Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About chengyu
chengyu
Path Finder
Member since:
07-17-2013
06-05-2020
Community Statistics
| Posts | 36 |
| Solutions | 5 |
| Karma Given | 1 |
| Karma Received | 0 |
| Member Since | 07-17-2013 |
Activity Feed
- Karma Re: Does the Splunk App for Stream support Linux ARM Raspberry Pi? for vshcherbakov_sp. 06-05-2020 12:47 AM
- Posted Re: How should upgrade splunk on other director? on Installation. 04-12-2017 07:31 PM
- Posted Re: How should upgrade splunk on other director? on Installation. 04-12-2017 07:30 PM
- Posted How to upgrade Splunk on another directory? on Installation. 04-04-2017 06:24 PM
- Tagged How to upgrade Splunk on another directory? on Installation. 04-04-2017 06:24 PM
- Posted Re: How to use timechart command to calculate the average of a field? on Splunk Search. 02-13-2017 07:47 PM
- Posted Re: How to use timechart command to calculate the average of a field? on Splunk Search. 02-07-2017 10:00 PM
- Posted How to use timechart command to calculate the average of a field? on Splunk Search. 02-07-2017 04:52 PM
- Tagged How to use timechart command to calculate the average of a field? on Splunk Search. 02-07-2017 04:52 PM
- Tagged How to use timechart command to calculate the average of a field? on Splunk Search. 02-07-2017 04:52 PM
- Tagged How to use timechart command to calculate the average of a field? on Splunk Search. 02-07-2017 04:52 PM
- Posted How can i in Custom Decorations variable? on Dashboards & Visualizations. 11-09-2016 10:26 PM
- Tagged How can i in Custom Decorations variable? on Dashboards & Visualizations. 11-09-2016 10:26 PM
- Tagged How can i in Custom Decorations variable? on Dashboards & Visualizations. 11-09-2016 10:26 PM
- Posted Re: How can i do Subtraction cycle? on Splunk Search. 03-07-2016 07:00 AM
- Posted How can i do Subtraction cycle? on Splunk Search. 03-06-2016 10:39 PM
- Tagged How can i do Subtraction cycle? on Splunk Search. 03-06-2016 10:39 PM
- Posted Re: Splunk Add-on for NetFlow: Why are there no src_inf or dst_inf fields in transforms.conf? How do I capture the interface name? on All Apps and Add-ons. 11-03-2015 07:00 PM
- Posted Splunk Add-on for NetFlow: Why are there no src_inf or dst_inf fields in transforms.conf? How do I capture the interface name? on All Apps and Add-ons. 11-03-2015 06:58 PM
- Tagged Splunk Add-on for NetFlow: Why are there no src_inf or dst_inf fields in transforms.conf? How do I capture the interface name? on All Apps and Add-ons. 11-03-2015 06:58 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
04-12-2017
07:30 PM
Hi, i find the answer, command:
rpm -Uvh splunk-6.5.3.xxx.rpm --relocate /opt=/home
/opt director is default install path, /home is you change path
... View more
04-04-2017
06:24 PM
Hi, my splunk install on /home/splunk, i have try rpm -i -Uvh --prefix=/home splunk-6.5.3-36937ad027d4-linux-2.6-x86_64.rpm, but show "package splunk-6.5.3-36937ad027d4.x86_64 is already installed". i need remove splunk than re-install? thanks.
... View more
- Tags:
- upgrade
Labels
- Labels:
-
upgrade
02-13-2017
07:47 PM
myserarch ... |table bandwidth,_time | rex field=bandwidth "^(?P\d+.\d+)\s(?P\w+)$" | eval Unit=case(Unit="Gbps",1024,true(),1) | eval InGbps=(Value*Unit)/1024 |eval InGbps=round(InGbps,2) | timechart span=1d max(InGbps) as MaxGbps avg(InGbps) as AvgGbps
extract fields :
1.04 Gbps
384.05 Mbps
5.01 Gbps
...
... View more
02-07-2017
10:00 PM
Hi Sir, data is 1 Gbps/137.54 Kpps or 3600 Mbps/137.54 Kpps, i want calculate 1Gbps & 3600 Mbps avg value, not Kpps value. So i can use rex extract field capture 1 and 3600 value and call field name "bandwidth", but 3600 need transfer to gigabyte, finally use splunk command "timechart sapn=1mon avg(bandwidth)"
... View more
02-07-2017
04:52 PM
My raw data:
Feb 7 18:18:23 impact 1 Gbps/137.54 Kpps, importance 2...
