About benefitcos

benefitcos · ‎12-13-2013

Based on Lucas' initial suggestion and some poking around I came up with this: sourcetype!="*Private*" "Connected" "10.0.0.44" | eval USERNAME=lower(USERNAME) | transaction USERNAME maxspan=210s | lookup users.csv Username AS USERNAME | stats count by USERNAME "First Name" "Last Name" Region Country "Job Title" Role Department | inputlookup append=t users.csv | rename Username AS USERNAME | fillnull value=0 count | dedup USERNAME | table USERNAME "First Name" "Last Name" Region Country "Job Title" Role Department count | rename count AS Visits | sort -Visits This returns all my users sorted by most visits on top and lists all my zero connections at the end of the report. Perfect!

benefitcos · ‎12-13-2013

Thanks Lucas for the info. This exact formula returned all the entries from my .csv file with -0- visits while ignoring the counts from my first search. But bits and pieces of your suggestion did work nicely in my formula, while adding the dedup command. View answer above.

benefitcos · ‎12-12-2013

I have a search that checks my connection logs so to track users who log into my website against a lookup csv with about 500 users listed: sourcetype!="*Private*" "Connected" "10.0.0.44" | transaction USERNAME maxspan=210s | lookup users.csv Username AS USERNAME | stats count by USERNAME "First Name" "Last Name" Region Country "Job Title" Role Department | table USERNAME "First Name" "Last Name" Region Country "Job Title" Role Department count | rename count AS Visits | sort -Visits This returns all users who logged in to the website in the specified period in the order of most visits to fewest. But now, I'm more interested in the users who are NOT logging into my website (so I can find out why). Basically I want the full lookup.csv user list with their Visit counts for each period. How do I return the -0- Visits users along with the N Visits users together in one table?

benefitcos · ‎11-08-2013

Hello, Have installed AMMap and Maxmind per instructions here and in documentation. Using this formula: sourcetype="Sites*" Preview fromHost!="'10.*'" | rex "'(?<fromHost>\d+.\d+.\d+.\d+)'"| stats count by fromHost | head 100 | eval count_label="Login" | eval iterator="fromHost" | eval iterator_label="IP" | eval movie_color="#FF0000" | eval output_file="home_threat_data.xml" | eval app="amMap" | lookup geoip clientip as fromHost I'm able to generate results (which I can't post without enough 'karma', but trust me, I'm seeing cities, countries, lat, long, region, etc..) However, when I use the | mapit command, all of a sudden 'no events were found'. When I run a check of the Splunk logs there are entries which coincides with each | mapit request: Fri Nov 08 11:31:03 2013 - ERROR - Traceback:Traceback (most recent call last): File "D:\splunk\etc\apps\amMap\bin\map_results.py", line 180, in run result_dict_list = get_results() File "D:\splunk\etc\apps\amMap\bin\map_results.py", line 41, in get_results if results[0].has_key("app"): IndexError: list index out of range Any ideas on what might be happening? Appreciate any tips!

benefitcos · ‎11-08-2013

Per Splunk, there is a bug in DB Connect; by upgrading to the latest version fixed the bug and added 'Amazon S3' to the Data Inputs window (where the app now works).

benefitcos · ‎11-04-2013

Hello all, Trying to install and setup the Splunk for Amazon S3 Add-on. I can access and download the App from here: http://apps.splunk.com/app/1137/ . I get a successful message from Splunk after install. I've added the App to my instance of Splunk; I can see the files within the Splunk folder [D:\splunk\etc\apps\s3...], I've configured the s3.py spec file with my access and secret keys (within ~\bin...], but I am unable to see anything named Amazon S3 in the Data Input section of Splunk, nor any other options to Add Data via Amazon S3. Looked on Splunk.com for any documentation (couldn't find any) and the few postings in the Answers section don't fully answer my problem. I've googled the web, as well, but again only limited info was found. Any tips or guidance you could provide this noob would be most appreciated!

benefitcos · ‎10-16-2013

per lukejadamec, adding: ... | eval USERNAME=lower(USERNAME) worked nicely.

benefitcos · ‎10-16-2013

That did the trick! Thank you.

benefitcos · ‎10-16-2013

I later on found this answer: http://answers.splunk.com/answers/61646/combining-multivalues-together-inside-a-field However, I'm having trouble combining 'Sandra' and 'sandra' because of the case difference.

benefitcos · ‎10-16-2013

I am new to Splunk but am loving what it can do with it! We use Splunk to track user activity on our webapp. It looks in the logs and extracts my users into the field 'USERNAME'. However, I have one user who uses multiple logins that are almost the same: Sandra.chin ... (17) Sandra Chin ... (10) sandra.chin ... (8) sandra chin ... (4) Sandra chin ... (2) This is the same person, only spelled with case & punctuation five different ways. How can I merge these field values into one entry (lets say, Sandra Chin) with any/all appropriate totals accounted for? (logins, downloads, etc...) When correct, Sandra's single entry should read like this: Sandra Chin ... (41) And sort within the overall users count list like this: Bill Johnson ... (88) Sandra Chin ... (41) Mary Thomas ... (24) Would anyone know how I might accomplish this? Thanks in advance!

Posts	10
Solutions	2
Karma Given	1
Karma Received	4
Member Since	‎10-01-2013

Online Status	Offline
Date Last Visited	‎06-05-2020 02:04 AM

Include zero-count items from lookup

MapIt doesn't map it

Install & Setup S3 Add-on

Merge near-identical field values

Re: Include zero-count items from lookup

Re: Include zero-count items from lookup

Include zero-count items from lookup

MapIt doesn't map it

Re: Install & Setup S3 Add-on

Install & Setup S3 Add-on

Re: Merge near-identical field values

Re: Merge near-identical field values

Re: Merge near-identical field values

Merge near-identical field values