Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Splunk Answers
- :
- About MuS
MuS
Legend
Member since:
02-05-2011
Sunday
Community Statistics
| Posts | 4421 |
| Solutions | 808 |
| Karma Given | 2134 |
| Karma Received | 3911 |
| Member Since | 05-02-2011 |
Activity Feed
- Got Karma for Re: How to include dashboards in an app from other apps?. Wednesday
- Got Karma for Re: How to forward logs from universal forwarders to heavy forwarders for filtering before routing to indexers?. a week ago
- Got Karma for Re: Where is actually SPLUNK_DB located?. 2 weeks ago
- Got Karma for Re: Why am I getting a "Search is waiting for input" message on my dashboard panel?. 2 weeks ago
- Got Karma for Re: How to change server roles in the Distributed Management Console using the CLI or conf files?. a month ago
- Got Karma for Re: Where is actually SPLUNK_DB located?. 04-09-2024 09:16 AM
- Got Karma for Re: How to search and monitor Splunk user logins that are using LDAP based authentication?. 04-03-2024 02:47 PM
- Got Karma for Re: How to search the names of triggered alerts, their trigger time, and the events that triggered them?. 03-16-2024 06:23 AM
- Got Karma for Re: How to display a list of fields for an index?. 03-13-2024 07:14 AM
- Got Karma for Re: How to split events from the same log into different indexes based on content?. 03-06-2024 02:21 PM
- Got Karma for Re: Is there a CLI command for debug refresh?. 03-04-2024 01:12 PM
- Got Karma for Re: How to get a distinct count of only unique values of a field. 03-01-2024 12:48 PM
- Got Karma for Re: How to write a search for a specific timestamp?. 02-29-2024 08:09 AM
- Got Karma for Re: How to display a list of fields for an index?. 02-14-2024 06:08 AM
- Got Karma for Re: How to search a list of all enabled apps in Splunk and their versions on a search head?. 01-31-2024 09:51 PM
- Got Karma for Re: How to configure a license slave when the GUI won't allow access to Settings?. 01-31-2024 04:45 AM
- Got Karma for Re: What permissions do I need to give a user on the master node to view the monitoring console?. 01-30-2024 06:10 PM
- Got Karma for Re: What are the pain points with deploying your Splunk architecture on Windows OS?. 01-11-2024 09:27 AM
- Got Karma for Re: Securely store API key for modular input app?. 01-02-2024 08:34 AM
- Got Karma for Re: Securely store API key for modular input app?. 12-21-2023 03:06 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 8 | |||
| 20 | |||
| 5 | |||
| 5 | |||
| 14 | |||
| 2 | |||
| 15 | |||
| 15 | |||
| 6 |
12-21-2023
01:36 AM
2 Karma
Hi toocies, Take a look here https://dev.splunk.com/enterprise/docs/developapps/manageknowledge/secretstorage/ this has some good examples for your use case. Hope this helps ... cheers, MuS
... View more
05-17-2023
02:37 AM
Hi there, The tstats command performs queries on indexed fields in tsidx files. The indexed fields can be from indexed data, metadata or accelerated data models. This means it will not scan the _raw events and should normally be super fast except you have bloated tsidx files due to the above mentioned cases. So usually the answer using `tstats` would be the best options and like you said `metadata` does not provide an index name ... but I tried something like this | dbinspect index=*
| rename index AS baz
| table baz
| map maxsearches=100 search="| metadata type=sourcetypes index=$baz$ | eval foo=$baz$" which almost worked but something once the search is done removes the field `foo` from the result 😞 Not too good in web/UI debugging but I suspect its related of some UI cleanup of `_fieldname` cheers, MuS
... View more
08-22-2022
03:18 PM
1 Karma
Hi there, Please see my reply from 24-06-2022 it will explain how this can be done. cheers, MuS
... View more
07-16-2022
02:36 PM