Feb 7 18:18:23 impact 3600 Mbps/137.54 Kpps, importance 2...
I want use timechart search command calculate avg(1Gbps & 3600Mbps) by week or month. Now i use rex to extract field 1G and 3600Mbps values but the field name is same. i wish to change 3600Mbps to Gbps then run timechart avg(field) . What should i do? Thanks.
... View more
11-09-2016
10:26 PM
Hi Guys, I create form in my splunk and also create Custom Decorations, and create two choice box time and shcool, i can use time box variable in xml, but school variable i don't understand into form. How should i do into my form? Thanks.
<form stylesheet="devices.css">
<label>test</label>
<fieldset submitButton="true" autoRun="true">
<input type="dropdown" token="school">
<label>School</label>
<choice value="*">All School</choice>
<choice value="A school">A school</choice>
<choice value="B school">B school</choice>
<default>*</default>
</input>
<input type="time" token="time" searchWhenChanged="true">
<label>time</label>
<default>
<earliest>-15m</earliest>
<latest>now</latest>
</default>
</input>
</fieldset>
<search>
<query>index=* splunk_server=* | stats count as value | rangemap field=value low=1- 10000 severe=0-0 default=low</query>
<earliest>$time.earliest$</earliest>
<latest>$time.latest$</latest>
<progress>
<set token="value2">$result.value$</set>
<set token="range2">$result.range$</set>
</progress>
</search>
<row>
<panel>
<html>
<div class="small"> </div>
<div class="custom-result-value icon-only $range2$"> $school$ </div>
</html>
</panel>
</row>
... View more
03-07-2016
07:00 AM
My splunk search command:
sourcetype=stream:http | streamstats avg(bytes_in) as avg by src_ip | eval minus = avg - bytes_in | table minus,avg,bytes_in,src_ip
... View more
03-06-2016
10:39 PM
Hi, I have calculate avg values, but i want do subtraction cycle like
values=1,2,5,7,10;sum=25;avg=5
show:
5-1=4
5-2=3
5-5=0
5-7=-2
5-10=-5
How can i do? Thanks.
... View more
- Tags:
- eval
- subtraction
11-03-2015
07:00 PM
note: i collect cisco router and switch devices
... View more
11-03-2015
06:58 PM
Hi Guys,
I have installed the Splunk Add-on for NetFlow and also checked transforms.conf, fields but I can't see about src_inf or dst_inf values e.g: interface name Ethernet 0/0... How do I capture interface name? Thank you so much.
transforms.conf
FIELDS=
"start_time",
"end_time",
"duration",
"src_ip",
"dest_ip",
"src_port",
"dest_port",
"protocol",
"tcp_flag",
"fwd_status",
"src_tos",
"input_pkt",
"input_byte",
"output_pkt",
"output_byte",
"in_int",
"out_int",
"src_bgp_as",
"dest_bgp_as",
"src_mask",
"dest_mask",
"dest_tos",
"flow_dir",
"next_hop_router",
"bgp_next_hop_router",
"src_vlan",
"dest_vlan",
"in_src_mac",
"out_dest_mac",
"in_dest_mac",
"out_src_mac",
"mpls1",
"mpls2",
"mpls3",
"mpls4",
"mpls5",
"mpls6",
"mpls7",
"mpls8",
"mpls9",
"mpls10",
"client_latency",
"server_latency",
"app_latency",
"exp_ip",
"engine",
"exp_sys_id"
... View more
08-23-2015
09:09 PM
I refer http://answers.splunk.com/answers/194879/dynamic-drilldown-pass-the-timechart-commands-time.html resolve it.
