:
2 errors occurred while the search was executing. Therefore, search results might be incomplete. Hide errors.
•[hdfsprovider] Error while running external process, return_code=255. See search.log for more info
•[hdfsprovider] Exception - com.splunk.mr.JobStartException: Failed to start MapReduce job. Please consult search.log for more information. Message: Failed to create Hunk directories due to permission denied. Please make sure you have write permission to the directory specified by vix.splunk.home.hdfs in your provider
**********Search
index="my_index" | stats count(eval( OverallAvgNetworkMOS < 3.5 OR Stream_1_JitterInterArrival > 30 OR Stream_2_JitterInterArrival > 30 OR Stream_1_RoundTrip > 500 OR Stream_2_RoundTrip > 500 OR Stream_1_PacketLossRate>0.1 OR Stream_2_PacketLossRate>0.1)) AS bad_call count(eval(OverallAvgNetworkMOS >= 3.5)) AS good_call | transpose
I checked other posts related to error but could not find a suitable solution. Is this knida search related to config?
Does anyone know how these two can happen? How do I fix this? Thanks a lot!
... View more
07-19-2018
02:22 AM
ok thanks for your response
... View more
07-19-2018
12:36 AM
Thanks for your response. I have a few questions tho. For line 5, results,unused1,unused2 = splunk.Intersplunk.getOrganizedResults() , does it mean initialize all the columns in the file? Also, I use pandas library in Python so the program executes files as unit of columns, so the loop is not necessary in this case. Then will it still work if for result in results: is not included?
... View more
07-18-2018
06:53 PM
I've create a dashboard to visualize a business software log analysis. Before adding flume agent I was processing data in excel and then through Python program because there're a lot of tedious field extractions to do, such as extracting about ten fields from one column that's JSON formatted. And then I would manually upload processed .csv file and search in Splunk.
But after adding flume agent, the _raw data was really messy and not responding to my rex search. Also if I were to use rex the search string could be about 100 lines for each dashboard panel. So I was wondering if there's way to insert my Python program to the dashboard source to process data?
my props.config:
> [log_session]INDEXED_EXTRACTIONS =csv
> FIELD_DELIMITER=,
> [source::/datalake/log/******]
> sourcetype = my_named_source
... View more
07-15-2018
10:33 PM
btw there's a typo in question... I meant exactly the regular expression, that is, rex .
... View more
07-15-2018
10:15 PM
Yes you are right.. I totally misinterpreted it. Thanks a lot!
... View more
07-15-2018
08:38 PM
Hi all, I'm using virtual index to access log files stored in Hadoop and then trying to extract certain values from JSON formatted file. But the the parsed file does not have name but only string values enclosed in "" with comma between them so the rex wouldn't work. So I was wondering if there's any possible solution to extract these. here's one example:(For example I'm extracting two email address)
11:14:45.000 AM "admin0f.online.lync.com","073e10cd-3910-46d9-95ee-e72ff0ed41dc","False","f24484cef680422ca872a99e47986e5d;add34fecd1;44a0bc0b3e","","7/13/2018 9:34:52 AM","7/13/2018 9:36:44 AM","jessica@example.com","alex@example.com","UCCAPI/16.0.9330.2118 OC/16.0.9330.2118 (Skype for Business)","UCCAPI/16.0.9330.2118 OC/16.0.9330.2118 (Skype for Business)","","","34872F8C-DBB6-53AD-8815-9328990D7FB8","B4DD4A65-1BFA-5E22-9194-F8D06EA27D9F","","","","","200","[IM]","{""RequestType"":""BYE"",""RequestTime"":""2018-07-13T09:36:44.016"",""ContentType"":""application/sdp;call-type=im"",""ResponseCode"":"""",""DiagnosticId"":51004,""ErrorCategory"":""Success"",""DiagnosticHeader"":""51004; reason=\""Action initiated by user\"";\""OriginalPresenceState=\""\""3000\""\"";CurrentPresenceState=\""\""3000\""\"";MeInsideUser=\""\""No\""\"";ConversationInitiatedBy=\""\""6\""\"";SourceNetwork=\""\""2\""\"";RemotePartyCanDoIM=\""\""Yes\""\""\""""} {""RequestType"":""BYE"",""RequestTime"":""2018-07-13T09:36:43.5572341"",""ContentType"":"""",""ResponseCode"":""200"",""DiagnosticId"":51004,""ErrorCategory"":""Success"",""DiagnosticHeader"":""51004; reason=\""Action initiated by user\""""}
... View more
