About sshelly_splunk

sshelly_splunk · ‎06-15-2022

I'll do my best to make pseudo SPL here:) index="prod" source="mysource" | transaction startswith=(fieldname=start_field_value OR filename=alternate_start_field_value) endswith=(diff_fieldname=end_value OR diff_fieldname2=alternate_fieldvalue) |stats count You will need to encapsulate your search in "()". If you could share field names, values desired, that would help. I used an old eventgen data set and came up with the following. You can use this with your index(es), sourcetypes, etc. index=main | transaction clientip JSESSIONID startswith=(status=200 action=addtocart) endswith=(status=200 AND action=purchase) | stats count by host You can insert SPL into the "()" to define start and end. I would avoid using clear text search for any of the start/end filters though.

sshelly_splunk · ‎06-15-2022

I grabbed the Splunk tutorial data (from googling "splunk search tutorial") for this example. source="tutorialdata.zip:*" | transaction clientip JSESSIONID startswith=(action=addtocart) endswith=(action=purchase) Note - the syntax for the startswith and endswith keyword specifications/filters. A transaction is created for each unique pair of clientip and JSESSIONID with succesful add's to cart and purchase. Hope this helps.

sshelly_splunk · ‎06-14-2022

When you use "transaction", there is a field created called "eventcount" which shows how many events are in each transaction. You can look for max eventcount, stats count by, etc ....

sshelly_splunk · ‎08-23-2018

Your base search will be specific to your environment (i.e. Windows Event codes, ssh login messages, etc), but if you get your base search, you can than do something like: "yoursearch" | chart count over user by host Again, it will depend on your source data. If you give a bit more info (sourcetypes, etc), be happy to respond.

sshelly_splunk · ‎08-23-2018

You can rename sourcetypes as per: https://docs.splunk.com/Documentation/Splunk/7.1.2/Data/Renamesourcetypes. I usually approach this using a transforms to set sourcetype at ingest, though not positive that would be of most use to you. Is it possible to post sample events scrubbed of course:))?

sshelly_splunk · ‎06-04-2018

Use the following in props.conf for the sourcetype: "SHOULD_LINEMERGE = true BREAK_ONLY_BEFORE = Message()$" I tried w/your event data, and it worked for me.

sshelly_splunk · ‎01-03-2018

Sorry - a bit quick on the "submit" button:) In the UI, you can create the sourcetype. I used your single event, and this is what I came up with: Timestamp format %d-%b-%Y %H:%M:%S Timestamp prefix occured":" Under "Advanced" SEDCMD s/.+?{/{/ KV_MODE=json

sshelly_splunk · ‎01-03-2018

Sorry - a bit quick on the "submit" button:) In the UI, you can create the sourcetype. I used your single event, and this is what I came up with: Timestamp format %d-%b-%Y %H:%M:%S Timestamp prefix occured":" Under "Advanced" SEDCMD s/.+?{/{/ KV_MODE=json

sshelly_splunk · ‎01-02-2018

I would do something like the following: In your props.conf stanza defining sourcetype: #This should everything up to and including the first "{" with a "{" - I think SEDCMD=s/.+?{/{/ In transforms, something like the following. This will extract key/value pairs at search time for you. Also, make sure to set time_format correctly. [get_my_json_key_values] REGEX="(.+?)"."(.+?)" FORMAT=$1::$2

sshelly_splunk · ‎12-12-2017

DATETIME_CONFIG specifies how you want to extract timestamps at ingest time. When using DATETIME_CONFIG pointing to a file, BREAK_ONLY_BEFORE_DATE will not work (most likely) as expected. Can u put up a sample event ? I think specifically stating timestamp format will probably get you where you want to be.

sshelly_splunk · ‎12-12-2017

TIME_FORMAT = %a %b %d %H:%M:%S %Y TIME_PREFIX = ^M\s+ I don't know how you want to break your events though. Can u tell me the first/last line in an event??

sshelly_splunk · ‎11-29-2017

Can upload some anonymized data ? This would occur at the indexer or heavy forwarder via regex most likely. A sample log (with more than a few whitelist and blacklist) events should suffice.

