Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About iancorrea
iancorrea
Path Finder
Member since:
05-27-2019
06-05-2020
Community Statistics
| Posts | 14 |
| Solutions | 0 |
| Karma Given | 10 |
| Karma Received | 0 |
| Member Since | 05-27-2019 |
Activity Feed
- Karma Re: How to compare values on the same columns and on the same date for jnudell_2. 06-05-2020 12:50 AM
- Karma Re: Issue on Dropdown timepicker on Dashboard for elle118. 06-05-2020 12:50 AM
- Karma Subsearch time range for szrobag. 06-05-2020 12:49 AM
- Karma Re: Subsearch time range for szrobag. 06-05-2020 12:49 AM
- Karma Re: Why are search results cut off at 10,000 in Splunk Web and 10,000 or 20,000 results via REST API? for woodcock. 06-05-2020 12:48 AM
- Karma Re: How to reset a child multiselect input when the value for the parent input is changed? for MaryvonneMB. 06-05-2020 12:48 AM
- Karma Re: How to Bold "Titlle" of all reports in a dashboard? for Kenshiro70. 06-05-2020 12:48 AM
- Karma Re: Subtracting 30 minutes from passed drilldown parameter to use as earliest/latest in next timechart search for Raghav2384. 06-05-2020 12:47 AM
- Karma field extraction based on index for sbsbb. 06-05-2020 12:46 AM
- Karma Re: Format results with comma thousands separator for juanxiayan. 06-05-2020 12:45 AM
- Posted Splunk Forwarder enable boot start not working on Windows XP on Getting Data In. 03-02-2020 01:09 AM
- Tagged Splunk Forwarder enable boot start not working on Windows XP on Getting Data In. 03-02-2020 01:09 AM
- Tagged Splunk Forwarder enable boot start not working on Windows XP on Getting Data In. 03-02-2020 01:09 AM
- Posted Re: Missing events from Splunk Universal Forwarder on Getting Data In. 02-11-2020 12:12 AM
- Posted Re: Missing events from Splunk Universal Forwarder on Getting Data In. 02-10-2020 08:52 PM
- Posted Missing events from Splunk Universal Forwarder on Getting Data In. 02-10-2020 08:30 PM
- Tagged Missing events from Splunk Universal Forwarder on Getting Data In. 02-10-2020 08:30 PM
- Tagged Missing events from Splunk Universal Forwarder on Getting Data In. 02-10-2020 08:30 PM
- Posted Re: Parsing Meraki CMX API data on props.conf on All Apps and Add-ons. 12-12-2019 06:38 PM
- Posted Parsing Meraki CMX API data on props.conf on All Apps and Add-ons. 12-12-2019 01:55 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
03-02-2020
01:09 AM
Hi, I have Universal Forwarder on my Windows XP machine. I enabled the boot-start upon installation but upon rebooting the machine, splunk forwarder is not running and it needs to start manually. Does anyone encounter this type of problem and do you have solutions for this. Thanks!
... View more
02-11-2020
12:12 AM
I have been using batch since 1 month ago and there is no problem until this day. I cannot use the monitor because my client wants to use batch.
... View more
02-10-2020
08:52 PM
yes, the other 167 events was successfully parsed
... View more
02-10-2020
08:30 PM
I have one missing event out of 168 events from our Universal Forwarder. I've already checked the internal logs and the file has been indexed "Batch input finished reading file=", but I cannot find this source on my index. I also tried to expand time range and nothing appears, then check if the forwarder was restarted on the time of file was index, but it is not.
Settings on my forwarder is:
inputs.conf
[batch://my_path]
move_policy = sinkhole
disabled = false
sourcetype = my_sourcetype
index = my_index
outputs.conf
[tcpout]
defaultGroup = default-autolb-group-forwarder
[tcpout:default-autolb-group-forwarder]
disabled = false
server = myIndexer:9997
useACK = true
... View more
12-12-2019
06:38 PM
Hi @kamlesh_vaghela , I'm just trying to simulate the Meraki CMX API process using Postman and the sample events I gathered was from this site https://documenter.getpostman.com/view/897512/71FUpux?version=latest#7f7ed3e0-0ed4-8d55-c39d-b802dadbe703.
