Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- Find Answers
- :
- About DMohn
DMohn
Motivator
Member since:
09-07-2015
01-16-2023
Community Statistics
| Posts | 279 |
| Solutions | 55 |
| Karma Given | 76 |
| Karma Received | 67 |
| Member Since | 09-07-2015 |
Activity Feed
- Got Karma for Re: Should you add the configurations in limits.conf on universal forwarder OR indexer servers?. 11-12-2025 08:50 AM
- Got Karma for Re: How to extract month and year from _time. 12-05-2021 04:36 PM
- Got Karma for Re: How to assign fixed colors to pie chart with dinamic legend. 01-18-2021 11:50 AM
- Got Karma for Re: What does this message mean regarding the health status of Splunkd?. 11-25-2020 05:02 AM
- Karma Re: Insert one search into other search as a new column for jyab6z. 06-05-2020 12:50 AM
- Karma Re: How do I get the current time in unix/epoch time? for blindfire_bandi. 06-05-2020 12:50 AM
- Karma Re: line of threshold in timechart graph for whrg. 06-05-2020 12:50 AM
- Karma Re: Calculate percentage b/n 2 counted numbers for swimena. 06-05-2020 12:50 AM
- Karma Re: How do you separate fields into different variables based on the beginning letter of field? for ibdubs. 06-05-2020 12:50 AM
- Karma Re: How do you separate fields into different variables based on the beginning letter of field? for ibdubs. 06-05-2020 12:50 AM
- Karma Re: Splunk Enterprise Security Alexa Domain NOT lookup failing for HannanPervez. 06-05-2020 12:50 AM
- Karma Re: Can anyone help me to match a value into lookup.csv if condition for nickhills. 06-05-2020 12:50 AM
- Karma Re: parameterize search from various source types simultaneously in a fixed time frame. for zacksoft. 06-05-2020 12:50 AM
- Karma Re: Why is our license master unreachable and Index replication not working? for woodcock. 06-05-2020 12:50 AM
- Karma Re: How do you merge events with unique entries? for SplunkMasterSne. 06-05-2020 12:50 AM
- Karma Re: My searchhead is slow since I update from 6 to 7.2.3 for nickhills. 06-05-2020 12:50 AM
- Karma Re: Why is the KV Store Process Failing After Upgrade from 7.1.3 to 7.2.0? for dauren_akilbeko. 06-05-2020 12:50 AM
- Karma Re: Rex to extract text that ends with either one of multiple words for Cbr1sg. 06-05-2020 12:50 AM
- Karma Re: timechart when span set to a week gives a different values , in comparison to span set to a day for a duration of a week. for shahid285. 06-05-2020 12:50 AM
- Karma Re: Enterprise Security Identity Correlation - merging of identities for nickhills. 06-05-2020 12:50 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 1 | |||
| 0 | |||
| 0 | |||
| 0 |
06-11-2019
05:57 AM
Found the solution by myself, after a while.
If you don't enable SSL in the http input setting, Splunk won't accept https calls 🙂
So be aware of that!
... View more
06-11-2019
05:34 AM
In that case the only possibility would be - as bad as it sounds - to check your logging ...
If you get logs in one file that are years apart, I would personally consider the logging itself to be crap.
... View more
06-11-2019
03:42 AM
You can make all neccessary configuration changes in the UI, without the need to touch the plain XML code.
If you integrate a timetange picker in your Dashboard, use the edit search function for all panels in your dashboard to use the shared time picker as time constraint.
For a dropdown selection you can specify a token name in the UI as well, which you can then integrate in the searches powering your panels - such as
<your search> sourcetype=$yourTokenHere$ | rest_of_your_search
... View more
06-11-2019
03:38 AM
I am not 100% sure about this, but you can try to use an additional datetime.xml to extract the year from the filename. I am not aware of any method to exract the time (which is an index-time operation, hence done per-event) from any event earlier in the file.
Check https://docs.splunk.com/Documentation/Splunk/7.3.0/Data/Configuredatetimexml for details of the datetime.xml usage.
