About ashish9433

ashish9433 · ‎03-18-2021

I would suggest installing it on DMC and you would be able to get the results you are looking for.

ashish9433 · ‎06-29-2020

Hey, There is no direct way of onboarding encrypted data to Splunk. In case there is a requirement to do so, you can go ahead and write a script (python/shell) that access the API of encrypted source, parse it and send it to Splunk. There is a python library to address this https://pypi.org/project/py-pgp/ The below code should be a starter for you import pgpy emsg = pgpy.PGPMessage.from_file(<path to the file from the client that was encrypted using your public key>) key,_ = pgpy.PGPKey.from_file(<path to your private key>) with key.unlock(<your private key passpharase>): print (key.decrypt(emsg).message)

ashish9433 · ‎07-29-2019

Yup baiscally the rest API was sending out the data is random order everytime it polled and the regex was written without that things to be taken into consideration. Later on it was realized that the JSON response is completely jumbled up on every hit and fixing the Regex solved the prblm. Thanks for your help!

ashish9433 · ‎07-19-2019

yeah even i am banging my head that what is that i am missing. I have posted only half of the output. The actual output is a valid json.

ashish9433 · ‎07-19-2019

This doesnt work and in preview even with/without the events shows properly formatted and parsed, but i don't know why when it is getting indexed it is messing up

