Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About vikram1583
vikram1583
Explorer
Member since:
02-13-2019
05-16-2022
Community Statistics
| Posts | 70 |
| Solutions | 0 |
| Karma Given | 0 |
| Karma Received | 1 |
| Member Since | 02-13-2019 |
Activity Feed
- Posted How to remove [] in Json format data? on Splunk Search. 05-16-2022 09:39 AM
- Posted Microsoft Azure Add on for Splunk pulling only 1000 records on Getting Data In. 04-29-2022 12:48 PM
- Posted Re: How to exclude duplicate Data while onboaring the data in below scenerio on Getting Data In. 04-21-2021 08:16 AM
- Posted Re: How to exclude duplicate Data while onboaring the data in below scenerio on Getting Data In. 04-21-2021 08:14 AM
- Posted How to exclude duplicate Data while onboaring the data in below scenerio on Getting Data In. 04-20-2021 11:57 PM
- Posted Re: how to convert date field to days on Splunk Search. 02-03-2021 01:59 PM
- Posted Re: how to convert date field to days on Splunk Search. 02-03-2021 01:53 PM
- Posted Re: how to convert date field to days on Splunk Search. 02-03-2021 01:47 PM
- Posted how to convert date field to days on Splunk Search. 02-03-2021 12:53 PM
- Posted Re: Need help for below scenario on Splunk Enterprise. 12-09-2020 07:55 AM
- Posted Need help for below scenario on Splunk Enterprise. 12-07-2020 11:55 PM
- Posted Splunk addon configuration for heavy forwarder HA on Splunk Enterprise. 11-06-2020 01:50 PM
- Posted Need results exact URL mentioned in macros on Splunk Search. 09-22-2020 12:00 PM
- Got Karma for Splunk Enterprise security. 06-05-2020 12:51 AM
- Posted can some explain this search please on Splunk Enterprise Security. 04-16-2020 02:04 PM
- Tagged can some explain this search please on Splunk Enterprise Security. 04-16-2020 02:04 PM
- Posted Can some one help in writing searches for below scenerio in Enterprise security on Splunk Enterprise Security. 04-08-2020 09:31 AM
- Tagged Can some one help in writing searches for below scenerio in Enterprise security on Splunk Enterprise Security. 04-08-2020 09:31 AM
- Posted can some one help me with SPL on Splunk Search. 04-06-2020 11:06 AM
- Tagged can some one help me with SPL on Splunk Search. 04-06-2020 11:06 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
05-16-2022
09:39 AM
I have a field properties.policies in json format
field value: [{"fieldname":"fieldvalue","fieldname":"fieldvalue","fieldname":"fieldvalue",[priview] "fieldname":"fieldvalue",[]}]
i want to remove first and last [] so that other fields can populate
can some one send me the rex please ?
Thanks in advance
... View more
04-29-2022
12:48 PM
I am pulling Azure billing Subscriptions data from Microsoft Azure Add on for Splunk it is only pulling 1000 records per interval(7200) and some time not getting any data Can some one help on this? Thanks in advance
... View more
- Tags:
- azure billing
Labels
- Labels:
-
heavy forwarder
04-21-2021
08:16 AM
data will be same for previous dates it just adds new data for current date
... View more
04-21-2021
08:14 AM
Hi @venkatasri thanks for your response. its not about only 2 files i will run that script every day if i inject those files everyday license usage will increase so i just want to inject new data
... View more
04-20-2021
11:57 PM
I have a python script with runs daily and saves output in csv file for example: if i run that script today it will get the data from april 1st to today date(04/21/2021) and if i run tomorrow it will get the data from april 1st to tomorrow date (04/22/2021) and with different file name every time we run i want to onboard this data into splunk with out duplicate data how can we do that? we have a field name called start_time this field we are taking as time field for example: start_time field value = 04/21/2021 10.30 example: start_time field value = 04/22/2021 10.30 Thanks in advance
... View more
Labels
- Labels:
-
inputs.conf
02-03-2021
01:59 PM
@bowesmana worked now but i am getting results like 0.1068998 and 2.765478 like this i just want days need to remove after .
