About MuS

MuS · ‎05-17-2023

Hi there, The tstats command performs queries on indexed fields in tsidx files. The indexed fields can be from indexed data, metadata or accelerated data models. This means it will not scan the _raw events and should normally be super fast except you have bloated tsidx files due to the above mentioned cases. So usually the answer using `tstats` would be the best options and like you said `metadata` does not provide an index name ... but I tried something like this | dbinspect index=* | rename index AS baz | table baz | map maxsearches=100 search="| metadata type=sourcetypes index=$baz$ | eval foo=$baz$" which almost worked but something once the search is done removes the field `foo` from the result 😞 Not too good in web/UI debugging but I suspect its related of some UI cleanup of `_fieldname` cheers, MuS

MuS · ‎08-22-2022

Hi there, Please see my reply from 24-06-2022 it will explain how this can be done. cheers, MuS

MuS · ‎07-16-2022

Hi there, Your inputs.conf setting of `initCrcLength = 10000` tells Splunk to read 10000 bytes into the file to validate the seekcrc or if this file was seen before. If your file is smaller than 10000 bytes Splunk will report the message you see and re-index the file. This behaviour is expected as described in the docs https://docs.splunk.com/Documentation/Splunk/9.0.0/Admin/Inputsconf#MONITOR: Try to remove the option `initCrcLength` and restart Splunk. Hope this helps ... cheers, MuS

MuS · ‎07-16-2022

Hi there, Please check, verify you have configured the roles and permissions for the users - details can be found here https://docs.splunk.com/Documentation/DBX/3.9.0/DeployDBX/Configuresecurityandaccesscontrols hope that helps ... cheers, MuS

MuS · ‎06-24-2022

Hi loganramirez, Start with the obvious and check splunkd.log for errors like truncation for the HEC input and if not done already restart the HEC instance; new parsing configs most likely require a restart to be applied. Check with btool if your props.conf is really applied and not gets 'overwritten' by other settings. Check for typos in the sourcetype and case matching 😉 Also try another tool like nc to send the test event just to rule out that it's not curl related. Hope this helps ... cheers, MuS

MuS · ‎06-23-2022

Hi there, well using `splunk_server=foo` will only work if `foo` is a search peer of the Splunk instance you're running the query on. The best option, from my point of view, is to run this query on the Splunk instance that is configured to run the monitoring console because that instance usually has all Splunk instances configured as search peers. cheers, MuS

MuS · ‎06-02-2022

That did also not work for the same permission related reasons, but like I said it's working now. cheers, MuS

MuS · ‎06-02-2022

Okay, found the solution! It's not documented anywhere but the lookup definition in Splunk needs to be shared globally AND the owner of the lookup definition needs to be 'nobody' - also remember to set the permission of the CSV so everyone is able to write and share it globally as well. Hope this helps ... cheers, MuS

MuS · ‎05-14-2022

Hi there, we encountered the exact same problem. Using the provided commands in the Splunk app in Phantom it seems there is no way to update a lookup table BUT we have a workaround for that 😉 If you are forwarding the Phantom event to Splunk you can use those events and run a scheduled search that will then update the lookup file. Hope this helps ... cheers, MuS

MuS · ‎02-07-2022

Hi there, for multiples digits you have to add a + like this: | rex field=foo "\dm\'=(?<perc>\d+)\%" cheers, MuS

MuS · ‎02-04-2022

Hi there, if the format of the string is always the same you can use rex to get the first 8 like this | makeresults | eval foo="SERVICEPERFDATA::'total 120m'=8%;95;97 SERVICECHECKCOMMAND::check_nrpe3!check_cpu!-a!\"warn=load > 95\" \"crit=load \> 97\" \"time=120m\"!\"detail-syntax=%(load)% load for %(time) - Thresholds: Warn gt 95%, Crit gt 97%\"!show-all!!! HOSTSTATE::UP HOSTSTATETYPE::HARD SERVICESTATE::OK SERVICESTATETYPE::HARD SERVICEOUTPUT::OK: 8% load for 120m - Thresholds: Warn gt 95%, Crit gt 97%" | makemv delim="X" foo | mvexpand foo `comment("Anything above is to generate events")` | rex field=foo "\dm\'=(?<perc>\d)\%" cheers, MuS

