About icyfeverr

icyfeverr · ‎09-14-2017

@LukeMurphey Works perfectly. Thank you for getting this deployed, it is much appreciated.

icyfeverr · ‎09-01-2017

Thanks for taking my question into consideration, it is much appreciated. Do you know when you expect to have 1.2 released by chance?

icyfeverr · ‎08-31-2017

I am using the app File Meta-data, and it is supposed to Monitor Files within a directory and/or sub-directories. The only time I can have it report on individual files, is if I check the option to "Recursively iterate sub-directories". Is there a way to have it monitor individual files within a directory without this option checked? Again, if I check this option, I do get file level details, but for all sub directories, but if it is not checked, I only get meta data on the directory itself with no file level details. Example without option checked, the only output received is: time="Thu Aug 31 23:29:00 2017" is_directory=1 file_count=1 directory_count=2 path=G:\Users\tmpuser\documents\test atime="Thu Aug 31 23:11:23 2017" atime_epoch=1504239083.99 ctime="Thu Aug 31 22:45:54 2017" ctime_epoch=1504237554.1 dev=0 gid=0 ino=0 mode=16895 mtime="Thu Aug 31 23:11:23 2017" mtime_epoch=1504239083.99 nlink=0 size=0 uid=0 file_count_recursive=3 directory_count_recursive=4 Example with it checked, but I get all files with in the directory and all sub-directories: time="Thu Aug 31 23:31:51 2017" is_directory=0 path=G:\Users\tmpuser\documents\test\file.txt atime="Thu Aug 31 23:11:17 2017" atime_epoch=1504239077.35 ctime="Thu Aug 31 23:11:17 2017" ctime_epoch=1504239077.35 dev=0 gid=0 ino=0 mode=33206 mtime="Thu Aug 31 23:11:17 2017" mtime_epoch=1504239077.35 nlink=0 size=0 uid=0 time="Thu Aug 31 23:31:51 2017" is_directory=0 path=G:\Users\tmpuser\documents\test\folder1\folder1.txt atime="Thu Aug 31 23:11:33 2017" atime_epoch=1504239093.87 ctime="Thu Aug 31 23:11:33 2017" ctime_epoch=1504239093.87 dev=0 gid=0 ino=0 mode=33206 mtime="Thu Aug 31 23:11:33 2017" mtime_epoch=1504239093.87 nlink=0 size=0 uid=0

icyfeverr · ‎11-04-2015

icyfeverr · ‎11-03-2015

The splunk user probably does not have write access. Need to check permissions on the directorie(s)/file(s).

icyfeverr · ‎10-28-2015

amljohnson, based on his note, it sounds like he setup a DB Input, which is indexing the database on the server at set intervals, and using that to correlate his data instead of using the DB Lookup, which I believe queries the db directly at the time of search.

icyfeverr · ‎10-28-2015

Hi hgehrts, Are you using Advanced Query Mode? That is where I have been seeing the most problems with that error. What I have determined so far is that if you are using 'JOIN' statements it seems to throw this error when searching, not through the wizard. I removed the joins and did the linkage in the WHERE statement instead and that has seem to resolve my issue, not that I agree with it, as I think I should be able to use JOIN statements, but thought I would post my findings thus far. Error Example: SELECT ce.id, err.error_msg FROM rdb.error_id ce JOIN rdb.d_error err ON err.d_error_id = ce.d_error_id Fixed Example: SELECT ce.id, err.error_msg FROM rdb.error_id ce, rdb.d_error err WHERE err.d_error_id = ce.d_error_id

icyfeverr · ‎10-27-2015

I struggled with this myself just recently, the main piece is selecting the correct connection type, as you will see below. For SID use 'oracle', if you are using Service name use 'oracle_service'. If you are using a SID follow this format: [SID Example] connection_type = oracle database = sid host = hostname jdbcUseSSL = 0 port = 1521 If you are using a Service Name follow this format: [Service Name Example] connection_type = oracle_service database = service_name host = hostname or ip address jdbcUseSSL = 0 port = 1563

icyfeverr · ‎10-27-2015

So, I kept digging and I see that I did a foobar. The props.conf file should not have EXTRACT in it for the transforms reference and should contain REPORT instead. Changed from: Props.conf: [sr_info] EXTRACT-id = id To: [sr_info] REPORT-id = id All is working now....Yay

icyfeverr · ‎10-27-2015

Just to note, because it is not displaying in the post. There is a (backslash) in front of the d for 15 digits.

