×

Join the Conversation

Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Ask a Question
k909
Engager
Member since: ‎05-15-2012
‎08-06-2024
Community Statistics
Posts 6
Solutions 0
Karma Given 1
Karma Received 0
Member Since ‎05-15-2012
Activity Feed
View All

Re: How to use a list of whitelist mac addresses t...

by in Splunk Search
‎04-20-2017 11:22 PM
‎04-20-2017 11:22 PM
Thank you ... View more

Re: How to use a list of whitelist mac addresses t...

by in Splunk Search
‎04-20-2017 12:41 AM
‎04-20-2017 12:41 AM
screenshot from dropl not work http://d.pr/i/rn4B http://d.pr/i/Oo6z ... View more

Re: How to use a list of whitelist mac addresses t...

by in Splunk Search
‎04-20-2017 12:40 AM
‎04-20-2017 12:40 AM
try to configure lookup table firstly but result - bad, not use lookup table where i am wrong? cat whitelist_mac.csv whl_mac 00:80:9f 44:8a:5b 68:f7:28 78:24:af index="cp" DHCPREQUEST | eval mac=substr(request_mac,1,8) | search NOT [inputlookup whitelist_mac | table whl_mac ] | top limit=20 mac mac count percent 00:80:9f 2606 44.615648 44:8a:5b 1424 24.379387 9c:1c:12 494 8.457456 ... View more

How to use a list of whitelist mac addresses to fi...

by in Splunk Search
‎04-19-2017 12:05 AM
‎04-19-2017 12:05 AM
Hello, for control dhcp server, need to search "bad" mac addresses, but use whitelist . And need modify search string for add new mac. how use list of whitelist mac addresses to find these "bad" mac addresses? index="cp" DHCPREQUEST | eval mac=substr(request_mac,1,8) | search NOT mac="00:80:9f" | search NOT mac="44:8a:5b" | top limit=20 mac ... View more

Re: How to import CPU load from Check Point logs?

by in Monitoring Splunk
‎12-09-2016 01:57 AM
‎12-09-2016 01:57 AM
Hi, Thanks for answer, but space delimeter not help. try to change props.conf [cpu_61k_csv] FIELDS = Average,CPU,user,nice,sys,iowait,irq,soft,steal,idle,intr/s DELIMS = " " But space delimeter its different, it depend from value from row ... View more

How to import CPU load from Check Point logs?

by in Monitoring Splunk
‎12-07-2016 11:28 PM
‎12-07-2016 11:28 PM
Hi all, we're trying to import archive logs from checkpoint (gaia). In one archive it includes many hardware params. Each file has a unix timestamp (cpu_load.1480888800) 866 each day cut cpu_load.1480888800 Average: CPU %user %nice %sys %iowait %irq %soft %steal %idle intr/s Average: all 0.54 0.00 0.47 0.08 0.02 1.13 0.00 97.75 18997.50 Average: 0 4.00 0.00 2.90 3.00 0.10 3.20 0.00 86.80 1060.80 Average: 1 0.10 0.00 0.40 0.00 0.00 0.80 0.00 98.80 0.00 Average: 12 0.30 0.00 0.00 0.00 0.10 0.50 0.00 99.20 637.00 Average: 39 0.10 0.00 0.60 0.00 0.10 1.10 0.00 98.10 1267.90 How import cpu load for each core? ... View more
Contact Me
Online Status
Offline
Date Last Visited
‎08-06-2024 07:25 AM
Karma given to
View All