... View more
08-23-2015
08:03 PM
Hi guys,
index=_internal sourcetype=stream:stats host=* | spath Output=TcpSessionCount path=sniffer{}.processors{}.tcpSessionCount | fields - _raw | fields host TcpSessionCount | stats sum(TcpSessionCount) as TotalTcpSessionCount by host,_time | convert timeformat="%m/%d/%Y:%H:%M:%S" ctime(_time) AS Time | fields,host,Time,TotalTcpSessionCount | stats avg(TotalTcpSessionCount) by Time
XML:
<drilldown>
/app/HTTP_DDoS_Monitor/High_DDoS_SRC_IP?form.Time=$row.Time$
</drilldown>
I can transfer $row.Time$ to a form. If I want to use timechart avg(TotalTcpSessionCount) as TcpSessionCount by host the $row.Time$ can't be transferred to a form. Can I use the timechart command to transfer _time or Time fields to a form?
index=_internal sourcetype=stream:stats host=* | spath Output=TcpSessionCount path=sniffer{}.processors{}.tcpSessionCount | fields - _raw | fields host TcpSessionCount | stats sum(TcpSessionCount) as TotalTcpSessionCount by host,_time | convert timeformat="%m/%d/%Y:%H:%M:%S" ctime(_time) AS Time | fields,host,Time,TotalTcpSessionCount | **timechart avg(TotalTcpSessionCount) as TcpSessionCount by host**
... View more
05-19-2015
10:13 PM
Hi Guys, finally use "delta" command, thank you everybody kindly support.
... View more
05-13-2015
09:53 PM
Hi Sir:
The first query I calculate the daily amount, calculated after the date +7 days, the average amount of 5/9 to 5/16, the field name is Totalweekqty, Totalweekqty still calculate the number of the day. How do i make |search now < week| or | where now < month | working? Thank you.
sourcetype=xxx PartNo=123 VendorCode=1000 storage_in_date=2014-05-09*
| eval Indate = substr(storage_in_date, 1, len(storage_in_date)-13)
| eval now = strptime(Indate, "%Y-%m-%d")
|eval week=(now+604800)
|eval month=(now+2592000)
| stats sum(qty) as Totaldayqty values(now) as now values(week) as week values(month) as month by VendorCode,PartNo
|search now < week
| stats values(Totaldayqty) as Totaldayqty avg(Totaldayqty) as Totalweekqty values(now) as now values(week) as week values(month) as month by VendorCode,PartNo
| where now < month | stats values(Totaldayqty) as Totaldayqty values(Totalweekqty) as Totalweekqty avg(Totalweekqty) as Totalmonthkqty by VendorCode,PartNo |
... View more
- Tags:
- subsearch
05-06-2015
04:44 AM
Hi Runals:
I have try where command | where VendorPrice1 < CurrentPrice |, result still the same.
... View more
05-06-2015
12:16 AM
Hi Sir:
My Raw data CurrentPrice,VendorPrice1...is string not number, so i use convert change fields attribute. I hope VendorPrice1 < CurrentPrice or VendorPrice2 < CurrentPrice or VendorPrice3 < CurrentPrice appear data and highlights red color. If use ... |search VendorPrice1 < 0.3345 | ... is fine, if use |search VendorPrice1 < CurrentPrice| data is error, It can not seem to use than the size of the string, should can i do? Thank you.
My RAW data:
CurrentPrice VendorPrice1 VendorPrice2 VendorPrice3
.3345 .3303 .3302 .3305
sourcetype=xxx Status=Approved PartNo=$PartNo$ VendorCode=$VendorCode$ | Convert num(CurrentPrice) as CurrentPrice,num(VendorPrice1) as VendorPrice1,num(VendorPrice2) as VendorPrice2,,num(VendorPrice3) as VendorPrice3 | search ((VendorPrice1 < CurrentPrice) OR (VendorPrice2 < CurrentPrice) OR (VendorPrice3 < CurrentPrice) ) |stats values(CurrentPrice) values(VendorPrice1) values(VendorPrice2) values(VendorPrice3) by RfqNo,PartNo,VendorCode
... View more
04-20-2015
08:48 PM
Hi,
I have correctly installed forwarder-for-linux-arm-raspberry-pi_10.tgz and also copied the Splunk App for Stream, but i can't capture data on the forwarder to our Splunk Indexer server. I have referenced StreamApp-6.2.1-DeployStreamApp.pdf, but I did not find support for arm-raspberry. How should i do this? Thank you kindly for the support.
... View more
10-23-2014
09:01 PM
Hi, when I do the filtering windows log, I use the main program 6.1.4 then changed forwarder license, so Windows AD (main program changed forwarder license ) >> forwarder(main program changed forwarder license ) >> splunk index is my architecture.
