Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About reneedeleon
reneedeleon
Engager
Member since:
05-23-2018
11-21-2023
Community Statistics
| Posts | 43 |
| Solutions | 0 |
| Karma Given | 1 |
| Karma Received | 0 |
| Member Since | 05-23-2018 |
Activity Feed
- Posted Re: When SQL set data is sent to Splunk via sql scripts, do you use sql syntax or do you utilize Splunk query linguistic on Splunk Search. 08-10-2022 06:15 AM
- Posted When SQL set data is sent to Splunk via sql scripts, do you use sql syntax or do you utilize Splunk query linguistics? on Splunk Search. 08-09-2022 09:49 AM
- Karma Re: Time conversion from milliseconds to break down to days hours minutes seconds for woodcock. 06-05-2020 12:50 AM
- Posted Re: can you create a reset button after the submit in a dashboard? on Dashboards & Visualizations. 04-02-2020 07:34 AM
- Posted Re: Reusable Script - Reset All Tokens with a Single Click on Getting Data In. 03-31-2020 07:52 PM
- Posted can you create a reset button after the submit in a dashboard? on Dashboards & Visualizations. 03-30-2020 08:40 PM
- Tagged can you create a reset button after the submit in a dashboard? on Dashboards & Visualizations. 03-30-2020 08:40 PM
- Posted Re: dashboard clear text in text input on Dashboards & Visualizations. 03-29-2020 09:34 PM
- Posted Re: multi text input for search with a date, source, and location dropdowns on Dashboards & Visualizations. 03-10-2020 05:43 AM
- Posted Multi text input for search with a date, source, and location dropdowns on Dashboards & Visualizations. 03-09-2020 07:09 AM
- Tagged Multi text input for search with a date, source, and location dropdowns on Dashboards & Visualizations. 03-09-2020 07:09 AM
- Posted Re: Time conversion from milliseconds to break down to days hours minutes seconds on Splunk Search. 10-25-2019 11:09 AM
- Posted Re: Time conversion from milliseconds to break down to days hours minutes seconds on Splunk Search. 10-21-2019 05:48 AM
- Posted Re: Time conversion from milliseconds to break down to days hours minutes seconds on Splunk Search. 10-21-2019 05:47 AM
- Posted Re: Time conversion from milliseconds to break down to days hours minutes seconds on Splunk Search. 10-16-2019 09:02 AM
- Posted Re: Session Duration in minutes on Getting Data In. 10-15-2019 07:18 AM
- Posted Re: Time conversion from milliseconds to break down to days hours minutes seconds on Splunk Search. 10-15-2019 06:10 AM
- Posted Re: Time conversion from milliseconds to break down to days hours minutes seconds on Splunk Search. 10-11-2019 04:44 AM
- Posted Re: Time conversion from milliseconds to break down to days hours minutes seconds on Splunk Search. 10-11-2019 04:41 AM
- Posted Re: Time conversion from milliseconds to break down to days hours minutes seconds on Splunk Search. 10-10-2019 09:37 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
08-10-2022
06:15 AM
Awesome @inventsekar I will give this a try. I was definitely concerned as I have only dealt with data in Splunk as it is ingested in a CEF format. Utilizing SQL scripts for data ingestion is a new format for me. Thank you.
... View more
08-09-2022
09:49 AM
This is just a question for my learning. When SQL set data is sent to Splunk via sql scripts, do you use sql syntax or do you utilize Splunk query linguistics? and can you format your rows and columns in the same manner? I'm crowd sourcing to better build my report.
... View more
Labels
- Labels:
-
fields
04-02-2020
07:34 AM
Thank you, it worked like a charm.
... View more
03-31-2020
07:52 PM
@rob_jordan I tried you code but I keep getting an "Invalid character entity" message could you provide an assist?
... View more
03-30-2020
08:40 PM
I am trying to create a clear button for my dashboard but none of the XML I have written has worked. I have one date and time drop down and two drop down to follow. After those I have six text input fields then a submit button. I am trying to have a clear or reset button to follow to remove the text from the input. Does anyone have any thoughts on how this should be done?
<done>
<unset token="update_user_tok"></unset>
<unset token="update_index_tok"></unset>
<unset token="update_date_tok"></unset>
<unset token="update_exptime_tok"></unset>
</done>
<fieldset resetButton="true" autoRun="false">
... View more
- Tags:
- splunk-enterprise
Labels
- Labels:
-
drilldown
-
simple XML
03-29-2020
09:34 PM
@Sukisen1981 is it possible to create a clear input for text fields in xml for a dashboard?
... View more
03-10-2020
05:43 AM
Thank you @gcusello,
The dropdowns are there 100% of the time, it's the text fields that are the issue. I Have tried to get the analysts to learn how to use Splunk but this is going to be the only way they can do it. Let me tweak the xml a little more.
