Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About sureshmurgan
sureshmurgan
Path Finder
Member since:
04-30-2019
05-25-2022
Community Statistics
| Posts | 24 |
| Solutions | 1 |
| Karma Given | 4 |
| Karma Received | 0 |
| Member Since | 04-30-2019 |
Activity Feed
- Karma Re: How to merge consecutive event values from a single field? for gcusello. 05-25-2022 12:42 AM
- Karma Re: How to merge consecutive event values from a single field? for gcusello. 05-25-2022 12:42 AM
- Karma Re: How to merge consecutive event values from a single field? for gcusello. 05-25-2022 12:42 AM
- Karma Re: How to merge consecutive event values from a single field? for wenthold. 05-25-2022 12:42 AM
- Posted Re: How to compare multiple values of a field with the corresponding values of another field and add a new value based on the comparison result? on Splunk Search. 10-08-2019 10:15 PM
- Posted Re: How to filter down events with specific string value from a multivalue field and then to compare and pick values as per the condition? on Installation. 10-07-2019 11:22 AM
- Posted Re: How to filter down events with specific string value from a multivalue field and then to compare and pick values as per the condition? on Installation. 10-07-2019 11:22 AM
- Posted Re: How to filter down events with specific string value from a multivalue field and then to compare and pick values as per the condition? on Installation. 10-07-2019 11:21 AM
- Posted Re: How to compare multiple values of a field with the corresponding values of another field and add a new value based on the comparison result? on Splunk Search. 10-07-2019 11:10 AM
- Posted Re: How to compare multiple values of a field with the corresponding values of another field and add a new value based on the comparison result? on Splunk Search. 10-06-2019 09:19 PM
- Posted How to compare multiple values of a field with the corresponding values of another field and add a new value based on the comparison result? on Splunk Search. 10-06-2019 12:30 PM
- Tagged How to compare multiple values of a field with the corresponding values of another field and add a new value based on the comparison result? on Splunk Search. 10-06-2019 12:30 PM
- Tagged How to compare multiple values of a field with the corresponding values of another field and add a new value based on the comparison result? on Splunk Search. 10-06-2019 12:30 PM
- Tagged How to compare multiple values of a field with the corresponding values of another field and add a new value based on the comparison result? on Splunk Search. 10-06-2019 12:30 PM
- Tagged How to compare multiple values of a field with the corresponding values of another field and add a new value based on the comparison result? on Splunk Search. 10-06-2019 12:30 PM
- Tagged How to compare multiple values of a field with the corresponding values of another field and add a new value based on the comparison result? on Splunk Search. 10-06-2019 12:30 PM
- Posted Re: How to merge consecutive event values from a single field? on Splunk Search. 06-20-2019 07:32 AM
- Posted Re: How to merge consecutive event values from a single field? on Splunk Search. 06-20-2019 07:16 AM
- Posted Re: How to merge consecutive event values from a single field? on Splunk Search. 06-20-2019 06:04 AM
- Posted How to merge consecutive event values from a single field? on Splunk Search. 06-20-2019 04:48 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
10-08-2019
10:15 PM
Your suggestion have worked and I have marked it as the answer. I will post the addon queries in a separate thread. Thanks again Oliver!
... View more
10-07-2019
11:22 AM
index=windowsevents sourcetype="System" SourceName=WindowsUpdate
EventCode=19 OR EventCode=20
|rex field=Message "(?P<Status>Installation\s\w+):.*(?P<Update>KB\d+).*"
|stats latest(_time) as Time latest(Status) as Status latest(Message) as Message by host Update
|search Status="Installation Failure"
... View more
10-07-2019
11:22 AM
This gives me the intended result. Thanks VatsalJagani for your help with this.
... View more
10-07-2019
11:21 AM
index=windowsevents sourcetype="System" SourceName=WindowsUpdate
EventCode=19 OR EventCode=20
|rex field=Message "(?P<Status>Installation\s\w+):.*(?P<Update>KB\d+).*"
|stats latest(_time) as Time latest(Status) as Status latest(Message) as Message by host Update
|search Status="Installation Failure"
... View more
10-07-2019
11:10 AM
This worked well, thanks for that Oliver. Actually my requirement is a lot more complex. I will try to explain it here,
This is the query am using now,
| pivot Application_ApplicationInventory
latest(InstallDate) as InstallDate
latest(DisplayVersion) as DisplayVersion
splitrow
host
splitrow
DisplayName
filter host in (101,102,103,104)
filter DisplayName in ("Adobe","Chrome","vlc")
| where isnotnull(DisplayName)
| eval PreReq=case((DisplayName="Adobe" AND DisplayVersion < "7.5") OR (DisplayName="Chrome" AND DisplayVersion < "2.0") OR (DisplayName="vlc" AND DisplayVersion < "6.0"),"1",true(),"0")
This is giving me the result as intended for the PCs where its installed. I have some more requirements and need to include those conditions as well,
1. Need to mark the PCs as non compliant where any of these applications is not installed at all. It would be nice if we know what application is not installed but not mandatory at this point.(This data is not available directly. I have an option to append the PCs separately but search goes longer.)
