About arikanter

arikanter · ‎04-23-2024

Also looking for this

arikanter · ‎05-03-2021

Hi! Sorry, I wasn't clear enough in my ask. In my use case, my search will never return events because I'm not searching events, I'm searching lookuptables. Results from lookuptables are returned as statistics, not events. Problem: Splunk alerts (by design?) appear to trigger only when searches return events. I want my Splunk alert to trigger on statistics.

arikanter · ‎04-30-2021

I have two lookup tables that get updated 1/day from time/CPU intensive searches. I want to create an alert to let me know when there are deltas between these two lookup tables. I can schedule as a report, and this works, but then I get empty reports if not deltas are found. I think the reason my alert is not triggering is because the results from my search are not showing as events, but as statistics. |inputlookup main.csv |lookup secondary.csv eventSource as eventSource output Name|where isNull(Name) "Trigger Number of Results" = greater than 0 the search returns results, but no alert is triggered.

arikanter · ‎04-24-2020

Rich-- thank you so much -- I did not know about "relative_time" . That was so helpful, and what you provided was exactly what I needed. 🙂

arikanter · ‎04-23-2020

two time fields per event: _time (default eventfield for Splunk) occurtime (timestamp within body of event) I only want to show events where the field in the body of the event: "occurtime" is not more than two days older than "_time". I have done the following to convert occurtime to epoch time: eval occur=strptime(occurtime,"%Y-%m-%dT%H:%M:%S") example current output: _time: 2020-04-23 05:07:03.151 occurtime: 2020-02-24T17:42:38.572Z occur: 1582594958.000000 I just need to figure out how the < funcitons with time. Thank you!

arikanter · ‎09-23-2019

Token 1: <label>OS</label> <choice value="Windows">Windows</choice> <choice value="RedHat">RedHat</choice> Token 2: I want to set Token 2 to be based on whatever was selected for Token1. For example: If RedHat was selected for token1, make Token2: "OS01" If Windows, was selected for token1, make Token2: "OS02"

Posts	6
Solutions	0
Karma Given	0
Karma Received	0
Member Since	‎11-01-2018

Online Status	Offline
Date Last Visited	‎04-23-2024 03:37 PM

Create an alert based on comparison of two lookup ...

ignore timestamp greater than 2 days

How to make second token value be based on choice ...

Re: Splunk Add-on for ServiceNow report ingestion

Re: Create an alert based on comparison of two loo...

Create an alert based on comparison of two lookup ...

Re: ignore timestamp greater than 2 days

ignore timestamp greater than 2 days

How to make second token value be based on choice ...