sshelly_splunk · ‎11-20-2017

Time is a bit hairy if it's not set correctly when data starts coming in. If you have the appropriate TZ specified in props.conf for your host/sourcetype, than anything coming in from the point the change was made will be "correct". All time math inside of splunk is done in epoch time, and therefore if your data came in, and splunk thought it was in UTC, than they have timestamps for whatever that timestamp is (allowing for TZ) in epoch time. Local TZ specifies how you want the time to be displayed along the "Time" column in the events window. You can change your TZ and see how things change (the "Time" value will change, but the timestamp in the raw events will not. Sorrry to ramble a bit, but the way I approach it, if working with OS's set in different TZ's, I specify the correct TZ for hosts/sources based on whatever criteria I can align them with. Say you have hostnames starting with "SF" - as an example, meaning, they are in San Fran and some starting with: NY, than I would set the stanza as follows: [host::SF*] TZ = PST or [host::NY*] TZ = EST If they can be split by IP's or some other mechanism, use that. Hope this helps.

sshelly_splunk · ‎11-14-2017

something like : index=someindex date_wday=monday date_hour=01 I am pretty sure the date_* fields are all relative, so that "should" work:) reply if it does not

sshelly_splunk · ‎11-13-2017

I'd do the following in props.conf: TIME_FORMAT=%m/%d/%y","%H:%M:%S TIME_PREFIX=\d+"," BREAK_ONLY_BEFORE_DATE=true Based on your sample, that should break events correctly. If not, can u paste more sample events?

sshelly_splunk · ‎11-10-2017

I apoligize if this seems like a stupid question :), but do you have a single splunk instance (indexer and search head are the same)? If distributed, you will need the props/etc on all instance (search heads and indexers).

sshelly_splunk · ‎11-02-2017

If you only want to extract that exact text, than: (?P<myfield>Node is not the current one\.)

sshelly_splunk · ‎10-13-2017

Have you tried the timewrap command? I just did this, and if you choose Line Chart in visualization, looks pretty cool, and seems to be pretty fast: sourcetype=prd_banking_server Bank_Code = 108 earliest=-2d@d |eval Duration=duration/1000 | timechart avg(Duration) span=1h | timewrap series=relative 24h I obviously used different data:) I did it w/apache logs, and used response_time to generate the viz.

sshelly_splunk · ‎10-12-2017

ddrillic - You can index just the json portion of the event, but it looks like the text before the json portion includes timestamp, etc. Since this log is not proper json, I think you're going to need to do regex on it for display purposes. When looking at xml or json data (assuming it conforms to standards - sorry not exactly sure what that all entails:)), you can use kvmode=xml or json, or use something like the above. My skills are really around getting data in, and not SPL proper (I know, I know:)), so I will defer to the SPL experts for the spl-specific questions, but my focus is really on making sure data comes in correctly, so the SPL doesn't need to be complex to get value out of the data. Sorry if that doesnt help.

sshelly_splunk · ‎10-10-2017

sorry - just re-read your question. I test regex in the search bar sometimes, but not usually. Slightly different format, etc, so I use regex101, but might be just a preference.

Posts	64
Solutions	8
Karma Given	1
Karma Received	10
Member Since	‎04-19-2016

Online Status	Offline
Date Last Visited	‎06-13-2023 12:28 PM

Re: How to write search to find number of Splunk t...

Re: How to write search to find number of Splunk t...

Re: How to write search to find number of Splunk t...

Re: how can i filter abnormal login from same user...

Re: Sourcetype Inheritance: How to inherit parent ...

Re: Line Breaks

Re: JSON transformations

Re: JSON transformations

Re: JSON transformations

Re: LineBreakingProcessor truncates long events an...

Re: How to configure the timestamp configuration o...

Re: Blacklist log events (not log filenames) using...

Re: IIS Logs question

Re: How do I map my personally TZ-adjusted time to...

Re: Correctly format Oracle logs in Apache Log4j

Re: Splunk search doesn't extract fields on the fo...

Re: Extract Text from logs

Re: compare response time from yesterday to today

Re: How can we extract a json document within an e...

Re: How can we extract a json document within an e...