... View more
06-11-2019
02:41 AM
A missing year to your timestamp should not cause any problems if you have set up timestamp recognition in your props.conf correctly.
Try using the following parameters in props.conf for your relevant sourcetype (assuming the timestamp is at the beginning of your event):
[yoursourcetype]
TIME_PREFIX = ^
TIME_FORMAT = %b %d %H:%M:%S
MAX_TIMESTAMP_LOOKAHEAD = 16
This should tell Splunk how to read your timestamp correctly and not produce any future-timestamped events, as it will try to stay as close to the current time as possible.
... View more
06-11-2019
02:33 AM
As soon as you are enrolled in this course you will receive a link with course material for your educational course. During the training itself the instructor may provide additional course sheets as well.
Please note, that the handouts are personalized, and may not be shared with anyone.
... View more
06-11-2019
02:23 AM
Hi all,
I am trying to send events to HEC locally via CLI and keep getting a SSL error. I have looked up several docs, but I have not yet found the solution to it. My problem is like this:
Command:
curl -vvv -k -H "Authorization: Splunk my-hec-token" https://mysplunkhost:8088/services/collector/event -d '{ [aWholeLotOfJSONformattedData] }'
Return is:
* Hostname was NOT found in DNS cache
* Trying xx.xx.xx.xx...
* Connected to mysplunkhost (xx.xx.xx.xx) port 8088 (#0)
* successfully set certificate verify locations:
* CAfile: none
CApath: /etc/ssl/certs/
* SSLv3, TLS unknown, Certificate Status (22):
* SSLv3, TLS handshake, Client hello (1):
* error:140770FC:SSL routines:SSL23_GET_SERVER_HELLO:unknown protocol
* Closing connection 0
curl: (35) error:140770FC:SSL routines:SSL23_GET_SERVER_HELLO:unknown protocol
Any advise on where I can fix this?
... View more
05-29-2019
04:10 AM
Can you please provide an example for the search you are trying to run from the dropdown? We would need to know the following information to give proper advice:
- Contents of the Dropdown (Label / Value)
- Variables for the search
... View more
05-28-2019
03:44 AM
Try this:
index="Web"
| eval WebTraffic = case(match(http_user_agent, "(?i)bot"), "Bots",match(http_user_agent, "(?i)crawl"), "Crawlers",1=1,"Users")
| stats count as total_count, count(eval(WebTraffic="Bots")) as bot_count, count(eval(WebTraffic="Crawlers")) as crawler_count
| eval bot_percent=round((bot_count/total_count)*100,2)
| eval crawler_percent=round((crawler_count/total_count)*100,2)
| table total_count, bot_count, bot_percent, crawler_count, crawler_percent
... View more
05-28-2019
03:31 AM
If using a query to fill values to a dropdown you have to make sure the values are unique. Please try the following query:
| inputlookup xxx.csv | fields Field2 | dedup Field2
... View more
05-28-2019
03:27 AM
If you need the event to be multi-line in Splunk, I would recommend to leave it multi-line while forwarding it.
What was the original purpose of converting it to a single-line event? Line-/event-breakting issues? In that case I'd suggest to review your props.sonf setting for the particular sourcetype, so the events will be broken correctly even if they come in as multiline.
You cold try the following settings:
[your_sourcetype]
SHOULD_LINEMERGE = false
LINE_BREAKER = ([\r\n]+)(SF_SPLUNK_EVENT)
This should break the incoming events at the string "SF_SPLUNK_EVENT" - leaving other linebreaks as they are. So there will be no need to further convert a field from single to multi anymore.
... View more
04-25-2019
05:36 AM
Wait, what sould be the result in the incident row? A count? An incident identifier?