... View more
03-09-2020
07:09 AM
I am currently working on a dashboard that will simplify the search for some of our office personnel who are not Splunk savvy. I am creating a dashboard that has three drop down and six text inputs in order to ensure they are getting the specific results they are looking for, however I am not sure if the code is working and why the submit button are not working. I am very new to XML and any help would be appreciated.
my code:
Splunk made simple
<input type="time" token="token_time">
<label>Date and Time</label>
<default>
<earliest>@d</earliest>
<latest>now</latest>
</default>
</input>
<input type="dropdown" token="source_token">
<label>Select Source</label>
<choice value="calories-3514">choclates</choice>
<choice value="calories-1445">veggies</choice>
<choice value="calories-4461">cakes</choice>
<choice value="calories-5447">pies</choice>
</input>
<input type="dropdown" token="food_token">
<label>Food</label>
<choice value="*">All</choice>
<fieldForLabel>Food</fieldForLabel>
<fieldForValue>food_name</fieldForValue>
<search>
<query>index=goodies source=$source_token$
| stats count by food_name</query>
<earliest>@d</earliest>
<latest>now</latest>
</search>
</input>
<input type="text" token="user_tok">
<label>Who</label>
<default>$user_tok$</default>
</input>
<input type="text" token="uid_tok">
<label>Trainer</label>
<default>$uid_tok$</default>
</input>
<input type="text" token="src_tok">
<label>First meal</label>
<default>$src_tok$</default>
</input>
<input type="text" token="dst_tok">
<label>Second Meal</label>
<default>$dst_tok$</default>
</input>
<input type="text" token="junkfood_tok">
<label>third meal</label>
<default>$junkfood_tok$</default>
</input>
<input type="text" token="snack_tok">
<label>Snack</label>
<default>$snack_tok$</default>
</input>
<panel>
<title>Panel 1</title>
<table>
<search>
<query>index=goodies source=$token_time$
| fillnull value=NULL food_name, user, uid, src, dst, junkfood, snack
| table food_name, user, uid, src, dst, junkfood, snack
|
$time_token.earliest$
$time_token.latest$
10
none
none
true
... View more
- Tags:
- splunk-enterprise
Labels
- Labels:
-
drilldown
10-25-2019
11:09 AM
how do I get this query to show what I have tabled and a breakdown of the total time down broken down by days, hours, minutes, seconds.
... View more
10-21-2019
05:48 AM
Thank you, I will give this a try as well.
... View more
10-21-2019
05:47 AM
Thank you Sir it worked. Now the problem is the math or I did not place the string in the correct order. My results are all coming up as the same value.
... View more
10-16-2019
09:02 AM
Would you happen to know the regex that spells it all out like you did?
... View more
10-15-2019
06:10 AM
That gave the following:
187+03:05:08.611111
how do I translate that to English?
... View more
10-11-2019
04:44 AM
Thank you Giuseppe. I tried the new iteration but I am still getting a blank in the field column. Also now I am being asked to generate the diff field with days instead of hours.
... View more
10-11-2019
04:41 AM
Thank you Jacob, but I don't have access to that part of the app. I only get to play with the search and reporting.
... View more
10-10-2019
09:37 AM
I tried it and it gave total at the bottom of the stats table under the total field. I am trying to get a line by line breakdown by days, hours, minutes, seconds. I will play with the search you gave me and try to get it there. Thank you.
... View more
10-10-2019
05:48 AM
I need help with the conversion since it's a line by line total. Believe it or not most to the query was built utilizing your and dal's responses to many questions.
... View more
10-10-2019
05:22 AM
Yes Sir, I am trying to get a total breakdown in the diff field: 34d 13h 26m 24s
... View more
10-09-2019
10:14 AM
I have been working on a search that gives a duration breakdown.
I am trying to achieve:
thehost theip c_time clean_date tap whocares diff
vex 127.0.0.1 10/9/2019 10:02 7/2/2018 4:59 1.0.0.127 recluse 2s
hive 127.0.0.2 10/10/2019 10:02 7/3/2018 4:59 1.0.0.128 lunas howl 13s
fallen 127.0.0.3 10/11/2019 10:02 7/4/2018 4:59 1.0.0.129 not forgotten 2m 24s
cabal 127.0.0.4 10/12/2019 10:02 7/5/2018 4:59 1.0.0.130 wendigo 28m 48s
scorn 127.0.0.5 10/13/2019 10:02 7/6/2018 4:59 1.0.0.131 redricks broadsword 5h 45m 36s
taken 127.0.0.6 10/14/2019 10:02 7/7/2018 4:59 1.0.0.132 randys throwing knife 2d 21h 7m 12s
guardian 127.0.0.7 10/15/2019 10:02 7/8/2018 4:59 1.0.0.133 thousand voices 34d 13h 26m 24s
What I am getting:
thehost theip c_time clean_date tap whocares diff
vex 127.0.0.1 10/9/2019 10:02 7/2/2018 4:59 1.0.0.127 recluse 11140.66139
hive 127.0.0.2 10/10/2019 10:02 7/3/2018 4:59 1.0.0.128 lunas howl 9926.056944
fallen 127.0.0.3 10/11/2019 10:02 7/4/2018 4:59 1.0.0.129 not forgotten 101.1680556
cabal 127.0.0.4 10/12/2019 10:02 7/5/2018 4:59 1.0.0.130 wendigo 3995.172778
scorn 127.0.0.5 10/13/2019 10:02 7/6/2018 4:59 1.0.0.131 redricks broadsword 767.7697222
taken 127.0.0.6 10/14/2019 10:02 7/7/2018 4:59 1.0.0.132 randys throwing knife 2113.435278
guardian 127.0.0.7 10/15/2019 10:02 7/8/2018 4:59 1.0.0.133 thousand voices 4890.476667
I am getting a final tally of total hour down. Below is the search I am using. Any help would be appreciated.