Here is the whole event from this site,
{
"version": "2.0",
"secret": "splunk*****",
"type": "DevicesSeen",
"data": {
"apMac": "00:18:0a:13:dd:b0",
"apFloors": [],
"apTags": [
"dev",
"home",
"test"
],
"observations": [
{
"ipv4": "/192.168.0.56",
"location": {
"lat": 51.5355157,
"lng": -0.06990350000000944,
"unc": 0.20755340376944298,
"x": [],
"y": []
},
"seenTime": "2016-09-24T00:06:14Z",
"ssid": ".interwebs",
"os": null,
"clientMac": "18:fe:34:d7:7c:26",
"seenEpoch": 1474675574,
"rssi": 56,
"ipv6": null,
"manufacturer": "Espressif"
},
{
"ipv4": null,
"location": {
"lat": 51.5355157,
"lng": -0.06990350000000944,
"unc": 2.355135751488216,
"x": [],
"y": []
},
"seenTime": "2016-09-24T00:06:28Z",
"ssid": null,
"os": "Android",
"clientMac": "98:f1:70:34:1c:3e",
"seenEpoch": 1474675588,
"rssi": 43,
"ipv6": null,
"manufacturer": "Murata Manufacturing"
},
{
"ipv4": "/192.168.0.95",
"location": {
"lat": 51.5355157,
"lng": -0.06990350000000944,
"unc": 0.30140056490166983,
"x": [],
"y": []
},
"seenTime": "2016-09-24T00:05:46Z",
"ssid": ".interwebs",
"os": "Generic Linux",
"clientMac": "74:da:38:88:7c:df",
"seenEpoch": 1474675546,
"rssi": 53,
"ipv6": null,
"manufacturer": "Edimax Technology"
},
{
"ipv4": "/192.168.0.42",
"location": {
"lat": 51.5355157,
"lng": -0.06990350000000944,
"unc": 0.11936056928416994,
"x": [],
"y": []
},
"seenTime": "2016-09-24T00:06:40Z",
"ssid": "MR34 Bridge",
"os": "Mac OS X",
"clientMac": "f4:5c:89:9b:17:67",
"seenEpoch": 1474675600,
"rssi": 53,
"ipv6": null,
"manufacturer": "Apple"
},
{
"ipv4": "/192.168.0.4",
"location": {
"lat": 51.5355157,
"lng": -0.06990350000000944,
"unc": -0.5,
"x": [],
"y": []
},
"seenTime": "2016-09-24T00:06:19Z",
"ssid": ".interwebs",
"os": "iOS",
"clientMac": "c0:f2:fb:0b:05:e7",
"seenEpoch": 1474675579,
"rssi": 60,
"ipv6": null,
"manufacturer": "Apple"
},
{
"ipv4": "/192.168.0.63",
"location": {
"lat": 51.5355157,
"lng": -0.06990350000000944,
"unc": 0.20755340376944298,
"x": [],
"y": []
},
"seenTime": "2016-09-24T00:06:27Z",
"ssid": ".interwebs",
"os": null,
"clientMac": "18:fe:34:e1:b4:7a",
"seenEpoch": 1474675587,
"rssi": 56,
"ipv6": null,
"manufacturer": "Espressif"
},
{
"ipv4": "/192.168.0.92",
"location": {
"lat": 51.5355157,
"lng": -0.06990350000000944,
"unc": 0.22200004405702012,
"x": [],
"y": []
},
"seenTime": "2016-09-24T00:06:39Z",
"ssid": ".interwebs",
"os": null,
"clientMac": "18:fe:34:ce:a1:6d",
"seenEpoch": 1474675599,
"rssi": 57,
"ipv6": null,
"manufacturer": "Espressif"
},
{
"ipv4": "/192.168.0.35",
"location": {
"lat": 51.5355157,
"lng": -0.06990350000000944,
"unc": 1.6658518302986447,
"x": [],
"y": []
},
"seenTime": "2016-09-24T00:06:37Z",
"ssid": ".interwebs",
"os": null,
"clientMac": "18:fe:34:f2:95:26",
"seenEpoch": 1474675597,
"rssi": 46,
"ipv6": null,
"manufacturer": "Espressif"
},
{
"ipv4": "/192.168.0.69",
"location": {
"lat": 51.5355157,
"lng": -0.06990350000000944,
"unc": 0.6019477321869419,
"x": [],
"y": []
},
"seenTime": "2016-09-24T00:06:02Z",
"ssid": ".interwebs",
"os": null,
"clientMac": "18:fe:34:ed:8b:ea",
"seenEpoch": 1474675562,
"rssi": 61,
"ipv6": null,
"manufacturer": "Espressif"
},
{
"ipv4": "/192.168.0.38",
"location": {
"lat": 51.5355157,
"lng": -0.06990350000000944,
"unc": 1.233417960754815,
"x": [],
"y": []
},
"seenTime": "2016-09-24T00:06:23Z",
"ssid": ".interwebs",
"os": null,
"clientMac": "18:fe:34:fc:5a:7f",
"seenEpoch": 1474675583,
"rssi": 47,
"ipv6": null,
"manufacturer": "Espressif"
},
{
"ipv4": "/192.168.0.15",
"location": {
"lat": 51.5355157,
"lng": -0.06990350000000944,
"unc": 1.5497743004111961,
"x": [],
"y": []
},
"seenTime": "2016-09-24T00:06:40Z",
"ssid": ".interwebs",
"os": "Generic Linux",
"clientMac": "74:da:38:56:0a:80",
"seenEpoch": 1474675600,
"rssi": 47,
"ipv6": null,
"manufacturer": "Edimax Technology"
}
]
}
}
... View more
12-12-2019
01:55 AM
I'm trying to parse data coming from Cisco Meraki CMX using HTTP Event Collector. The raw data was JSON API.