ashish9433 · ‎07-19-2019

Hi, I have tried Splunk Add-on builder as well as REST API app of App store to get data via REST API from Mongo DB OPS Manager, but the results events are not getting broken properly I tried fiddling dump, dumps, load & loads function in python as well as whatever i could think of in props.conf but no positive results. Any inputs on how do i fix it? Below is how i see the data in splunk irrespective i use Splunk Add-on builder or REST API App {"links":[{"href":"http://opsmanager.abc.xyz.org:80/api/public/v1.0/globalAlerts?status=OPEN&pageNum=1&itemsPerPage=100","rel":"self"}],"results":[{"acknowledgedUntil":"2119-03-01T14:07:52Z","acknowledgingUsername":"abc@zyz.com","alertConfigId":"5980bcc00e545f881d3659a1","created":"2018-08-21T14:49:27Z","currentValue":{"number":2.3656959E7,"units":"SECONDS"},"eventTypeName":"OUTSIDE_METRIC_THRESHOLD","groupId":"5a0dbc440e545f72701d8ca6","hostId":"8d9e4f32e307e1b4a935d0f3e0055940","hostnameAndPort":"denata3utmdb01.abc.xyz.org:27045","id":"5b7c26771f98cf1493f1577b","lastNotified":"2019-03-25T01:24:51Z","links":[{"href":"http://opsmanager.abc.xyz.org:80/api/public/v1.0/globalAlerts/5b7c26771f98cf1493f1577b","rel":"self"}],"metricName":"OPLOG_SLAVE_LAG_MASTER_TIME","replicaSetName":"ATBDAP03","status":"OPEN","tags":["TAG_SDLC"],"typeName":"HOST_METRIC","updated":"2019-05-22T09:52:52Z"},{"acknowledgedUntil":"2119-06-22T14:08:19Z","acknowledgingUsername":"abc@zyz.com","alertConfigId":"5980bf8a0e545f881d3663fd","created":"2019-03-09T23:20:40Z","eventTypeName":"HOST_RECOVERING","groupId":"5a0dbc440e545f72701d8ca6","hostId":"8d9e4f32e307e1b4a935d0f3e0055940","hostnameAndPort":"denata3utmdb01.abc.xyz.org:27045","id":"5c844a480e545f1d153be335","lastNotified":"2019-05-21T21:24:59Z","links":[{"href":"http://opsmanager.abc.xyz.org:80/api/public/v1.0/globalAlerts/5c844a480e545f1d153be335","rel":"self"}],"replicaSetName":"ATBDAP03","status":"OPEN","tags":["TAG_SDLC"],"typeName":"HOST","updated":"2019-07-16T14:08:19Z"},{"acknowledgedUntil":"2119-06-22T14:08:09Z","acknowledgingUsername":"abc@zyz.com","alertConfigId":"5980c0390e545f881d366688","created":"2019-03-29T01:49:16Z","eventTypeName":"HOST_DOWN","groupId":"5994baea0e545f0fb11a7bf8","hostId":"61a2829f7bbb5f89f3406642206a36fa","hostnameAndPort":"denatb3mdips01.abc.xyz.org:27045","id":"5c9d799cf76e9d3f9d9934f1","lastNotified":"2019-05-21T21:24:53Z","links":[{"href":"http://opsmanager.abc.xyz.org:80/api/public/v1.0/globalAlerts/5c9d799cf76e9d3f9d9934f1","rel":"self"}],"replicaSetName":"ATIPS03","status":"OPEN","tags":["TAG_SDLC"],"typeName":"HOST","updated":"2019-07-16T14:08:09Z"},{"acknowledgedUntil":"2119-06-22T14:08:03Z","acknowledgingUsername":"abc@zyz.com","alertConfigId":"5980bf280e545f881d36629d","created":"2019-04-26T01:48:10Z","currentValue":{"number":92.42220000199045,"units":"RAW"},"eventTypeName":"OUTSIDE_METRIC_THRESHOLD","groupId":"5994baea0e545f0fb11a7bf8","hostId":"b4711110d008f035c85bc9edd549bb46","hostnameAndPort":"denatb3mdips02.abc.xyz.org:27045","id":"5cc2635a0e545f54c4245073","lastNotified":"2019-05-21T21:24:53Z","links":[{"href":"http://opsmanager.abc.xyz.org:80/api/public/v1.0/globalAlerts/5cc2635a0e545f54c4245073","rel":"self"}],"metricName":"DISK_PARTITION_SPACE_USED_DATA","replicaSetName":"ATIPS03","status":"OPEN","tags":["TAG_SDLC"],"typeName":"HOST_METRIC","updated":"2019-07-16T14:08:03Z"},{"acknowledgedUntil":"2119-06-22T14:07:58Z","acknowledgingUsername":"abc@zyz.com","alertConfigId":"5980bf280e545f881d36629d","created":"2019-05-03T17:17:46Z","currentValue":{"number":93.33982523912108,"units":"RAW"},"eventTypeName":"OUTSIDE_METRIC_THRESHOLD","groupId":"5994baea0e545f0fb11a7bf8","hostId":"b4270e868d403038d18dad42693416f5","hostnameAndPort":"denatb3mdips03.abc.xyz.org:27045","id":"5ccc77ba0e545f54c4d931d4","lastNotified":"2019-05-21T21:24:53Z","links":[{"href":"http://opsmanager.abc.xyz.org:80/api/public/v1.0/globalAlerts/5ccc77ba0e545f54c4d931d4","rel":"self"}],"metricName":"DISK_PARTITION_SPACE_USED_DATA","replicaSetName":"ATIPS03","status":"OPEN","tags":["TAG_SDLC"],"typeName":"HOST_METRIC","updated":"2019-07-16T14:07:58Z"},{"acknowledgedUntil":"2119-06-22T14:07:52Z","acknowledgingUsername":"abc@zyz.com","alertConfigId":"5980bf280e545f881d36629d","created":"2019-05-08T01:46:28Z","currentValue":{"number":91.2596940644846,"units":"RAW"},"eventTypeName":"OUTSIDE_METRIC_THRESHOLD","groupId":"5994baea0e545f0fb11a7bf8","hostId":"697b2c7697e9fb5f466a6f6f65d1f914","hostnameAndPort":"dens2b3mdips02.abc.xyz.org:27045","id":"5cd234f4f76e9d580f1c16b4","lastNotified":"2019-05-21T21:24:53Z","links":[{"href":"http://opsmanager.abc.xyz.org:80/api/public/v1.0/globalAlerts/5cd234f4f76e9d580f1c16b4","rel":"self"}],"metricName":"DISK_PARTITION_SPACE_USED_DATA","replicaSetName":"ST2IPS03","status":"OPEN","tags":["TAG_SDLC"],"typeName":"HOST_METRIC","updated":"2019-07-16T14:07:52Z"},{"acknowledgedUntil":"2119-06-22T14:07:43Z","acknowledgingUsername":"abc@zyz.com","alertConfigId":"5980bd950e545f881d365cb2","created":"2019-05-20T14:35:51Z","currentValue":{"number":155845.0,"units":"SECONDS"},"eventTypeName":"OUTSIDE_METRIC_THRESHOLD","groupId":"597f93d70e545f881d331591","hostId":"42d7c182422a623b875df934da1cc3e9","hostnameAndPort":"deni1b3mdedi01.abc.xyz.org:27130","id":"5ce2bb470e545f55d16ed5b4","lastNotified":"2019-05-22T02:39:58Z","links":[{"href":"http://opsmanager.abc.xyz.org:80/api/public/v1.0/globalAlerts/5ce2bb470e545f55d16ed5b4","rel":"self"}]