MuS · ‎02-04-2022

Hi there, try something like this: | stats count AS "Total Purchased", distinct_count(clientip) AS "Customers" by productId Replace the last stats from the docs page with the above one and it should show you what you have asked for 🙂 cheers, MuS

MuS · ‎04-05-2021

Sorry but no! This post is missing all basic details, informations just to be able to actually recapture what problem you might have encountered. Without further details, informations this can not be solved. Please provide more details like real world events for both indexes and and what you want to achieve. MuS

MuS · ‎04-05-2021

Just came along this old post, happy to give some karma to an old friend 😊

MuS · ‎01-19-2021

Hi Robert, This is caused by some error not being caught correctly by the script. The refresh actually works just the feedback is wrong. I should get that fixed at one point 😕 cheers, Michael / MuS

MuS · ‎11-03-2020

Hi bmorgenthaler , you can use `streamstats` to calculate the time difference and filter on that like this: your base search here | streamstats current=f last(_time) AS l_time last(EventType) AS l_EventType by EventType | eval diff = _time - l_time | where diff < 60 AND l_EventType=="AGENT_DISCONNECT" AND EventType=="AGENT_RECONNECT" This might needs tuning but will give you a starting point. Hope this helps ... cheers, MuS

MuS · ‎10-22-2020

Hi jdmclemore, Yes you will be fine using the 7.3.x intermediate HF's. But remember that you might have to change some SSL related settings on them if you have those 6.x UF's sending events over S2S using SSL see the docs here https://docs.splunk.com/Documentation/Forwarder/7.3.0/Forwarder/Compatibilitybetweenforwardersandindexers Hope that helps ... cheers, MuS

MuS · ‎10-22-2020

Hi there, Take a look at this answer https://community.splunk.com/t5/Splunk-Search/How-to-compare-fields-over-multiple-sourcetypes-without-join/m-p/113477 it provides examples how it can be done. Basically get a common field over all events and use stats to do the final calculations. Hope this helps ... cheers, MuS

MuS · ‎08-12-2020

Hi there, nowadays this can be configured in the Splunk UI under `Settings - User Interface - Time Ranges` cheers, MuS

MuS · ‎06-15-2020

Hi @niketn Your approach got me towards the result I wanted! I ended up with this run everywhere example to sort the pie chart trellis sorted the way I needed them | tstats count WHERE index=_* by index sourcetype | eval my_range=case(count > 0 AND count < 500, 1,count > 500 AND count < 1000, 2,count > 1000 AND count < 2000, 3, 1=1, 10) | stats dc(sourcetype) AS st dc(index) AS idx by my_range | sort - my_range | streamstats count as sno | eval something=sno.". ".my_range | stats sum(st) AS st sum(idx) AS idx by something Thanks and I hope this will help some one else while we wait for the fix ... cheers, MuS

Posts	4419
Solutions	807
Karma Given	2134
Karma Received	3887
Member Since	‎05-02-2011

Online Status	Offline
Date Last Visited	‎08-11-2023 04:09 PM

Report Capture app for Splunk: Exception capturing...

How to use eval if there is no result from the bas...

How to compare fields over multiple sourcetypes wi...

Splunkbase Apps update bug?

docs.splunk.com wrong link to answers

splunkbase feature request

splunkbase colored background

Captain Picard's Star fleet messages

the pony command

max throughputs of forwarders

Re: "Join" REST with metastats to get sourcetypes ...

Re: How to search and monitor Splunk user logins t...

Re: Why error "Unable to import data.File too smal...

Re: splunk db had permission issue with ldap users...

Re: Testing sourcetype with sample data formats _t...

Re: How to search and monitor Splunk user logins t...

Re: How to update a lookup file in Splunk from Pha...

Re: How to update a lookup file in Splunk from Pha...

Re: How to update a lookup file in Splunk from Pha...

Re: Extracting number from a string in order to us...

Re: Extracting number from a string in order to us...

Re: How to create search stirng for the given qest...

Re: Search using lookup

Re: How to calculate the index size from all index...

Re: Can Add-on Debug Refresh be run from a cluster

Re: Ignore events within a timespan?

Re: Forwarder/Indexer compatibility with Intermedi...

Re: Splunk query to join two searches

Re: Is there a way to remove the `Real-time` part ...

Re: How can I change the sort order of data in a T...