About jlelli

jlelli · ‎10-30-2018

With the eval command is quite simple to do that; something like: | eval Percentage= round(100 * Count / Total,2) However I don't understand how you are using the fields in your table; if i understood correctly the "Actual_Sept" field has in it the values of both the dividend and the divisor. Is that correct?

jlelli · ‎10-17-2018

Ok, let's talk about mode(): is gives you the most frequent field however it does not gives you the count used to extract that values. To obtain that value is a bit of a pain. Additionally your search sourcetype="ms:iis:auto" cs_host="www.example.com" | timechart max(c_ip) span=5sec Leaves me a bit puzzled because it should give you the max value of the C_ip field; it does not give you the count. Are you sure is it working correctly? The best solution i can advise is to use this method (https://answers.splunk.com/answers/99221/counting-how-often-the-mode-value-occurs-in-a-result-set.html) to extract the count of the mode(); applied to your fields it should become: sourcetype="ms:iis:auto" cs_host="www.example.com" | bin _time span=5s | eventstats mode(C_ip) as mostfrequent by _time ` | eval isMode=if(C_ip=mostfrequent,1,0) | timechart span=5s mode(C_ip) as mode, sum(isMode) as hits Hope this answers your question!

jlelli · ‎10-17-2018

So would it have to get to greater than 10 before a single alert? I need to be able to catch the ones that just come in once as well. What I'm trying to avoid is for the ones that come in 10 times within one minute, to just report on that specific alert once. If you need to be notified as soon as ONE event comes in then change the alert value "Greater than" to 0. Ok, so is there a way with this feature to say that if the alert is only one time, forward to OpsGenie... and if the alert is greater than 5 in 5 minutes, alert only once to OpsGenie? So you need to define two different notification behaviours according to the volume of the alert? I think the easiest way to do so is to clone the alert condition and change the triggers: - Forward to OpsGenie: is Greater than 0 in 1 minute, trigger "for each result", no throttle (be careful: this setting can create A LOT of notifications) - Alert to OpsGenie: is greater than 5 in 5 minutes, trigger "Once", throttle 24h (or something like that)

jlelli · ‎10-16-2018

For example, if you have continuous events during those 5minutes, with that throttle you will receive 1 alert every 5minutes. Correct, but only if there are 10+ events again during those 5 minutes, otherwise you would not receive a new alert.

jlelli · ‎10-16-2018

If all the values are uniques (and they should be if they are Orders) you can try something like: | foreach OrderNumberFailureA [eval match=if(OrderNumberFailureA=OrderNumberFailureB, OrderNumberFailureA, NULL)] | table OrderNumberFailureA OrderNumberFailureb match I don't understand why all the table commands (since there is not direct row correlation between the three fields) in this case a stats would be faster: search 1 | rename OrderNumberFailure AS OrderNumberFailureA |append [search search2 |rename OrderNumberFailure AS OrderNumberFailureB] | foreach OrderNumberFailureA [eval match=if(OrderNumberFailureA=OrderNumberFailureB, OrderNumberFailureA, NULL)] | stats values(OrderNumberFailureA) values(OrderNumberFailureB) values(match)

jlelli · ‎10-16-2018

this should work: | rex field=uri_path "^(?<myfield>/\w+/\w+/\w+/)"

jlelli · ‎10-16-2018

host="SERVER_Number_*" "Game Starting..." | timechart span=1d count by host Timechart already groups by _time so there is no need to add it

jlelli · ‎10-16-2018

Something like this? I set the throttle time to 5 minutes to receive a new alert if the condition is still ongoing; If you need to alert only once to activate the team then you can raise the throttle time to one hour or more according to your preferences and/or policies.

jlelli · ‎10-16-2018

If you have common unique values for different fields, would not be easier to rename them all and then apply a transaction command on the renamed field? Something like: | rename subject as UID | rex "sendmail+\S+\s(?<UID>[[:alnum:]]+)" | transaction UID If the time and format of the events are always the same you can add further options to the transaction, something like | transaction UID startswith=subject endswith=to and/or | transaction UID maxevents=3

jlelli · ‎10-10-2018

Please note that in the code i provided the verification of the single event is made by: | transaction host MemberName startswith="4732" endswith="4733" (this creates a single event from the coupling of member-add / member-remove) | where mvcount(EventCode)<2 (this excludes all the paired events, showing only the orphaned ones) In your search your have replaced the where command with | where mvcount(MemberName)<2 and since the MemberName field is unique the filter does not work. Replace this with the original | where mvcount(EventCode)<2 and it should work fine. If no records are shown is because there are no Orphaned events, so try to change the time slice of the search or to increase the search range.

jlelli · ‎10-09-2018

I don't understand the reason for all the field extraction, eval and renaming; so i took some liberties in the query. Try instead: source="WinEventLog:Sec*" index="wineventlog" EventCode=4732 OR EventCode=4733 | rex "Security ID:\s+(?<MemberName>.*)" | rex "Account Name:\s+(?<UserName>.*)" | rex "Group Name:\s+(?<GName>.*)" | transaction host MemberName startswith="4732" endswith="4733" | where mvcount(EventCode)<2 | eval Date=strftime(_time, "%d/%y") | table Date MemberName EventCode | rename MemberName as "Member Name" EventCode as "EventCode" If the Windows Security ID has matches this should work, otherwise you can try to match the Account Name replacing the transaction and table lines with: | transaction host UserName startswith="4732" endswith="4733" | table Date, UserName, EventCode

jlelli · ‎10-09-2018

I'm not familiar with Windows Security Logs and your query uses a logic that i don't fully understand; if you need a test string i need a sample of the event.