Hi there, Your inputs.conf setting of `initCrcLength = 10000` tells Splunk to read 10000 bytes into the file to validate the seekcrc or if this file was seen before. If your file is smaller than 10000 bytes Splunk will report the message you see and re-index the file. This behaviour is expected as described in the docs https://docs.splunk.com/Documentation/Splunk/9.0.0/Admin/Inputsconf#MONITOR: Try to remove the option `initCrcLength` and restart Splunk. Hope this helps ... cheers, MuS
... View more
07-16-2022
02:22 PM
Hi there, Please check, verify you have configured the roles and permissions for the users - details can be found here https://docs.splunk.com/Documentation/DBX/3.9.0/DeployDBX/Configuresecurityandaccesscontrols hope that helps ... cheers, MuS
... View more
06-24-2022
02:55 PM
1 Karma
Hi loganramirez, Start with the obvious and check splunkd.log for errors like truncation for the HEC input and if not done already restart the HEC instance; new parsing configs most likely require a restart to be applied. Check with btool if your props.conf is really applied and not gets 'overwritten' by other settings. Check for typos in the sourcetype and case matching 😉 Also try another tool like nc to send the test event just to rule out that it's not curl related. Hope this helps ... cheers, MuS
... View more
06-23-2022
11:44 AM
Hi there, well using `splunk_server=foo` will only work if `foo` is a search peer of the Splunk instance you're running the query on. The best option, from my point of view, is to run this query on the Splunk instance that is configured to run the monitoring console because that instance usually has all Splunk instances configured as search peers. cheers, MuS
... View more
06-02-2022
10:08 PM
That did also not work for the same permission related reasons, but like I said it's working now. cheers, MuS
... View more
06-02-2022
03:00 AM
Okay, found the solution! It's not documented anywhere but the lookup definition in Splunk needs to be shared globally AND the owner of the lookup definition needs to be 'nobody' - also remember to set the permission of the CSV so everyone is able to write and share it globally as well. Hope this helps ... cheers, MuS
... View more
05-14-2022
05:47 PM
1 Karma
Hi there, we encountered the exact same problem. Using the provided commands in the Splunk app in Phantom it seems there is no way to update a lookup table BUT we have a workaround for that 😉 If you are forwarding the Phantom event to Splunk you can use those events and run a scheduled search that will then update the lookup file. Hope this helps ... cheers, MuS
... View more
02-07-2022
11:25 AM
2 Karma
Hi there, for multiples digits you have to add a + like this: | rex field=foo "\dm\'=(?<perc>\d+)\%" cheers, MuS
... View more
02-04-2022
02:54 PM
2 Karma
Hi there, if the format of the string is always the same you can use rex to get the first 8 like this | makeresults
| eval foo="SERVICEPERFDATA::'total 120m'=8%;95;97 SERVICECHECKCOMMAND::check_nrpe3!check_cpu!-a!\"warn=load > 95\" \"crit=load \> 97\" \"time=120m\"!\"detail-syntax=%(load)% load for %(time) - Thresholds: Warn gt 95%, Crit gt 97%\"!show-all!!! HOSTSTATE::UP HOSTSTATETYPE::HARD SERVICESTATE::OK SERVICESTATETYPE::HARD SERVICEOUTPUT::OK: 8% load for 120m - Thresholds: Warn gt 95%, Crit gt 97%"
| makemv delim="X" foo
| mvexpand foo `comment("Anything above is to generate events")`
| rex field=foo "\dm\'=(?<perc>\d)\%" cheers, MuS
... View more
02-04-2022
02:44 PM
2 Karma
Hi there, try something like this: | stats count AS "Total Purchased", distinct_count(clientip) AS "Customers" by productId Replace the last stats from the docs page with the above one and it should show you what you have asked for 🙂 cheers, MuS
... View more
04-05-2021
02:01 AM
Sorry but no! This post is missing all basic details, informations just to be able to actually recapture what problem you might have encountered. Without further details, informations this can not be solved. Please provide more details like real world events for both indexes and and what you want to achieve. MuS
