Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About mistydennis
mistydennis
Communicator
Member since:
12-02-2016
a week ago
Community Statistics
| Posts | 88 |
| Solutions | 1 |
| Karma Given | 32 |
| Karma Received | 3 |
| Member Since | 12-02-2016 |
Activity Feed
- Posted Re: Error - Microsoft O365 Email Add-on for Splunk App - Python error? on All Apps and Add-ons. 05-11-2023 10:16 AM
- Posted How to convert multiple date formats in same field? on Splunk Search. 02-27-2023 12:59 PM
- Posted Embedded Pie Chart Needs to Show Zero Results on Dashboards & Visualizations. 02-23-2023 09:41 AM
- Karma Re: Timecharts and how to avoid "no results found inspect" for somesoni2. 02-22-2023 01:36 PM
- Posted Re: Compare results from two timeframes and show differences? on Alerting. 02-14-2023 02:41 PM
- Posted Compare results from two timeframes and show differences? on Alerting. 02-14-2023 01:51 PM
- Posted How to achieve stats count on multiple fields? on Reporting. 02-09-2023 02:53 PM
- Posted How do I refine this search to use 'my_report_date' instead of _time? on Splunk Search. 01-31-2023 04:14 PM
- Karma Re: Calculate difference between multiple fields for PickleRick. 12-06-2022 06:09 AM
- Karma Re: Calculate difference between multiple fields for PickleRick. 12-06-2022 06:08 AM
- Posted Re: Calculate difference between multiple fields on Splunk Search. 12-06-2022 05:32 AM
- Posted Re: Calculate difference between multiple fields on Splunk Search. 12-05-2022 03:04 PM
- Posted How to calculate difference between multiple fields? on Splunk Search. 12-05-2022 02:54 PM
- Karma Re: How to remove a carriage return from a field for lguinn2. 10-12-2022 07:50 AM
- Posted Re: Trouble with date conversion on Splunk Search. 09-29-2022 01:34 PM
- Posted Trouble with date conversion on Splunk Search. 09-29-2022 12:17 PM
- Posted Trouble extracting multivalue fields- How do I separate these fields into their own events? on Getting Data In. 09-27-2022 05:34 AM
- Karma Re: Carriage return newline (\r\n) not working as delimiter for makemv for jwilk. 09-26-2022 03:06 PM
- Posted How to exclude matching results from Lookup? on Splunk Search. 09-19-2022 02:50 PM
- Posted Re: How to limit the results of one lookup with a second lookup? on Splunk Search. 08-23-2022 07:04 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
05-11-2023
10:16 AM
I'm having the same issue with a different app, wondering if anyone has found a solution to this.
... View more
02-27-2023
12:59 PM
I have some data coming in with multiple date formats in the same field, and I'm having trouble reporting on these dates. I'd like to keep the dates consistent - how do I create a statement to change just the dates that are in the undesirable format? What I have:
DateAdded
2021-11-03
2/15/2022
1/13/2023
What I would like:
DateAdded
2021-11-03
2022-02-15
2023-01-13
... View more
Labels
- Labels:
-
other
02-23-2023
09:41 AM
I have an embedded pie chart where I'm trying to show something rather than "no results found" with the red exclamation mark, and this is making people think the report isn't working. I've tried several methods to address this, but I can't get the results I would like. Query and results: | inputlookup my_lookup
| search Exposure=External
| stats count by Status
| eval pie_slice = count + " " + Status
| fields pie_slice, count Is it possible to add something to the query so that when there are zero results I get this?
... View more
Labels
- Labels:
-
chart
02-14-2023
02:41 PM
So that query gives me all the results from both days (2,584 rows). What I want to find out is how the results are different from both days. With my data set there should be 136 rows. The desired outcome is a table that looks like this: AssetName cveID Exposure Number of CVEs server1 cve1 Internal 1 server 2 cve1, cve2, cve3 Internal 3
... View more
02-14-2023
01:51 PM
Hello Splunk experts - I am trying to create a query that shows the difference in results from two distinct time frames. Original search:
index=summary_nexpose
| table AssetName, cveID, Exposure
| mvcombine delim=",", cveID
| nomv cveID
| eval numberCVEs=mvcount(split(cveID,","))
| rename numberCVEs AS "Number of CVEs"
What I need to do is add two timeframes: results from 30 days ago vs. results from today, and then show the difference in events between those two timeframes.
... View more
Labels
- Labels:
-
other
02-09-2023
02:53 PM
Hi all - this one is hurting my brain. I need to pull two distinct numbers from my events: one with a total count of assets, and one with a total count of assets that contain a vulnerability. What I think it should look like is not working:
| (stats dc(AssetNames) AS TotalExternalAssets, (dc(Asset_Names) AS TotalExposedAssets | where vulnerability!="missing"))
How do I get these two counts out of my events?
