Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About perlish
perlish
Communicator
Member since:
04-23-2012
06-26-2022
Community Statistics
| Posts | 82 |
| Solutions | 1 |
| Karma Given | 17 |
| Karma Received | 18 |
| Member Since | 04-23-2012 |
Activity Feed
- Karma Re: Splunk enterprise on the new Mac m1 under Rosetta for xanthakita. 06-26-2022 05:01 AM
- Karma Re: Splunk enterprise on the new Mac m1 under Rosetta for xanthakita. 06-26-2022 05:00 AM
- Posted Can I use splunk mobile in the splunk enterprise 8.1 ? on All Apps and Add-ons. 04-23-2021 05:16 PM
- Got Karma for Re: can't send an alert email with "ERROR:root:'NoneType' object has no attribute 'find' while sending mail to..."?. 06-05-2020 12:48 AM
- Got Karma for How to print results excluding the last line in Splunk like "head -n -1" in LInux?. 06-05-2020 12:47 AM
- Karma Re: How can I integrate splunk with fusionchart ? for sdaniels. 06-05-2020 12:46 AM
- Karma Re: what're the username and password in the splunk 2013 app in IOS for miteshvohra. 06-05-2020 12:46 AM
- Karma Re: How can I download the Splunk App for PCI Compliance for mloven_splunk. 06-05-2020 12:46 AM
- Karma Re: can I use a prefilter to collect the syslog which I really need before put them in the database for yannK. 06-05-2020 12:46 AM
- Karma Re: how can I force splunk read file line by line for Takajian. 06-05-2020 12:46 AM
- Karma Re: how can i try this app? for jcoates_splunk. 06-05-2020 12:46 AM
- Karma Re: how can I intergrity vector map with maxmind GeoIP database ? for ziegfried. 06-05-2020 12:46 AM
- Karma Re: how can I intergrity vector map with maxmind GeoIP database ? for ziegfried. 06-05-2020 12:46 AM
- Karma Re: how can I enable MMAP caching in Google GeoIP of MaxMind for ziegfried. 06-05-2020 12:46 AM
- Karma Re: how can I use the C API of MaxMind geolite for verticaltier. 06-05-2020 12:46 AM
- Karma Re: how can I use the C API of MaxMind geolite for ziegfried. 06-05-2020 12:46 AM
- Karma Re: How to increase the maximum number of concurrent historical searches? for hexx. 06-05-2020 12:46 AM
- Got Karma for An error occurred while reading the page template. See web_service.log for more details. 06-05-2020 12:46 AM
- Got Karma for how to add arrow in dashboard and views. 06-05-2020 12:46 AM
- Got Karma for how to use two geoip database. 06-05-2020 12:46 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
04-23-2021
05:16 PM
I want to monitor the splunk dashboard in my IPhone,Can I use splunk mobile in the Splunk Enterprise 8.1 ? It seems that Splunk Cloud Gateway can not work in Splunk Enterprise 8.1.
... View more
Labels
- Labels:
-
dashboard
02-25-2019
01:08 AM
Hi everyone,
My data is as flowing.
The cnt is events count of scanner_type by day.
I want to show everyday`s different scanner_type events number with a line chart.
_time scanner_type cnt
2019-02-23T00:00:00.000 mykings_ip 113
2019-02-23T00:00:00.000 sql_union1 2915
2019-02-22T00:00:00.000 mykings_ip 174
2019-02-22T00:00:00.000 sqlmap_stacked 39
2019-02-22T00:00:00.000 backup-file 483300
2019-02-22T00:00:00.000 sqlmap_union1 6
I want convert to this format
time sqlmap_union1 backup-file sqlmap_stacked mykings_ip
2019-02-22T00:00:00.000 6 483300 39 174
2019-02-23T00:00:00.000 2915 null null 113
Thanks so much.
... View more
12-19-2017
05:41 PM
I'm sorry that I don't have the sample data. When I tried to solve the question I asked ,I used nomv() method and found that the single value's type is string. Therefore, I asked the following question.
... View more
12-18-2017
08:55 PM
It works,thank you!
While I have another question, it seems that splunk parse the float to string sometimes, and because of this problem, the mvfilter function may become invalid. How can I solve it in this situation?
... View more
12-18-2017
12:35 AM
Hi,
I want to deal the multivalue field to get the counts whch is satisfied the conditions I set. For example, in the following picture, I want to get search result of (myfield>44) in one event.
... View more
05-23-2017
07:00 PM
Still doesn`t work, it should be splunk limit.
https://answers.splunk.com/answers/303/whats-max-events-i-can-have-timestamped-with-a-particular-second-millisecond.html
... View more
05-23-2017
07:28 AM
Hi,everyone.
