Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About mklhs
mklhs
Path Finder
Member since:
07-08-2019
08-25-2020
Community Statistics
| Posts | 24 |
| Solutions | 1 |
| Karma Given | 4 |
| Karma Received | 0 |
| Member Since | 07-08-2019 |
Activity Feed
- Tagged Connection between traffic in firewall logs on Splunk Enterprise. 08-20-2020 11:53 PM
- Tagged Connection between traffic in firewall logs on Splunk Enterprise. 08-20-2020 11:53 PM
- Posted Connection between traffic in firewall logs on Splunk Enterprise. 08-20-2020 12:30 PM
- Karma Re: Compare Two Fields with different Names on different Index for DavidHourani. 06-05-2020 12:50 AM
- Karma Re: Alert Not Triggering for woodcock. 06-05-2020 12:50 AM
- Karma Re: Create Search for a Host who dont send Data for x minutes in the last 10 Days for renjith_nair. 06-05-2020 12:50 AM
- Karma Re: Create Search for a Host who dont send Data for x minutes in the last 10 Days for renjith_nair. 06-05-2020 12:50 AM
- Posted Re: makeresult Work in normal Search app but not in my Dashboard on Dashboards & Visualizations. 03-24-2020 01:40 PM
- Posted Re: makeresult Work in normal Search app but not in my Dashboard on Dashboards & Visualizations. 03-24-2020 01:36 PM
- Posted makeresult Work in normal Search app but not in my Dashboard on Dashboards & Visualizations. 03-24-2020 11:54 AM
- Tagged makeresult Work in normal Search app but not in my Dashboard on Dashboards & Visualizations. 03-24-2020 11:54 AM
- Posted How to extract fields from the header? on Splunk Search. 02-20-2020 04:48 AM
- Tagged How to extract fields from the header? on Splunk Search. 02-20-2020 04:48 AM
- Tagged How to extract fields from the header? on Splunk Search. 02-20-2020 04:48 AM
- Posted Re: Use Lookup to control searches how can i use a value at the lookupcsv as a variable for earliest=$variable$ on Splunk Search. 02-17-2020 02:31 PM
- Posted Use Lookup to control searches how can i use a value at the lookupcsv as a variable for earliest=$variable$ on Splunk Search. 02-16-2020 07:28 AM
- Tagged Use Lookup to control searches how can i use a value at the lookupcsv as a variable for earliest=$variable$ on Splunk Search. 02-16-2020 07:28 AM
- Posted How can the results of multiple notifications (triggered alarms) be written to a dashboard using a Lookup? on Dashboards & Visualizations. 01-07-2020 04:57 AM
- Tagged How can the results of multiple notifications (triggered alarms) be written to a dashboard using a Lookup? on Dashboards & Visualizations. 01-07-2020 04:57 AM
- Tagged How can the results of multiple notifications (triggered alarms) be written to a dashboard using a Lookup? on Dashboards & Visualizations. 01-07-2020 04:57 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
08-20-2020
12:30 PM
Hi, guys,I need your swarm intelligence. I'm supposed to write a use case that detects a very specific traffic pattern. Specifically, this is about an SRC system sending a packet to a destination system on destination port 161 and within 10 minutes this destination system sends a "response" "connection" to another system on destination port 69. Here the 2nd destination system can be the 1st SRC system or another. I can't get a real transaction here because there is no identifier except that the 1st destination system becomes the SRC system. I thank you for your time and effort!
