Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Are you a member of the Splunk Community?
Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- Find Answers
- :
- About dineshp
dineshp
Explorer
Member since:
01-11-2015
06-05-2020
Community Statistics
| Posts | 20 |
| Solutions | 0 |
| Karma Given | 0 |
| Karma Received | 1 |
| Member Since | 01-11-2015 |
Activity Feed
- Got Karma for How to add a 3rd column to my table to display "match" next to a value in column 2 that matches any value in column 1?. 06-05-2020 12:47 AM
- Posted Can a "redundancy" forwarder be triggered to send logs if the primary forwarder is down? on Getting Data In. 08-30-2017 02:55 PM
- Tagged Can a "redundancy" forwarder be triggered to send logs if the primary forwarder is down? on Getting Data In. 08-30-2017 02:55 PM
- Tagged Can a "redundancy" forwarder be triggered to send logs if the primary forwarder is down? on Getting Data In. 08-30-2017 02:55 PM
- Posted Re: Exclude result like the first result on Splunk Search. 09-12-2016 05:48 PM
- Posted Re: Exclude result like the first result on Splunk Search. 09-12-2016 04:57 PM
- Posted Re: Exclude result like the first result on Splunk Search. 09-12-2016 02:37 PM
- Posted Exclude result like the first result on Splunk Search. 09-11-2016 08:11 PM
- Tagged Exclude result like the first result on Splunk Search. 09-11-2016 08:11 PM
- Tagged Exclude result like the first result on Splunk Search. 09-11-2016 08:11 PM
- Tagged Exclude result like the first result on Splunk Search. 09-11-2016 08:11 PM
- Posted Re: Build a table with information from various sourcetype on Splunk Search. 03-09-2016 06:24 PM
- Posted Build a table with information from various sourcetype on Splunk Search. 03-09-2016 05:06 PM
- Tagged Build a table with information from various sourcetype on Splunk Search. 03-09-2016 05:06 PM
- Tagged Build a table with information from various sourcetype on Splunk Search. 03-09-2016 05:06 PM
- Tagged Build a table with information from various sourcetype on Splunk Search. 03-09-2016 05:06 PM
- Posted Removing events with duplicate fields from transaction command on Splunk Search. 10-06-2015 08:40 PM
- Tagged Removing events with duplicate fields from transaction command on Splunk Search. 10-06-2015 08:40 PM
- Tagged Removing events with duplicate fields from transaction command on Splunk Search. 10-06-2015 08:40 PM
- Tagged Removing events with duplicate fields from transaction command on Splunk Search. 10-06-2015 08:40 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 1 |
08-30-2017
02:55 PM
Hi,
Is it possible to configure the indexer to index logs from one forwarder only (say forwarder 1) and if logs from "forwarder 1" stops, start indexing logs from "forwarder 2"
At the moment, we have two universal forwarders (for redundancy purpose) sending same data to one indexer. So we are consuming twice as much the licence. Is there a way to remove duplicate logs before it gets indexed / or listen to one forwarder at a time.
Many Thanks
... View more
09-12-2016
02:37 PM
Hi inventsekar,
Thank you for your reply. "_time" is the time when a resource gets free. I sorted the result with "_time" so i can grab the top two results.
doing head on the result gives me Laptop1 & Laptop2. But what i want is to grab one laptop and one projector after sorting them by time.
Is there a way we can say "exclude the result similar to the first result" so anything that looks like "Laptop*" gets discarded and we only get projector.
I found a work around using append command and running the search twice.
*source=sdesktop "Available" Laptop| stats count by resource, _time | sort - _time | head 1 | append [search source=sdesktop "Available" Projector*| stats count by resource, _time | sort - _time | head 1 ]
Result:
resource _time
Laptop1 2016-09-12 12:04:14
Projector2 2016-09-11 03:13:04
... View more
09-11-2016
08:11 PM
Hi,
I want to identify the available and occupied resources in a pool. The active resource will have "Available" on the log and the occupied resource will have "taken" in the pool.
(only 1 set of resource is always available and one set should always be taken i.e Laptop1 and Laptop2 cannot be available at the same time)
Now when i do,
source=sdesktop "Available" | stats count by resource, _time
resource _time
Laptop1 2016-09-12 12:04:14
Laptop2 2016-09-12 10:00:45
Projector2 2016-09-11 03:13:04
Projector1 2016-09-06 11:17:50
I want following result,
resource _time
Laptop1 2016-09-12 12:04:14
Projector2 2016-09-11 03:13:04
I tried source=sdesktop "Available" | stats count by resource, _time | sort - _time | head 2
resource _time
Laptop1 2016-09-12 12:04:14
Laptop2 2016-09-12 10:00:45
Please help.
Thank you.
... View more
03-09-2016
06:24 PM
Tried it, didnt work.
... View more
03-09-2016
05:06 PM
I have two different logsource,
ProxyLogs: Contains "ipaddress" and "username"
WebLogs: Conatains "IP_address" and whole other stuff like UserAgent, Time, Branch,HostName,loginname
I have a query that is giving me following things which i want
TIme, IP, hostname, UA, loginname, Branch
But my requirement is to Lookup the individual "ipaddress" from ProxyLogs in the Weblogs and find the matching username (i.e who that IP belongs to)
Time, IP, hostname, UA, loginname, Branch, username
I have this so far:
sourcetype=WebLogs (other- logic)| stats count by Time,IP_address,HostName,UserAgent,loginname,Branch| rename IP_address as IP | rename UserAgent as UA | join IP type=outer [search sourcetype=WebLogs |fields username ipaddress]
But this result in random user every i run the search.
