About chrisboy68

chrisboy68

Awesome, thank you!

chrisboy68

chrisboy68 · ‎03-29-2022

Yes. that was exactly what I was looking for.!

chrisboy68 · ‎03-25-2022

Hi, I have a simple stats | stats values(Field1) sum(TB) by Field2 date_month This gives me one row for each month. Field1 10 Field2 Jan Field1 15 Field2 Feb I want to see it like below so each month is on the same row grouped by the fields. Field1 Field2 Jan 10 Feb 15 Tried transpose and some other suggestions. I just keep missing. Thanks, Chris

chrisboy68 · ‎02-23-2022

I figured out a solution. I was over thinking it. index=main ```place all your normal SPL here``` | eval alert_name = "myalert" ```create a variable with this alert name or key``` | lookup AlertSample.csv AlertName AS alert_name output IsOn ```lookup table has 2 columns, AlertName and IsOn``` | search IsOn=true ```evalute to true``` If there is a better way, would be glad to hear it. Chris

chrisboy68 · ‎02-23-2022

Hi, struggling why I can't seem to get this working. I want to have an alert evaluate to true (trigger) based on if its deemed active or inactive in a lookup table. The idea would be SPL would alway check the lookup and if the alert SPL evaluates to true, it would do it normal action. This way, we can have numerous alerts that are disabled (evaluate to false) but just updating one value in a lookup table and not clicking Disable for all alerts. I was thinking i could do something like index=main | append [| inputlookup AlertSample.csv where AlertName=MySampleName | fields IsOn] this and just append the value IsOn to all the events but its not working and I have tried many variants of spl. Suggestions or a better way of doing this? Thank you! Chris

chrisboy68 · ‎02-16-2022

I'm almost there. Now I need to count by each event, as this is totaling for every single event. Looks like I just need to add a group by in the stats. Thank you!

chrisboy68 · ‎02-16-2022

Neat. Trying to follow. I need to have the total of all, not each count. So, in my example, the total is 5.

chrisboy68 · ‎02-16-2022

Ok I updated. Just know that the sample is deeply nested and I can get to this object starting with an initial spath.

chrisboy68 · ‎02-16-2022

sorry, i made the sample too easy. I updated my sample json. No, I need to count the instance of the object.

chrisboy68 · ‎02-16-2022

Hi, struggling trying to count objects in a big json doc. I'm on version 8.0.5, so function json_keys is not available. { "0": { "field1": "123" }, "1": { "field2": "123" }, "2": { "field3": "123" }, "3": { "field4": "123" }, "4": { "field5": "123" } } This is a sample, I am able to get down to the path (startpath) with spath. What I'm trying to do is count the instances of the objects (0,1,2,3,4). I can't cleanly regex backwards as the real values names are not consistent. Thought I could do something like startpath{} and list them out , but the wildcards {} are not working anyway I try it. Thoughts, suggestions? Thanks Chris

chrisboy68 · ‎09-24-2021

Ugh. Seem counter intuitive. Thought time modifiers in SPL overrode the time picker. Anyway, thanks, so I can just run some SPL for last 30-60 days in hopes I find my problem in the future. If someone is pushing events in the past like months and years in the past, it will be a heavy query...

chrisboy68 · ‎09-24-2021

I'm stumped. So using this debug data , I did a search specifc to the time. Time picker was selected for Sept 6 (same day) index=os sourcetype=ps host=MyHost _time=1630910039.599 | eval indextime=strftime(_indextime,"%Y-%m-%d %H:%M:%S") | table host _time indextime Returns, the event time and indexed time differences, see below. Yeah, so my hunch was right. Now I want to reverse engineer some spl i can run now and find some issues. So lets just start with using a time modifier for index_earliest and spot check before I do some time math. index=os sourcetype=ps _index_earliest=-24h | eval indextime=strftime(_indextime,"%Y-%m-%d") | eval event_time =strftime(_time, "%Y-%m-%d") | table host _time indextime event_time The above does not pull back any data. If I remove the Timemodifier in the SPL and set the time picker for 24hrs, I do get back data. Am I missing something?

chrisboy68 · ‎09-24-2021

Update. So I had to put HEC into DEBUG mode to find my issue body_chunk="{"time":1630910039.599,"index":"os","host":"myhost","source":"ps","sourcetype":"ps", Just a snippet of the event above. The "time" sent in, is for the past. The HEC received time is Sept 6-time, but the actual time is Sept-24-time. This is the problem I'm trying to find without having to place an indexer into DEBUG mode. To clarify the question, how would I find this problem in the future by SPL? Thanks Chris

chrisboy68 · ‎09-23-2021

Thanks. Yeah looked at that, even have MetaWoot gathering metrics. None of those will show me ingest if the event date is in the past. Next stop debugging.

chrisboy68 · ‎09-23-2021

Thanks for the reply. That query did not tell me anything was wrong, all looked fine there.

chrisboy68 · ‎09-23-2021

Hi, I have an issue where I can see something is consuming licenses ingestion for a specific sourcetype. Unfortunately, the host is blank in index=_internal source="*license_usage.log*, however, I do know the index. I cannot find what host is sending data Indexed today by potentially sending dates in the past. I have found sending events dates in the past to be this issues. Only time i have solved it before, is DEBUG an HEC and I don't want to keep doing that. I want to do something like this: | tstats count where index=os AND sourcetype=ps groupby host| where < actually ingest time was yesterday but event time was days in the past, list event time and ingest time> Is this possible? Thank you! Chris

chrisboy68 · ‎09-13-2021

Its 09/2021 and this solved our 502 issues too. Thank you!

chrisboy68 · ‎07-29-2021

Ok, let me give it a shot. Thanks Chris

chrisboy68 · ‎07-29-2021

Thank you. Still a bit confused how to set up elastic sources For example. Given this tstats | tstats count summariesonly=t where index !=_* AND sourcetype=*aws* AND host= ip* groupby host, index ,sourcetype I want my elastic sources to be "host:index:sourcetype". As mentioned, I have over 1k of inputs on all my HFs , so looking at using tstats with just so is it possible to put in one tstats query in the constraint to achieve what I'm looking for? Thank you, Chris

Posts	127
Solutions	4
Karma Given	1
Karma Received	17
Member Since	‎06-14-2013

Online Status	Offline
Date Last Visited	3 weeks ago

How to dynamically subtract two last column values...

How to get Stats values by Month as a Column?

How to set an alert to fire based on lookup table ...

Having trouble reading complexed nested Json

TSTATS Sort by Indexed Time?

TrackMe App: Adding Host to DataSources

Splunk Add-on for AWS Issues with Kinesis Pull

Workload Management - Admission Rules only working...

Scheduled Search Not Being Dispatched

Search Marcro - Sending Results to Macro Variable.

Re: Dynamically Subtract Two Last Column Values

How to dynamically subtract two last column values...

Re: How to get Stats values by Month as a Column?

How to get Stats values by Month as a Column?

Re: How to set an alert to fire based on lookup ta...

How to set an alert to fire based on lookup table ...

Re: Reading complexed nested Json

Re: Reading complexed nested Json

Re: Reading complexed nested Json

Re: Reading complexed nested Json

Having trouble reading complexed nested Json

Re: TSTATS Sort by Indexed Time?

Re: TSTATS Sort by Indexed Time?

Re: TSTATS Sort by Indexed Time?

Re: TSTATS Sort by Indexed Time?

Re: TSTATS Sort by Indexed Time?

TSTATS Sort by Indexed Time?

Re: Fixing 502 errors when front-ending Search Hea...

Re: TrackMe App: Adding Host to DataSources

Re: TrackMe App: Adding Host to DataSources