Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About LauraBre
LauraBre
Communicator
Member since:
05-10-2012
06-05-2020
Community Statistics
| Posts | 77 |
| Solutions | 1 |
| Karma Given | 11 |
| Karma Received | 8 |
| Member Since | 05-10-2012 |
Activity Feed
- Karma Re: span 5min for the last 15min for MHibbin. 06-05-2020 12:46 AM
- Karma Re: SDK javascript: client side test (error 404) for ineeman. 06-05-2020 12:46 AM
- Karma Re: SDK javascript: client side test (error 404) for ineeman. 06-05-2020 12:46 AM
- Karma Re: column chart : How can we create a chart with three fields? for brettcave. 06-05-2020 12:46 AM
- Karma Re: Log4j Splunk for Damien_Dallimor. 06-05-2020 12:46 AM
- Karma Re: Compare two timerange in one report for MuS. 06-05-2020 12:46 AM
- Karma Re: current hour for lpolo. 06-05-2020 12:46 AM
- Karma Re: SearchSelectLister for Ayn. 06-05-2020 12:46 AM
- Karma Re: SearchSelectLister for Ayn. 06-05-2020 12:46 AM
- Karma Re: SearchSelectLister : default value for Lamar. 06-05-2020 12:46 AM
- Karma Re: How can I count lines? for kristian_kolb. 06-05-2020 12:46 AM
- Got Karma for Re: every 5min for the last 15min. 06-05-2020 12:46 AM
- Got Karma for SDK javascript: client side test (error 404). 06-05-2020 12:46 AM
- Got Karma for Splunk : chart of two timeperiods. 06-05-2020 12:46 AM
- Got Karma for Compare two timerange in one report. 06-05-2020 12:46 AM
- Got Karma for StaticSelect/stringreplace. 06-05-2020 12:46 AM
- Got Karma for SearchSelectLister. 06-05-2020 12:46 AM
- Got Karma for How can we change the color column chart?. 06-05-2020 12:46 AM
- Got Karma for How can we change the color column chart?. 06-05-2020 12:46 AM
- Posted splunk draw (development) on Deployment Architecture. 08-23-2012 08:35 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
08-23-2012
08:35 AM
Hi,
I want to draw a graph but the chart that it appears is different of the chart which appears in splunk. I don't understand why because I test with other requests and it works so I want to know if it's a problem in syntax or, in splunk when I launch my search I have this "[subsearch]: Your timerange was substituted based on your search string Your timerange was substituted based on your search string" so it can be come from that?
Thx by advance,
Laura
package net.awl.bfi.splunk;
import java.io.BufferedReader;
import java.io.IOException;
import java.io.InputStream;
import java.io.InputStreamReader;
import java.io.PrintWriter;
import java.util.Enumeration;
import javax.servlet.ServletException;
import javax.servlet.http.HttpServlet;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import com.splunk.Job;
import com.splunk.Service;
public class SplunkServlet extends HttpServlet {
/**
*
*/
private static final long serialVersionUID = 1L;
private static String getContent() {
Service service = new Service("odpcil01b", 8089);
service.login("a532136", "admin");
Job job = service
.getJobs()
// .create("search source=\"tcp:5540\" tkn Service_Type=\"*\" | timechart count(Service_Type) by Requester");
.create("search source=\"laura_acs\" BCF=\"*\" earliest=-0d@d latest=now | multikv | eval ReportKey=today | append [search source=\"laura_acs\" BCF=\"*\" earliest=-1d@d latest=-0d@d| multikv | eval ReportKey=yesterday ] | append [search source=\"laura_acs\" BCF=* earliest=-7d@d latest=now| multikv | eval ReportKey=\"last 7 days\" ]|DEDUP ID_TRANS| timechart span=5m count as \"Nb transactions\" by ReportKey");
InputStream in = job.getTimeline();
BufferedReader br = new BufferedReader(new InputStreamReader((in)));
String output;
System.out.println("Output from Server .... \n");
StringBuffer buffer = new StringBuffer();
try {
while ((output = br.readLine()) != null) {
buffer.append(output + "\n");
}
} catch (IOException e) {
// TODO Auto-generated catch block
e.printStackTrace();
}
return buffer.toString();
}
public void doGet(HttpServletRequest req, HttpServletResponse response)
throws ServletException, IOException {
response.setContentType("application/json");
PrintWriter out = response.getWriter();
out.println(getContent());
}
public void doPost(HttpServletRequest req, HttpServletResponse res) {
System.out.println("do post proxy");
Enumeration headerNames = req.getHeaderNames();
while (headerNames.hasMoreElements()) {
String headerName = (String) headerNames.nextElement();
System.out.println(headerName);
System.out.println(req.getHeader(headerName));
}
}
}
... View more
- Tags:
- splunk
08-20-2012
06:39 AM
hello,
I have a question about a search with case. This is my search:
source="Laura_acs" |eval Transac=case(ERRL="TIMEOUT_REACHED" OR ERRL="TIMEOUT_REACHED_RECORD","PA Pb fin de session 3D Secure", SD_STAT_PA="NO" AND (NOT ERRL="TIMEOUT_REACHED" OR NOT ERRL="TIMEOUT_REACHED_RECORD"),"PA Pb Autres",STAT_VE="N","VE No",STAT_VE="Y" AND SD_STAT_PA="Y","PA Yes",STAT_VE="Y" AND SD_STAT_PA="ATTEMPT","PA Attempt",STAT_VE="Y" AND SD_STAT_PA="N", "PA No",STAT_VE="Y","VE sans PA")|DEDUP ID_TRANS|chart count by Transac
In this search I want for the last case (VE sans PA) that my log line doen't contain field SD_STAT_PA. How can do it? Because, for the moment, STAT_VE="Y" is the selection of all the others case.
