Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About knalla
knalla
Path Finder
Member since:
05-25-2016
03-28-2023
Community Statistics
| Posts | 35 |
| Solutions | 0 |
| Karma Given | 11 |
| Karma Received | 3 |
| Member Since | 05-25-2016 |
Activity Feed
- Posted How to Calculate the total duration? on Splunk Search. 06-30-2021 12:06 PM
- Posted Splunk line breaking issue on Getting Data In. 05-06-2021 09:46 PM
- Got Karma for How to compare list with lookup?. 09-24-2020 03:08 PM
- Posted How to compare list with lookup? on Splunk Search. 09-24-2020 01:57 PM
- Karma Re: Splunk light alerts to Splunk Enterprise for gcusello. 06-05-2020 12:51 AM
- Karma Re: How to use line breaking for sample data? for DavidHourani. 06-05-2020 12:50 AM
- Karma Upgrade Plan For ServiceNow AddOn for rbal_splunk. 06-05-2020 12:50 AM
- Karma Details in alert manager are not displayed for guiotto4. 06-05-2020 12:50 AM
- Karma Re: How to use regex to replace string? for sduff_splunk. 06-05-2020 12:50 AM
- Karma Re: How to use regex to replace string? for woodcock. 06-05-2020 12:50 AM
- Got Karma for Whats the best way to get Azure Security center logs to Splunk?. 06-05-2020 12:50 AM
- Karma Is there any plan to pull Azure Security Center logs and alerts from Splunk Add-on for Microsoft Cloud Services? for swong2. 06-05-2020 12:49 AM
- Karma Can't select action in "Execute external workflow action" 's window for osakachan. 06-05-2020 12:49 AM
- Karma Re: How to extract the fields for kv pair syslog data? for horsefez. 06-05-2020 12:49 AM
- Karma When will Splunk App for Windows Infrastructure be compatible with splunk addon for microsoft windows version 5.0.0? for tcaron. 06-05-2020 12:49 AM
- Got Karma for Re: How to move a diag to the desktop folder?. 06-05-2020 12:49 AM
- Karma Update of Splunk WSA Plugin to support WSA 10.x for tmayer. 06-05-2020 12:48 AM
- Posted Re: Is there a way to configure a custom file name for the exported CSV file attached in saved search alert emails? on Alerting. 05-05-2020 02:22 PM
- Posted How to disable clustering? on All Apps and Add-ons. 03-04-2020 02:50 PM
- Posted how to send events to nullque? on Splunk Search. 02-10-2020 09:45 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
06-30-2021
12:06 PM
Hi, I'm trying to get the total duration of events for each user from access logs with time gap. sample event: _time user 2021-06-30 00:00:26 user1 22021-06-30 01:00:26 user1 22021-06-30 01:00:26 user1 22021-06-30 01:20:26 user1 and then there are no events for 4 hours 22021-06-30 05:00:26 user1 22021-06-30 05:30:26 user1 22021-06-30 06:02:26 user1 I'm trying to calculate the total duration of day. Any ideas how to achieve this?
... View more
Labels
- Labels:
-
stats
-
transaction
05-06-2021
09:46 PM
Hi, I'm trying to line break events and extract time stamp, but it has no date any ideas how to get this? [04:05:16.255][t] setting data time stamp [04:05:14.255][t] setting data time stampwewe22 [04:05:12.255][t] setting data time etc <PSET>CDPTLSGSG <cc>
... View more
Labels
- Labels:
-
props.conf
-
transforms.conf
09-24-2020
01:57 PM
1 Karma
Hi all, I'm trying to compare list of apps by server with a list of apps in lookup to find if its installed or not. I tried Join and append, its not working. Please advise. |inputlookup app_list.csv| table app_name index=test | table system app_name | stats values(app_name) by system| append [|inputlookup app_list.csv| table app_name
... View more
03-04-2020
02:50 PM
Hi, I'm working on displaying all at a time, Is there a way to disable clustering in maps?
... View more
- Tags:
- Maps+ for Splunk
02-10-2020
09:45 PM
Hi, how to exclude internal source IP events for a sourcetype (web_logs) with src_ip=10.0.0.0/8 before indexing.
... View more
02-04-2020
10:34 AM
Thanks gcusello, how can I configure syslog output for splunk light?
... View more
02-04-2020
10:28 AM
Yes, alerting is available, currently email alerts are configured.
... View more
02-04-2020
09:42 AM
Hello,
we have splunk light platform only for few systems, Is there a way to send alerts from splunk light and ingest to splunk enterprise?
