Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About caili
caili
Path Finder
Member since:
08-09-2015
06-05-2020
Community Statistics
| Posts | 14 |
| Solutions | 0 |
| Karma Given | 0 |
| Karma Received | 4 |
| Member Since | 08-09-2015 |
Activity Feed
- Got Karma for How can I pass a default value to the map command?. 06-05-2020 12:47 AM
- Got Karma for How can I split an event into two or more events according to two multivalue fields?. 06-05-2020 12:47 AM
- Got Karma for How can I split an event into two or more events according to two multivalue fields?. 06-05-2020 12:47 AM
- Got Karma for How can I split an event into two or more events according to two multivalue fields?. 06-05-2020 12:47 AM
- Posted Re: Why is some of the data that is coming in to Splunk via UDP getting dropped? on Getting Data In. 05-19-2016 07:19 PM
- Posted How can I forward old data to 3rd party systems? on Getting Data In. 05-19-2016 05:06 AM
- Tagged How can I forward old data to 3rd party systems? on Getting Data In. 05-19-2016 05:06 AM
- Tagged How can I forward old data to 3rd party systems? on Getting Data In. 05-19-2016 05:06 AM
- Tagged How can I forward old data to 3rd party systems? on Getting Data In. 05-19-2016 05:06 AM
- Posted Why is some of the data that is coming in to Splunk via UDP getting dropped? on Getting Data In. 05-19-2016 04:49 AM
- Tagged Why is some of the data that is coming in to Splunk via UDP getting dropped? on Getting Data In. 05-19-2016 04:49 AM
- Tagged Why is some of the data that is coming in to Splunk via UDP getting dropped? on Getting Data In. 05-19-2016 04:49 AM
- Posted Re: How to compare data for specified absolute dates using the Timewrap command? on All Apps and Add-ons. 08-30-2015 01:43 AM
- Posted Is there a way to quickly turn to the first / last / specified page of results in a Simple XML dashboard? on Dashboards & Visualizations. 08-30-2015 01:01 AM
- Tagged Is there a way to quickly turn to the first / last / specified page of results in a Simple XML dashboard? on Dashboards & Visualizations. 08-30-2015 01:01 AM
- Tagged Is there a way to quickly turn to the first / last / specified page of results in a Simple XML dashboard? on Dashboards & Visualizations. 08-30-2015 01:01 AM
- Tagged Is there a way to quickly turn to the first / last / specified page of results in a Simple XML dashboard? on Dashboards & Visualizations. 08-30-2015 01:01 AM
- Posted Re: How can I split an event into two or more events according to two multivalue fields? on Splunk Search. 08-25-2015 09:08 PM
- Posted Re: How can I split an event into two or more events according to two multivalue fields? on Splunk Search. 08-19-2015 02:42 AM
- Posted Re: associated query according to the context on Splunk Search. 08-16-2015 09:47 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 3 | |||
| 1 |
05-19-2016
07:19 PM
The first line is missing， not be indexed
if I add BREAK_ONLY_BEFORE = <headinfo in props.conf，then all the data(less than 256) will be combined as one envent
the configuration of props.conf is :
[a_log]
category = Custom
description = receiving UDP port data
pulldown_type = 1
#SHOULD_LINEMERGE = true
#BREAK_ONLY_BEFORE = <headinfo
There is no transforms.conf in local directory
... View more
05-19-2016
05:06 AM
I referred to the document as shown in http://docs.splunk.com/Documentation/Splunk/6.4.1/Forwarding/Forwarddatatothird-partysystemsd
I can forward the new data which are first indexed to 3rd-party systems, but the old data indexed before can't be forwarded
How can I solve it?
Thanks in advance.
... View more
05-19-2016
04:49 AM
Every UDP packet is like this below:
<headinfo product="wf" hash="D95F-7C1A-0F4D-A311" msgtype="3840" sip="0"/>
<wsec dev_ip="59.57.13.68" protocol_type="HTTP" src_port="57681" protect_id="2395196206" wa_host="www.shis.gov.cn" url="L3NzemZ3bXMvd3d3cm9vdC9pbmeC5qc3A=" count_num="1" agent="aHR0cCUyZGZveGJv" src_ip="59.6.74.114" http_protocol="HTTP/1.1" dst_port="80" dst_ip="59.60.3.146" stat_time="1463656155" wa_referer="Tm9uZQ==" method="2" alertlevel="3" event_type="28" />
There are two lines, but I want to combine to one event
Splunk indexes the data like this:
<wsec dev_ip="59.57.13.68" protocol_type="HTTP" src_port="57681" protect_id="2395196206" wa_host="www.shis.gov.cn" url="L3NzemZ3bXMvd3d3cm9vdC9pbmeC5qc3A=" count_num="1" agent="aHR0cCUyZGZveGJv" src_ip="59.6.74.114" http_protocol="HTTP/1.1" dst_port="80" dst_ip="59.60.3.146" stat_time="1463656155" wa_referer="Tm9uZQ==" method="2" alertlevel="3" event_type="28" />
the first line is dropped.
What can I do for this?
Thanks in advance.
... View more
- Tags:
- splunk-enterprise
- udp
08-30-2015
01:43 AM
I don't understand your question exactly because my English is poor, and I'm not sure the query below can help you.