Thx by advance,
Laura
... View more
- Tags:
- search
08-13-2012
08:29 AM
Thx, I did it. I insert my index.html in htdocs of my apache and I add SSLProxyEngine On ProxyPass /proxy/ https://localhost:8089/ in the Apache config file and decommented all modules about proxy. So it works cery well when I doen't use tomcat but when I use tomcat and Apache, there is the error 404 so I don't result the problem with tomcat but I can connect to my spolunk so it's a good thing. Now I want to use this in a dynamic web project where I use tomcat so I search I can I do it? Do you have an idea?
Thx by advance,
Laura
... View more
08-10-2012
05:52 AM
Hi,
I try to use the SDK javsacript in my dynamic web project J2EE so I create a proxy servlet and a page .html so the authentification in Splunk works because I don't have the error message alert of this page:
<html>
<head>
<meta charset="utf-8">
<title>How to start a Splunk session</title>
<script type="text/javascript" src="scripts/jquery.min.js"></script>
<script type="text/javascript" src="scripts/client/splunk.js"></script>
<script type="text/javascript" charset="utf-8">
function displayApps() {
var http = new splunkjs.ProxyHttp("servlet/proxy");
// Create a Service instance and log in
var service = new splunkjs.Service(http, {
username: "admin",
password: "admin",
scheme: "https",
host: "localhost",
port: "8089"
});
// Print installed apps to the console to verify login
service.apps().fetch(function(err, apps) {
if (err) {
alert("Error listing apps");
return;
}
console.log("success connection");
service.serverInfo(function(err, info) {
console.log("Splunk Version: ", info.properties().version);
});
var myapps = "";
var appsList = apps.list();
for(var i = 0; i < appsList.length; i++) {
myapps += "App " + i + ": " + appsList[i].name + "<br/>"
}
document.getElementById("applist").innerHTML=myapps;
});
}
</script>
</head>
<body>
<button type="button" onclick="displayApps()">Log in and list apps</button>
<p id="applist"></p>
</body>
</html>
I see the message success connection and I can show in my console of firebug all methods can use but I don't able to have version information, list of apps, ...
Where can my problem come from?
Thx by advance,
Laura
... View more
- Tags:
- javascript
- splunk
08-08-2012
08:46 AM
Hello,
Thanks very much for your answer. So, if I understand, I have to add a proxy in my apache (I work with a tomcat apache) and eclipse. I program in java. So I create a proxy of my choice. Then what have I to change in my dynamic web java project? And next I just to add the proxy in my browser?
Thx by advance,
Laura
... View more
08-07-2012
05:17 AM
1 Karma
Hello,
I try to use sdk javascript client side so I've splunk on my host where I add the app JSON2 and I have my project on eclipse where I copy the folder client and jquery.min.js. I want to connect to my local splunk so I have test this:
<html>
<head>
<meta charset="utf-8">
<title>How to start a Splunk session</title>
<script type="text/javascript" src="scripts/jquery.min.js"></script>
<script type="text/javascript" src="scripts/client/splunk.js"></script>
<script type="text/javascript" charset="utf-8">
function displayApps() {
var http = new splunkjs.ProxyHttp("/proxy");
// Create a Service instance and log in
var service = new splunkjs.Service(http, {
username: "admin",
password: "admin",
scheme: "https",
host: "localhost",
port: "8089"
});
// Print installed apps to the console to verify login
service.apps().fetch(function(err, apps) {
if (err) {
alert("Error listing apps");
return;
}
var myapps = "";
var appsList = apps.list();
for(var i = 0; i < appsList.length; i++) {
myapps += "App " + i + ": " + appsList[i].name + "<br/>"
}
document.getElementById("applist").innerHTML=myapps;
});
}
</script>
</head>
<body>
<button type="button" onclick="displayApps()">Log in and list apps</button>
<p id="applist"></p>
</body>
</html>
But I've the alert "Error listing apps" and the error is :
"NetworkError: 404 Introuvable - http://localhost:8080/proxy/services/json/v2/services/auth/login?";
login?