ashish9433 · ‎03-12-2019

Hi, I have lot of alerts which even trigger during the maintenance period causing false incidents. The cmdb has the maintenance schedule but in the formats like "1st&3rd-Friday@10am", "2nd&4th-Monday@6pm" and so on. I am trying to prase this time in Splunk search query so that i can create Starttime & Endtime for which the alert will not trigger. I am able to "| eval CurrentDay = strftime(now(), "%A")" which gives me the current day like whether today is Monday/Tuesday or what day, but how do i find out if it is first monday of the month or 2nd monday or so for me to address this requirement. Anyone who can point me towards some direction in addressing this?

ashish9433 · ‎02-26-2019

I have tried similar to what you have mentioned but i dont see that working!

ashish9433 · ‎02-24-2019

Hi, I am using below search query which list's out the sequence of login using standard querying. What the below query does is it gives me the authentication actions as list. I am looking for those security events which gets succeed after multiple failures. The below query does the job but i want to use it using tstats command as the below conventional query is quite slow. sourcetype="WinEventLog:Security" EventCode=4624 OR EventCode=4625 | stats count sparkline as trend values(user) as Users max(_time) as maxtime min(_time) as mintime values(difference) as difference list(action) as list values(src_bunit) as src_bunit values(dest_bunit) as dest_bunit values(dvc_bunit) as dvc_bunit values(user_email) as user_email,values(Failure_Reason) as Failure_Reason, values(signature) as signature,values(Error_Code) as Error_Code by user | eval list = mvjoin(list, " ") | eval alert = if(match(list, "(?:failure\s?){4,}(?:success)"), "True", "False") | where alert = "True" | eval diff = round((maxtime - mintime)/60,0) | eval timediff = mvindex(split(diff, "-"),1) | eval maxtime=strftime(maxtime,"%H:%M:%S") | eval mintime=strftime(mintime,"%H:%M:%S") | where count>100 | fields - diff | where timediff<=60 I tried constructing the below query but list() function doesn't seems to be working with tstats command and hence i am unable to get the exact sequence. In the below query list(Authentication.action) as list doesn't work and hence the issue. If i use values() it will only give me success & failure but not the sequence and hence i am not able to find success after four failures. | tstats summariesonly=t earliest(_time) as maxtime, latest(_time) as mintime, values(Authentication.dest_nt_domain) as dest_nt_domain,values(Authentication.signature) as signature, list(Authentication.action) as list,values(Authentication.user_email) as user_email,values(Authentication.dest) as dest ,values(Authentication.body) as body,values(Authentication.signature_id) as signature_id values(Authentication.Error_Code) as Error_Code, count as EventCount from datamodel=Authentication where sourcetype="WinEventLog:Security" (Authentication.signature_id="4624" OR Authentication.signature_id="4625") groupby Authentication.user | eval list = mvjoin(list, " ") | eval alert = if(match(list, "(?:failure\s?){4,}(?:success)"), "True", "False") | where alert = "True" | eval diff = round((maxtime - mintime)/60,0) | eval timediff = mvindex(split(diff, "-"),1) | eval maxtime=strftime(maxtime,"%H:%M:%S %Z") | eval mintime=strftime(mintime,"%H:%M:%S %Z") | where EventCount>=50 | fields - diff | where timediff<=60 Why I am using "list" cmd? To get failure followed by a success action sequence like below example After list command, | eval list = mvjoin(list, " ") | eval alert = if(match(list, "(?:failure\s?){4,}(?:success)"), "True", "False") | where alert = "True" Example: failure failure failure failure success failure success How can i address the above scenario using datamodel/tsats?