YourSearch earliest="05/25/2015 00:00:00" latest="05/30/2015 23:59:59" | eval weeknum="first week" | append [search YourSearch earliest="06/15/2015 00:00:00" latest="06/20/2015 23:59:59" | eval weeknum="second week" ] | timechart count by weeknum
In the query ,I do not use timewrap command
Hope it's useful to you~~
... View more
08-30-2015
01:01 AM
In the simple XML dashboard, the page flip can only turn to the previous page or the next page.
Now the function is like this:
Can I turn to the first / last / specified page quickly when there are too many pages?
... View more
08-25-2015
09:08 PM
Thanks very much. I'm so sorry that I had posted my comment in the wrong place.
... View more
08-19-2015
02:42 AM
Is there anybody else who can help me ?
Thanks in advance!
... View more
08-16-2015
09:47 PM
I can use map command to meet the second requirement, but the search speed is slow
And the first one may be need using "NOT" , but I'm unable to write the query
... View more
08-16-2015
06:13 AM
I think the autoregress command does not meet the requirements, because I don't know the "p".
I want query according to the FieldA (time)
Thank you for your kindness~
... View more
08-16-2015
12:30 AM
My raw data is like:
FieldA | FieldB | FieldC | FieldD
1439638106 | 1.1.1.1 | 21 | 500
1439637106 | 1.1.1.1 | 21 | 200
1439636106 | 2.2.2.2 | 23 | 200
1439635106 | 3.3.3.3 | 21 | 500
1439634106 | 4.4.4.4 | 25 | 200
1439633106 | 3.3.3.3 | 21 | 200
1439631106 | 5.5.5.5 | 28 | 500
1439532106 | 3.3.3.3 | 21 | 200
.......
FieldA is a timestamp field
1、
I want to find the FieldD=200 by FieldB,FieldC, but in the next time (FieldA +1h@h), FieldD!=500
so the result is:
FieldA | FieldB | FieldC | FieldD
1439636106 | 2.2.2.2 | 23 | 200
1439634106 | 4.4.4.4 | 25 | 200
.......
2、
I want to find the FieldD=500 by FieldB,FieldC, and in the previous time (FieldA -1h@h), FieldD=200
so the result is:
FieldA | FieldB | FieldC | FieldD
1439638106 | 1.1.1.1 | 21 | 500
1439637106 | 1.1.1.1 | 21 | 200
1439635106 | 3.3.3.3 | 21 | 500
1439633106 | 3.3.3.3 | 21 | 200
.......
How can I write the search query ?
... View more
08-15-2015
01:45 AM
The SPL search command is so powerful that can handle so complex problems. Thanks very much~
... View more
08-14-2015
11:19 PM
3 Karma
The raw data is like :
FieldA | FieldB | FieldC | FieldD
14-51-P-1216;14-52-P-0258;14-52-P-0053;14-52-P-0054 | 99DF-E8FF-DA0F-5F6D;1B33-9DAE-7B47-A7B4;FCFF-8F4A-106F-5894;5864-CDA1-7400-AD33 | 2015-07-14 | 2015-11-13
14-50-L-0892;14-50-L-0891 | E934-DD3D-86C9-1D5B;F64B-3125-1D75-1D53 | 2015-08-14 | 2015-09-01
FieldA & FieldB are both multivalue fields, and how many values of one field is indefinite.
But, there is a one - to - one relationship between the two fields.
I want to split the two events into 6 events as listed below:
FieldA | FieldB | FieldC | FieldD
14-51-P-1216 | 99DF-E8FF-DA0F-5F6D | 2015-07-14 | 2015-11-13
14-52-P-0258 | 1B33-9DAE-7B47-A7B4 | 2015-07-14 | 2015-11-13
14-52-P-0053 | FCFF-8F4A-106F-5894 | 2015-07-14 | 2015-11-13
14-52-P-0054 | 5864-CDA1-7400-AD33 | 2015-07-14 | 2015-11-13
14-50-L-0892 | E934-DD3D-86C9-1D5B | 2015-08-14 | 2015-09-01
14-50-L-0891 | F64B-3125-1D75-1D53 | 2015-08-14 | 2015-09-01
... View more
- Tags:
- field
- multivalue
- split
08-13-2015
10:22 PM
U resolved my question, thanks!
I can pass an invalid data to the arguments, so the last map can't search it.
If no default value given, then no event whose ruleid is 50513 is found, the search report error, but i want it returns 0.
... View more
08-12-2015
11:05 PM
1 Karma
My searce Query is:
index=ies_log ruleid=50513 earliest=-7d@d|eval start_time=relative_time(date,"-5m@m")|eval start_time=strftime(start_time, "%m/%d/%Y:%H:%M:%S")|eval end_time=strftime(date, "%m/%d/%Y:%H:%M:%S" )|fields start_time,end_time,sip,dip,dport |map search="search index=ies_log ruleid=20347 earliest=$start_time$ latest=$end_time$ sip=$sip$ dip=$dip$ dport=$dport$" maxsearches=10000|stats dc(dip)
If no event found before map command, then all the arguments have no value passed,
and the error is:
Error in 'map': Did not find value for required attribute 'st'.
Can I pass a default value to the command? How?
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:04 AM
|