... View more
Labels
- Labels:
-
other
01-31-2023
04:14 PM
Hi all - I'm attempting to write a query using earliest/latest based off a date field in the event, not _time. I've tried a dozen things, and no matter what I try the earliest/latest fields are not showing what I expect. I'm using 'my_report_date' as the desired earliest/latest field. When I run the following search, the earliest should be 11/1/22, but it shows as 11/2 (these events were sent to a summary index prior to the events of 11/1). The rest of the query is finding the number of days between first/last events. How do I refine this search to use 'my_report_date' instead of _time?
index=summary
| stats earliest(my_report_date) AS FirstFound, latest(my_report_date) AS LastFound by my_asset
| convert mktime(FirstFound) AS FirstFoundEpoch timeformat="%Y-%m-%d"
| convert mktime(LastFound) AS LastFoundEpoch timeformat="%Y-%m-%d"
| eval daysdiff=round((LastFoundEpoch-FirstFoundEpoch)/86400,0)
| stats count by my_asset, FirstFound, LastFound, daysdiff
... View more
Labels
- Labels:
-
stats
12-06-2022
05:32 AM
Thanks, @PickleRick for the typo fix 🙂 After plugging in the search, I'm not getting expected results - everything is "0":
... View more
12-05-2022
03:04 PM
When plugged into my search I get an error: index=myindex
| stats count as total by report_date
| streamstats window=1 current=f value(total) as previous_total
| eval diff=if(previous_total > total, previous_total-total, 0)
| streamstats sum(diff) as running_total_diff Error: Error in 'streamstats' command: The argument 'value(total)' is invalid.
... View more
12-05-2022
02:54 PM
Hi Splunk experts - I have an unusual math problem on my hands and I'm not sure how to deal with it. We are trying to prove how many tickets have been completed, so we are only counting the numbers that show improvement, not the numbers that show the addition of more tickets (following me?).
Here's the data:
report_date total 2022-11-07 4111 2022-11-08 3764 2022-11-09 3562 2022-11-10 3633 2022-11-11 3694 2022-11-14 7506 2022-11-15 12987 2022-11-16 15159 2022-11-17 14851 2022-11-18 14410 2022-11-21 6674 2022-11-22 5793 2022-11-23 5601
What I am trying to do is determine the difference between the "total" fields, but only when the count goes down. So for example, 11/7 - 11/9 show counts going down (4111-3562=549). But the numbers go up on 11/10, so we don't want to count those. And then the numbers go down again on 11/17, so I would add the difference between 11/16 and 11/17 to the previous 549.
I feel like I am making this more complicated that it needs to be. Help.
... View more
Labels
- Labels:
-
eval
-
transaction
09-29-2022
01:34 PM
Thank you, @richgalloway ! I see you have answered MANY questions regarding date and timestamps here - maybe it's time for you to just write a book and help us all out 🙂
... View more
09-29-2022
12:17 PM
I need to create a field (30days) with a date 30 days from the date in a given field (pubdate). I believe I have that part working, but can't seem to get the date to convert to the format I want. |makeresults
|eval pubdate="2022-09-30,2021-08-31"
|makemv delim="," pubdate
|mvexpand pubdate
|eval epochtime=strptime(pubdate, "%Y-%m-%d")
|eval 30days=epochtime + 2592000
|convert ctime(30days)
|table pubdate, 30days Which produces: pubdate 30days 2022-09-30 10/30/2022 00:00:00.000000 2021-08-31 09/30/2021 00:00:00.000000 All I want to do is to format the 30days date field the same was as pubdate - "%Y-%m-%d". Everything I'm trying is producing an error.
... View more
Labels
- Labels:
-
eval
09-27-2022
05:34 AM
Hi all - I am having trouble pulling out mv fields into separate events. My data looks like this:
I'd like to pull each event out into it's own line, but I'm having trouble with the carriage returns and getting the fields to pair correctly (i.e., error 1232 is with server 1). Example search:
| makeresults
| eval error="1232
2345
5783
5689
2345
5678
5901", server="server1
server2
server3
server4
server6
server9
server7"
| makemv delim="
" error
| makemv delim="
" server
| eval uniquekey=mvzip(server,error, ":")
How do I separate these fields into their own events so the data looks like:
1232
server1
server1:1232
2345
server2
server2:2345
5783
server3
server3:5783
... View more
Labels
- Labels:
-
field extraction
09-19-2022
02:50 PM
Hi all - I am trying to exclude matching results from a lookup and can't get it to work. I've tried multiple searches, tried what I've found in Splunk Answers, and I just can't get this to work. Here's what I have right now:
| inputlookup myinputlookup1
| search NOT
[ |lookup my_lookup InLookField AS LookField OUTPUT InLookField]
This search runs but produces no results. What am I doing wrong?
