Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- Find Answers
- :
- About kenntun
kenntun
Engager
Member since:
01-06-2019
06-05-2020
Community Statistics
| Posts | 13 |
| Solutions | 0 |
| Karma Given | 1 |
| Karma Received | 0 |
| Member Since | 01-06-2019 |
Activity Feed
- Karma Re: Can you help us create a query for CPU usage and top 10 processes? for DalJeanis. 06-05-2020 12:50 AM
- Posted Search syntax help on Splunk Search. 05-11-2020 12:20 AM
- Tagged Search syntax help on Splunk Search. 05-11-2020 12:20 AM
- Posted Re: Restore multiple frozenDB on Knowledge Management. 05-02-2019 07:18 AM
- Posted Restore multiple frozenDB on Knowledge Management. 05-02-2019 07:07 AM
- Tagged Restore multiple frozenDB on Knowledge Management. 05-02-2019 07:07 AM
- Posted Re: How do you add a blank row after each unique host in search results? on Splunk Search. 01-14-2019 01:39 AM
- Posted Re: How do you add a blank row after each unique host in search results? on Splunk Search. 01-14-2019 01:07 AM
- Posted Re: How do you add a blank row after each unique host in search results? on Splunk Search. 01-14-2019 12:56 AM
- Posted Re: How do you add a blank row after each unique host in search results? on Splunk Search. 01-13-2019 09:48 PM
- Posted How do you add a blank row after each unique host in search results? on Splunk Search. 01-13-2019 08:26 PM
- Tagged How do you add a blank row after each unique host in search results? on Splunk Search. 01-13-2019 08:26 PM
- Tagged How do you add a blank row after each unique host in search results? on Splunk Search. 01-13-2019 08:26 PM
- Posted Website Input: Cannot parse data with custom css selector for apache server-status page on All Apps and Add-ons. 01-09-2019 01:42 AM
- Tagged Website Input: Cannot parse data with custom css selector for apache server-status page on All Apps and Add-ons. 01-09-2019 01:42 AM
- Posted Custom Splunk_TA_apache for new access log format on Getting Data In. 01-08-2019 01:12 AM
- Tagged Custom Splunk_TA_apache for new access log format on Getting Data In. 01-08-2019 01:12 AM
- Tagged Custom Splunk_TA_apache for new access log format on Getting Data In. 01-08-2019 01:12 AM
- Tagged Custom Splunk_TA_apache for new access log format on Getting Data In. 01-08-2019 01:12 AM
- Tagged Custom Splunk_TA_apache for new access log format on Getting Data In. 01-08-2019 01:12 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
05-11-2020
02:13 AM
Since there are two different condition, there'll be 2 different SPL, in my opinion. Try these and see if they might help you. In the span part, you can specify the span as per your needs. I also hope that index=* was done for obfuscating the name of the index, if not, then please specify the name of the Index, when you run this search in your environment.
First SPL:
index=* source="/u01/testing.csv" sourcetype="365csv" | where NOT "Last Login"=NULL AND Disable="YES" | timechart span=1d count by region
Second SPL:
index=* source="/u01/testing.csv" sourcetype="365csv" | search "Last Login"=NULL AND Disable!="NO" | timechart span=1d count by region
... View more
01-14-2019
02:52 AM
Hi @kenntun ,
I have used above data as input and loaded it into Splunk. Below is one possible solution. I hope this solution can help you.
P.S.: I have used sorting on the basis of hostname and mount and accordingly.