jlelli · ‎10-09-2018

If i understood correctly you need to find the "orphaned" accounts that do not have BOTH events 4732 and 4733. In this case i can suggest simply to group by account | stats list(EventCode) by "Account Name" | where mvcount(EventCode)<2 Obviously this will work only if the accounts and Event Codes are uniques (no single account can have more than 1 event 4732 and 1 4733 event) If this is not the case then you need first to group the events in different transactions, then apply the evaluation: something like | transaction Host "Account Name" startswith=4732 endswith=4733 | where mvcount(EventCode)<2 | table _time "Account Name" EventCode

jlelli · ‎10-09-2018

I think an eval case could fit nicely | eval category=case(like(URL, "%marketing"),"marketing" OR like(URL, "%Shopping%"), "Shopping" OR like(URL, "%Education%"), "Education" OR like(URL, "%Socialmedia%"), "Social media" , true(), "other") | stats count by category

jlelli · ‎10-09-2018

Another alternative is to use a rename and join index=a |rename MTH as month | join month [search index=b]

jlelli · ‎10-08-2018

If the events are in the same index you could simply add an OR in the search string and then extract the values you need with a rex extraction; something like: search "upload succesful" OR "[ERROR]"| rex "\> (?<result>.*)" | top result

jlelli · ‎09-28-2018

As @harishalipaka said: change the scheduled time on Cron; the expression for "every hour" is: 0 0 * ? * *

jlelli · ‎05-31-2018

Since this thread seems to be still active and unsolved i'll post my solution: expanding the logic proposed by @gkanapathy you can count the _time of the first occurrence of a new IP address: | stats earliest(_time) as _time by clientip | timechart count(_time) The only problem with this logic is that Ip addresses that have first appeared earlier than the time range considered will be counted in the first time span. It's a problem that's going to matter less the longer your time range and span are but, honestly, i don't know even if this can be solved and how.

jlelli · ‎05-16-2018

Thank You, I still misspell some comma here and there but your logic is way simpler and faster to use.

jlelli · ‎05-11-2018

I am not an expert but i think there are some logic problems; First I would use something simpler to extract the timestamps since _time is already defined in Splunk Search A | stats last(_time) as Received by transactionID | join transactionID [search B | stats last(_time) as Send by transactionID] | eval Response=Received-Sent Now that you got the response time for each specific transationID and I suppose you want to know the avg Response time during specific time slots. however with my system you do not have anymore a general _time but only the one referred to the specific TransactionID. A possible solution would be nest this search as a further subsearch for the time range you need, something like: Search A | join transactionID [Search A | stats last(_time) as Received by transactionID | join transactionID [search B | stats last(_time) as Send by transactionID] | eval Response=Received-Sent] | stats avg(Response) by _time I think there are easier ways to achieve this but it should work

jlelli · ‎05-11-2018

Hi all, I got some problems categorizing a custom field according to its content; to do so I am using multiple eval IF commands: | eval Myfield=if(Like(Myfield, "%Windows%"), "Microsoft", Myfield) | eval Myfield=if(Like(Myfield, "%iPhone%"), "Apple", Myfield) | eval Myfield=if(Like(Myfield, "%Android%"), "Google", Myfield) With a simple stats count by MyField i got both the number of Microsoft, Apple and Google values and the explicit values for everything else. So far is exactly what I need. Now I want to expand this query in two ways 1- Including multiple conditions for the same value (to save writing a sigle eval for each case) | eval Myfield=if(Like(Myfield, "%Windows%" OR "%Office%" OR "%Notepad%"), "Microsoft", Myfield) 2 - Including an "Other" value for everything that is not specified | eval Myfield=if(NOT Like(Myfield, "%Windows%" OR "%iPhone%" OR "%Android%"), "Other", Myfield) However neither of two is working: I got some SPL grammar or logic problem that still can't solve...

Posts	21
Solutions	5
Karma Given	1
Karma Received	2
Member Since	‎05-11-2018

Online Status	Offline
Date Last Visited	‎06-05-2020 02:04 AM

Multiple eval of the same field

Re: How do you add percentage of total for several...

Re: How do you use the timechart command to retrie...

Re: Can you help me fine-tune my malware related a...

Re: Can you help me fine-tune my malware related a...

Re: How do you compare values in two columns creat...

Re: Can you help me come up with a regex for an AP...

Re: How do you use the timechart command to see a ...

Re: Can you help me fine-tune my malware related a...

Re: How do I correlate email events when the key-i...

Re: Can you help me compare two searches and then ...

Re: Can you help me compare two searches and then ...

Re: Can you help me compare two searches and then ...

Re: Can you help me compare two searches and then ...

Re: Can you help me make a visualization from the ...

Re: How do I bind values from different indexes wi...

Re: What is the best way to calculate the percenta...

Re: After configuring email alerts, why am I not r...

Re: Does distinct_count() in a timechart count uni...

Re: Multiple eval of the same field

Re: subtraction of timestamp from two search

Multiple eval of the same field

Are you a member of the Splunk Community?