icyfeverr · ‎10-27-2015

I setup a field extraction two ways, neither have worked and have caused Splunk to not function in a manner I think it should. I setup a field extraction through the GUI and applied a transform through the GUI. Upon searching, the extraction is not shown, which would point me in the direction of my regex being incorrect, however, I do not believe this to be the case. The weird part is when I attempt to do a field extraction through the Wizard walk through, it takes me to a blank page now, and if I remove it the page now loads. Since this did not work, I attempted to create the files manually in the app to see if the GUI was breaking it, but I got the same results as above. below is a copy of my props and transforms config files. Props.conf: [sr_info] EXTRACT-id = id Transforms.conf [id] MV_ADD = 1 REGEX = (?<id>(EI|EP|DK)\d{15}) Any ideas why this would be breaking the Wizard Walk through extraction page, the one you are able to click on via the event(s)? FYI - When I do the extraction through the Wizard my regex is fine, it is rather simple anyways and wouldn't expect any issues from it.

icyfeverr · ‎08-19-2015

Ok, so utilizing the field extractions for the End Session time is all that would be needed then, since the start time is associated to Start Session time, then just use the eval to translate the string to an epoch time and then subtracting the two to get the second difference. I guess I will go with that, I was just trying to see if there was a different/better way of going about it. Thanks.

icyfeverr · ‎08-18-2015

Yes, that is a potential solution. I was really hoping there was a way to have the multiline event act like the transaction command and have it apply a duration field to the event upon index.

icyfeverr · ‎08-18-2015

I appreciate the response, but the Transaction command can not be applied to a multi-line-event, as a multi-line-event is essentially, at least in this case, a "transaction" already. The text example you see above is a "single" event since it was indexed as a multi-line event.

icyfeverr · ‎08-18-2015

I am trying to find the best way to get the duration (in seconds) on a multiline event, possibly having it captured during indexing. I know I can use rex/field extractions and use the eval command at search-time, but was hoping for some more ideas. Example: --------------------[Start Session - 2015-08-18 10:47:27.000]------------------- [2015-08-18 10:47:27.000][INFO]Attempting to connect... [2015-08-18 10:47:27.000][INFO]Sending request [2015-08-18 10:47:27.000][INFO]Retrieving response [2015-08-18 10:47:29.000][INFO]Response size = 627 bytes ---------------------[End Session - 2015-08-18 10:47:29.000]-------------------- Duration = 2 (seconds) Thanks in advance.

icyfeverr · ‎08-13-2015

couple of things: First, acharlieh is correct, you will want to have the transforms.conf file setup with the following: [ieee-mac-oui] filename = ieee-mac-oui.csv match_type = WILDCARD(Vendor_MAC) The next part referenced by mcaiep is correct, you will want the values in your lookup table stored with the '' at the end of the values (ex. below): Vendor_MAC,Manufacturer 000000,XEROX CORPORATION 000001*,XEROX CORPORATION 000002*,XEROX CORPORATION 000003*,XEROX CORPORATION Now, the last part is to reference the stanza name (ieee-mac-oui) in your lookup. Current Search: index=windhcp | lookup ieee-mac-oui.csv Vendor_MAC OUTPUT Manufacturer | table hostname, mac, src_ip, Manufacturer Corrected Search using Stanza: index=windhcp | lookup ieee-mac-oui Vendor_MAC OUTPUT Manufacturer | table hostname, mac, src_ip, Manufacturer Notice the slight difference above, this tells the search to use the stanza in the transforms.conf file instead of just referencing the csv directly without the wildcards.

