Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- About ajromero
ajromero
Path Finder
Member since:
07-03-2019
11-03-2023
Community Statistics
| Posts | 35 |
| Solutions | 1 |
| Karma Given | 11 |
| Karma Received | 1 |
| Member Since | 07-03-2019 |
Activity Feed
- Posted Re: get the peak total memory usage splitt by day on Splunk Search. 03-16-2023 08:11 AM
- Posted How to get the peak total memory usage splitt by day on Splunk Search. 03-15-2023 05:05 PM
- Tagged How to get the peak total memory usage splitt by day on Splunk Search. 03-15-2023 05:05 PM
- Tagged How to get the peak total memory usage splitt by day on Splunk Search. 03-15-2023 05:05 PM
- Posted eStreamer is sending about 12 logs per minute and each log is about 30 mg- How can I reduce the number and size of logs? on Getting Data In. 08-01-2022 04:05 PM
- Got Karma for Re: How to exclude user name that start with the number "0" on a correlation search on ES?. 02-25-2022 02:10 PM
- Posted Re: How to exclude user name that start with the number "0" on a correlation search on ES? on Security. 02-25-2022 11:06 AM
- Posted Re: How to exclude user name that start with the number "0" on a correlation search on ES? on Security. 02-25-2022 08:30 AM
- Posted How to exclude user name that start with the number "0" on a correlation search on ES? on Security. 02-24-2022 11:44 AM
- Posted Re: Alert when user is log off on Alerting. 06-17-2021 07:51 AM
- Posted Alert when user is log off on Alerting. 06-15-2021 03:53 PM
- Tagged Alert when user is log off on Alerting. 06-15-2021 03:53 PM
- Karma Re: Need to trigger an alert when a process is not running for bowesmana. 06-15-2021 03:48 PM
- Posted Need to trigger an alert when a process is not running on Alerting. 05-12-2021 05:59 PM
- Tagged Need to trigger an alert when a process is not running on Alerting. 05-12-2021 05:59 PM
- Tagged Need to trigger an alert when a process is not running on Alerting. 05-12-2021 05:59 PM
- Tagged Need to trigger an alert when a process is not running on Alerting. 05-12-2021 05:59 PM
- Posted WMI does not collect data from servers that do not use Local System Account on Getting Data In. 04-12-2021 07:44 PM
- Tagged WMI does not collect data from servers that do not use Local System Account on Getting Data In. 04-12-2021 07:44 PM
- Posted eStreamer add on installation on Installation. 03-03-2021 10:43 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
03-16-2023
08:11 AM
that worked but now I'm trying to convert the result to gigabytes I tried this but it doesn't do it | timechart span=1d max(windows_mem_free) as Peak by host |eval Peak=round((Peak/1024/1024/1024),2)
... View more
03-15-2023
05:05 PM
Hi,
How can I make this search to display the peak by day
index=* sourcetype=Perfmon:Memory host=* |timechart span=7d | stats sparkline(avg(windows_mem_free)) as Trend avg(windows_mem_free) as Average, max(windows_mem_free) as Peak , latest(windows_mem_free) as Current, latest(_time) as "Last Updated" by host | convert ctime("Last Updated") | eval Peak=round((Peak)/1000,2) | eval Current=round((Current)/1000,2) | eval Average=round((Average)/1000,2)
Thank you,
... View more
08-01-2022
04:05 PM
eStreamer sending about 12 logs per minute and each log is about 30 mg this is causing an issue with the license consumption, we get license violation every day
what setting can I change to reduce the number of logs and the size of the logs
thank you
... View more
- Tags:
- estreamer
Labels
- Labels:
-
heavy forwarder
Hi, that actually worked pretty good for me. thank you
... View more
02-25-2022
08:30 AM
Hi tshah-splunk I tried that and it worked, but just realized that there more users with different names like these How can I exclude that kind of users? Thank you, Araceli
... View more
02-24-2022
11:44 AM
how to exclude user name that start with the number "0" on a correlation search on ES
This is the query:
| from inputlookup:access_tracker | stats min(firstTime) as firstTime,max(lastTime) as lastTime by user | where ((now()-'lastTime')/86400)>90
and I want to remove all user that start with "0"
Thank you
... View more
Labels
- Labels:
-
authentication
-
LDAP
06-17-2021
07:51 AM
Hi, I already have the age field in the table and it doesn't do it index="wineventlog" user="*.COM" OR user="*" | head 1 | eval age = now() - _time |table _time user name thanks
... View more
06-15-2021
03:53 PM
I need to get an alert when a user is log off from a server, here is my query index="wineventlog" user="*.COM" OR user="*" | head 1 | eval age = now() - _time |table _time user name Then I'm setting a custom alert to but I don't get any alert Thank you,
... View more
Labels
- Labels:
-
alert action
-
alert condition
05-12-2021
05:59 PM
Need to trigger an alert when a process is not running, here is my query but I can not the alert to work index="os" source="Perfmon:Process" host="vm* process_name="RT*" | dedup host process | join host [search index="os" source=Perfmon:Process host="vm*" process_name="RT*" | stats latest(host) latest(_time) by host |eval lastSeen='latest(_time)'|fields host lastSeen] |eval status=if(lastSeen<(_time - 300), "not running","running") |table host status process_name | search status = "not running" or is there another way to look for windows process not running thank you