Any help will be really appreciated.
... View more
10-06-2015
08:40 PM
Hi all,
I am writing a query to detect brute force attempts, where the username is different in each request.
index=syslog username!="NULL" | transaction clientip maxspan=60m maxpause=2m | stats count by clientip | search count >5 | sort count desc
This is giving me if someone has typed in same username within 2 mins, i want to avoid those. So i want to know if someone tried to login more than 5 times with different usernames from the same IP.
I tried my luck with dedup, but it doesn't seem to be working.
index=syslog username!="NULL" | transaction clientip maxspan=60m maxpause=2m | dedup username | stats count by clientip | search count >5 | sort count desc
Thank You
... View more
04-12-2015
03:12 PM
Yup.. This worked, Thank you so much.
... View more
04-10-2015
03:52 AM
Thank you for highlighting that the subsearch gets evaluated first, i will try and flip the query.
I know what you mean; but no it wont work that way..
when you run this query: index = weblogs "/admin//" ---- it filters out the log that has username in it. So, the remaining logs (that has "/admin//") only has sessionid not username.
May be this will work,
index=weblogs id | table id, username | append [ search index=weblogs "/admin//" | table sessionid | dedup sessionid | rename sessionid to id]
... View more
04-09-2015
09:01 PM
I have a scenario like this:
Login logs are created when users ( both admin and normal) logs in the website with a valid username. - upon successful authentication a session ID is provided. - at this stage the log has both sessionid and username in the same log.
The admin username lands on a page that starts with "/admin//". The normal user lands on page "/user/*" - but at this stage the log wont have username but still has the sessionid.
Now my goal is to search for all admin users (i.e. those who hit "/admin//"), and list the username, sessionid in the same place.
I have done something like this:
index=weblogs "/admin//" | table sessionid | dedup sessionid | rename sessionid to id append [search id | table id, username]
Not sure, if i am doing it right in the latter search. Any help will be appreciated, thank you.
... View more
- Tags:
- aggregate
- correlation
04-07-2015
04:39 PM
I believe we are running 5.x There are no popups :'(
... View more
04-07-2015
02:40 PM
This works, but i think its excluding something else as well.. Not just the UserAgent field.
... View more
04-07-2015
02:40 PM
Naa.. That didnt work. when i press "Alt" and its came up as NOT - .
This resulted lesser search result.
... View more
04-06-2015
08:23 PM
I know what you are saying, when i run .....|stats count by UserAgent|sort UserAgent
"-" is always on the top with highest number of count.
... View more
04-06-2015
07:51 PM
run this to see if the service is up and running.
service --status-all | grep splunkd
Thanks
... View more
04-06-2015
07:46 PM
When running this search:
index=syslog | stats count by UserAgent
it gives me - and a whole bunch of other User Agents. Some of the logs do not have User Agent, so they have - instead. I just want to exclude this from the result.
I tried:
index=syslog UserAgent!="-" | stats count by UserAgent
index=syslog UserAgent!=- | stats count by UserAgent
index=syslog NOT UserAgent=- | stats count by UserAgent
index=syslog NOT UserAgent="-" | stats count by UserAgent
No luck. Any help will be appreciated, thank you.
... View more
03-16-2015
07:39 PM
For example getting just "www.google.com"
https://www.google.co.nz/webhp?sourceid=chrome-instant&ion=1&espv=2&ie=UTF-8#q=splunk
where "https://www.google.co.nz/webhp?sourceid=chrome-instant&ion=1&espv=2&ie=UTF-8#q=splunk" is already extracted as URL.
... View more
03-12-2015
09:30 PM
@ramdaspr
Is it possible to make a partial match as ooposed to exact match. The search can be within the same event.
For Example:
0.10.12.10, -, -, -, 3/13/2015, 0:23:55, -, myproxy, -, www.facebook.com, 31.13.77.6, 443, 0, 3948, 2672, SSL-tunnel, -, -, www.facebook.com:443, -, Inet, 0, -, Allow, Req ID: 0eaf3338; Compression: client=No server=No compress rate=0% decompress rate=0%, Internal, Internal, 0x80, Allowed, -, -
I have extracted following:
1. www.facebook.com as URL1
2. www.facebook.com:443 as URL2
| eval matches=if(URL1==URL2, "match", "no match") == Gives me no match.
... View more
03-05-2015
03:24 PM
1 Karma
My current search looks like this:
index=myfood | table Sunday, Monday
Which results in:
Sunday Monday
Egg Rice
Apple Chicken
Banana Milk
Carrot Vegetable
Rice Noodles
Now, my objective is to add another column named "Matches" and identify if any of the food on Sunday matches with the food on Monday.
I did something like this:
| eval matches=if(Sunday==Monday, "match", "no match")
but I get following result:
Sunday Monday Matches
Egg Rice no match
Apple Chicken no match
Banana Milk no match
Carrot Vegetable no match
Rice Apple no match
which is not right, because Rice and Apple is a match to column Monday.
Any help is really appreciated. Thanks
... View more