... View more
Labels
- Labels:
-
other
12-16-2019
12:56 PM
Hi, I had similar issue, I updated externalworkflow_actions_rest_handler and its still same.
... View more
07-29-2019
07:49 AM
Hello,
I'm trying to pass values of field to other field. Is there a best way to do it?
Query:
index=alerts status=resolved | dedup incident_id|table incident_id user
| lookup incidents incident_id OUTPUTNEW alert, title, owner, status, impact, urgency, external_reference_id|search owner=unassigned |modifyincidents owner="$result.user$"
I'm trying to pass user value to owner.
... View more
- Tags:
- query
- search-query
07-26-2019
10:13 AM
Added these in props.conf
TIME_FORMAT = %Y-%m-%dT%H:%M:%S.%3N
TIME_PREFIX = \"TimeStamp\": \"
TZ = UTC
... View more
07-26-2019
08:17 AM
Hi,
We are getting logs in UTC format, I tried using TZ=UTC on Heavy forwarder, but its not working for all events.
Working events:
_time Event_Timestamp
2019-07-26 08:25:44.000 2019-07-26T13:24:43.3570000Z
2019-07-26 07:21:45.000 2019-07-26T12:20:42.0070000Z
Not working:
_time Event_Timestamp
2019-07-26 07:04:06.417 2019-07-26T07:04:06.4170000Z
2019-07-26 07:03:06.293 2019-07-26T07:03:06.2930000Z
Any suggestions?
... View more
- Tags:
- timezone
07-12-2019
11:38 AM
Hello, I'm looking to monitor memory usage by process, with currently perfmon logs, we are getting CPU usage by Process but not memory, Any suggestions to get those events?
... View more
Labels
- Labels:
-
resource usage
06-10-2019
11:21 AM
Its working, but its not breaking events if the event start with TBD.
... View more
05-20-2019
09:37 PM
Hi,
How to use line breaking to break events before TBD, new event starts with TBD.
sample data:
ABC*11*231~
CFFGBPR*DD*1212*Ddf*12333~
TBD*1*3234454*12223355~
DFR*ESDFR*5ewewesd112~
dsdd*DD*dd*Ddf*12333~
FTRRD*DFF*455*434*4321~
TBD*1*wewe*2344~
DFR*ESDFR*5ewewesd112~
dsdd*DD*dd*Ddf*12333~
FTRRD*DFF*455*434*4321~
DFR*ESDFR*5ewewesd112~
dsdd*DD*dd*Ddf*12333~
FTRRD*DFF*455*434*4321~
required output:
event 1
TBD*1*3234454*12223355~
DFR*ESDFR*5ewewesd112~
dsdd*DD*dd*Ddf*12333~
FTRRD*DFF*455*434*4321~
event 2
TBD*1*wewe*2344~
DFR*ESDFR*5ewewesd112~
dsdd*DD*dd*Ddf*12333~
FTRRD*DFF*455*434*4321~
DFR*ESDFR*5ewewesd112~
dsdd*DD*dd*Ddf*12333~
FTRRD*DFF*455*434*4321~
I tried below stanza, it dint work. Any suggestions?
[ ]
SHOULD_LINEMERGE=true
NO_BINARY_CHECK=true
BREAK_ONLY_BEFORE=TBD
CHARSET=UTF-8
disabled=false
... View more
05-14-2019
07:09 AM
I tried, its working with regular alerts, but not from the app actions.
... View more
05-13-2019
02:23 PM
Hello,
I'm trying to create to custom alert action from alert manager app to automate emails with invoking action. I add this on alert_action.conf. Its not working as expected. Any suggestions?
[snow_email]
is_custom = 1
label = SNOW action
disabled = 0
command = |sendalert sendemail "to=test@service.now.com" "server=relay.test.com" "from=splunk@test.com" "subject=test22"
... View more
05-12-2019
05:12 PM
Hi,
I have the below urls. How can I use the regex to remove the tokens from urls? Looking to remove data between /interactions/ and result_data.
sample:
https://test.com:443/test11/interactions/000e433c-a27-344347f-drfere/result_data
output needed:
https://test.com:443/test11/interactions/result_data
... View more
04-30-2019
12:46 PM
Thanks Susiken, but we are on London version, current add-on is not compatible with it.
... View more
04-30-2019
08:39 AM
Hi,
I'm trying to create a alert action to send email to SNOW instance to create a incident. Whats the best way to achieve it?
... View more
12-03-2018
07:02 AM
1 Karma
Hello,
Are there any other options to on-board azure security center alerts to Splunk other than eventhub?
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
03-28-2023
10:29 PM
|
Karma given to