... View more
02-03-2021
01:53 PM
@bowesmana sorry i am getting this error : error in eval command the arguments to the striptime function are invalid
... View more
02-03-2021
01:47 PM
@bowesmana in my case i have a field name : First Date so in that field i have "2021-01-29 00:25:58.913024+00" so i used | makeresults
| eval date="First Date"
| eval dz=strptime(date, "%F %H:%M:%S.%6N%:::z")
| eval days=(now()-dz)/86400 i am getting eval command the 'striptime' function is unsopperted or undifined
... View more
02-03-2021
12:53 PM
i have a date field like this 2021-01-29 00:25:58.913024+00 i want to convert this just date as days field using now() when i run the command Thanks in advance
... View more
- Tags:
- splunk
Labels
- Labels:
-
Other
12-07-2020
11:55 PM
we have a server A Linux box (HF) (AWS cloud ) this server is a primary server i copied conf files in LOCAL folder to S3 bucket through python script ,and scheduled a job daily to copy files ,now i need to copy the same configuration files to server B (HF) (AWS cloud ) this server is a DR server Scenario: if some thing happened to primary server we need to copy config files in S3 bucket and paste in DR server local folder and should restart Splunk this should be done in automation way can some one help best way to do it?? Thanks in advance
... View more
- Tags:
- splunk
Labels
- Labels:
-
Other
11-06-2020
01:50 PM
I am trying to configure AWS addon and SNOW TA for heavy forwarder HA, is there any better way in Splunk to configure synchronize xxxxxxxx0003 has the SNOW TA and xxxxxxxx0004 has the AWS TA xxxxxxx0002 has SNOW TA which needs to synchronize to xxxxxx0003 xxxxx0001 has AWS TA and needs to synchronize to xxxxxx0004 Thanks In Advance
... View more
Labels
09-22-2020
12:00 PM
i am using macros for this urls here i have urls like /accountinformationview /AccountInformationView /emailsubscription /EmailSubscription /logoff /Logoff in macros i am using only URL=/AccountInformationView OR URL=/EmailSubscription like this but i am getting both the URL i tried URL="/EmailSubscription" like this still same results how can i get exact URL mentioned in the macros
... View more
04-16-2020
02:04 PM
my search |eval _time= strftime(_time, "%Y-%m-%d")|stats latest(AssetRiskScore) as score by _time AssetNames | sort 0 - _time
| dedup 2 AssetNames | reverse
| streamstats current=f last(score) AS prev_score BY AssetNames
| eval change = score - prev_score
... View more
04-08-2020
09:31 AM
Hello all,
In Enterprise Security I need to write searches for below scenario can some help in writing this?
1.Search that shows hosts that have had more and more vulnerabilities over three months. The intent is to find servers that have never been patched
a.There should actually be 2 searches, one for workstations and one for servers
2.Incorporate software versions from Rapid7 and show vulnerabilities per version. This should then allow for a way to view the servers that are associated with these most vulnerable software versions
a.There should actually be 2 searches, one for workstations and one for servers
Thanks in advance
... View more
04-06-2020
11:06 AM
index= xxxxxx sourcetype=xxxxxx
| eval import_time=strftime(_time, "%Y-%m-%d:%H")
| eval import_timeday=strftime(_time, "%Y-%m-%d")
| eventstats latest(import_time) as Last by import_timeday
| where Last = import_time
| timechart count by Product
with this search the output seems to be hourly instead of daily
Can some one help in sending SPL to see results daily
Thanks in advance
... View more
03-18-2020
01:26 PM
1 Karma
in my Splunk ES i want to find below search
Count of New Notables created in last 30 days
Count of Modified Correlation Searches in last 30 days
Time of Notable Closure
Can some one help in sending search please..
Thanks in advance
... View more
03-16-2020
02:19 PM
search 1...|table src_ip
search 2: tag=authentication user!=*$ src_ip=xx.xx.xx.xx
| head 1
| table user src_ip
from search 1 result i need to find user so i have search 2 to find that but i want to show both results in one search i tried like this
search1....| table src_ip | join type=left src_ip [|search tag=authentication user!=*$ src_ip=$src_ip$ | head 1
| table user src_ip
but not able to find result can some one help
... View more
03-04-2020
05:16 PM
Hi,
i have an event having white spaces in between i want to trim it
the data is coming from db connect i don't have access so i need o done it in search head
Can some one help me in fixing this
... View more
03-03-2020
08:24 PM
Hi,
I'm trying to get the results based on recent field value. How to filter the events with the most recent scan date for all ip's?
scan_date field values
03-01
02-22
... View more
03-03-2020
03:33 PM
i Have 2 source types each source type having asset_id field i want a search to display same asset_id that is in both source types
from that results i want to display nexpose_tag field for that asset_id from second source type
... View more
03-01-2020
11:33 PM
how might i incorporate regex into a like eval element in a search like this. This syntax does not work
| eval product=case((signature LIKE "%Cipher%") OR (signature LIKE "%SMBv2 signing%") OR (signature LIKE "%Diffie-Hellman%") OR
(signature LIKE "%Weak Cryptographic%") OR (signature LIKE "%SHA-%") OR (signature LIKE "%SWEET32%") OR (signature LIKE "%TLS/SSL%") OR
(signature LIKE "%Certificate Is Invalid%") OR (signature LIKE "%protocol%"), "Cipher/Protocol/Cert",
signature LIKE "%Java%", "Java",
signature LIKE regex="[M][S][0-9][0-9][-][0-9][0-9][0-9]", "test",
signature LIKE "%Apache%", "Apache",
signature LIKE "%Apple%", "Apple",
signature LIKE "%Cisco%", "Cisco",
| search product=test
| dedup signature
| table signature product
... View more
- Tags:
- splunk-enterprise
03-01-2020
05:24 PM
in my event i want to extract TLD's
i want to extract:
com
news
tech
net
org
please help me with rex?
thanks in advance
... View more
- Tags:
- rex
- splunk-enterprise
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
05-16-2022
05:56 PM
|