POST http://localhost:8080/proxy/services/json/v2/services/auth/login?
404 Introuvable
And it's say that it's in jquery.min.js that there is the error and I do'nt know why is localhost:8080 and not 8089?????
Thx by advance if you know where is come from the error.
Laura,
... View more
08-03-2012
02:44 AM
Hello,
Thanks very much for your answer. I see that there are this app but I don't able to start node.js because when I try to launch it, it say "did you forget to run 'npm install?' but I download node.js which include the module npm so I don't able to say why it doesn't work.
I want to see pie chart of column chart in my web page.
Thx by advance if you know where is the problem.
Laura
... View more
08-03-2012
02:39 AM
Hello,
I have a question about the port and indexes access. I want to konw if it is possible to control index or port access. For example, I want only the users with the admin role can access to the index "_test" that I have create, how can do it????
Thx by advance,
Laura
... View more
08-02-2012
06:15 AM
hello,
I want to use SDK javascript. I installed splunk in local. Now I tried to connect to my local splunk with the sdk, it's work very well. I have a list of my search's results... Now I want to have chart in my web page so I try to use SDK javascript. I test this html page:
<script type="text/javascript" src="scripts/jquery.min.js"></script>
<script type="text/javascript" src="scripts/client/splunk.js"></script>
<script type="text/javascript" charset="utf-8">
var service = new splunkjs.Service({username: "admin", password: "admin"});
service.login(function(err, success) {
if (err) {
console.log("erreur");
throw err;
}
console.log("Login was successful: " + success);
service.jobs().fetch(function(err, jobs) {
var list = jobs.list();
for(var i = 0; i < list.length; i++) {
console.log("Job " + i + ": " + list[i].sid);
}
});
});
</script>
<html>
<head>OK</head>
</html>
I have a problem because in my project the splunk.js and several javascripts files indicates error but I just copy and paste folder client and jquery.js from the sdk javascript that I download. My html page indicate just OK when I launch it in my browser and no error appear in my log console of my browser but if the connection works, I have to have the message "Login was successful" else "erreur" but I have nothing. Where does it come from???
Thx by advance,
Laura
... View more
07-30-2012
01:32 AM
1 Karma
I resolve my problem: this my actually search:
source="Laura_ACS" earliest=-15m latest=now| bucket _time span=5m | eventstats count as "totalVE" by _time| eventstats count(eval(SD_STAT_PA="N")) as "totalVENO" by _time|eval percent=(totalVENO/totalVE)*100 |stats values(totalVENO) AS COMPTEUR, values(percent) AS TAUX by _time |search TAUX=100
... View more
07-30-2012
12:47 AM
Hello,
I have this following search:
source="Laura_ACS" earliest=-15m latest=now| eventstats count as "totalVE"| eventstats count(eval(STAT_VE="N")) as "totalVENO"|eval percent=(totalVENO/totalVE)*100 | stats values(totalVENO) AS COMPTEUR, values(percent) AS TAUX|search TAUX=100
I want to calculate this search every 5min for the last 15min. How can I do it?
Thx by advance,
Laura
... View more
- Tags:
- search
07-27-2012
05:13 AM
transaction is an answer but I don't know how can I apply this on my search because I have several subsearches. I want to calculate the taux for all the range time.
Thx by advance,
Laura
... View more
07-27-2012
01:28 AM
Hello,
I test this but I have a problem because I have to apply the span on all my search :
-eventstats count as "totalVE"
-eventstats count(eval(STAT_VE="N")) as "totalVENO"
-stats values(totalVENO) AS COMPTEUR, values(percent) AS TAUX
But I don't know how can do it.
Thanks by advance,
Laura
... View more
07-26-2012
10:47 AM
Thx very much. I test this tomorrow and I return my search as soon as I have good results.
