Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- About johnhuang
johnhuang
Motivator
Member since:
07-10-2019
06-08-2026
Community Statistics
| Posts | 378 |
| Solutions | 78 |
| Karma Given | 73 |
| Karma Received | 130 |
| Member Since | 07-10-2019 |
Activity Feed
- Got Karma for Re: What search can list the Empty indexes which are not sending data to splunk enterprise?. 04-10-2025 07:12 AM
- Posted Re: CSS changes in v9.4.0 on Dashboards & Visualizations. 03-04-2025 11:15 AM
- Karma Re: CSS changes in v9.4.0 for coreyCLI. 03-04-2025 11:14 AM
- Posted Re: CSS changes in v9.4.0 on Dashboards & Visualizations. 02-25-2025 12:59 PM
- Posted Re: Dashboard CSS Width setup doesn't work anymore with 9.x version ? on Dashboards & Visualizations. 02-25-2025 12:58 PM
- Karma Dashboard CSS Width setup doesn't work anymore with 9.x version ? for JulienKVT. 02-25-2025 12:57 PM
- Got Karma for Re: Cannot get count by case statement. 11-08-2024 12:39 PM
- Got Karma for Re: Splunk doesn't display extra spaces. 11-08-2024 05:26 AM
- Got Karma for Re: Splunk doesn't display extra spaces. 11-07-2024 08:49 PM
- Karma Re: Join two indexes on time where time is different by 2 sec for yuanliu. 11-07-2024 07:30 PM
- Posted Re: Splunk doesn't display extra spaces on Splunk Search. 11-07-2024 07:23 PM
- Posted Re: Cannot get count by case statement on Splunk Search. 11-07-2024 07:13 PM
- Posted Re: Moving indexers from centos to redhat8 on Getting Data In. 10-04-2024 04:10 AM
- Got Karma for Re: mvexpand multiple multi-value fields?. 08-29-2023 05:49 AM
- Posted Re: How can I adjust the query to include total connections that are initiated out of the country? on Splunk Enterprise. 04-13-2023 10:40 AM
- Posted Re: Need Help with Query Involving Countries on Splunk Enterprise. 04-13-2023 08:23 AM
- Got Karma for Re: Metadata fields license consumption. 04-13-2023 08:12 AM
- Posted Re: Metadata fields license consumption on Getting Data In. 04-13-2023 08:08 AM
- Karma Re: Metadata fields license consumption for mattymo. 04-13-2023 07:53 AM
- Posted Does the length of metadata fields and its value, host, source, and sourcetype count against license consumption? on Getting Data In. 04-12-2023 07:41 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
03-04-2025
11:15 AM
@coreyCLI, thank you for this. Adding "flex-basis" resolved the issue for me.
... View more
02-25-2025
12:58 PM
We're seeing similar issues with 9.3.2408
... View more
11-07-2024
07:13 PM
1 Karma
You can use LIKE or MATCH | eval region=CASE(LIKE(url, "%region1%"), "Region 1", LIKE(url, "%region2%"), "Region 2")
| eval region=CASE(MATCH(url, "region1"), "Region 1", MATCH(url, "region2"), "Region 2")
... View more
10-04-2024
04:10 AM
You can convert/upgrade in place, Red Hat has an utility (Convert2RHEL) that allows you to upgrade CentOS 7 to RHEL 8. We've done this across thousands of CentOS servers with various configurations and apps and had no issues.
... View more
04-13-2023
10:40 AM
Add this after the ip location line: | search NOT Country="United States" If want to exclude a list of Countries: | search NOT Country IN ("United States", "United Kingdom", "France")
... View more
04-13-2023
08:23 AM
There's a few ways to break it down by users. You can try: index=company_logs "Client Type: Cisco AnyConnect VPN Agent"
| iplocation src
| stats dc(src) BY Country Cisco_ASA_user
index=company_logs "Client Type: Cisco AnyConnect VPN Agent"
| iplocation src
| chart dc(src) BY Cisco_ASA_user Country
index=company_logs "Client Type: Cisco AnyConnect VPN Agent"
| iplocation src
| stats dc(src) values(Cisco_ASA_user) AS Cisco_ASA_user BY Country
... View more
04-13-2023
08:08 AM
1 Karma
Thank you @mattymo, I was able to test and confirm your answer. The following event sent to HEC would incur license usage of 22 bytes. {
"index":"summary_is_temp",
"host":"testing_hec_license_consumption.acme.org",
"source":"/var/logs/application_monitoring.log",
"sourcetype":"application_status",
"event":{
"message":"Seems OK"
}
}
... View more
04-12-2023
07:41 PM
Does the length of metadata fields and its value such as time, host, source and sourcetype count against license consumption? For example, the following HEC JSON has a length of 212 characters but the event (_raw) is only 20 characters, is license calculated against the total json length or _raw length?
