About afulamba

afulamba · ‎10-15-2019

Yes, I am using that query that returns the values appearing in the multiselect options. No issue with that. However, I want to set one more value 'All' as default value in the multiselect which should take the value for all the hosts instead of selecting the individual hosts from the multiselect options. In short, I want to avoid the below hard-coding of the servers and populate it from the lookup table. h101,h102,h103

afulamba · ‎10-15-2019

Hi, Is there any way to get all the values in the column from the lookup table to build the default choice option in the drop-down? I want to remove the hard-coded list of hosts in the default and populate it from the look up. I don't want to use static option with All=* as it may pull other host names when I will add the records in the lookup for other environment/location values. Can some one advise, please? <input type="multiselect" token="host" searchWhenChanged="true"> <label>VM Host</label> <prefix>host=</prefix> <delimiter> OR host=</delimiter> <search> <query>| inputlookup gw_host.csv | search environment=stage | dedup hostname | fields hostname</query> <earliest>-15m</earliest> <latest>now</latest> </search> <fieldForLabel>host</fieldForLabel> <fieldForValue>hostname</fieldForValue> <default>h101,h102,h103</default> </input> File: gw_host.csv location,environment,hostname 1,stage,h101 2,stage,h102 3,stage,h103 Thanks, AJ.

afulamba · ‎05-13-2019

Yup, sure. Thanks for all your help.

afulamba · ‎05-13-2019

I had to change the field name in the lookup from sf-domain to whitelistdomain and it worked. It seems "-" in the field name was the culprit which was not evaluating the host name. I had not given the actual domain names and the actual lookup details for security reason. My bad, we could have identified the issue earlier otherwise. Thanks a lot for your help!!!!!!!

afulamba · ‎05-03-2019

Here is the sample log event and the lookup First query for hostname from the logs index=web host=1 OR host=2 "*HTTP/1.1 3*" "*abc*" | eval hostname=mvindex(split(mvindex(split(_raw,"&HOSTNAME="),1),"&AUTHNLEVEL="),0) | eval hostname=trim(replace(hostname,"www.","")) 10.154.248.238 - - [03/May/2019:06:49:35.367 -0500] GET /xxx/rest/services/public/abc?ERROR_CODE=0x00000000&ERROR_TEXT=BA0521I%20%20%20Successful%20completion&HOSTNAME=www.yyy.us&AUTHNLEVEL= HTTP/1.1 307 - https://www.yyy.us/logout Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0) userid=- sec=0 usec=13508 fwd=,- route=route0 Lookup table | inputlookup domain.csv domain yyy.us yyy.at yyy.ae So in this example if I see yyy.us in the both the result I am expecting this when I combine the query in one.

afulamba · ‎05-03-2019

If I run the these 2 subsearch separately, I see the hostname value return from first search also returns from the look up from the second search, however, when run the search together as above, it doesn't return the data. Did it work for anybody for such scenario? Thanks for the input.

afulamba · ‎05-02-2019

I tried both as suggested below but doesn't work as expected. This returns no result | inputlookup domain.csv | rename domain AS hostname | join hostname [| search index=web host=1 OR host=2 sourcetype="apache:access" "*HTTP/1.1 5*" "*abc*" | eval hostname=mvindex(split(mvindex(split(_raw,"xxxx="),1),"&yyyyy"),0) | stats count by hostname ] This returns result even the domain value is not in the lookup. [| inputlookup domain.csv | stats values(domain) as query ] index=web host=1 OR host=2 sourcetype="apache:access" "*HTTP/1.1 5*" "*abc*" | eval hostname=mvindex(split(mvindex(split(_raw,"xxx"),1),"yyyyy"),0)

afulamba · ‎04-30-2019

Any more suggesstions please?

afulamba · ‎04-26-2019

Thats correct. whatever derived as hostname from logs, match it with domain in the lookup table.

afulamba · ‎04-26-2019

May be the labels I used are confusing. base query example: index=* host=1 OR host=1 "HTTP/1.1 30*" "abc" | eval hostname=mvindex(split(....)) Here the derived hostname value could be abc.com, def.com etc. In the look up table for domain column I have listed abc.com, def.com etc. So my need is that the search should return the result if the derived hostname matches with domain in the lookup. To follow your approach I would need to add another column in the lookup something relevant to it otherwise. Please suggest.

afulamba · ‎04-26-2019

Thanks for the input. Actually I have single column look up table with column name 'domain', no other column for host. To avoid the list of domains in the base query that looks ugly, I want to keep the fix list of domains in the table and I can add new domains as and when required in the table. However, the hostname derived from the logs in the base query can be any value based on the client domain. I want to filter the requests in the apache logs which have the hostname exist in lookup table.

