Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About Sarmbrister
Sarmbrister
Path Finder
Member since:
01-30-2015
06-05-2020
Community Statistics
| Posts | 21 |
| Solutions | 1 |
| Karma Given | 3 |
| Karma Received | 3 |
| Member Since | 01-30-2015 |
Activity Feed
- Karma Re: How to edit my search that looks over the last 7 days but displays each day? for somesoni2. 06-05-2020 12:49 AM
- Got Karma for Re: How to edit my search that looks over the last 7 days but displays each day?. 06-05-2020 12:49 AM
- Karma Re: How to search the count of all values for a field, and also display all the values in the results? for richgalloway. 06-05-2020 12:48 AM
- Karma Re: Why am I unable to view logs after a Splunk restart? for MuS. 06-05-2020 12:47 AM
- Got Karma for Re: How do I set up Splunk Enterprise Linux to ingest Windows logs that are not part of the universal forwarder install?. 06-05-2020 12:47 AM
- Got Karma for Re: Monitor evtx log. 06-05-2020 12:46 AM
- Posted Re: Is there a way to create a hyperlink in a stats table to an external site? on Splunk Search. 08-11-2017 12:13 PM
- Posted Re: Create a variable that combines two string values on Splunk Search. 08-11-2017 09:55 AM
- Posted Is there a way to create a hyperlink in a stats table to an external site? on Splunk Search. 08-11-2017 09:51 AM
- Tagged Is there a way to create a hyperlink in a stats table to an external site? on Splunk Search. 08-11-2017 09:51 AM
- Tagged Is there a way to create a hyperlink in a stats table to an external site? on Splunk Search. 08-11-2017 09:51 AM
- Tagged Is there a way to create a hyperlink in a stats table to an external site? on Splunk Search. 08-11-2017 09:51 AM
- Posted Re: How to edit my search that looks over the last 7 days but displays each day? on Splunk Search. 07-31-2017 09:34 AM
- Posted How to edit my search that looks over the last 7 days but displays each day? on Splunk Search. 07-28-2017 12:14 PM
- Tagged How to edit my search that looks over the last 7 days but displays each day? on Splunk Search. 07-28-2017 12:14 PM
- Tagged How to edit my search that looks over the last 7 days but displays each day? on Splunk Search. 07-28-2017 12:14 PM
- Tagged How to edit my search that looks over the last 7 days but displays each day? on Splunk Search. 07-28-2017 12:14 PM
- Posted Re: Cisco eStreamer for Splunk: Is there any listing or definitions of what the "rec_type_simple" fields mean? on All Apps and Add-ons. 03-28-2017 01:15 PM
- Posted Re: For the upcoming leap second at the end of 2016, will there be issues with any of the Splunk versions running in my environment? on Deployment Architecture. 01-03-2017 12:58 PM
- Posted Re: Why is saved search not found for dashboard panel? on Dashboards & Visualizations. 11-10-2016 11:09 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
08-11-2017
12:13 PM
This is great! Thank you @niketnilay.
... View more
08-11-2017
09:55 AM
Would an eval expression work in this case?
Example
search... | eval new_variable=foo. "" .bar
... View more
08-11-2017
09:51 AM
I am currently working on a Splunk query to look at Windows Defender data that has been allowed in the environment. I am using an evalto combine two fields which creates the URL to the Windows Defender Security Intelligence page. What I'd like to do is to make that result in the field a hyper link so all I have to do is click it and it directs me to the Windows Defender Security site. In my results example below I'd like to make the results in field windeflink a hyperlink.
My Search Query:
index=sccm sourcetype="sccm:malware" action=allowed
|stats count by dest_name,severity,signature
|eval windeflinkpart="https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name="
|eval windeflink=(windeflinkpart. "" .signature)
|table dest_name,severity,signature,count,windeflink
|sort severity
Results Example:
dest_name severity signature count windeflink
Severe 8 https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=
... View more
07-31-2017
09:34 AM
1 Karma
This is great thank you! I just added in an eval in there to get the duration but thank you for the help.
... View more
07-28-2017
12:14 PM
I have been asked by Legal to get login logoff time for colleagues with in certain time frames usually very specific weeks at a time. I have developed the below search to pull what I want but my issue is that I want to be able to search the last 7 days and show the login and logout per day. So I want a table to show like Monday user logged in at 8:03 AM and logged out at 4:15 PM then in the next row I want it to show log in logout time for Tuesday and goes on through out the week.
Search:
index=wineventlog user=user sourcetype="WinEventLog:Security" EventCode=4624 OR EventCode=4634 action=success
|convert ctime(_time) AS time
|stats earliest(eval(if(EventCode=4624, time, null()))) AS Logon ,latest(eval(if(EventCode=4634, time, null()))) AS Logoff by user
How I want it to look
User Logon Logoff
User account 07/28/2017 08:04:48 07/28/2017 15:59:30
User account 07/27/2017 08:04:48 07/27/2017 15:59:30
User account 07/26/2017 08:04:48 07/26/2017 15:59:30
User account 07/25/2017 08:04:48 07/25/2017 15:59:30
User account 07/24/2017 08:04:48 07/24/2017 15:59:30
User account 07/23/2017 08:04:48 07/23/2017 15:59:30
... View more
03-28-2017
01:15 PM
Were you able to gather any other information on the rec_type_simple fields?