... View more
Labels
- Labels:
-
lookup
08-23-2022
07:04 AM
I had a feeling I was overcomplicating it - thank you so much!
... View more
08-22-2022
01:34 PM
Hi all - I am trying to take one lookup and limit its results with another lookup. I can kinda get it to work with my current SPL, but it's taking a long time to run and the results don't come out as expected. Here's what I have so far:
| inputlookup my_kvstore
| lookup my_lookup lookupfield_1 AS kvstorefield_1 OUTPUT lookupfield_1
| lookup my_kvstore kvstorefield_1 AS lookupfield_1 OUTPUT kvstorefield_2, kvstorefield_3, kvstorefield_4, kvstorefield_5
| WHERE kvstorefield_1=lookupfield_1
Results:
kvstorefield_1
kvstorefield_2
kvstorefield_3
kvstorefield_4
kvstorefield_5
lookupfield_1
2016
2016
centos
centos
linux
linux
web
web
workstation1
workstation2
2016
2016
2017
2017
2017
apache
apache
apache
tomcat
tomcat
tomcat
http
http
http
server1
server2
server3
2017
2017
2017
1. Is my search formed correctly? 2. How do I get each of the events to come out in their own row instead of being grouped into one line based on the matching kvstorefield/lookupfield?
... View more
08-10-2022
09:53 AM
I'm having trouble extracting some dates from a date field. Certain assets were provided with a generic date, and I can't seem to extract the date for these events.
Sample data:
lastscan
newdate
2022-08-10T06:51:33.874Z
2022-08-10
2022-08-10T00:06:19.920Z
2022-08-10
1969-12-31T23:59:59.999Z
SPL: | eval newdate=strptime(lastscan,"%Y-%m-%d") | eval newdate=strftime(newdate,"%Y-%m-%d")
As you can see, the events with the 1969 date are not extracting as expected and I'm getting no results for the "newdate" field. Any thoughts on how I can extract the date from the 1969 events?
... View more
Labels
- Labels:
-
field extraction
-
table
07-06-2022
12:46 PM
Figured it out. I added a new column ("mycount") in lookup2 with a "0" value for each entry. Then when I searched lookup2 against lookup1, for every row where there was no cve match between lookups, the cve was added with a "0" value. Final search: | inputlookup lookup_1
| table cveID asset Project product dueDate
| mvcombine delim=",", asset
| nomv asset
| eval numberCVEs=mvcount(split(asset,","))
| append
[ |inputlookup lookup_2
| fields q1-cveID, mycount
| eval cveID=q1-cveID ]
| dedup cveID
| eval numberCVEs=if(mycount=0, "0", numberCVEs)
| table cveID, q1-cveID asset Project product dueDate
... View more
07-06-2022
06:23 AM
Thanks for this, ITWhisperer, this got me a little closer. I would also like the cve's that have 0 assets to show in the report, right now only assets with at least a value of 1 are showing. Is it possible to add this?
... View more
07-01-2022
01:45 PM
Hi everyone: I have a lookup I am using to filter against another lookup and I'm having trouble getting the output to appear like I want it. I've looked at many answers here and just can't figure out what I'm doing wrong. My search: | inputlookup lookup_1
| table cveID asset Project product dueDate
| mvcombine delim=",", asset
| nomv asset
| eval numberCVEs=mvcount(split(asset,","))
| appendpipe
[ |inputlookup lookup_2
| fields q1-cveID ]
| fillnull
| table cveID, q1-cveID asset Project product dueDate I am trying to match the cveID field of lookup_1 to the q1-cveID field of lookup_2. And if there are cve's that exist in lookup 2 but do not exist in lookup 1, I still want them to appear with a "0" value in the asset column (thus the append). What I'm currently getting: cveID q1-cveID Asset Project product dueDate cve-1234 0 7 Microsoft Office 2022-07-01 0 cve-1234 0 0 0 0 What I would like to see: cveID q1-cveID Asset Project product dueDate cve-1234 cve-1234 7 Microsoft Office 2022-07-01 cve-5678 cve-5678 0 Apple iPhone 2022-08-01 How do I match up these two lookups and create a "0" value for items that exist only in lookup 2?
... View more
- Tags:
- lookups
06-21-2022
06:54 AM
1 Karma
Solved! Thank you to everyone that provided hints - it turns out that the field in question was coming from a lookup, and for some reason I could not successfully apply the case statement in my query. But I opened up the lookup query, added the case statement there, and it worked. I don't understand why this worked, but it did.
... View more
06-21-2022
06:37 AM
Yes, it does seem to work with your query but unfortunately it does not work in mine. I have confirmed the field is not multivalue.
... View more
06-21-2022
06:34 AM
Thank you for this - I did verify that the field was a number, but I plugged in your eval anyway. Still doesn't work, though I appreciate the tip about reading from left to right (I didn't know that).
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
a week ago
|