{
"time":1437522387,
"host":"dataserver01.applicationmonitoring.com",
"source":"/var/logs/application_monitoring.log",
"sourcetype":"application_status",
"event":{
"message":"Seems OK"
}
}
... View more
Labels
- Labels:
-
source
-
sourcetype
12-09-2022
12:53 PM
1 Karma
source=WinEventLog:Security EventCode IN (4728, 4732, 4746, 4751, 4756, 4761, 4729, 4733, 4747, 4752, 4757, 4762, 4786, 4788) earliest=-7d@d
| eval changed_by=mvindex(Security_ID, 0)
| eval member_id=mvindex(Security_ID, 1)
| eval group_id=mvindex(Security_ID, 2)
| rex "A member was (?<change_type>(added|removed))"
| eval host_name=coalesce(src_nt_host, dvc_nt_host, host)
| rename EventCode as event_code EventCodeDescription AS event_desc
| table _time host_name changed_by change_type group_id member_id event_code event_desc
... View more
11-16-2022
02:29 PM
Splunk doesn't like fieldnames with special characters like periods. | rename properties.url AS endpoint
| rex field=endpoint mode=sed "s/\/\d+\//\/{id}\//"
... View more
11-16-2022
10:10 AM
| eval Count=LOWER(Count)
| fillnull value="0m" Count
| eval {Year}=Quarter." ".Count
| stats max(20*) AS 20* BY Quarter
| sort -Quarter
| table 20* With test data: | makeresults | eval data="2021,Q4,2m;2021,Q3,1m;2021,Q2,2m;2021,Q1,;2022,Q4,5m;2022,Q3,7m;2022,Q2,8m;2022,Q1,5m"
| eval data=split(data, ";") | mvexpand data
| rex field=data "(?<Year>\d+)\,(?<Quarter>\w+)\,(?<Count>\w+)?"
| table Year Quarter Count
| eval Count=LOWER(Count)
| fillnull value="0m" Count
| eval {Year}=Quarter." ".Count
| stats max(20*) AS 20* BY Quarter
| sort -Quarter
| table 20*
... View more
11-16-2022
09:47 AM
1 Karma
If you want to extract all guids after "fieldx": | rex max_match=0 "(\'fieldx\':\s)?(?<fieldx_guids>\w{8}\-\w{4}-\w{4}-\w{4}-\w{12})(?:\,\s|\")" If you want to extract all guids in the data: | rex max_match=0 "(?<guids>\w{8}\-\w{4}-\w{4}-\w{4}-\w{12})"
... View more
11-10-2022
10:12 AM
Try this: <eval token="exclude_uri">"NOT cs_uri_sterm IN (\\\"".replace(trim($exclude$),"\\s+","\\\", \\\"")."\\\")"</eval>
... View more
11-10-2022
09:48 AM
You should create a lookup for the vulnerability definition -- you can adjust the fields to save into the lookup as necessary. First create the initial lookup: index=rapid7 sourcetype="rapid7:insightvm:vulnerability_definition" earliest=-7d@d
| dedup id
| fields id added categories cves cvss_v2_access_complexity cvss_v2_access_vector cvss_v2_authentication cvss_v2_availability_impact cvss_v2_confidentiality_impact cvss_v2_exploit_score cvss_v2_impact_score cvss_v2_integrity_impact cvss_v2_score cvss_v2_vector cvss_v3_attack_complexity cvss_v3_attack_vector cvss_v3_availability_impact cvss_v3_confidentiality_impact cvss_v3_exploit_score cvss_v3_impact_score cvss_v3_integrity_impact cvss_v3_privileges_required cvss_v3_scope cvss_v3_score cvss_v3_user_interaction cvss_v3_vector denial_of_service description links modified pci_cvss_score pci_fail pci_severity_score pci_status published references risk_score severity severity_score title
| rename id AS vulnerability_id