... View more
Labels
03-24-2020
01:40 PM
Thank you for your Time
This is the Part from my Dashboard, if you need more Tell me
My Dashboard:
<form>
<label>Analyse Dashboard</label>
<fieldset submitButton="true" autoRun="false">
<input type="text" token="analyse_result" searchWhenChanged="true">
<label>Analyse Ergebnis</label>
</input>
<input type="dropdown" token="alarm_status">
<label>Alarm Status ändern</label>
<choice value="Open">Offen</choice>
<choice value="Work">In Arbeit</choice>
<choice value="Closed">Geschlossen</choice>
</input>
</fieldset>
<row>
<panel>
<event>
<search>
<query>| makeresults
| eval event_hash=123
| eval alarm_phase = "Open"
| eval wann = now()
| eval kommentar="bla"
| table event_hash alarm_phase wann kommentar</query>
<earliest>0</earliest>
<latest></latest>
</search>
<option name="list.drilldown">none</option>
<option name="refresh.display">progressbar</option>
</event>
</panel>
</row>
</form>
... View more
03-24-2020
01:36 PM
Thank you for your Time
This is the Part from my Dashboard, if you need more Tell me
My Dashboard:
Analyse Dashboard
<input type="text" token="analyse_result" searchWhenChanged="true">
<label>Analyse Ergebnis</label>
</input>
<input type="dropdown" token="alarm_status">
<label>Alarm Status ändern</label>
<choice value="Open">Offen</choice>
<choice value="Work">In Arbeit</choice>
<choice value="Closed">Geschlossen</choice>
</input>
<panel>
<event>
<search>
<query>| makeresults
| eval event_hash=123
| eval alarm_phase = "Open"
| eval wann = now()
| eval kommentar="bla"
| table event_hash alarm_phase wann kommentar
<earliest>0</earliest>
<latest></latest>
</search>
<option name="list.drilldown">none</option>
<option name="refresh.display">progressbar</option>
</event>
</panel>
... View more
03-24-2020
11:54 AM
Hello,
i want to build a dashboard with different panels to Analyse some Alarms.
At the Top i have 2 Input fields field1(text input) and field2(dropdown for status)
I want to habe a panel or an hidden query where i build with | makeresult some Values and write them into my index. Like an Kommentary Funktion for Analysis.
My Problem is now that if i use this query in normal Search app:
| makeresults
| eval event_hash=123
| eval kommentar=abc
| eval wann = now()
| table event_hast kommentar wann
it works perfectly....
But if im going to Save this as a dashboard Panel and look at my Dashboard, it say that no Results get Reflected.
Anyone know This issue?
Thanks for your Help
... View more
02-20-2020
04:48 AM
Hello,
I would like to leave the
"header.JMSDestination"="topic/testTopic/Durable-Non-Subscription/20"
the last two fields extract us as a field by creating an eval function so that it looks like the following:
"Durable-Non-Subscription.20" Next step I would like to separate this variable again so that it looks like "Non-Subscription.20" . Finally, I need two variables:
"Durable-Non-Subscription.20"
"Non-Subscription.20"
Thank you very much
... View more
02-17-2020
02:31 PM
Hey Thank you!
i have a little problem with this query. My Target is to alert here if a host dont send the data in like 10 min. So i have a list from all hosts with params, but this query only shows me the hosts how send data. I need the hosts without data und write this to a outputlookup.
Additional Information: i dont know if it help but all hosts in the list have another "param_search_1"
As Information i have a lookupfile whith recent alarms. i use this lookup file to exclude specific hosts from the search for like 30 min, thats works fine !
... View more
02-16-2020
07:28 AM
Hello together,
i got the task to make 3 searches in total controllable over several systems via a csv.
The CSV looks something like this:
host, search_1, search_2, param_search_1, param_search_2, e-mail
host_test, 1, 1, 10, 20, bla@web.de
the 1 in search_1 and 2 should mean that the respective search is active for this host system.
param 10 is the variable from when search_1 should trigger an alarm.
The search_1 should tell me if the host_test has not sent any events for more than 10 minutes.
search index=blue earliest=$param_search_1$ sourcetype=foo host=$host$
only it doesn't work quite the way I want it to... does anyone have any idea how I can use a CSV to parameterize the searches?
... View more
01-07-2020
04:57 AM
I would like to monitor each individual queue. The alarm can be parameterized for individual queues via lookup.
My goal is to build a dashboard in a way that each line does not only show the monitored queue but also the method (see below 3 methods) with which this queue should be monitored. How can I pack the results triggered by notifications into a dashboard using a lookup table?
The method consists of 3 notifications for each individual queue:
1) Notification for missing message flow
After the alarm is triggered, how long will no messages flow in minutes?