icyfeverr · ‎09-30-2014

Can you provide an example output that you are currently getting and also provide an example of what your expecting based on your example above.

icyfeverr · ‎09-30-2014

gkanapathy, I would agree with your response, but it would not work in my circumstance (at least with my current knowledge). below is the query that I was trying to do as a Subsearch but was unable to get it to work properly because of what myself and MuS explained above and below. sourcetype=checks check_number=XXX | eval earliest=strftime(_time-2, "%m/%d/%Y:%H:%M:%S") | eval latest=strftime(_time+2, "%m/%d/%Y:%H:%M:%S") | fields + earliest, latest, sourcetype | format "" "(" "" ")" "OR" ""

icyfeverr · ‎09-25-2014

This does work, but not the way you think. The earliest and latest work, but the Time Picker is still utilized for the date range. What this means is if you leave the Time Picker as "All Time", that it will have to search through all time and it is extremely slow, especially compared to if you run the search(es) independently.

icyfeverr · ‎09-25-2014

It's b/c the backslash is not showing up, which is why I thought that. If the path is correct and you did a "splunk restart", that should have worked.

icyfeverr · ‎09-25-2014

Well maybe your path is correct, does it have a backslash after the C:? For some reason the forums will not display the backslash.

icyfeverr · ‎09-25-2014

I could be wrong, but I think your path is incorrect: Current: "[monitor://C:UserspdimriDesktopsharedsplunk__9.txt]" Should be: [monitor://C:\UserspdimriDesktopsharedsplunk__9.txt] This will require a restart obviously after the change.

icyfeverr · ‎09-25-2014

Can you provide an example of how you expect the output to look?

icyfeverr · ‎09-25-2014

Try the below at the end of your original search: | eval exp_date=relative_time(Lastpasswordchangedate, "+90d@d") | eval exp_days=floor((exp_date-Lastpasswordchangedate)/86400) If the above does not work, please copy and paste your entire search and provide a screenshot,

icyfeverr · ‎09-24-2014

I was just about to post the same thing, I am pretty sure he isn't using epoch time, so your second option is what he will want to use, but I think you can remove the strptime and just have the below. eval exp_date=strftime(relative_time(Lastpasswordchangedate, "+90d@d"), "%m/%d/%Y")

Posts	40
Solutions	5
Karma Given	5
Karma Received	11
Member Since	‎10-01-2013

Online Status	Offline
Date Last Visited	2 weeks ago

Monitoring Files without Recursively iterating sub...

Splunk 6.3 Extract Fields Props.conf & transforms....

How to get the duration in seconds from a multilin...

Why is my "OR" statement not working?

The Lovely Transaction Command

Parse first/last error in an event

Re: Monitoring Files without Recursively iterating...

Re: Monitoring Files without Recursively iterating...

Monitoring Files without Recursively iterating sub...

Re: Using a search base with inputlookup, how do I...

Re: I have sudo splunk user access, but why am I g...

Re: After intalling Splunk DB Connect 2.0.6 on our...

Re: After intalling Splunk DB Connect 2.0.6 on our...

Re: DB Connect 2: How to configure a connection to...

Re: Splunk 6.3 Extract Fields Props.conf & transfo...

Re: Splunk 6.3 Extract Fields Props.conf & transfo...

Splunk 6.3 Extract Fields Props.conf & transforms....

Re: How to get the duration in seconds from a mult...

Re: How to get the duration in seconds from a mult...

Re: How to get the duration in seconds from a mult...

How to get the duration in seconds from a multilin...

Re: Why is our search on Windows DHCP logs using a...

Re: How to write regex to filter out UUID before s...

Re: Is it possible to use earliest twice in one se...

Re: Is it possible to use earliest twice in one se...

Re: How to forward events to a particular index?

Re: How to forward events to a particular index?

Re: How to forward events to a particular index?

Re: How To Table The Average Of A Field Created Us...

Re: How to create a new date field with a value th...

Re: How to create a new date field with a value th...