About scelikok

scelikok

Hi @AL3Z, You didn't provide field names in the events and lookup file. I assume domains.csv is a lookup file in Splunk. Please try below sample; I assumed your event and csv file has a field named "domain" alert_type=ufa and alert_name="suspicious uploads" NOT [inputlookup domains.csv | fields domain | format]

scelikok · ‎05-07-2023

Hi @Kirthika, You can try below; | autoregress Handset_ID | search Handset_ID_p1="Started" Handset_ID!="Serial Number" | stats count by Handset_ID

scelikok · ‎05-07-2023

Hi @Shrav, For this particular sample you can convert all status values to lowercase. Since search works case-insensitive your further searches will run without problem. Please be careful that where command works case-sensitive.

scelikok · ‎05-07-2023

Hi @balcv, You can use below; | eval newtime=strftime(strptime(datefield,"%Y-%m-%dT%H:%M:%S.%7QZ")+36000,"%Y-%m-%dT%H:%M:%S.%3QZ")

scelikok · ‎04-20-2023

Hi @Rakzskull, You must update outputs.conf in your UF to send logs to new HF. Editing deploymentclient.conf only changes the deployment server address. If you are using deployment server to manage UF's you should update related deployment app outputs.conf configuration.

scelikok · ‎04-12-2023

Hi @Renunaren, You can use the latest function to find the latest status of the jobs like below. If you can share your query we can help better. | stats latest(status) as status by name | stats count by status

scelikok · ‎04-12-2023

Hi @satish, I can see on your query that active_hmc and hmc_pair both have the same values. Could you please show us the current output of your query (anonymized) as a sample and your desired output?

scelikok · ‎04-06-2023

Hi @PickleRick, It is not stated in documents but HEC event endpoint skips TRANSFORMS.

scelikok · ‎04-05-2023

Hi @dsfyxcasdcertzu, Yes, raw endpoint causes message to change. You can try using env field for setting correct hostname. It will not change host value but you will be able to query the real hostname. https://docs.docker.com/config/containers/logging/splunk/

scelikok · ‎04-05-2023

Hi @splunkcol, The reason there is no result may be that there is no new data after the last query. If there is no new data after the checkpoint value it is normal to see "No results found". You can check by deleting the 2nd and 3rd rows of your SQL and executing. It should show the results. If so everything seems ok.

scelikok · ‎04-05-2023

Hi @muradgh, Frozen path keeps only compressed raw data. That is why the calculation is done using below formula; DailyDataVolume = 5GB RawCompressionFactor = 0.15 NumberofDaysinFrozen = 9 months = 270 days ArchivedStorageSpace = DailyDataVolume* RawCompressionFactor* NumberofDaysinFrozen ArchivedStorageSpace = 5 * 0.15 * 270 = 202.5 GB Please keep in mind that Splunk does not manage the Archive path. It just moves raw data to that path. There is no retention check. This calculation is only for you to provide enough space. You should manually clean data older than 9 months.

scelikok · ‎04-05-2023

Hi @asplunk789, Adding a table command makes searches run on the search head. That is why it is slow. Base searches should be more specific. