About mikefoti

srauhala_splunk · ‎03-29-2023

In the settings of the visualization you can choose to set 0 for null values.

ITWhisperer · ‎01-24-2023

index=myIndex AND status=* | table _time status src_ip dest_ip | sort + _time | stats count(eval(status="401")) as count earliest(_time) AS ET latest(_time) AS LT by src_ip

SplunkMcSplunk · ‎06-23-2022

I normally just tell the audience about our experience in migrating to Victoria. Nah just playing: Microsoft/Atlassian ( who ever you want to rag on) just bypassed Volkswagen yesterday: Yeah Volkswagen only produced 30 million Bugs: and if we had splunk, or cause we have splunk we detected them all: OR learning Splunks SPL is a walk in the Park: Jurassic park soz for the lame suggestions, but any play on splunks name is NSFW ( but still Hilarious)

aromanauskas · ‎06-04-2019

Try: ... | stats min(earliest) AS earliest max(latest) AS latest by theSrc |rename theSrc AS DNS.src | format ] BY DNS.query_type

mikefoti · ‎04-13-2015

Esix_splunk, Thanks... once I added %d after %b, it worked. TIME_FORMAT =%b %d, %Y %H:%M:%S.%9N

lguinn2 · ‎09-10-2014

Try this yoursearchhere | eventstats count as total_events by client_ip URL Method | where total_events > 8 | sort client_ip URL Method _time | streamstats current=f window=1 global=f last(_time) as prev_time by client_ip URL Method | eval time_diff = _time - prev_time | transaction client_ip URL Method maxpause=65s | where time_diff >= 55 and eventcount > 8 This may not be exactly what you want, but perhaps it will give you some new ideas... I used eventstats to eliminate as many client_ip's as I could, before creating the transactions. This should make the transaction command run faster. I also calculated the time difference between events so that I could use it later to implement the "minpause" idea.

martin_mueller · ‎08-01-2013

You could approach like this: your search | stats dc(clientip) as dc by serverip | where dc = 3 That counts the unique IPs per server - those rows that have a "3" will have been visited by all three clients.

sspencer_splunk · ‎02-01-2013

The update checking mechanism can be enabled/disabled per your organization's internal policies. Keep in mind that all this update checking mechanism does is reach out to a publicly-available website to check for a new version. (OK, so it does a little more than that, but that's neither here, nor there.) If a new version is available, splunkweb presents this information on the Splunk login page. You can disable it in web.conf. Set "updateCheckerBaseURL" in web.conf to 0. For more information, search for the term "updateCheckerBaseURL" on the web page linked above.

savithamr · ‎02-09-2016

Yureka.. its @ Settings->System->Server Controls

mikefoti · ‎11-21-2012

Good info.. thanks! I do realize/intend to switch to the free license. Not too concerned about accidentally providing non-admin access to sesitive logs becuase it is quite simple to wipe the index periodcally (or even after each use).

MarioM · ‎09-09-2012

it's actually transactiontypes.conf but it only allow to call 1 transaction definition by using " ... | transaction name=mytransactiondef ... " and this "name" field doesnot seems to be searchable. Then i would try a different way either using summary indexing & marker or eval & case function

mikefoti · ‎06-28-2012

Wow, you made that look easy! Thanks for your help... works perfectly now.

mikefoti · ‎06-28-2012

The answer was to replace the module SearchSelectLister with StaticSelect. Details here: http://splunk-base.splunk.com/answers/51663/convert-dynamic-drop-down-to-static-in-advanced-xml

lguinn2 · ‎11-09-2012

index=winradius eventtype=nps_accessReqRejected | top nps_radiusClientIP runs over all time. change it to index=winradius eventtype=nps_accessReqRejected earliest=-24h | top nps_radiusClientIP and I'll bet it runs much much faster...

mikefoti · ‎04-13-2012

It all works perfectly now that I do |fields at the right place. Thanks both for your help!

landen99 · ‎11-21-2014

or just round(x)

MarioM · ‎04-05-2012

Fields extractions are on the search head then if your indexer is the search head too then you should put it there. Your sencond extraction via delims looks right.

dart · ‎12-30-2011

Windows event logs should be importable as .evt or .evtx files, however you need to be running your indexer on Windows to do so. The default sourcetype would be WinEventLog: followed by the source log, for example for the Application log it would be WinEventLog:Application, however automatic sourcetype assignment should work, and fields should be extracted.

rrovers · ‎10-18-2017

open the document in textwrangler choose - 'save' - linebreaks 'windows (crlf) - encoding unicode (utf8)

mikefoti · ‎12-06-2011

Thanks, I guess its not that complicated after all.

mikefoti · ‎12-02-2011

both work equally well both both also fail to pick up a value of EMPTY... which is weird... seems like /w ought to match EMPTY or anyother word?!?!?

Ayn · ‎11-30-2011

Yes. That is how regexes work.

Ayn · ‎11-28-2011

OK. I don't know the exact log format, but perhaps it is similar to that used by the IronPort WSA or Squid. There are apps for both those.

mikefoti · ‎11-25-2011

Thanks for your suggestion. Actually the host field in the events in the TMG index is in fact polulated with "fofrd". It looks now like the original edits I made were correct after all. I beleive I did not see any events becuase there were no events. But when I came in this AM to consider implementing your suggestion, I noticed plenty of events have been collected, without making any new changes.

mikefoti · ‎10-13-2011

Found the problem/solution. I had created the TCP listener using the WebUI incorrectly. I started by clicking on: Data Inputs > TCP > etc. Where I should have started is : Forwarding and Receiving > Configure Receiving > New The difference in these two starting points is the resulting entry in the inputs.conf file mentioned here: http://answers.splunk.com/questions/10346/splunk-is-adding-weird-strings-like-linebreaker-x00-x00-to-my-events-what-is

Posts	63
Solutions	4
Karma Given	3
Karma Received	12
Member Since	‎06-28-2011

Online Status	Offline
Date Last Visited	‎11-01-2023 06:46 PM

How to force timechart to display zero for null va...

How to display the number of failures, plus earlie...

subsearch inserts AND

How to configure Splunk to recognize the correct t...

Search proxy logs for beaconing hosts

compound query

Can I prevent Splunk from automatically checking f...

Restarting Splunk

Is windows admin access required to run locally in...

Searching by Transaction TYPE

Re: How to force timechart to display zero for nul...

Re: streamstat

Re: Splunk Jokes?

Re: subsearch inserts AND

Re: How to configure Splunk to recognize the corre...

Re: Search proxy logs for beaconing hosts

Re: compound query

Re: Can I prevent Splunk from automatically checki...

Re: Restarting Splunk

Re: Is windows admin access required to run locall...

Re: Searching by Transaction TYPE

Re: convert dynamic drop-down to static in advance...

Re: convert dynamic drop-down to static

Re: dynamic form... is it normal to be this slow?

Re: is eval the right choice?

Re: using EVAL

Re: How to copy/paste a regex into splunk

Re: sourcetype for windows event logs

Re: inputlookup error "line endings"

Re: how to compare dates outside of the default da...

Re: Regex Help

Re: Regex -or- How to cleanup field values

Re: better field discovery with SUF

Re: Routing not working as expected

Re: Which sourceType to select on new Indexer for ...