... View more
04-25-2019
05:31 AM
index="_internal" component=root OR component=Metrics OR eventtype=splunkd-log OR eventtype=splunkd-access SEVERITY= INCIDENT= | stats count by component, severity | xyseries component severity count
... View more
04-25-2019
04:34 AM
Okay, if you have a field component in your events, you can use a this search command:
<your base search> | stats count by component, severity
This will give you a overview that will look somehow like this:
component severity count
splunkd_log 5 1
splunkd_log 2 4
metrics 5 2
metrics 4 3
To format this table in a sort of matrix-like view, you may use the xyseries command:
| xyseries component severity count
[...]`
... View more
04-25-2019
01:59 AM
You could try a search like this:
index="_internal" component=root OR component=Metrics OR eventtype=splunkd-log OR eventtype=splunkd-access SEVERITY=* INCIDENT=* | eval type=case(component="Metrics","Metrics",component="root","Root",eventtype="splunkd-log","Splunkd-Log",eventtype="splunkd-access","Splunkd-Access",1=1,"other") | stats count by type severity | xyseries type severity count
This would give you a table like such:
Severity 1 Severity 2 ....
Metrics 1 2
Root 5
Splunkd-Log 6 8
Splunkd-Access 3
... View more
03-28-2019
08:51 AM
Sorry, edited the typos for convenience. Glad it helped.
If you could mark the answer as accepted it would help future users 😉
... View more
03-28-2019
08:32 AM
1 Karma
Okay, then modify the query like this:
index=foo EventCode=bar | eval Account_Type=case(like(Account_Name,"R%"),"AccountType1",like(Account_Name,"D%"),"AccountType2",like(Account_Name,"X%"),"AccountType3",1==1,"unknown") | stats count by Account_Type
... View more
03-28-2019
08:17 AM
1 Karma
Try this:
index=foo EventCode=bar | eval Account_Type=case(Account_Name=="R*","AccountType1",Account_Name=="D*","AccountType2",Account_Name=="X*","AccountType3",1==1,"unknown" | stats count by Account_Type
... View more
03-28-2019
08:12 AM
1 Karma
It might be a bit ugly, but this query gives exactly the result you want...
<your_base_query> | stats count as "Total Events", dc(user) as "Distinct Users" by url | appendcols [<your_base_query> | stats count by url, user | eval user = user." - ".count | stats list(user) as "Users + count" by url]
In case you want a distinct event count an no total count, just swap the first stats count for a stats dc(events)
... View more
03-26-2019
12:57 AM
Is your "Header" field extracted correctly?
If you use rex field=_raw "TransactionId\":\"(?<TransactionId>[^\"]+)\"" | table TransactionId you should get the desired results. Please keep in mind, that \w does only cover word charakters, which don't include the hyphen. So either use [\w-] or use the negated quotation [^\"].
... View more
03-25-2019
09:54 AM
If you have field names with spaces in them, you need to quote the fields! Or replace the name with underscores, just as you did. And yes, in this special case, Splunk will have difficulties recognizing the former as a variable and the latter as a string.
Thats why it is always a good practice to go with non-space field names, and do the conversion (remaming) at the very end!
... View more
03-25-2019
06:58 AM
Okay, in that case you need to add a after
... View more
03-25-2019
12:19 AM
This is not what you had described in your starting post ... If I comapre the initial screenshot with the one you posted as your "intended result", you only removed the "SessionCode = Drop" events. Is this what you are trying to do? If not, please go into detail a bit more and elaborate, which results you want to see (or not) - e.g. SessionType = Single or Multi, Session Code = ....
... View more
03-25-2019
12:14 AM
Won't this configuration cut the SNMPv2-SMI::enterprises part out of the event? I don't know if this is intended. Thats why I included this in a non-capturing group in my example.
But apart from that you are correct, if data comes in via UF, you should always inclund EVENT_BREAKER config!
... View more
03-22-2019
01:26 AM
1 Karma
You can add a filter condition after your search like this:
| search eventcount=1 OR (eventcount>1 AND SessionType="MultiMode" AND NOT (SessionEstablish="Success" AND SessionCode="Drop"))
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
01-16-2023
08:32 AM
|