2. Compliance for another app AdobeAcrobat (this will not be present in all PCs but we need to consider only the PCs where its installed and check for the version to mark it as compliant or noncompliant)
3. Compliance for two apps IE and Mozilla (either IE or Mozilla will be present in the PCs, so if any of them is present - check for the respective version and mark as compliant or noncompliant. Also, here when both these apps are not installed we have to mark it as noncompliant)
Like I have said before we have to check for all these and mark a PC as compliant or noncompliant.
I have tried to explain as clearly as I could. Any suggestion is greatly appreciated.
... View more
10-06-2019
09:19 PM
This looks like a nice logic. Will attempt this and get back. Thank you 🙂
... View more
10-06-2019
12:30 PM
I want to check for list of applications installed and its versions from all the PCs in my environment. If all the list of applications and the expected versions are present in the PC, I want to tag it as compliant.
Sample Data: Consider the following data added to Splunk, PC, Name, Version are the field names and I have added some values to it.
PC : x,y
Name : Adobe, Chrome, vlc
Version : 10(Adobe), 11(Chrome), 12(vlc) (--> I added App Name within brackets for our understanding, Version field only has the numeric values 10,11 and 12 given here)
My Requirement : I want to check for each PC x and y, If all three applications Adobe,Chrome and vlc are installed with the version given above or newer version.
... View more
06-20-2019
07:32 AM
Here's little more information about the query and the result and what I want.
Search :
ADSite_Membership="Initiating task ContentDownload for CI*" OR ADSite_Membership="Initiating Content Download*" OR ADSite_Membership="Unable to get locations*"
|table _time ADSite_Membership
Search Result:
2019-06-19 12:36:15.000 Initiating task ContentDownload for CI ScopeId_B4419992-1C14-4FC6-AB4E-D7730CD14853/DeploymentType_4a3a8593-e333-4bb4-a3f9-bb1ce19cf0eb.6 (GP4.1.11 BlueCoatDecom - User Interactive) for target: , consumer: {CA8EDD4A-6D29-4CE0-90AD-0EB22011B165}
2019-06-19 12:36:15.000 Initiating task ContentDownload for CI ScopeId_B4419992-1C14-4FC6-AB4E-D7730CD14853/DeploymentType_28ce7e7a-307a-417b-baf1-70c6bf0889d9.10 (Intel GFX driver 6th 7th 8th Apollo Gemini (EUDM - ALL)) for target: , consumer: {FE0C1DDA-725A-4FF2-9E20-D78968FAC529}
2019-06-20 12:58:02.414 Unable to get locations, no need to continue with download
2019-06-20 13:07:52.000 Initiating task ContentDownload for CI ScopeId_B4419992-1C14-4FC6-AB4E-D7730CD14853/DeploymentType_28ce7e7a-307a-417b-baf1-70c6bf0889d9.10 (Intel GFX driver 6th 7th 8th Apollo Gemini (EUDM - ALL)) for target: , consumer: {546E275F-FE56-4EA8-A37B-41508E57148D}
Requirement : If you look at the 3rd row, it has "Unable to get locations*". When we get it in results I want to extract that as Status and also I want to extract the value from previous event "ScopeId*" as Deployment
... View more
06-20-2019
07:16 AM
Hi Giuseppe, Status is not showing any value at all. I have given explained it further with a sample. Please have a look and let me know if you need more information. Thanks for your help with this!