| table vulnerability_id categories title description cves cvss_v2_score cvss_v3_score pci_cvss_score severity severity_score added modified
| outputlookup rapid_vulnerability_definition_lookup.csv To keep the lookup up to date, schedule a report (daily or as often as you need) index=rapid7 sourcetype="rapid7:insightvm:vulnerability_definition" earliest=-1d@d
| rename id AS vulnerability_id
| append [| inputlookup rapid_vulnerability_definition_lookup.csv]
| dedup vulnerability_id
| table vulnerability_id categories title description cves cvss_v2_score cvss_v3_score pci_cvss_score severity severity_score added modified
| outputlookup rapid_vulnerability_definition_lookup.csv To use the lookup: index=rapid7 sourcetype="rapid7:insightvm:asset:vulnerability_finding" finding_status=new
| eval date=strftime(now(),"%m-%d")
| eval date=strftime(now(),"%m-%d")
| eval date_first=substr(first_found,6,5)
| where date=date_first
| lookup rapid_vulnerability_definition_lookup.csv vulnerability_id OUTPUT title description
... View more
11-10-2022
09:21 AM
1 Karma
This should match your output. | makeresults
| eval data="11/8,Apple,X,3;11/8,Apple,Y,10;11/8,Apple,X,3;11/8,Apple,Y,10;11/8,Orange,Y,6;11/8,Orange,X,1;11/8,Orange,Y,6;11/9,Apple,X,0;11/9,Apple,Y,9;11/9,Apple,X,0;11/9,Orange,X,7;11/9,Orange,Y,2"
| eval data=split(data, ";")
| mvexpand data
| rex field=data "(?<Date>[^,]*)\,(?<Fruit>[^,]*)\,(?<Seller>[^,]*)\,(?<Bad_count>[^,]*)"
| table Date Fruit Seller Bad_count
| eval {Seller}_bad_count=Bad_count
| eventstats max(*_bad_count) AS *_bad_count BY Date Fruit
| table Date Fruit Seller Bad_count *_bad_count
... View more
11-10-2022
08:48 AM
Your table layout example is not clear. Does the dashes between the field values represent artificial delimiters or is it part of the value?
... View more
11-10-2022
08:36 AM
Are the fieldnames Date, Fruit, Seller, Bad_count? Could you provide a sample of your data (screenshot)?
... View more
11-10-2022
08:04 AM
Try something like this. You have to manually select the column chart and format the X-Axis Label to rotate vertically. <base_search>
| timechart span=1d count
| eval date=strftime(_time, "%Y-%m-%d")
| table date count
... View more
11-10-2022
07:51 AM
Keep in mind that =@d is a short way of expressing =-0d@d. As best practice, I recommend you use =-0d@d. earliest=-1d@d+7h latest=-1d@d+19h
... View more
11-10-2022
07:43 AM
Assuming your fieldnames are: Date, Fruit, Seller, Bad_count | eval {Seller}_bad_count=Bad_count
| eventstats sum(*_bad_count) AS *_bad_count BY Date
| table Date Fruit Seller Bad_count *_bad_count
... View more
11-08-2022
03:14 PM
Combine the multivalued fields, take a count, then dedup and count again. If the count goes down after deduping, you have a match. <base_search>
| eval id_combined=MVAPPEND(ID1, ID2)
| eval id_ct=MVCOUNT(id_combined)
| eval id_combined=MVDEDUP(id_combined)
| eval id_dc=MVCOUNT(id_combined)
| eval match=IF(id_ct>id_dc, "TRUE", "FALSE")
... View more
11-08-2022
11:02 AM
Could you provide a sample query and data that you're using?
... View more
11-08-2022
06:46 AM
Could you expand the userAction field?
... View more
