Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About john_byun
john_byun
Path Finder
Member since:
10-07-2013
03-08-2021
Community Statistics
| Posts | 38 |
| Solutions | 0 |
| Karma Given | 12 |
| Karma Received | 1 |
| Member Since | 10-07-2013 |
Activity Feed
- Posted Re: Query to find events with more than 2 values for a specific field compared to another field on Splunk Search. 02-01-2021 01:36 PM
- Karma Re: Query to find events with more than 2 values for a specific field compared to another field for scelikok. 02-01-2021 01:36 PM
- Posted Query to find events with more than 2 values for a specific field compared to another field on Splunk Search. 02-01-2021 01:18 PM
- Posted Re: Using fireall logs to find hosts that do not use a specific protocol on Splunk Search. 06-23-2020 10:59 AM
- Posted Using fireall logs to find hosts that do not use a specific protocol on Splunk Search. 06-23-2020 10:15 AM
- Karma Re: Cannot see full field list in Add Auto-Extracted Field window for a dataset in a datamodel for codebuilder. 06-05-2020 12:51 AM
- Karma Re: Constant re-authentication after SSO migration for marycordova. 06-05-2020 12:50 AM
- Karma Re: Palo Alto Networks App for Splunk: Where is the WildFire dashboard? for panguy. 06-05-2020 12:49 AM
- Karma Setting tag permissions for jasongb. 06-05-2020 12:49 AM
- Karma Re: Help with simple timechart query for MuS. 06-05-2020 12:47 AM
- Karma Re: Issue extracting field from host metadata for kristian_kolb. 06-05-2020 12:46 AM
- Karma Re: Combine counts from 2 separate searches using subsearches for _d_. 06-05-2020 12:46 AM
- Karma Re: Combine counts from 2 separate searches using subsearches for _d_. 06-05-2020 12:46 AM
- Karma Re: Universal Forwarder not sending data - timed out for lguinn2. 06-05-2020 12:46 AM
- Karma Re: Universal Forwarder not sending data - timed out for Akili. 06-05-2020 12:46 AM
- Got Karma for Universal Forwarder not sending data - timed out. 06-05-2020 12:46 AM
- Posted Re: Cannot see full field list in Add Auto-Extracted Field window for a dataset in a datamodel on Splunk Search. 03-16-2020 04:29 PM
- Posted Cannot see full field list in Add Auto-Extracted Field window for a dataset in a datamodel on Splunk Search. 03-09-2020 08:55 AM
- Posted Re: Constant re-authentication after SSO migration on Security. 07-31-2019 05:19 PM
- Posted Re: Constant re-authentication after SSO migration on Security. 07-31-2019 04:04 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 0 |
02-01-2021
01:36 PM
Perfect! Thanks for your help.
... View more
02-01-2021
01:18 PM
I'm trying to create a query to show me all users who have purchased more than 1 type of product. Each event has a "user" field and a "product" field. I only want to see the users that have purchased more than 1 type of product. "| stats count by user product" This shows me all user and product combinations, but don't know how to filter all events where a user only purchased one type of product. I feel that it should be a very simple query, but can't seem to figure it out.
... View more
- Tags:
- dc
06-23-2020
10:59 AM
I am looking to list all src's that do not use ssl. Your query basically gives me the same results because all src's use multiple apps. Is there a way to do this without me doing a massive diff of tens of thousands of results?
... View more
06-23-2020
10:15 AM
I have the following query for PAN firewall logs: index=pan app=ssl | stats count by src This would give me a list of all src IPs of devices that use SSL. How would I create a query to give me the opposite results? I want the list of src IPs that never have SSL traffic.
... View more
Labels
- Labels:
-
stats
03-16-2020
04:29 PM
We are in SplunkCloud and do not have access to any of the .conf files.
... View more
03-09-2020
08:55 AM
I'm new to data models and have a very newbie question. We are using SplunkCloud and when I try to add an auto-extracted field to the dataset, I only see a partial lists of fields. How do I scroll down or go to next page when trying to add fields to the "Add Auto-Extracted Field" window?
... View more
07-31-2019
05:19 PM
Correct. To be more specific, I don't have to login again. The window refreshes, I can see the SSO screen flash for a second and then the screen comes back up. It happens over and over and is very annoying when I am trying to change my query and it refreshes while I am typing and I have to type it in again. The only fix is to shut down all the windows or all except for one and open up new windows.
... View more
07-31-2019
04:04 PM
I don't have an issue with the session expiring. The issue is that refreshing the page triggers the issue described by the original poster. Each window tries to auto-refresh every 15 seconds or so. The only way to stop this continuous reauth is to close all the windows except one as the poster above mentioned. If want your exact searches back, you have to go into your browser history and reopen them.
... View more
07-11-2019
08:53 AM
I am seeing the same issue and I also believe your workaround works, but it's annoying. I also think it's a bug and hope Splunk will fix it.
... View more
05-29-2019
03:13 PM
Let me ask a slightly different question. In general, is it going to be faster using a string search compared to a field search?
... View more
05-24-2019
01:37 PM
In most cases, I don't notice a huge difference when I specify a fieldname or do a free text search, but for some fields it is literally 260 times slower.
Are searches using fieldnames supposed to be slower than free text?
What is it about these particular fields that make it unbearably slow?
For instance:
index=main myusername
This search has completed and has returned 1,774 results by scanning 1,774 events in 2.65 seconds
index=main user=myusername
This search has completed and has returned 1,774 results by scanning 40,885,115 events in 689.411 seconds
... View more
01-16-2019
10:21 AM
Can Splunk build in an option to enable Duo on an account basis instead of globally?
... View more
01-16-2019
10:17 AM
Is this really not possible with Splunk Cloud? Is there a workaround to get MFA working?
... View more
12-04-2017
04:42 PM
After entering all of the Duo Admin API info (integration key, secret key, host) I get the following error message when I hit Next and cannot proceed.
Encountered the following error while trying to save: Splunkd daemon is not responding: ("Error connecting to /servicesNS/admin/search/data/inputs/duo_input: ('The read operation timed out',)",)
If I navigate to splunk:8089/servicesNS in a web browser, I see the following:
This XML file does not appear to have any style information associated with it. The document tree is shown below.
Not Found
Does anyone know what the problem might be and how I can fix it?
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
03-08-2021
06:51 PM
|
