Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Are you a member of the Splunk Community?
Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- About jcolon68
jcolon68
Explorer
Member since:
05-23-2019
06-05-2020
Community Statistics
| Posts | 9 |
| Solutions | 0 |
| Karma Given | 0 |
| Karma Received | 1 |
| Member Since | 05-23-2019 |
Activity Feed
- Got Karma for How do I show more fields after the stats count by command?. 06-05-2020 12:50 AM
- Posted Re: Create an alert for account login fails at a certain amount of times within a certain time on Alerting. 06-05-2019 10:19 AM
- Posted Re: Alert for Failed Login Attempts on Alerting. 06-04-2019 01:28 PM
- Posted Create an alert for account login fails at a certain amount of times within a certain time on Alerting. 06-04-2019 07:35 AM
- Tagged Create an alert for account login fails at a certain amount of times within a certain time on Alerting. 06-04-2019 07:35 AM
- Tagged Create an alert for account login fails at a certain amount of times within a certain time on Alerting. 06-04-2019 07:35 AM
- Tagged Create an alert for account login fails at a certain amount of times within a certain time on Alerting. 06-04-2019 07:35 AM
- Tagged Create an alert for account login fails at a certain amount of times within a certain time on Alerting. 06-04-2019 07:35 AM
- Posted How to forward logs by Index / SourceType, from Splunk to 3rd party? on Getting Data In. 05-30-2019 06:01 AM
- Tagged How to forward logs by Index / SourceType, from Splunk to 3rd party? on Getting Data In. 05-30-2019 06:01 AM
- Tagged How to forward logs by Index / SourceType, from Splunk to 3rd party? on Getting Data In. 05-30-2019 06:01 AM
- Tagged How to forward logs by Index / SourceType, from Splunk to 3rd party? on Getting Data In. 05-30-2019 06:01 AM
- Tagged How to forward logs by Index / SourceType, from Splunk to 3rd party? on Getting Data In. 05-30-2019 06:01 AM
- Posted Re: Windows Event: How to get the complete event show up so it can be extracted? on Splunk Search. 05-29-2019 01:19 PM
- Posted Windows Event: How to get the complete event show up so it can be extracted? on Splunk Search. 05-29-2019 12:26 PM
- Tagged Windows Event: How to get the complete event show up so it can be extracted? on Splunk Search. 05-29-2019 12:26 PM
- Tagged Windows Event: How to get the complete event show up so it can be extracted? on Splunk Search. 05-29-2019 12:26 PM
- Posted Re: How do I show more fields after the stats count by command? on Splunk Search. 05-24-2019 06:18 AM
- Posted Re: How do I show more fields after the stats count by command? on Splunk Search. 05-23-2019 01:56 PM
- Posted How do I show more fields after the stats count by command? on Splunk Search. 05-23-2019 01:42 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 1 |
06-05-2019
10:19 AM
This is great! Thanks! what if I just wanted to monitor a couple of specific acccounts?
... View more
06-04-2019
01:28 PM
What if you only wanted to check for maybe 4 particular accounts and not all?
... View more
06-04-2019
07:35 AM
I'd like some ideas on alerting when an Active Directory account has a particular # of login failures within a particular amount of time. The premise is to try and send an alert on an account that is about to get locked out.
... View more
05-30-2019
06:01 AM
Is there a way to forward logs from Splunk to a 3rd Party collector by Index / SourceType?
... View more
05-29-2019
01:19 PM
I created the Field Extraction from a search. I apologize , I'm fairly new to splunk not sure what you mean by creating it for a sourcetype (Inline).
I created the Field, re ran the same search ., but I don't see the new field in available fields.
... View more
05-29-2019
12:26 PM
I created a Field Extraction and can see it on the list of Field Extractions. How do I add it to the Fields in a search?
I'm trying to extract a field from Windows Event but for some reason, when trying to extract, the whole message is not coming through. So the part of the message I'm trying to extract doesn't show up.
How can I get the complete message from the Event show up to extract?
... View more
05-24-2019
06:18 AM
I just really want to group the Account_Name field into individual lines with a count. But I want to see multiple fields, like Computer Name , which may be different for example:
Account_Name Computer name IP
account Computer 1 10.10.0.1
account Computer 2 10.10.0.2
account Computer 3 10.10.0.3
what I'd like to see is just a grouping and count of "Account_Name" and show other fields as well:
Account_Name Computer name IP Count
account Computer 1 10.10.0.1 3
account Computer 2 10.10.0.2 3
account Computer 3 10.10.0.3 3
... View more
05-23-2019
01:56 PM
Thanks! I tried that , but the count is not correct. It's only showing count as 1 for most of the results when there's multiple.
... View more
05-23-2019
01:42 PM
1 Karma
I need to add more columns to a search after results are counted. Here's my query
index=wineventlog EventCode=4740 host=* | stats count by Account_Name | sort - count
Results give me Account_Name and Count ...I want to add more fields to results.I tried table but this doesn't work.
... View more