ashish9433 · ‎12-23-2018

Hi, I have JSON data, which seems to be properly prased. I have a field which holds multiple IPs in a new lined when seen in formatted events and seperated with \n when seen in un-formatted. Check the below screenshot I am unable to use mvexpand or split or even i tried to use makemv command but it doesn't work as expected. Any clue, how to handle this situation, when i do a stats or table i want IPs as multivalued whereas currently it is displayed as just a text with IPs separated with space.

ashish9433 · ‎07-02-2018

@niketnilay no it doesn't work, i do not see any events. I assume since the file is empty it is not creating any event and since no event no entry in the source list. I may be wrong but i cannot see any result for source=*.trg Any work around getting the list of file uploaded using Metadata or Rest command.

ashish9433 · ‎07-02-2018

@niketnilay i do not want to block those files, infact i want a way to identify if the respective .trg file has been available in the directory or not. If i see that an empty .trg file was available in the directory i can alert using Splunk and that's what is my requirement.

ashish9433 · ‎07-02-2018

Hi Team, I have folder in which batch jobs loads the data files which are being consumed by Splunk. The data files are larger and sometimes it takes hours to get loaded into the directory. Once the file is loaded completely there is a empty file created with the same name as of the data file but with extension as .trg. This empty .trg file is just to indicate the data is completely copied and the next process can start. When monitoring the directory the empty files as usual would not be uploaded into splunk as it doesn't have any data, but is there a way using metadata command or REST command i can find out if splunk attempted to upload that empty file so that i can alert the file has been completely copied into the directory?

ashish9433 · ‎03-20-2018

I already did this, the problem is the result is shown as list of all image_name as columns and date as rows with all zero in all the row of all the cloumns and thus the issue!

ashish9433 · ‎03-20-2018

I want to group by span=15d and have a visualization and also use a single value with trend indicator option. I tried span, bin and timechart none of them is working on lookup data.

ashish9433 · ‎03-20-2018

I already did this, the problem is the result is shown as list of all image_name as columns and date as rows with all zero in all the row of all the cloumns and thus the issue!

ashish9433 · ‎03-20-2018

Hi Team, I have a scheduled search which generates a lookup file similar to below Whenever i run stats command on this data it runs perfectly fine. But whenever i try to run timechart command it doesnt work, like below search ...| timechart count by image_name search ... | timechart count(image_name) or any permutation i try with i get either zero or null but not the actuall count or aggregate function. Basically i am looking to use span/bin on this data but i am unable to do that so thought of using timechart command. I have properly formatted the time to _time by converting into epoch time and then into %c standard format. I am not sure why timechart is not working on the lookup/csv file data.

ashish9433 · ‎02-19-2018

I have a glass table which has multiple services and each of the services has multiple KPIs mapped on the glasstable as in the below image. When i click on Circle (KPI 1) within the respective service, it takes me to a another glasstable which has Service swapping enable. I did generated a unique URL by clicking on each of the services and then put that in the drilldown of the orignal glass table circle click. What is happening is that on clicking it takes to the another glasstable but always default (service 1) is selected by default irrespective if i click on service 2 or 3 or any one. I made it very sure that the URL is correct. Also i found that if i select say respective service from the service swapping menu of the glass table the URl changes with the service ID, but if i just copy paste the same URL into another tab it resets to default service. The same i have to do with click on square (KPI 2) and it should take to a glasstable where respective service should be selected as from where the click came from. inshort how do i drilldown from Glasstable 1 to Glasstable 2 (with service swapping) with respective service selected from the dropdown.

ashish9433 · ‎02-16-2018

looks like easy and innovative way of doing it! Thanks @ashleyherbert

ashish9433 · ‎01-15-2018

HI Team, I have a table which has multiple values like below. In the table there are multiple Check_Category and for each Check_Category there are multiple check_ids. What i want to do is, when someone clicks on Any Check_Category, in the above example lets say the person click on "Initial Setup", then i need to drilldown to another page having only those Check_ID as columns As in below screenshot i will have only those check_ID as colomn which are listed for clicked "Check_Category". Basically if i can get the list of all the Check_ID, separated by "Space", then i can use fields command to list only those columns.