| makeresults
| eval data="host1,x, , ;host2,x, , ;host3,x, , "
| makemv data delim=";"
| mvexpand data
| makemv data delim=","
| eval hostval=mvindex(data,0),mount=mvindex(data,1),Disksize=mvindex(data,2),Free=mvindex(data,3)
| table hostval,mount,Disksize,Free
| append
[search index=test source="C:\\Splunk_Data\\Test\\testdata_splunk.csv"
| dedup hostval,mount
| table hostval,mount,Disksize,Free
]
| sort hostval,mount
| eval hostval=if(mount="x","",hostval),mount=if(mount="x"," ",mount)
... View more
01-16-2019
12:00 PM
Could you be so kind to take a look at the logs and see what it says? Run the following search and let us know what kind of things you see:
index=_internal sourcetype=web_input_modular_input NOT (DEBUG OR INFO)
... View more
01-08-2019
01:12 AM
We have new apache access log and ssl access log format as follow:
ssl_access_log
test_server:18301 172.31.107.148 172.31.4.40 - - [08/Jan/2019:16:32:15 +0800] 2985 "GET /monitor/check.txt HTTP/1.1" 200 12 617 3011 "-" "check_http/v2.0.3 (nagios-plugins 2.0.3)" "-" "TLSv1.2" "ECDHE-RSA-AES256-GCM-SHA384"
access_log
test_server:18300 172.31.107.148 172.31.4.178 - - [08/Jan/2019:16:22:40 +0800] 2865 "GET /server-status HTTP/1.1" 200 16164 136 16451 "-" "libwww-perl/6.13" "-" "-" "-"
I would like know how to modifythe props.conf so that it can extract the correct fields. Our current configuration are as follow:
[apache:access:test_server]
category = Web
description = Access logs produced by Apache Web Server (test_server)
pulldown_type = true
SHOULD_LINEMERGE = false
KV_MODE = none
EXTRACT-apache_access= ^(?[^:]+):(?\d+)\s+(?[^ ]+)\s+(?\S+)\s+(?\S+)\s+\[(?\d+\/\w+\/\d+:\d+:\d+:\d+\s+[-+]\d+)\]\s+(?\d+)[^"\n]*"(?[^"]+)[^ \n]*\s+(?\d+)\s+(?\d+|[-])\s+\"(?[^"]+)\"\s+(?[^ ]+)\s+(?[^ ]+)\s*\"*(?[^"]+)\"*
EXTRACT-apache_request = (?\w*)\s+(?[^ ]*)\s+(?[^"]+)[^ \n]* in request
EXTRACT-source_filename = (?[^/]*)$ in source
EXTRACT-site = ^(?[^_]+)_access_(?[^_]+).log in source_filename
EVAL-bytes_in = 0
EVAL-bytes_out = 0
FIELDALIAS-bytes_in = request_bytes as bytes_in
FIELDALIAS-bytes_out = response_bytes as bytes_out
FIELDALIAS-src_ip = src as src_ip
FIELDALIAS-dest = host as dest
FIELDALIAS-http_referrer = http_referer as http_referrer
EVAL-site = ""
EVAL-web_server = host . ":" . site
EVAL-bytes = bytes_in+bytes_out
#EVAL-response_time = response_time_microseconds/1000
EVAL-response_time = response_time_milliseconds
EVAL-product = "Web Server"
EVAL-vendor = "Apache"
EVAL-vendor_product = "Apache Web Server"
EVAL-dest_ip = if(match(host,"\d+.\d+.\d+.\d+"), host, null())
LOOKUP-apache_httpstatus_lookup = apache_httpstatus_lookup status OUTPUT status_description status_type
... View more
01-08-2019
12:47 AM
I would like to create a dashboard that reads from the apache server-status page and displays the output for the following:
hits
bytes
busy
idle
Waiting for connection
starting up
Reading request
Sending reply
Keepalive
DNS_lookup
Logging
Gracefully finishing
Idle cleanup
Open slot
Any apps could help me read the output from the apache server-status page? How could I extract these information?
... View more
- Tags:
- apache
- server-status
01-08-2019
06:01 AM
Hi Kenntun!
Do you use linux? Maybe the analytics for linux app solve your problem? https://splunkbase.splunk.com/app/3777/
Greetings,
Jacob
... View more
01-07-2019
06:06 AM
1 Karma
1) Start by changing USEOTHER to true, so that you get the entire CPU usage. If you have dozens or hundreds of Commands, then the sum of the highest ten would not be expected to match the total.
2) To compare, you might want to bin the time span=1s and use avg(pct_cpu). CPU usage really only matters by host, so start by comparing these...
eventtype=nmon:performance type=TOP OStype="*" host="host2" Command=*
| bin _time span=1s
| stats avg(pct_CPU) AS pct_CPU by _time,host,Command,PID
| stats sum(pct_CPU) As pct_CPU by _time,host
| timechart span=15s avg(pct_CPU) AS pct_cpu
eventtype=nmon:performance type=CPU_ALL frameID=* host="host2"
| timechart span=15s avg(cpu_load_percent) AS cpu_load_percent
We've pulled out the "by key" and "by host" in the timecharts, so that the two timecharts can be appended together and get sensible results. If the above look reasonably similar, then you can step by step add back your code until you find the difference.
... View more