I'm using props.conf
[http_json]
INDEXED_EXTRACTIONS = json
SHOULD_LINEMERGE = false
KV_MODE = json
NO_BINARY_CHECK = 1
TIME_PREFIX = "seenTime": "
TIME_FORMAT = %Y-%m-%d
MAX_DAYS_AGO = 5000
but the event in the Splunk is only parsed to only one event. Do I need to edit transforms.conf for this kind of data or is there any mistake on my props.conf? Thank you.
This is the sample JSON raw data that I'm trying to parse.
{
"version": "2.0",
"secret": "splunk*****",
"type": "DevicesSeen",
"data": {
"apMac": "00:18:0a:13:dd:b0",
"apFloors": [],
"apTags": [
"dev",
"home",
"test"
],
"observations": [
{
"ipv4": "/192.168.0.56",
"location": {
"lat": 51.5355157,
"lng": -0.06990350000000944,
"unc": 0.20755340376944298,
"x": [],
"y": []
},
"seenTime": "2016-09-24T00:06:14Z",
"ssid": ".interwebs",
"os": null,
"clientMac": "18:fe:34:d7:7c:26",
"seenEpoch": 1474675574,
"rssi": 56,
"ipv6": null,
"manufacturer": "Espressif"
},
{
"ipv4": null,
"location": {
"lat": 51.5355157,
"lng": -0.06990350000000944,
"unc": 2.355135751488216,
"x": [],
"y": []
},
"seenTime": "2016-09-24T00:06:28Z",
"ssid": null,
"os": "Android",
"clientMac": "98:f1:70:34:1c:3e",
"seenEpoch": 1474675588,
"rssi": 43,
"ipv6": null,
"manufacturer": "Murata Manufacturing"
},
{ ...
... View more
09-08-2019
10:15 PM
Hi, I edited the question for more details. Thank you so much 🙂
... View more
09-05-2019
10:48 PM
How to reset sorting when using column header to sort table in dashboard?? I have a dashboard with submit button. When I sort the table on my first search and run another search, the new search acquire the sorting on my last search. Is there any way to fix this? Thank you. P.S: Im using sort command in my search query on my dashboard and it doesn't fix the second search.
Edit: I uploaded sample table. When I sort Item Code (Descending) on the dashboard on my first run and then run another search on the same dashboard (using different time range) and click "submit' button, the Item Code on the second search still has descending order.
... View more
07-31-2019
01:42 AM
I have 5 different apps with different index on each apps and with same sourcetypes every apps. I have different calculated fields every apps that has only "per app" permission and my 6th app will be my main app that will search all my index. How will I apply my calculated fields on my 6th app when i make a query of different index. To explain more further, i will have this example...
App1: index=app1
App2: index=app2
App3: index=app3
App4: index=app4
App5: index=app5
On my 6th app, if I search "index=app1", I need the calculated fields that I make on App1. Is there any way to solve this kind of problem?
PS: I cannot make the permission of my calculated fields to Global because it will overlap to other apps because the sourcetype is same on all apps. Thanks 😃
... View more
06-19-2019
06:07 PM
Thanks! This works the way I want it. 😄
... View more
06-18-2019
10:23 PM
I'm having problem on the eval part on join subsearch. When i run this search, I've got this result
"Error in 'eval' command: The expression is malformed. Expected )."
I'm using Dropdown on the dashboard as my timepicker so i have multiple tokens. Thanks
...//my base search//... earliest=$_emon$/$_eday$/$_eyear$:00:00:00 latest=$_lmon$/$_lday$/$_lyear$:23:59:59
| join type=outer
[
search ...//another base search//... latest="+2mon" earliest=[| gentimes start=-1|eval new = relative_time($_emon$/$_eday$/$_eyear$:00:00:00 ,"-2228000")| return $new]
But when I'm using default time picker and use only one token $time.earliest$, my search is okay. Is the issue on this was having multiple tokens when selecting time? Thanks
... View more
06-18-2019
01:00 AM
Hi. Do you find any solution to this? I have this problem too. Thanks
... View more
06-12-2019
05:59 PM
Thanks for researching for a solution sir, I appreciate your effort 🙂 But i came up to another solution which I think the same concept as your answer. I made another field named "Comparison" and used eventstats to compare. This is what I've done,
1. ... [my search] ...
2. | eval Comparison=if(Log=="In", Date+"|"+B1+"|"+B2+"|"+Cost,Date+"|"+B2+"|"+B1+"|"+Cost)
3. | eventstats count as Status by Comparison
4. | eval Status=if(Status=="1","Failed","Passed")
5. | where Status="Failed"
... View more
06-12-2019
05:17 AM
I have this table, and i just want to remove the rows that has the same cost on that date if the B1 of that row is on the B2 of another row. So basically, I just want to remove rows 4 and 5. Is there any way to do this? Thanks.
... View more