I am searching events with the following values in the field ADSite_Membership,
ADSite_Membership="Initiating task ContentDownload for CI*" OR ADSite_Membership="Initiating Content Download*" OR ADSite_Membership="Unable to get locations*"
If I pull the events as is, I get the below results,
2019-06-19 12:36:15.000 UK922061 Initiating task ContentDownload for CI ScopeId_B4419992-1C14-4FC6-AB4E-D7730CD14853/DeploymentType_4a3a8593-e333-4bb4-a3f9-bb1ce19cf0eb.6 (GP4.1.11 BlueCoatDecom - User Interactive) for target: , consumer: {CA8EDD4A-6D29-4CE0-90AD-0EB22011B165}
2019-06-19 12:36:15.000 UK922061 Initiating task ContentDownload for CI ScopeId_B4419992-1C14-4FC6-AB4E-D7730CD14853/DeploymentType_28ce7e7a-307a-417b-baf1-70c6bf0889d9.10 (Intel GFX driver 6th 7th 8th Apollo Gemini (EUDM - ALL)) for target: , consumer: {FE0C1DDA-725A-4FF2-9E20-D78968FAC529}
2019-06-20 12:58:02.414 UK922061 Unable to get locations, no need to continue with download
2019-06-20 13:07:52.000 UK922061 Initiating task ContentDownload for CI ScopeId_B4419992-1C14-4FC6-AB4E-D7730CD14853/DeploymentType_28ce7e7a-307a-417b-baf1-70c6bf0889d9.10 (Intel GFX driver 6th 7th 8th Apollo Gemini (EUDM - ALL)) for target: , consumer: {546E275F-FE56-4EA8-A37B-41508E57148D}
Requirement : If you look at the third row result, I have "Unable to get locations*" . When we find this result, I want to extract it as Status and want to extract the ScopeId_* from the previous event as Deployment.
... View more
06-20-2019
06:04 AM
Hi Giuseppe,
I get to see Deployment field now but Status is still blank. I have tried both rex commands you had shared.
Please note there could be many events in the field and we need to stop extracting only the two consecutive lines and should not go beyond that.
... View more
06-20-2019
04:48 AM
This is the requirement.
We are collecting a log file that has the following events (along with others)in the same field named ADSite_Membership, these two lines occurs consecutively in the same order as I have given below:
Initiating task ContentDownload for CI ScopeId_B4419992-1C14-4FC6-AB4E-D7730CD14853/DeploymentType_4a3a8593-e333-4bb4-a3f9-bb1ce19cf0eb.6 (BlueDom - User Interactive) for target: , consumer: {719C1F1E-63E2-46C6-9469-E38B881EEA5A}
Unable to get locations, no need to continue with download
I am trying to extract two separate fields from the above values but its not working, Here's the rex command I am using:
|rex field=ADSite_Membership "(?ms)Initiating task ContentDownload\s\w+\s\w+\s(?P<Deployment>ScopeId.*)\sfor.*(?P<Status>Initiating content download.*)"
(Note: Willard value 'star' is not showing up in some sections of the rex command above)
I am intending to extract :
ScopeId_B4419992-1C14-4FC6-AB4E-D7730CD14853/DeploymentType_4a3a8593-e333-4bb4-a3f9-bb1ce19cf0eb.6 (BlueDom - User Interactive) as Deployment
Unable to get locations, no need to continue with a download as Status.
How can I do that?
... View more
06-20-2019
04:35 AM
I got the solution. I am using windows events to keep a track of the installation failure and got a query working for it. Thanks!
... View more
06-10-2019
08:17 PM
Here's the query that's written till now. This will fetch all the Installation success and failure events and going to give the latest result. There could be multiple updates and some might have failed and other updates that came through would have got installed fine. So, this query is only going to give me the latest log where its failure. I need to get all the installation failure logs with the respective updates.
Not sure if this is this clear enough?
index=sccm_uk source="C:\Windows\CCM\Logs\WUAHandler.log" sourcetype=WindowsCCMLogs host="*" (ADSite_Membership="Installation job encountered some failures") OR
(ADSite_Membership="Installation of updates completed.")
|stats latest(ADSite_Membership) as WUAInstallError by host
|search WUAInstallError!="Installation of updates completed."
|dedup host
|stats dc(host) as #Hosts by WUAInstallError
|sort 0 - #Hosts
|addcoltotals #Hosts
... View more
06-10-2019
08:56 AM
Hi Vatsal, thanks for responding.
Here's the query that's written till now. This will fetch all the Installation success and failure events and going to give the latest result. There could be multiple updates and some might have failed and other updates that came through would have got installed fine. So, this query is only going to give me the latest log where its failure. I need to get all the installation failure logs with the respective updates.
Not sure if this is this clear enough?
index=sccm_uk source="C:\Windows\CCM\Logs\WUAHandler.log" sourcetype=WindowsCCMLogs host="" (ADSite_Membership="Installation job encountered some failures") OR
(ADSite_Membership="Installation of updates completed.")
|stats latest(ADSite_Membership) as WUAInstallError by host
|search WUAInstallError!="Installation of updates completed."
|dedup host
|stats dc(host) as #Hosts by WUAInstallError
|sort 0 - #Hosts
|addcoltotals #Hosts
... View more
06-10-2019
01:45 AM
Windows update installation logs from machines are forwarded every day in Splunk. In our windows environment, some windows update installations might fail and get logged as failed in the log, many get installed and gets logged as installed. These failed updates will try again to install another time and may get installed successfully or may end up as a failure again.