ashish9433 · ‎01-12-2018

This guidance, made me get what i was looking for! Thanks

ashish9433 · ‎01-11-2018

Hi Team, This appears to be a complex scenario to me to implement on Splunk Below is the table i have on Splunk In the above table, for check_ids (1.1.10, 1.1.14.... and so on ) there are multiple blank fields and i need to fill the blanks with a information in the lookup and condition. Below is the lookup file. In the lookup file, for each profile what all check_id are present is mentioned. Here comes the problem statement. In the first image above i want to fill the blanks to "unknown" if for that respective profile and check_id there is no entry in the lookup table. For example - In the first row, the profile is "coreos-level-1" and there is blank for "1.1.10", "1.1.14", both these entries are not there in the lookup, so i want to replace blank with "Unknown", whereas if the check_id exists in the lookup then nothing needs to be filled and it can remain blank. Can anyone help me with a logic to get this done in Splunk?

ashish9433 · ‎12-06-2017

@DalJeanis You are correct, i was looking for running stdev(), but was not able to find out how to do that, so ended up with a straight line of stdev. Do you have any idea how can we get running stdev() plotted for the above scenario?

ashish9433 · ‎12-06-2017

I was looking to plot a single line of standard deviation. Basically i was trying using stats command, but later i used streamstats command and i was able to address what i was looking for. Thanks for your revert @alistairmcdougall

ashish9433 · ‎12-06-2017

I have a table which is in below format Time ProcessTime1 ProcessTime2 ABC_Count 11/14/2017 100 112 30000 11/15/2017 118 205 30546 11/16/2017 119 121 43000 11/17/2017 141 192 95000 It produces a visualization like below, where ABC_Count is the overlay which is the red line in the below graph. I want to have stdev plotted in the below graph, and if run the below search query it is giving me zero as stdev mybase search | stats values(ProcessTime1), values(ProcessTime2), values(ABC_Count), stdev(ProcessTime1), stdev(ProcessTime2) by Time Basically if just remove the "by Time" in the above search i get stdev calculated properly, but then the visualization is not available. Any idea how stdev can be plotted in the same graph?

Posts	84
Solutions	2
Karma Given	46
Karma Received	21
Member Since	‎01-11-2015

Online Status	Offline
Date Last Visited	‎09-25-2023 03:20 PM

REST API JSON Parsing & Event breaking issue

How to create custom relative date and time in Spl...

How to list values using tstats in Splunk ES

mvexpand & split command not working on JSON data

Identifying empty file upload on Splunk

Timechart command in lookup or CSV File

Get URL for Splunk ITSI Glasstables with Service S...

Passing values from multiples row to another dashb...

Conditional Lookup

Calculate Standard Deviation for a table

Re: Where does Splunk Technical Assessment App sho...

Re: how to input encrypted files like PGP encrypte...

Re: REST API JSON Parsing & Event breaking issue

Re: REST API JSON Parsing & Event breaking issue

Re: REST API JSON Parsing & Event breaking issue

REST API JSON Parsing & Event breaking issue

How to create custom relative date and time in Spl...

Re: How to list values using tstats in Splunk ES

How to list values using tstats in Splunk ES

mvexpand & split command not working on JSON data

Re: Identifying empty file upload on Splunk

Re: Identifying empty file upload on Splunk

Identifying empty file upload on Splunk

Re: Timechart command in lookup or CSV File

Re: Timechart command in lookup or CSV File

Re: Timechart command in lookup or CSV File

Timechart command in lookup or CSV File

Get URL for Splunk ITSI Glasstables with Service S...

Re: Remove "All" from Multiselect Input in Dashboa...

Passing values from multiples row to another dashb...

Re: Conditional Lookup

Conditional Lookup

Re: Calculate Standard Deviation for a table

Re: Calculate Standard Deviation for a table

Calculate Standard Deviation for a table

Are you a member of the Splunk Community?