afulamba · ‎04-26-2019

Hi there, I want to build a query with strings from the lookup table. I have the list of domains in the look up table that I want to use in the query to match as hostname base query: index=* host=1 OR host=1 "HTTP/1.1 30*" "abc" | eval hostname=mvindex(split(....)) lookup [| inputlookup domain.csv | fields domain Domain in the lookup are the hostname in the base search. Can someone advise on this, please?

afulamba · ‎08-17-2018

Can someone help me here, please? Thanks, Amit

afulamba · ‎08-17-2018

Reposting sample log and my code CustomerService getPointDetails 6686 435 52 8 52 0x00000000 Successful Response 2 3 0 Louis/ST=Missouri/C=US PRODESB6_STL|18234799|180817043259896SAML 0 0 My code: index=app sourcetype = audit | eval tokenString=mvindex(split(mvindex(split(_raw,"gtid("),1),"): "),1) | eval temp=split(tokenString,"`") | eval field0=mvindex(temp,0) | eval field1=mvindex(temp,1)

afulamba · ‎08-17-2018

@niketnilay: Thank you! I will take a not of it for my next posts.

afulamba · ‎08-16-2018

sorry for the format of the text it appears. I could not preview it or see the option to edit my post.

afulamba · ‎08-16-2018

Hi there, Can someone help me with reading the tokenized string and assign the keys to each index retrieved. It is difficult for me as it is not key/value format to read. Log sample: CustomerService getPointDetails 6686 0x00000000 Successful Response 2 3 0 Louis/ST=Missouri/C=US PRODESB6_STL|18234799|180817043259896 SAML 0 0 I know which values is for what field in the sequence they appear in the logs. It does has space as a value too. I did tried below but since there are more than 20 fields I have to extracts, the query becomes very long and ugly and can cause performance too. index=app sourcetype = audit | eval tokenString=mvindex(split(mvindex(split(_raw,"gtid("),1),"): "),1) | eval temp=split(tokenString," ") | eval field0=mvindex(temp,0) | eval field1=mvindex(temp,1) I did check few regex option on web, that was also long query too. Please advise. Thanks,

afulamba · ‎08-08-2018

Thank you :-). It helps.

afulamba · ‎08-02-2018

Hi DalJeanis, There is no direct relation b/w 2 query in the query. However, the value I get in T5 and T10 alerts me the issue and the 2nd query shows the data from the other supporting system. So when the alerts fire I want to show in the alert email itself whether the issue is from backend support system or not. To your question on eventstats, yes I also can use stats that also returns me the number of events, that I only need and not entire data. The first query is only build the trigger condition and based on that I have put the data from 2nd query in the alert. I will go though the query you provided and update the post. Thank you!!

afulamba · ‎08-02-2018

Hello Splunkers, This is my 1st post on this forum, I need some help here. I have to set up a alert which has 2 search queries. 1st query decides the trigger condition and the alert email will have the stats/table from the 2nd query. Is it doable? e.g. My 1st search: index=xxx sourcetype=X | eventstats count(eval(Total_time>5000 AND Total_time<10000)) as T5 count(eval(Total_time>=10000)) as T10 | where T5>40 OR T10>20 I have to trigger the alert if T5>40 or T10>20 In the alert I have to show the stats from 2nd query on different index. 2nd query: index=YYY sourcetype = Y : : |table fld1 fld2 fld3 If required can I add 3rd query as well to show the table? Regards, Amit

Posts	20
Solutions	0
Karma Given	0
Karma Received	1
Member Since	‎08-02-2018

Online Status	Offline
Date Last Visited	‎06-05-2020 02:04 AM

Wildcard search from lookup

how to use string from lookup table in search

Assign keys to tokenised string

Alert: set trigger condition on 1st search query a...

Re: Wildcard search from lookup

Wildcard search from lookup

Re: how to use string from lookup table in search

Re: how to use string from lookup table in search

Re: how to use string from lookup table in search

Re: how to use string from lookup table in search

Re: how to use string from lookup table in search

Re: how to use string from lookup table in search

Re: how to use string from lookup table in search

Re: how to use string from lookup table in search

Re: how to use string from lookup table in search

how to use string from lookup table in search

Re: Assign keys to tokenised string

Re: Assign keys to tokenised string

Re: Assign keys to tokenised string

Re: Assign keys to tokenised string

Assign keys to tokenised string

Re: Alert: set trigger condition on 1st search que...

Re: Alert: set trigger condition on 1st search que...

Alert: set trigger condition on 1st search query a...