1. index=net* Inactive NIC
2. | rex field=_raw "^[^ \n]* (?P[^ ]+)"
3. | rex field=_raw "^(?:[^ \n]* ){2}(?P[^ ]+)"
4. | rex field=_raw "(?\s)"
5. | rex field=_raw "[#]\d{3}(?\d\s+\w{8}\s\d+\S\d+\S\d+\s\d+\S\d+\S\d+(\S\d)?\s+(\d+\S\d+\S\d+\S\d+)?)" max_match=0
6. | rex field=_raw "[#]\d{3}(?\w+\S\w{13}\S\w{3}\s+\w{8}\s\d+\S\d+\S\d+\s\d+\S\d+\S\d+(\S\d)?\s+(\d+\S\d+\S\d+\S\d+)?)" max_match=0
7. | rex field=_raw "[#]\d{3}(?\d+\S\d+\S\d+\S\d+\S*\w*\s+\w*\s*\w{8}\s\d+\S\d+\S\d+\s\d+\S\d+\S\d+(\S\d)?\s+(\d+\S\d+\S\d+\S\d+)?)" max_match=0
8. | mvexpand Alert
9. | rex field=Alert "(?P\d)\s+(?\w{8}\s(?\d+)\S(?\d+)\S(?\d+)\s(?\d+)\S(?\d+)\S(?\d+)(\S\d)?)\s+(?\d+\S\d+\S\d+\S\d+)?"
10. | rex field=Alert "(?P\w+\S\w{13}\S\w{3})\s+(?\w{8}\s(?\d+)\S(?\d+)\S(?\d+)\s(?\d+)\S(?\d+)\S(?\d+)(\S\d)?)\s+(?\d+\S\d+\S\d+\S\d+)?"
11. | rex field=Alert "(?P\d+\S\d+\S\d+\S\d+)\S*\w*\s+\w*\s*(?\w{8}\s(?\d+)\S(?\d+)\S(?\d+)\s(?\d+)\S(?\d+)\S(?\d+)(\S\d)?)\s+(?\d+\S\d+\S\d+\S\d+)?"
12. | lookup dnslookup clientip as theip OUTPUT clienthost as whocares
13. | eval whocares=case(isnull(whocares),"UNKNOWN",1=1,whocares)
14. | eval clean_date=trim(date_down,"Inactive ")
15. | convert timeformat="%Y-%m-%d %H:%M:%S" ctime(_time) AS c_time
16. | eval event=strptime(c_time, "%Y-%m-%d %H:%M:%S")
17. | eval tap = strptime(clean_date, "%Y-%m-%d %H:%M:%S")
18. | eval diff=(event - tap), diff=(diff / 60 / 60)
19. | convert rmunit(diff) as numSecs
20. | eval stringSecs=tostring(numSecs, "duration")
21. | eval stringSecs=replace(stringSecs, "(?:(\d+)\+)?0?(\d+):0?(\d+):0?(\d+)","\1d \2h \3m \4s")
22. | eval stringSecs=replace(diff, "^d (0h (0m )?)?","")
23. | eval duration=strftime(diff,"%Y-%m-%d %H:%M:%S")
24. | table thehost, theip, c_time, clean_date, stap, whocares, diff
... View more
10-08-2019
11:56 AM
Has this been answered? I am having the same issue, but I need to break it down by years, months, days hours:minutes:seconds. The current results I am receiving are in milliseconds. Please advise.
... View more
05-20-2019
09:51 AM
Thank you, but I had to make a small change.
| where match(hostA, "^\d+.\d+.\d+.\d+") AND match(hostB, "^\d+.\d+.\d+.\d+")
... View more
05-10-2019
08:02 AM
how do I specify a search where different fields for hostA and hostB when they are identified as IP addresses
I want to only pull stats for hostA and hostB when they are only identified as IP addresses and other specific names
index=stuff* blah OR blahblah
| fillnull value=NULL hostA, hostB
| where match(hosA,"(\d{1,3}\.}{3}\d{1,3})")
| where match(hostB,"(\d{1,3}\.}{3}\d{1,3})")
| stats count by hostA, hostB
and
index=stuff* blah OR blahblah
| fillnull value=NULL hostA, hostB
| regex hostA="^(\d{1,3}\.}{3}\d{1,3}).*"
| regex hostB="^(\d{1,3}\.}{3}\d{1,3}).*"
| stats count by hostA, hostB
I have tried both and neither turn up results am I taking the right approach?
... View more
- Tags:
- splunk-enterprise
05-06-2019
05:11 AM
I will give it a try. Thank you.
... View more