My raw log is like this:
2017-05-22 01:00:01 dst:100.100.100.2 src:118.32.120.110 port:60046 count:6
2017-05-22 01:00:01 dst:100.100.100.2 src:118.32.120.91 port:38026 count:2
2017-05-22 01:00:01 dst:100.100.100.2 src:118.43.104.16 port:33967 count:2
2017-05-22 01:00:01 dst:100.100.100.2 src:119.1.109.17 port:43973 count:3
And the count of raw log is 409767.
All of the time is 2017/05/22 01:00:01 in raw log.
But splunk extract timestamp is 2017/05/22 01:00:01 2017/05/22 01:00:02 2017/05/22 01:00:03 2017/05/22 01:00:04 2017/05/22 01:00:05
I use this search comand "sourcetype=test |stats count by _time",and got this result.
_time count
2017/05/22 01:00:01 100000
2017/05/22 01:00:02 100000
2017/05/22 01:00:03 100000
2017/05/22 01:00:04 100000
2017/05/22 01:00:05 9767
I have set TIME_FORMAT=%Y-%m-%d %H:%M:%S in props.conf,but doesn`t work.
I also use this "sourcetype=test | fieldformat _time=strftime(_time,"%Y-%m-%d %H:%M:%S") "
The timestamp return aN/NaN/NaN NaN:NaN:NaN.000
Anyone know how to solve this issue?
Thanks.
... View more
- Tags:
- props.conf
- timestamp
when trigger sendemail all log (include "info" log)
link text
... View more
03-02-2016
06:52 PM
Hi, Yasaswy .thanks for you answer my question ~.
any email going out of your splunk server (for other alerts)?
not anyone email success to send . and i'm sure the sender account&password is right
python.log with two error line :
2016-03-03 10:39:04,434 +0800 ERROR sendemail:114 - Sending email. subject="Splunk Alert: 危险端口开启告警 high port scan", results_link="http://linuxscan:8000/app/asset_discovery/@go?sid=scheduler__admin_YXNzZXRfZGlzY292ZXJ5__RMD51f09c7f374d6ba97_at_1456972740_1332", recipients="[u'test@test.com']", server="smtp.exmail.test.com:465"
2016-03-03 10:39:04,434 +0800 ERROR sendemail:377 - 'NoneType' object has no attribute 'find' while sending mail to: test@test.com
... View more
03-02-2016
03:39 AM
The alert triggers and Splunk tries to send the alert email, but something is wrong.
In the internal log, I find this one error:
03-02-2016 19:22:04.376 +0800 ERROR ScriptRunner - stderr from '/data/splunk/bin/python /data/splunk/etc/apps/search/bin/sendemail.py "results_link=http://linuxscan:8000/app/asset_discovery/@go?sid=scheduler__admin_YXNzZXRfZGlzY292ZXJ5__RMD51f09c7f374d6ba97_at_1456917720_400" "ssname=危险端口开启告警" "graceful=True" "trigger_time=1456917721" results_file="/data/splunk/var/run/splunk/dispatch/scheduler__admin_YXNzZXRfZGlzY292ZXJ5__RMD51f09c7f374d6ba97_at_1456917720_400/results.csv.gz"': ERROR:root:'NoneType' object has no attribute 'find' while sending mail to: test@test.com
Server information:
6.3.0
Splunk internal version
aa7d4b1ccb80
Installed app:
Asset Discovery
version
6.0
internal version
10
... View more
08-09-2015
07:45 PM
Yes. You solved my issue. Thanks very much.
... View more
08-07-2015
01:44 AM
1 Karma
Hi all,
I want to print results excluding the last line.
In Linux, I can use head -n -1
but in Splunk, the head command only accepts positive numbers.
... View more
05-14-2015
12:55 AM
Hi,all
I want alert through email, but found this error:
''NoneType' object has no attribute 'find' while sending mail to'test@test.com'
Version is 6.1.1.
Thanks.
... View more
- Tags:
- attributes
- object
02-08-2015
06:25 PM
Yes,I have tried but did not work.
... View more
02-08-2015
05:53 PM
I tried this method but it seems did not work.
How can I set up the line breaker like a '\n'.
... View more
02-06-2015
01:55 AM
The first picture is my original logs
The second picture is my logs in the splunk
Now,we can see the splunk wrap my logs in the wrong places.
Please tell me how to set in the props.conf can solve this problem.
Thanks very much!
... View more
02-04-2015
01:33 AM
Hi,
I use Kafka Messaging Modular Input to subscribe topic and index data in splunk.
But in the splunk webpage, chinese characters display incorrectly.
I've tried to configure CHARSET = UTF8, GB2312, GB18030 in props.conf, but both don't solve this issue.
Please help me.
Thanks.
... View more
01-10-2015
05:16 PM
I want to analysis 100k targets using the same search command in the realtime,splunk will create 100k search jobs in the same time.
I thought the mission is impossilble.
How can I use splunk like spark or storm ?
Thank you very much!
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-26-2022
11:26 AM
|