... View more
04-05-2021
01:54 AM
Just came along this old post, happy to give some karma to an old friend 😊
... View more
01-19-2021
11:08 PM
1 Karma
Hi Robert, This is caused by some error not being caught correctly by the script. The refresh actually works just the feedback is wrong. I should get that fixed at one point 😕 cheers, Michael / MuS
... View more
11-03-2020
07:16 PM
Hi bmorgenthaler , you can use `streamstats` to calculate the time difference and filter on that like this: your base search here
| streamstats current=f last(_time) AS l_time last(EventType) AS l_EventType by EventType
| eval diff = _time - l_time
| where diff < 60 AND l_EventType=="AGENT_DISCONNECT" AND EventType=="AGENT_RECONNECT" This might needs tuning but will give you a starting point. Hope this helps ... cheers, MuS
... View more
10-22-2020
12:07 PM
1 Karma
Hi jdmclemore, Yes you will be fine using the 7.3.x intermediate HF's. But remember that you might have to change some SSL related settings on them if you have those 6.x UF's sending events over S2S using SSL see the docs here https://docs.splunk.com/Documentation/Forwarder/7.3.0/Forwarder/Compatibilitybetweenforwardersandindexers Hope that helps ... cheers, MuS
... View more
10-22-2020
11:50 AM
Hi there, Take a look at this answer https://community.splunk.com/t5/Splunk-Search/How-to-compare-fields-over-multiple-sourcetypes-without-join/m-p/113477 it provides examples how it can be done. Basically get a common field over all events and use stats to do the final calculations. Hope this helps ... cheers, MuS
... View more
08-12-2020
03:27 PM
Hi there, nowadays this can be configured in the Splunk UI under `Settings - User Interface - Time Ranges` cheers, MuS
... View more
06-15-2020
09:15 PM
Hi @niketn Your approach got me towards the result I wanted! I ended up with this run everywhere example to sort the pie chart trellis sorted the way I needed them | tstats count WHERE index=_* by index sourcetype
| eval my_range=case(count > 0 AND count < 500, 1,count > 500 AND count < 1000, 2,count > 1000 AND count < 2000, 3, 1=1, 10)
| stats dc(sourcetype) AS st dc(index) AS idx by my_range
| sort - my_range
| streamstats count as sno
| eval something=sno.". ".my_range
| stats sum(st) AS st sum(idx) AS idx by something Thanks and I hope this will help some one else while we wait for the fix ... cheers, MuS
... View more
06-02-2020
09:30 PM
Hi mpuchalski,
Please read this https://docs.splunk.com/Documentation/Splunk/latest/Forwarding/Forwarddatatothird-partysystemsd#Syslog_data it can be configured on any Splunk instance. Just a word of caution: if you configure forwarding to a third party receiver and the receiving end goes down or is not available you will get in trouble on your Splunk instance.
Hope this helps ...
cheers, MuS
... View more
06-02-2020
06:36 PM
Hi there, since you're using REPORT it has to go on the Search Head like written, explained above:
REPORT is a search time field extraction that is linked to transforms.conf
cheers, MuS
... View more
05-29-2020
02:56 AM
Hi joseftw,
try something like this:
index=events (EventName=AccountCreated OR EventName=FavoriteCreated) AccountId=*
| eval EventName=case(isnotnull(EventName), EventName, 1=1, "unknown")
| stats count by AccountId, EventName
| fields - count
| table AccountId, EventName
If this does not work please modify it 😉 But you will get a starting point and should you need more help please read this post https://answers.splunk.com/answers/129424/how-to-compare-fields-over-multiple-sourcetypes-without-join-append-or-use-of-subsearches.html
cheers, MuS
... View more
05-25-2020
06:04 PM
I would not recommend to replace the shipped python that will result in a lot of tears 😉
Like you said, anything you build will not be upgrade proof
cheers, MuS
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
Sunday
|
Karma given to
