Trying to create a sparkline from data in a lookup table monitorusertraffic.csv has fields -user -trafficdestip -app -bytes_out -time when I run | inputlookup monitorusertraffic.csv | eval time=time | stats sum(bytesout) sparkline(sum(bytesout),1d) as datatrend by user trafficdestip app I get a value for "sum(bytesout)" but nothing under "sparkline(sum(bytesout),1d) as data_trend" Is there some sort of magical way that I need to alert my data for Splunk to be able to create a sparkline? ... View more

Lots of custom commands come with Splunk. 31 in the search app alone. I often see all of those commands and wonder if there is anything that I could be using. Since I am not an admin on the system, I can't just look at the code to find out. Is there a place that documents what these commands do and what sort of arguments they expect? ... View more

I have enabled the Network_Traffic data model with acceleration going back 32 days. After a recent Splunk upgrade to Splunk: 7.2.6 Splunk ES: 5.2.2 I noticed that my Network Traffic data model count volumes dropped off after going back about 2 weeks, despite an acceleration status of 100% complete. Found that by setting allowoldsummaries=t I could get all of the data. Tried re-indexing the data model. It seemed to pick up data further back, but still not all of it. I can check the model with this: | tstats summariesonly=t allow_old_summaries=t count as DMcountWithOld from datamodel=Network_Traffic.All_Traffic by span=1d _time | append [tstats summariesonly=t count as DMcountNoOld from datamodel=Network_Traffic.All_Traffic by span=1d _time ] | timechart span=1d sum(DMcountWithOld) as DMcountWithOld sum(DMcountNoOld) as DMcountNoOld and I still see results diverge starting about 2 weeks back Any ideas on why the data model acceleration fizzled out? If it matters, ES is on a 6 search head cluster ... View more

Palo Alto traffic logs include start and end events. Sometimes multiple start events. Since all traffic logs get the tags "network" and "communicate", they all get mapped to the Network_Traffic datamodel This is problematic for a couple of reasons: The number of events is inaccurate (at least 2x the actual number of events, but sometimes more) This is made worse if we had an additional source that logged Netflow (with only one event per connection) Traffic summaries are inaccurate: If I try to find allowed traffic, I will find some traffic that was actually blocked. this is because the start event may be allowed when the end event is blocked. If I try to summarize on durations or bytes, I get values at each start and end added into my totals It seems to me that these could be corrected by only mapping the PAN end event to the Network Traffic datamodel. I guess that I am looking for feedback on the best way to do this. And what the drawbacks to doing so might be. If it matters, I am using Splunk Enterprise Security, but mostly do my own correlations of Network Traffic in the search app. My thoughts on how to do it: -add the "end" tag to NetworkTraffic --if I do this then any other source with events to map to Network Traffic would also need to add the "end" tag. Seems unintuitive -remove "communicate" from the PAN traffic "start" events --not really sure what this might do -add an additional tag to the PAN traffic "end" events ("traffic"?) --add this to the NetworkTraffic defn --modify all sources that map to Network Traffic to include the "traffic" tag. I guess this is more intuitive than the first option. Any other ideas or thoughts? ... View more