Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About adamfrisbee
adamfrisbee
Explorer
Member since:
06-21-2016
12-04-2020
Community Statistics
| Posts | 14 |
| Solutions | 0 |
| Karma Given | 1 |
| Karma Received | 0 |
| Member Since | 06-21-2016 |
Activity Feed
- Karma Re: Why do I have to use eval for this search? for richgalloway. 12-01-2020 06:51 PM
- Posted In data models, what is the reason for child datasets on Knowledge Management. 11-30-2020 07:44 AM
- Tagged In data models, what is the reason for child datasets on Knowledge Management. 11-30-2020 07:44 AM
- Posted Re: Why do I have to use eval for this search? on Splunk Search. 06-29-2020 12:47 PM
- Posted Why do I have to use eval for this search? on Splunk Search. 06-29-2020 10:04 AM
- Posted How do I Display fields in a table after stats command? on Splunk Search. 06-28-2020 08:40 AM
- Posted Re: SEDCMD regular expression question on Splunk Search. 12-27-2019 08:28 AM
- Posted Re: SEDCMD regular expression question on Splunk Search. 12-26-2019 06:27 PM
- Posted Re: SEDCMD regular expression question on Splunk Search. 12-24-2019 01:02 PM
- Posted Re: SEDCMD regular expression question on Splunk Search. 12-24-2019 11:57 AM
- Posted Re: SEDCMD regular expression question on Splunk Search. 12-24-2019 08:54 AM
- Posted SEDCMD regular expression question on Splunk Search. 12-24-2019 08:00 AM
- Tagged SEDCMD regular expression question on Splunk Search. 12-24-2019 08:00 AM
- Tagged SEDCMD regular expression question on Splunk Search. 12-24-2019 08:00 AM
- Tagged SEDCMD regular expression question on Splunk Search. 12-24-2019 08:00 AM
- Posted How do I export extracted fields for use in another app? on Splunk Search. 06-23-2019 01:51 PM
- Tagged How do I export extracted fields for use in another app? on Splunk Search. 06-23-2019 01:51 PM
- Posted Can I set up an alert based on a sum on Alerting. 05-04-2019 08:51 PM
- Tagged Can I set up an alert based on a sum on Alerting. 05-04-2019 08:51 PM
- Posted Can you help me in Identifying metadata? on Getting Data In. 01-14-2019 08:33 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
11-30-2020
07:44 AM
In data models, what is the reason for child datasets? Would it not be easier to just create a root dataset with no children?
... View more
- Tags:
- data model
Labels
- Labels:
-
data model
06-29-2020
12:47 PM
I thought `eval` always created a new field? Why does it not in this case?
... View more
06-29-2020
10:04 AM
Hi everyone, Why does this search return nothing | stats count(status=200) AS Success While this search returns what I expect? | stats count(eval(status=200)) AS success
... View more
06-28-2020
08:40 AM
Working with some Apache logs. I am trying to get a table that displays the uri, the clientip, and the number of times that clientip has hit that uri (as hits). Everything is working as expected except for that table. Why doesn't the uri part work? I get a table with uri that has blank values, and the other fields show the expected values.
index=* clientip=* uri=*
| stats count(uri) AS hits by clientip
| table uri, hits, clientip
... View more
12-27-2019
08:28 AM
Okay, I didn't have the inputs.conf stanza configured correctly. Thanks for your help.
... View more
12-26-2019
06:27 PM
Hi @woodcock,
I have verified that the the data coming in is hitting a HF first, then forwarding to a search head. When the data gets to the search head, I can see that it's replacing the cc number in the raw event (when I "show source" it does not show the cc number). However, cc_no still shows up as a field with populated values. In the images below, I've replaced the cc number with the string "secret" using your recommended sed. The first image is the raw data.
... View more
12-24-2019
01:02 PM
It seems to be masking it when I look at the raw data, but I can still, for example, do | table cc_no and display all the CC numbers.
... View more
12-24-2019
11:57 AM
Neither of these mask the data, though. I must be doing something wrong. This is my props.conf
[csv]
SEDCMD-mask = s/\d+$/x{4}/g
... View more
12-24-2019
08:54 AM
Thank you! That seemed to partially work. It's masking it in some places.
... View more
12-24-2019
08:00 AM
Okay you regexperts, I need some help. I have a .csv file for which I need to mask the credit card numbers. Here is what it looks like (with all fake data and cc number)
user,first_name,last_name,email,cc_type,cc_no
bfiltness0,Bria,Filtness,bfiltness0@sayntec.com,jcb,3543149367325423
I've been trying to build my own regex expression, but with no luck. I would just like to replace the credit card number with xxxx. Any help would be greatly appreciated!
... View more
06-23-2019
01:51 PM
I am creating two apps that use the same data (weird,I know, but I am testing something in my environment). I've built one app, and used the field extractor to extract about five custom fields. I need to export/import them into another app, but I can't find them in the config files. Does anyone know where extracted fields are stored in the file system for custom apps?
... View more
- Tags:
- splunk-enterprise
05-04-2019
08:51 PM
I'd like to set up an alert based on whether the sum of a column is greater than a certain value. I have this
<search> | stats sum(visitors)
Which returns the sum of visitors as a single value. Can I set up an alert that triggers when the sum of visitors is greater than 50?
... View more
- Tags:
- splunk-enterprise
01-14-2019
08:33 AM
In the Splunk documentation for events, it lists this mock event
172.26.34.223 - - [01/Jul/2017:12:05:27 -0700] "GET /trade/app?action=logout HTTP/1.1" 200 2953
I need help identifying the host, source, and source type of this event. I can identify the host as 172.26.34.223 , the timestamp as [01/Jul/2017:12:05:27 -0700 and I believe the source here is GET /trade/app?action=logout HTTP/1.1 but what is the source type?
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
12-04-2020
11:59 PM
|
