Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About SteveBowser
SteveBowser
Explorer
Member since:
12-10-2015
Monday
Community Statistics
| Posts | 12 |
| Solutions | 0 |
| Karma Given | 4 |
| Karma Received | 0 |
| Member Since | 12-10-2015 |
Activity Feed
- Posted Re: Scheduled search with only | inputlookup in the search returns zero results on Splunk Enterprise. Monday
- Posted Re: Scheduled search with only | inputlookup in the search returns zero results on Splunk Enterprise. 2 weeks ago
- Posted Re: Scheduled search with only | inputlookup in the search returns zero results on Splunk Enterprise. 3 weeks ago
- Posted Re: Scheduled search with only | inputlookup in the search returns zero results on Splunk Enterprise. 3 weeks ago
- Posted Scheduled search with only | inputlookup in the search returns zero results on Splunk Enterprise. 3 weeks ago
- Posted Re: Invalid date in Dashboard Studio search on Dashboards & Visualizations. 01-06-2023 12:15 PM
- Karma Re: Invalid date in Dashboard Studio search for PickleRick. 01-06-2023 12:15 PM
- Posted Why is there invalid date in Dashboard Studio search? on Dashboards & Visualizations. 01-06-2023 11:39 AM
- Karma Re: How to create a search showing data starting on a Saturday up to current day for richgalloway. 06-05-2020 12:51 AM
- Karma Re: Distributed Monitoring console unable to find indexers for dkeck. 06-05-2020 12:49 AM
- Karma Re: Windows Winsock error 10053 for yannK. 06-05-2020 12:45 AM
- Posted Re: How to create a search showing data starting on a Saturday up to current day on Splunk Search. 03-02-2020 01:16 PM
- Posted Re: How to create a search showing data starting on a Saturday up to current day on Splunk Search. 03-02-2020 12:54 PM
- Posted How to create a search showing data starting on a Saturday up to current day on Splunk Search. 03-02-2020 12:13 PM
- Tagged How to create a search showing data starting on a Saturday up to current day on Splunk Search. 03-02-2020 12:13 PM
- Tagged How to create a search showing data starting on a Saturday up to current day on Splunk Search. 03-02-2020 12:13 PM
- Tagged How to create a search showing data starting on a Saturday up to current day on Splunk Search. 03-02-2020 12:13 PM
- Posted Re: Distributed Monitoring console unable to find indexers on Monitoring Splunk. 08-08-2019 06:56 AM
- Posted Palo Alto TA - Defining the APIKEY for the Content Packages on All Apps and Add-ons. 07-30-2019 08:42 AM
- Tagged Palo Alto TA - Defining the APIKEY for the Content Packages on All Apps and Add-ons. 07-30-2019 08:42 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
Monday
Answering my own question here - it needs to have dates to display results. In the end, I wrote the results to a summary index in a scheduled search using | collect index=test_summary addtime=true.
... View more
2 weeks ago
There are no timestamps in the lookup table. When I plug one in, I get the desired results.
... View more
3 weeks ago
I created a scheduled search that reads 2 input lookup csv files. It returns zero results when I look at the "View Recent"/Job Manager. When I run it by clicking the "Run" selection, I get the results that I'm looking for. What am I overlooking?
... View more
Labels
01-06-2023
12:15 PM
I changed the search to: eventtype=forcepoint_messages bundleId=* WEB sender=* | rex "WEB\-\d*\s(?<Action>\w*\s\w*\s\w*)\." | rex "src_label\=\'(?<src_label>\S*)\'" | eval FileName=name, JobName=Name, userName=userName | fillnull value=" " | eval Time = strftime(_time, "%Y-%m-%d:%H:%M:%S") | stats count AS Count BY Time userName JobName FileName Action bundleId | eval bundleID=bundleId | appendpipe [ stats sum(Count) AS Count BY bundleId | eval userName=""] | sort - bundleId | fields - Count bundleId And got this which will work for now. As for coloring, I'm attempting to do that based on the field "bundleId" but that has really been an issue, and it's so easy to achieve that in the Classic XML. Thank you for the assistance! V/R Steve
... View more
01-06-2023
11:39 AM
I am using the search depicted in the attached photo below to develop a viz in Dashboard Studio separating events by the field "bundleId". It appears to display events in the statistics table the way that I want them to.
However, when I save them to a dashboard via Dashboard Studio, I get an "Invalid Date" where I want the break in events (Note - this does not happen in the "Classic" version)
How can the "Invalid date" be removed? I already attempted to eval _time=" " in the appendpipe with no success.
Thank you.
... View more
Labels
- Labels:
-
Dashboard Studio
03-02-2020
01:16 PM
Yes, I like your answer better than mine. Thank you for the quick response
... View more
03-02-2020
12:54 PM
I'll answer my own question -
earliest=@w6 latest=now
No need for the evals.
Have a great day!
... View more
03-02-2020
12:13 PM
I have a customer that needs to have a dashboard showing a start date of Saturday and ending on the current workday. The search that I have tried, with no results, is:
index=| eval today=strftime(now(),"%a")
| eval Backdays=case(today=="Mon",2,today=="Tue",3,today=="Wed",4,today=="Thur",5,today=="Fri",6)
| search earliest=-"Backdays"d@d latest=now
There is definitely data for this past Saturday, Sunday and today (Monday) and the "Backdays" field is populating with a 1 (in this case)
Any help is most appreciated.
Thank you.
... View more
08-08-2019
06:56 AM
This helped me out (over 2 years later). We just need to remember to go to the MC ==> General Setup and accept the changes after adding the MC Server as a Cluster Search Peer. Thank you.
... View more
07-30-2019
08:42 AM
I’m attempting to get the “Retrieve Content Packs” working from the savedsearches. I receive the following: External search command ‘pancontentpack’ returned error code 2. Script output = “ERROR Unable to get apikey from firewall: local variable ‘apikey’ referenced before assignment “. I looked at the Answers page to get the key and hard-code it in the common.py script, but that doesn’t work. Can this be defined in the local passwords.conf file? If so, what would the stanza name be called? I can’t seem to find this anywhere in the documentation.
... View more
- Tags:
- palo-alto
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
Monday
|
