Good morning splunkers, Instead of keep all views created for an app into the <myappfolder>\default(or LOCAL)\data\ui\views , does exist a way to tell Splunk those views are at the same location but organized into some subfolders ? Examples> <myappfolder>\default(or LOCAL)\data\ui\views\ folder1 <myappfolder>\default(or LOCAL)\data\ui\views\ folder2 <myappfolder>\default(or LOCAL)\data\ui\views\ folderN Thanks in advance for your time and support. nik ... View more

Good morning Splunkers, I'm working on the search detailed below. By using two subsearches I'm trying to identify top 5 MY_GROUP's members and also top 5 hosts, both of them evaluated by counted LOGINS. I would like to chart results in a "column table" . I'm using those two subsearches because all of members of MY_GROUP often visits more that 20 hosts and this impact on the density of informations presented in the final chart. Does anybody know a way to make that code simpler and more efficient? Thanks all in advance. p.s. whether I run that search using a startmonthsago=6 instead of last 6 days (I know, it could be smarter to use a summary index, but i need it sporadically)...results are strange: as the two subsearches exit with some partial results. Is that possible in your opinion? This is the search: ([search tag=LOGIN startdaysago=7 tag="MY_GROUP" | stats count by User_Name |stats sum(count) as Total by User_Name | sort -Total | top limit=5 User_Name |fields User_Name] [ search tag=LOGIN startdaysago=6 tag="MY_GROUP" | stats count by host |stats sum(count) as Total by host | sort -Total| top limit=5 host |fields host]) | chart count(host) by User_Name,host" Thanks gkanapathy for your support. What I need is a chart where I get over the X-axis the TOP 5 user for logins realized in the last 6 days; on the Y-axis just count of logins. For each of those TOP 5 users, grouped by their name, I wanna show only those of the top 5 server each user has visited in the rangetime. Thanks... Ciao nik ...i just finished to try, and results arent those Im searching for. Let say Ausr,Busr,Cusr,Dusr, Eusr, Fusr, Gusr are member of MY_GROUP TOP 5 user by their login during last 6 days are : Ausr,Busr,Cusr,Dusr, Gusr. 1srv, 2srv, 3srv, 4srv, 5srv, 6srv, 7srv, ... 20srv... 50srv...2000srv are servers into my network (and consider each of users access 10-15 servers every week) TOP 5 server by counted login during last 6 days are : 1srv, 2srv, 3srv, 4srv, 7srv, What I need is a chart where the output is: EXAMPLE. for those top5 users Ausr = 1srv, 3srv, 4srv, 7srv, Busr = 1srv, 2srv, 3srv, 7srv, Cusr = 1srv, 2srv, 3srv Dusr = 4srv, 7srv Gusr = 1srv, 3srv, 7srv If I use tag=LOGIN tag="MY_GROUP" | stats count by User_Name host I will get splitted rows... so I cannot control TOP5 users If I use **tag=LOGIN tag="MY_GROUP" | chart count over User_Name by host | ** again I loose the control of the output...because all the results come out. ... Tks again.... ... View more

Good morning, I'm developing for a customer a very simple search. tag=mysourcetype tag=myeventtype startdaysago=7 tag= | stats count by _time,User_Name,"tag::eventtype" .... An example could be as follow: tag::sourcetype=WINDOWS tag::eventtype=an_action startdaysago=7 tag=groupfoo | stats count by _time,User_Name,"tag::eventtype" ... I'm using several eventtypes to identify : an_action = there are approximatly 60 eventcode saved as eventype to identify 5 categories of actions groupfoo = there are eventtypes to identify those groups. Customer wants a simple table where is clear WHEN, WHO, WHAT. Troubles are regarding WHAT: | stats count by _time,User_Name,"tag::eventtype" produces good rows (those regarding action ) but also I get duplicated results because groupfoo eventtypes. I mean that also goupfoo is defined as eventtype so for each time I get duplicated results: one (or more) by the perspective of action and this is what I'm looking for. Another one by the perspective of groupfoo : this is the sum of all the previous rows. Using inputlookup command, results aren't better: I built a lookup table for all those events I'm interested in, but: |input lookup mylookuptable.csv ---> works tag::sourcetype=WINDOWS startdaysago=7 tag= [|input lookup mylookuptable.csv | format ]| stats count by _time,User_Name, ... returns 0 events Where I wrong? Thanks in advance for your time and for any suggestions you would gently provide Nik ... View more

Hello Splunkers, Thanks to visit my question. I have two subsets of data related to each other. The set A consists of 50 items. Of these, only top 5 items interests me (subset AA'),assessed a condition. The set B contains 25 items. Of these, only top 5 items interests me (subset BB'),assessed a condition. My goal is: search for the top 5 elements of AA ', once assessed a condition. search for the top 5 elements of B, once assessed a required condition. Count how many intersections have the elements of AA ' with each of the top 5 elements of BB'. (subsearch AA') AND (subsearch BB') gives different results if (subsearch BB') AND (subsearch AA') Can someone kindly suggest me how to build that search using only the subsearches? Thanks in advance. Nik (currently working on splunk 4.0.9) ... View more

Good morning all! Today my goal is : evaluate suspicious logfail by a criteria (as follow). If "logfail" on the same host into my network are grater than #15 over a timerange=2mins Im interested to that event. In other words: I want splunk investigates any potentially dangerous login scenario over my network. I tried to build my search as follow: defining the perimeter of my search sourcetype="WinEventLog:Security" tag::eventtype="LOGFAIL" startdaysago=1 |bucket _time span=2m To evaluate each 2 minutes into previous 24 hours and evaluate if number of LOGFAIL on the same Computer, for each bucket was grater than 5 I would really appreciate if anybody could help me suggesting how to complete that search. I tried transaction to group ComputerName,LOGFAIL but Im not able to define e "minvalueevents" Thanks in advance for your time and suggestions. Bye for now. Nik p.s.Dear visitor: if this question and\or answers are helpful for your knowledge than let me invite you to vote their answer, in my opinion the easiest way to say them tks for suggestions and help.Bye ... View more

Good Morning all, Anybody knows if exists a limit regarding the amount of eventtype I could set into splunk? I already started to create eventtypes and corresponding tags for a Splunk's installation over a very large IT enviroment (also multiplatform), assuming there are no restriction. In case of limitations...is there a workaround to get my goal? Thanks in advance for your time. Nik ... View more

Good Morning all. I'm experiencing a strange behavior when I try to rename _time's field. My goal is to run a search by tag -> piping it to a timechart count -> rename _time as foo. When I run tag="admin" startmonthsago="10" | timechart count | rename _time as foo the result is a table where foo's column isn't into a familiar time format. How can I manage it? How can I keep the original time format (i.e. 11/1/09 12:00:00.000 AM) instead of getting a newer one (1257030000) after the renaming? Thanks in advance for any support. Nik p.s. time format = 11/1/09 12:00:00.000 AM after renaming _time as smthelse --> time format = 1257030000 ... View more