2) High latency notification [duration=delivery-entry] (e.g. if duration > 1200 )
What is the latency in seconds until an alarm is triggered?
3) Notification of high queue level (e.g. queue_level > 100 )
What is the level in number of messages, from which an alarm is triggered?
-The time until the next same alarm is triggered may be specified in minutes.
(1) Example of a queue that has not generated a message flow in the last 20 minutes:
1.1 Search:
index=hogehoge earliest=-20m@s sourcetype=syslog queue="system1"
1.2 Alerts:
Number of results is zero. Planned. Cron schedule
Also, I.e. for this queue (queue="system1" ) I should create 3 alerts (because 3 methods should be monitored for this queue) and put the results of alerts into the dashboard to make it clear. So far I haven't found a solution how to automatically create alerts for multiple queues (queue="system2" OR queue="system3" ...) and pack their results into the lookup table.
I would be very grateful for their support.
Thanks
... View more
12-18-2019
05:54 AM
Hello,
yes, statistically I have on the day the more or less the same distribution (avg=2,2 GB). Of course on weekends up to about 30% have little data volume.
... View more
12-17-2019
07:21 AM
The relevant data about the future development of CustID are read in via a lookup (new_custID.csv) based on the table:
| search index=myindex sourcetype=mysourcetype
| stats earliest(_time) as first_seen latest(_time) by CustID
| inputlookup append=t new_custID.csv
| stats min(frist_seen) as first_seen max(last_seen) by CustID
| output lookup new_custID.csv
My goal is to build dashboards with the predicted amount of data depending on the connection projects in order to get an overview of the imported amount of data in Splunk (Licensing costs) , so that I can link these new findings in my query:
| search index=myindex sourcetype=mysourcetype
| eval esize=len(_raw)
| stats sum(esize) as Volume_of_Data
The questions arise:
1) How can one automatically in Lookup recognize which concrete CustIDs are in operation / have been newly added after a certain period of time (for example, statistically seen monthly)? (Extrapolation).
2) A selection list can be used to select the times mentioned in the above lookup.
After selecting a point in time, the predicted amount of data for this point in time is displayed.
... View more
11-11-2019
02:57 AM
Thank you very much for your answer! Unfortunately it is not what I am looking for. I would like to set up a monitoring to detect if the latency of the file processing is too high. I have to calculate the time from server_a to server_b and back again. Per direction and in total. I can identify the event running from server_a -> server_b -> server_a by a unique id. I calculate the duration for 3 possible event_types in my current query, but so far I can't tell if the calculated duration is valid from server_a to server_b or from server_b to server_a.
... View more
11-11-2019
02:34 AM
Hello Guys,
i try to generate different fields using if 2.
I would like to write a query which looks at the following:
if sender==x then eval field_a==time_a and eval field_b==time_b
if else sender===y then eval field_x==time and eval field_y==time_y
To the general scenario I want to calculate the duration of the processing of log files. For this log files are sent from a server_a to a server_b where they are processed and sent back to server_a.
Here I want to write a query which calculates how long the file needs from server_a to server_b... how long from server_b to server_a and total duration... speaks server_a -> server_b -> server_a
... View more
10-30-2019
05:04 AM
Hello @HiroshiSatoh,
the column "data3" is empty. So, the column "data1" and "data2" were not parsed together. Do you know what it might be?
... View more
10-29-2019
08:20 AM
I have 2 columns with text format (data 1 and data 2). One of the two columns is empty. I want to parse the 2 columns into a separate column together (data3).
P.S search | eval data3 = coalesce(data1, data2) it doesn't work
... View more
08-26-2019
06:27 AM
Hello @diogofgm
Here are the raw data:
{"timestamp":"2019-07-12T20:48:08.371+02:00",
"user":"x",
"component":"new",
"target":"footbar",
"msglog":"invalid login"
}
..........
{"timestamp":"2019-07-12T20:48:08.25+02:00",
"user":"x",
"component":"old",
"target":"footbar",
"msglog":"Registration successful"
}
...........