... View more
04-12-2021
07:44 PM
I'm using WMI to monitor when services are down, but noticed that the servers that don't use the Local System account don't report any data
... View more
- Tags:
- wmi
Labels
- Labels:
-
inputs.conf
-
monitor
-
universal forwarder
-
Windows
03-03-2021
10:43 AM
we are trying to install the eStreamer add on on a Linux box but we can't. Everytime that we tried nothing happen no error nothing but it doesn't install anyone that have any experience with this installation thank you
... View more
- Tags:
- add on
Labels
- Labels:
-
heavy forwarder
-
Linux
01-25-2021
05:21 PM
Need to calculate the percentage of two columns- I have a search that gives me a total of two columns and I need to get the percentage like this: is what % column "Today" is of column "Grand" Here is the search I'm using Here is the search `duo_index` extracted_eventtype=authentication NOT auth_log_version=v2 result=SUCCESS | eval factor=if(factor=="n/a",reason,factor) | where factor!="None" and factor!="null" | eval factor=upper(factor) | stats count by factor | eventstats sum(count) as total |appendpipe [stats sum(count) as "equal"] |append[search `duo_index` extracted_eventtype=authentication NOT auth_log_version=v2 result=FAILURE | eval factor=if(factor=="n/a",reason,factor) | where factor!="None" and reason!="null" | stats count by reason | eventstats sum(count) as total |appendpipe [stats sum(count) as "total2"] ] |eval perc=(total2/equal)*100 |table perc equal total2 Thank you
... View more
01-11-2021
04:28 PM
login with splunk local admin account after Single sign on was enable. We started using SAML for the SSO so now we don't type any user/password, but I was wonder if I can still login using splunk local admin account, how can I do that
... View more
Labels
- Labels:
-
administration
11-20-2020
11:16 AM
We are trying to configure DUO Connector in Splunk, but we are getting " error credentials" and DUO documentation does not have a lot information anyone got duo working in Splunk?
... View more
- Tags:
- setup
Labels
- Labels:
-
configuration
-
troubleshooting
11-02-2020
03:40 PM
we set the buckets to roll from hot into cold for 90 days, but for some reason is not doing it and we are running low on space. How can I manually move buckets from to cold to free space Thank you
... View more
- Tags:
- buckets
Labels
- Labels:
-
indexer clustering
10-08-2020
09:09 AM
I added a third Index to my Cluster Master How do I tell my forwarders to send data to the new index or how my forwarders know about the new index thank you
... View more
- Tags:
- index
Labels
- Labels:
-
universal forwarder
09-21-2020
05:31 PM
I have a litigation hold report and I need to display if the account is disable. I created a lookup table so I can display user full and if the account is disable. when I pull data from the lookup table I can't display the status Here is my search eventtype=msexchange-mailbox-usage Database="*" Database="*" LitigationHoldEnabled=True |dedup User |table User, TotalDeletedItemSize, TotalItemSize, Database, Total, LitigationHoldEnable |addtotals fieldname=Total | lookup ActiveDirectoryUsers.csv User OUTPUT name |stats max(Total) as Total by name, Database |eval Total=round((Total/1000/1000/1000),2) |rename name as "Mailbox User Name",Total as "Mailbox Size (GB)" in the lookup table I have this: name, User, status for example : name: Rumer, Shelly, status: disable in my final report all I see the name, database, total i'm not able to display the status thank you
... View more
- Tags:
- reports
09-11-2020
09:06 AM
I was thinking if possible, can I restore the HOT data from a backup into the new drive? thanks
... View more
09-11-2020
08:39 AM
We are planing on move our HOT data to a faster storage. This new drive is already present in our Windows Index, so what is the best way to approach this. We use NetApp for storage thank you
... View more
Labels
- Labels:
-
indexer
08-11-2020
02:41 PM
We don't use apache can I do this by using proxy? or other way thanks
... View more
07-17-2020
11:37 AM
We are using LDAP to login splunk but now we want to enable SSO. We have Splunk enterprise 7.2.6 how can I do this? thank you
... View more
Labels
- Labels:
-
configuration
07-09-2020
08:18 AM
I will look into this thanks
... View more
07-07-2020
02:09 PM
we are having issues with performance and just noticed that our F5 app is consuming a lot cpu resources: the attach file is from one of my indexes what can I do? thank you
... View more
- Tags:
- Apps cpu usage
Labels
- Labels:
-
troubleshooting
07-06-2020
02:23 PM
awesome , this worked perfect thanks but I have another question, I would like to remove the Email Accounts field that does not have a User Name see below if that possible thanks
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
11-03-2023
07:07 PM
|
Karma given to