... View more
01-03-2017
12:58 PM
My Universal Forwarders started eating up CPU after the leap second. I'm still working on it but the below link should help out. The second step is running that script on the sever. I'll be working on this with the system admins to confirm that it works. If it does I'll update you. Hope this helps out.
https://answers.splunk.com/answers/52109/universal-forwarder-high-cpu-after-leap-second-correction.html
... View more
11-10-2016
11:09 AM
Have you checked the xml? I am currently having this same issue and saw that the xml is missing. I have no idea how it got deleted but without that I don't think the search will be able to run. Hope this helps.
your search query
... View more
10-24-2016
11:29 AM
When you say "count number of rows present" do you mean the number of rows in a static table? If I'm understanding what you want is the count of rows in a table and the static table in an alert.
... View more
10-24-2016
11:21 AM
I know this is an old post, but I created the below search query below. Should work for anyone looking for their average over the past 7 days. It's a big ugly search and I'm sure there is a way to simply this or to heavily utilize eval but this is what I ended up with. Hope it helps everyone.
index=_internal source=*license_usage.log type=usage
| eval GB = b/1024/1024/1024
| timechart span=1d sum(GB) by pool
| eval Time=strftime(_time, "%m/%d/%Y")
| fieldformat auto_generated_pool_enterprise=tostring(auto_generated_pool_enterprise, "commas"). " GB"
| fields - _time
| addcoltotals auto_generated_pool_enterprise label=Total labelfield=weeklytotal
| fields Time,auto_generated_pool_enterprise, weeklytotal
| search weeklytotal=Total auto_generated_pool_enterprise>1*GB
| eval weekly_average=(auto_generated_pool_enterprise/7)
|eval Total_weekly_average=round(weekly_average,2)
| table Total_weekly_average
| rename Total_weekly_average AS "Average over the past 7 days"
... View more
11-11-2015
08:26 AM
1 Karma
I am dealing with the same issue. One of two things might work for this.
1. When you run a search use this rex command. index= | rex mode=sed "s/\\x..//g" (This will remove all of the null data or anything that has \x and any two characters after it.
2. If you are continuing to index from the source then set up a transforms.conf file and set up the props.conf. regex to use s/\\x..//g
I set up the transforms.conf file and am currently waiting on data to flow through to determine if it is working.
Transforms.conf: http://docs.splunk.com/Documentation/Splunk/6.1/admin/Transformsconf
Props.conf: http://docs.splunk.com/Documentation/Splunk/latest/admin/Propsconf
Hope this helps.
... View more
09-22-2015
05:23 PM
I have been dealing with this same issue for a long time I think i figured out the issue. Since it is windows event logs and they are in binary Splunk might not know how to bring them in unless they are part of the wineventlog configs or the data needs to be in plain text. I am currently working on a script to put the data into plain text then have splunk read that file then delete the plain text file after splunk pulls the data. If successful I'll let you know.
... View more
09-21-2015
01:31 PM
is this the 5th time this month you have received this message? If so splunk doesn't stop indexing the data it just doesnt allow you to search any more for that day.
... View more
09-20-2015
12:35 PM
Are you being prompted to log in after trying to run the command?
I just had this same issue in the admin training course but I am not sure if the same fix would work here. But if you want to try it.
1. stop splunk on the deployment server
2. backup passwd file in etc to passwd.save
3. start splunk
4. cd to etc check that a new passwd file has been created (this has reset the admin password back to changeme)
5. stop splunk again
6. vi passwd.save copy everything but the admin line (top line in my instance)
7. vi passwd paste the data underneath the top line.
8. start splunk.
NOTE: DO NOT DELETE THE PASSWD.SAVE FILE UNLESS THIS CORRECTS THE ISSUE AND ALL USERS ARE ABLE TO LOG IN WITH NO ISSUES.
I had to change my admin password in the Splunk web ui after this.
if this does not work remove the newly created passwd file and change the passwd.save back to just passwd and system will be back to normal.
Good Luck I hope this helps. Like I said I had this in my admin training course so I don't know if this will apply to you.
... View more
09-16-2015
02:00 PM
Worked like a charm! Thanks again Captain.
... View more
09-16-2015
01:59 PM
I am currently having this same issue. Were you able to solve the problem? I have changed my CHARSET=UTF-16LE on my UF and no luck. Really looking for an answer on this one.
... View more
09-16-2015
01:41 PM
After you began to index your evtx file did you data come in clean? I am currently having this issue and the data is coming across null for me. I can't figure out how to fix it.
... View more
08-21-2015
09:28 AM
After talking with a Splunk engineer he was able to answer my question that the ./splunk splunkd-port 8089 will change the port number for the UF to the Deployment server. I was also able to find some great documentation on another Splunk question for any other users who might be having issues with Port information! Hope this helps anyone else.
... View more
08-19-2015
01:46 PM
1 Karma
Apologize for the late response but that is the BEST answer ever purely for the pirate lingo lol. I have visited this and everything looks like it has been configured right I think part of the issue is that the UF on the windows server is configured for port 9997 instead of 8089. Also I have training in a few weeks and will be at the splunk .conf2015 getting my admin cert so will no longer be a newbie floating in the water but captaining my own ship :D. Thanks again will let you know how everything works out.
... View more
08-19-2015
01:40 PM
I currently am having issues collect logs from a windows server that has the UF. I think the issue might be that the port is incorrectly configured on the UF to talk with 9997 instead of 8089. If I run the command ./splunk splunkd-port 8089 will that change the UF's port from 9997 to 8089?
... View more
07-08-2015
01:15 PM
I am new to Splunk. The main admin left a few months ago and I have taken over with little to no training. A colleague wants to ingest Windows Event Lync service logs and I have no idea how to get it to work, but he has installed the universal forwarder. Can some one help me out? I have read the documents on inputs.conf and still having issues. Need help fellow Splunkers!
Thanks in advance.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:04 AM
|