I hope drop eventcode=540 and 538, I have a reference to other people's actions, but unsuccessful.
transforms.conf
props.conf
[WinEventLog:Security] * Or [WMI:WinEventLog:Security] Or [wmi:WinEventLog:Security] Or [source::WinEventLog:Security]
TRANSFORMS-set = delete
[delete]
REGEX = (?msi)^EventCode=540 * Or REGEX=(?m)^EventCode=(540|538) Or REGEX=(?msi)^EventCode=(540|538)
DEST_KEY = queue
FORMAT = nullQueue
... View more
- Tags:
- windows
05-26-2014
12:32 AM
I'm resolve, i'm re-modify props.conf and clear transforms.conf
props.conf
[source::udp:514]
SEDCMD-nodeviceid = s/\sdevid=\w+\s/ /g
transforms.conf
(null)
restart splunk forward process.
success..^ ^
... View more
05-26-2014
12:20 AM
Hi, i use heavy forward setting data input port:514 and index=abcd after setting Forwarding and receiving » Forward data "192.168.1.128:19997", i'm try heavy filter.
step.1
props.conf
[source::udp:514]
TRANSFORMS-null= setnull
step.2
[setnull]
REGEX=REGEX=[.FGT60C3G13010319.]
DEST_KEY=queue
FORMAT=nullQueue
step.3
restart splunk forward host
my raw data:
May 26 15:16:41 192.168.1.99 date=2014-05-26 time=15:16:43 devid=FGT60C3G13010319 ...
can't filter
May 26 15:16:41 192.168.1.99 date=2014-05-26 time=15:16:43 devid= ...
... View more
05-12-2014
01:50 AM
Hi, my search:
I'm try fast mode but status the same, My Splunk OS 5.04.
Please help me, thanks.
index="xxx" srcip !="1.1.1.1" srcip != "2.2.2.2" srcip != "3.3.3.3" dstip != "111..." dstip !="112.1.1." dstip != "163.1.1." dstip != "10.1.1." | eval bandwidth=rcvdbyte+sentbyte | eval bandwidth(MB) = round(bandwidth/1024/1024,2) | strcat " " time " " as Date | eval n = coalesce(hostname, host_name) |strcat " " n url " " as weburl |stats sum(bandwidth(MB)) as bandwidth(MB) values(srcip) as srcip values(service) as service values(attack) as app last(Date) as FirstDate first(Date) as LastDate values(policyid) as policyid values(weburl) as weburl by dstip |sort 10 search srcip="123.123.123.123" |head 10
... View more
- Tags:
- slow
05-08-2014
08:34 PM
Hi, i search splunk document i find can't use command table must use chart, timechart, stats, and top...
ＨＴＴＰ://docs.splunk.com/Documentation/Splunk/5.0.8/Knowledge/Manageacceleratedsearchsummaries
I'm modify search, but always stay 0%...
index=xxx
| fillnull value="SSL" attack
| eval bandwidth=rcvdbyte+sentbyte
| eval bandwidthMB = round(bandwidth/1024/1024,2)
| strcat " " time " " as Date
| eval n = coalesce(hostname, host_name)
| strcat " " n url " " as weburl
| stats sum(bandwidthMB) as bandwidthMB values(srcip) as srcip values(attack) as app earliest(Date) as FirstDate latest(Date) as LastDate values(weburl) as weburl by dstip
... View more
05-06-2014
08:10 AM
Hi, i use Report Acceleration Summaries hope improve search speed. But always stay 0%, i search document seem not use "＊", i try delete dstip != 123.＊.＊.＊, but status the same. How should i do?
my search:
index=fg-1000c srcip !=1.1.1.1 dstip != 123.＊.＊.＊
| fillnull value=SSL attack
| eval bandwidth=rcvdbyte+sentbyte
| eval bandwidth(MB) = round(bandwidth/1024/1024,2)
| strcat " " time " " as Date | eval n = coalesce(hostname, host_name) |strcat " " n url " " as weburl
| stats sum(bandwidth(MB)) as bandwidth(MB) values(srcip) as srcip values(attack) as app last(Date) as FirstDate first(Date) as LastDate values(weburl) as weburl by dstip
| table srcip,dstip,app,FirstDate,LastDate,bandwidth(MB),weburl
| sort bandwidth(MB) desc
... View more
- Tags:
- report
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:04 AM
|