{"timestamp":"2019-07-12T20:48:08.184+02:00",
"user":"x",
"component":"new",
"target":"footbar",
"msglog":"Registration successful"
}
As I said, 1 field has several values in one row (
i.e. the value has "msglog"
"Registration successful"
"Registration successful"
"invalid login"). I would like to have these values in a table in a separate line extracted so that the results are correct. Otherwise, I can not limit my results, for example, only to "Registration successful"
... View more
08-26-2019
04:19 AM
Hi,
The output of both systems is written to the same index and differ by the component contained in the event.
e.g:
user=x component=old target=foobar
OR
user=x component=new target=foobar
|stats dc(component) as condition, list(msglog) as msglog, list(component) as component
| where condition>1
I have a data that looks like this:
|target |condition |msglog |component
|footbar | 2 |Registration successful |old
| | |Registration successful |new
| | |invalid login |new
A field is grouped into multiple fields (example "msglog", "Date", "component" . However, I want to extract them all separately in one field and list them in a table by targetID. The result should look like this:
|target |condition |msglog |component
|footbar | 2 |Registration successful |old
|footbar | 2 |Registration successful |new
|footbar | 2 |invalid login |new
BUT, if i use mvexpand:
...| mvexpand msglog
| fillnull msglog value=0
| mvexpand component
| fillnull component value=0
| dedup msglog component
There is an additional field with msglog=invalid login with component=old, which is not correct.
|target |condition |msglog |component
|footbar | 2 |Registration successful |old
|footbar | 2 |Registration successful |new
|footbar | 2 |invalid login |new
|footbar | 2 |invalid login |old
Thanks for your Help and your Time
... View more
08-25-2019
10:24 AM
Hello,
I need your help.
I have a field which contains multivalue.
Example:
Table
Foo
in cash
foo
in cash
I need a way to only display events that have foo and bar in this field. I tried to count the values and filter them accordingly but it doesn't work.
... View more
07-31-2019
01:36 PM
Hello,
i would like to find out if both systems deliver the same output.
The output of both systems is written to the same index and differ by the component contained in the event.
e.g:
user=x component=old target=foobar
user=x component=new target=foobar
I now want to find out with a query whether my old and my new system worked the same way and entered the same destination for the event. My question is now how do I write a query that tells me if the output of the old and new system is not the same
Thanks for your Help and your Time
... View more
07-21-2019
07:42 AM
Thats works for me Thank you for your Help
... View more
07-21-2019
07:07 AM
Thank for your Answer but i dont know if this is right for me
I have 2 indexes
in index 1 i have an event with a field named Nachrichtentid
this field has the value foobar
in index 2 i have an event with a field named OriginalId
this field also has the value foobar
I want to find out which events are not forwarded by index 1 and index 2, so where events are missing here. In both indexes the events have only these 2 fields as unique value.
... View more
07-21-2019
06:22 AM
Hello Guys,
i have 2 Index index a and index b
on index a i have a field called nachrichtId
on index b i have a field called originalId
this both fields have the Same string (Value)
i want to write now a Search where i can found out if i have some nachrichtId events on Index a but no originalId on index b.
I want to find out if i have some problems with my Events or if i have a gap between this 2 Indexes
can anyone help me please Thank you 🙂
... View more
07-09-2019
01:33 AM
Hello Guys,
i got it with that query:
index= sourcetype= | eval age = (now() - _time ) | stats first(age) as age, first(_time) as LastTime by xxx | convert ctime(lastTime) as "Last Active On" | eval Status=case(age < 600, "running",age > 600,"Down"
with the last eval i have determined from when a server counts as not available for me
I hope it Helps someone
Thanks @renjith.nair
... View more
07-08-2019
07:17 AM
Thank you!
but if I now have a time interval we say from last week Wednesday to yesterday how would I change the query? somehow that doesn't quite want to be me
... View more
07-08-2019
04:05 AM
Hello,
i wanted to write a search which will return all hosts which have not sent any events for 10 minutes in the last 10 days.
Normally the servers send every minute.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
08-25-2020
04:26 AM
|