Requirement: Take all the values from the installation logs (ie., all the values in a field) filter out the failed installation which hasn't been able to get installed successfully yet.
... View more
Labels
- Labels:
-
Windows
06-06-2019
11:26 PM
This didn't work on my first attempt, will try this as well. Thanks Wood!
... View more
06-06-2019
11:25 PM
This worked right when I added it to my base query.
Search result of the base query had an additional backslash but it fits the purpose. Thanks koshyk!
... View more
05-27-2019
01:29 PM
Here's the entire source code for better understanding. Here drilldown is not returning any result because base search result has one backslash to it. We need to somehow change the resulting value in the base search which is the input for drill down, to replace \ to \ and it should happen automatically when we click on the resulting base search row value where it only has single backslash, ( WMIError="Unable to connect to root\cimv2"). Need some modification in the drill down search.
Time
<earliest>-24h@h</earliest>
<latest>now</latest>
<search>
<query>index=sccm_uk source="C:\\Windows\\CCM\\Logs\\execmgr.log" sourcetype=WindowsCCMLogs host="*" WMIError="Unable to connect to root\\cimv2*"
|dedup host
|stats count(host) as #Hosts by WMIError
|sort 0 - #Hosts
|addcoltotals #Hosts</query>
<earliest>$field1.earliest$</earliest>
<latest>$field1.latest$</latest>
<sampleRatio>1</sampleRatio>
</search>
<option name="count">20</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">cell</option>
<option name="percentagesRow">false</option>
<option name="rowNumbers">false</option>
<option name="totalsRow">false</option>
<option name="wrap">true</option>
<drilldown>
<set token="WMI">$row.WMIError$</set>
</drilldown>
<search>
<query>index=sccm_uk source="C:\\Windows\\CCM\\Logs\\execmgr.log" sourcetype=WindowsCCMLogs host="*" WMIError="$WMI$"
|convert ctime(_time) as Time timeformat="%d-%m-%Y %H:%M:%S"
|stats latest(WMIError) as WMIError values(Time) as Time BY host</query>
<earliest>$field1.earliest$</earliest>
<latest>$field1.latest$</latest>
</search>
... View more
05-27-2019
01:26 PM
Here's the entire source code for better understanding. Here drilldown is not returning any result because base search result has one backslash to it. We need to somehow change the resulting value in the base search which is the input for drill down, to replace \ to \ and it should happen automatically when we click on the resulting base search row value where it only has single backslash, For eg : WMIError="Unable to connect to root\cimv2"
WMi Test
<input type="time" token="field1">
<label>Time</label>
<default>
<earliest>-24h@h</earliest>
<latest>now</latest>
</default>
</input>
<panel>
<table>
<search>
<query>index=sccm_uk source="C:\\Windows\\CCM\\Logs\\execmgr.log" sourcetype=WindowsCCMLogs host="*" WMIError="Unable to connect to root\\cimv2*"
|dedup host
|stats count(host) as #Hosts by WMIError
|sort 0 - #Hosts
|addcoltotals #Hosts</query>
<earliest>$field1.earliest$</earliest>
<latest>$field1.latest$</latest>
<sampleRatio>1</sampleRatio>
</search>
<option name="count">20</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">cell</option>
<option name="percentagesRow">false</option>
<option name="rowNumbers">false</option>
<option name="totalsRow">false</option>
<option name="wrap">true</option>
<drilldown>
<set token="WMI">$row.WMIError$</set>
</drilldown>
</table>
</panel>
<panel depends="$WMI$">
<title>Host details for $WMI$</title>
<table>
<search>
<query>index=sccm_uk source="C:\\Windows\\CCM\\Logs\\execmgr.log" sourcetype=WindowsCCMLogs host="*" WMIError="$WMI$"
|convert ctime(_time) as Time timeformat="%d-%m-%Y %H:%M:%S"
|stats latest(WMIError) as WMIError values(Time) as Time BY host</query>
<earliest>$field1.earliest$</earliest>
<latest>$field1.latest$</latest>
</search>
</table>
</panel>
... View more
05-27-2019
10:31 AM
Base Search:
We are fetching the data from the field named WMIError as given below,
WMIError="Unable to connect to root\cimv2*" (This is taken as the input value for the subsearch as a drill down)
<set token="WMI">$row.WMIError$</set> (Here it is taken as the input)
Subsearch (Drilldown) :
<title>Host details for $WMI$"</title>
<table>
<search>
ADSite_Membership="$WMI$"
</search>
</table>
</panel>
It is not resulting anything as the token value has a backslash to it (Unable to connect to root\cimv2).
How to replace single backslash () with double back slash(\) from this token before searching from here? Any help is appreciated.
... View more
