About andrey2007

andrey2007 · ‎01-10-2018

You cas specify and increase job lifetime period https://docs.splunk.com/Documentation/Splunk/latest/Search/Extendjoblifetimes

andrey2007 · ‎01-10-2018

Try to use rename [your_search] | rename "A:*" as "*:A", "B:*" as "*:B"

andrey2007 · ‎12-28-2017

you can change lookup manually but better on my mind create a scheduled search which will populate your lookup using outputlookup command

andrey2007 · ‎12-28-2017

You can create a lookup with banned words named stop_words.csv and use it as condition for your search somethink like this your_search [| inputlookup stop_words.csv | return 10 $banned_words]

andrey2007 · ‎12-27-2017

Sure it is best practice to send data to undexer layer please look at the docs http://docs.splunk.com/Documentation/Splunk/7.0.0/DistSearch/Forwardsearchheaddata

andrey2007 · ‎12-27-2017

[base of your search ] earliest=[ search ...search_to_restrict_session_start_date| eval date=strptime(Session_Start_Date, "%m/%d/%Y") | eval date=relative_time(date, "+1mon@mon") | return $date]... So you will get events starting from the beginning of next month after selected Session_Start_Date

andrey2007 · ‎12-25-2017

try this [base of your search] earliest=@d-4h@h time modifier were used (start of today minus 4 hours)

andrey2007 · ‎12-18-2017

You can do it using drop-down menu clicking Event Actions=>Extract fields with Regex generator to generate regexp.

andrey2007 · ‎12-18-2017

try this command | eval n=mvcount(myfield)

andrey2007 · ‎12-17-2017

Hi, try this [your search] | rex field=_raw "^(?:[^=\n]*=){3}(?P<code>\d+)\s+\w+=(?P<method>[^ ]+)(?:[^&\n]*&){8}\w+=(?P<SENDID>\w+)" and if you need count | stats count by method SENDID code

andrey2007 · ‎12-17-2017

Try to use Splunk Machine Learning Toolkit App especially built-in TFIDF(term frequency–inverse document frequency) numerical statistic after that you can use word cloud viz.

andrey2007 · ‎09-04-2017

Try to use standard color options for table: Color>Ranges http://docs.splunk.com/Documentation/Splunk/latest/Viz/TableFormatsFormatting

andrey2007 · ‎06-30-2017

to clarify we done it with transforms.conf and props.conf as we used automatic lookups and did not tested it with transforms.conf only. So our configs was same as in example: props.conf [yoursourcetype] LOOKUP-user = userlookup user OUTPUT username transforms.conf [userlookup] filename = userlookup.csv match_type = WILDCARD(user)

andrey2007 · ‎06-30-2017

We used it only with props.conf

andrey2007 · ‎06-30-2017

I have done it according this answer and it works https://answers.splunk.com/answers/52580/can-we-use-wildcard-characters-in-a-lookup-table.html

andrey2007 · ‎05-29-2017

I think you should start from reading the docs https://docs.splunk.com/Documentation/Splunk/6.5.3/Installation/HowtoupgradeSplunk And here you can find info about downgrading for Unix for example(rollback) Splunk Enterprise does not provide a means of downgrading to previous versions. If you need to revert to an older Splunk release, uninstall the upgraded version and reinstall the version you want.

andrey2007 · ‎05-19-2017

Sure, you are right "index=abc sourcetype=abc OR index=abc sourcetype=pqr" should be changed to something like "index=abc (sourcetype=abc OR sourcetype=pqr )"

andrey2007 · ‎05-19-2017

Looks that "if" has no sense because "fields" command deleted sourcetype field and mycount is always equals to "1"

andrey2007 · ‎05-17-2017

Maybe this would helpful index=abc sourcetype=abc OR index=abc sourcetype=pqr | stats count as Count by ID | join type=left ID [search index=abc sourcetype=abc | stats latest(userName) as userName by ID] | table userName ID Count

andrey2007 · ‎05-15-2017

Sure, thanks to dineshraj9 "abc" should be deleted in base search Also about report speed, for example you can filter excess events and accelerate your search http://docs.splunk.com/Documentation/Splunk/6.6.0/Report/Acceleratereports#How_reports_qualify_for_report_acceleration

Posts	131
Solutions	9
Karma Given	115
Karma Received	31
Member Since	‎07-29-2011

Online Status	Offline
Date Last Visited	‎06-23-2020 12:08 PM

Change font size in Radial Gauge

How to create a user role with capabilities to man...

HF1 -> HF2 -> Indexer: How to route a set of data ...

Cloning set of data to specified Splunk indexer

How to edit my heavy forwarder tcpout configuratio...

Why should I use search head clustering and what a...

How to join field name and field value?

How to make from one row two?

Sendemail command

Excel export custom template

Re: saved searches

Re: How to change table column headings?

Re: Splunk App for NLP

Re: Splunk App for NLP

Re: Store Search Head collect on Search Peer

Re: How to filter date based on the future data?

Re: How to search anything from yesterday at 8 pm ...

Re: Need to shorten data and show it by count

Re: count events in multivalue field

Re: Need to shorten data and show it by count

Re: Are there any Text analyzer app that we can us...

Re: Coloring a stats table value based on conditio...

Re: Wildcards in lookup file

Re: Wildcards in lookup file

Re: Wildcards in lookup file

Re: upgrade Splunk 6.4 to splunk 6.5

Re: Help me with search query command

Re: Help me with search query command

Re: Help me with search query command

Re: Display hosts with no data