... View more
07-26-2012
08:26 AM
Hello,
I have this following search:
source="Laura_ACS"| eventstats count as "totalVE"| eventstats count(eval(STAT_VE="N")) as "totalVENO"|eval percent=(totalVENO/totalVE)*100 | stats values(totalVENO) AS COMPTEUR, values(percent) AS TAUX|search TAUX=100
I want to calculate the "TAUX" for the last 15 min but I want to have a result with a span of 5 min and launch an alert if there are more than 2 results. That means that the TAUX equals 100 twice during the last 15 minutes. How can I apply this span of 5min in my search?
Thanks by advance,
Laura
... View more
- Tags:
- span
07-04-2012
06:21 AM
hello,
I have this following log in Splunk:
RS:D2T,PAN:1/1,Req:fr18126,User:a169805,TKN:g00e29dfd883effecba,H:W60080,SN:UTKBENCH,RC:000,TIME:180ms
I create a field RC which correspond and now I want to associate to each value of RC a value in splunk. For example I want to say where RC=000 the value is "ok". I know that I can add in my search "eval serieRC=case("RC=000,"ok",...)" but there are a lot of values and if there are a new value later, I have to modify all my search which take account this field to associate a new value. So I want to know if there is an other solution to this problem. I saw that there is "field transformation" but I don't understand very well how associate a value X to a value Y which is in the log for the field "RC".
Thanks by advance to your help.
Laura
... View more
- Tags:
- field-extraction
06-27-2012
02:04 AM
No, I want to count the total lines that my search returns, not indivduals raw events.
... View more
06-27-2012
01:30 AM
hello,
This is my search:
source=tcp:5555 PURCH_DAY=06-14 PURCH_DATE=19 PURCH_MIN>44 | stats count by ID_CARDHOLDER| sort - count | where count>=5|rangemap field=count severe=10-50 elevated=3-9 default=low
My problem is that I don't able to count the number of lines that my search returns. I want to apply my rangemap on the number of lines but I don't know how I can do it because I try count(_raw) but I don't use it correctly I think.
Thx by advance,
Laura
... View more
- Tags:
- count
06-25-2012
01:13 AM
Thx very much for your answer. I create a view following yours links. I have a problem when I go on the link. The error is:Splunk cannot find the "dashboard" view.This page was linked to from http://odpc:8000/en-US/app/ACS/ACS_alertes.
This is my xml file :
result
source=tcp:5555 PCH_D=06-14 PCH_DT=19|stats count
range
... View more
06-24-2012
02:19 PM
Thx very much to yours answers but if I have several lines of results, my single in my xml doesn't work, no????
... View more
06-24-2012
02:15 PM
Thx for your answer. I don't understand very well how have I to do to convert my dashboard because I don't have url in my xml file.
<?xml version='1.0' encoding='utf-8'?>
UVB : Error Codes
...
my search
Host: tpw.fr
-7d
VE YES:
range
count
... View more
06-24-2012
04:21 AM
Hello,
I create a form with "single" but we can't see the results of the search button. How can do it to have a link "view result".
Thanks by advance for your answer.
This is a part of my xml file:
<form>
...
<searchString>source=tcp:5555 PURCH_DAY=06-14 PURCH_DATE=19 PA_HOST="|tpwacs01v.priv.atos.fr" SD_STAT_PA="YES" | stats count | rangemap field=count severe=0-0 elevated=1-40 default=low</searchString>
<title>Host: tpwacs01v.priv.atos.fr</title>
<earliestTime>-7d</earliestTime>
<option name="beforeLabel">PA YES : </option>
<option name="classField">range</option>
<option name="field">count</option>
</single>
</row>
...
</form>
... View more
- Tags:
- view
06-24-2012
04:18 AM
Hello,
I have a question about rangemap. I want to create a search which allow to have the number of events by a field D_IPADD that I create and apply a rangemap. Red when there are more than 10
D_IPADD where count>10 and yellow where 10>count>5 but I don't know I can do it. I also want to see on the button the number of IP_ADRESS where count>10 for example. Actually my search allows to apply colors when at least one D_IPADD has more than 5 events or 10 and see the number of event but it isn't that I want.
Thanks by advance to your help.
<searchString>source=tcp:5555 PURCH_DAY=06-14 PURCH_DATE=19 |top 1 D_IPADD| rangemap field=count elevated=5-10 severe=10-100 default=low</searchString>
<title>Monitoring IP adresses : more than 10 appearances</title>
<earliestTime>-7d</earliestTime>
<option name="beforeLabel">NB Transactions : </option>
<option name="classField">range</option>
<option name="field">count</option>
</single>
... View more
- Tags:
- rangemap
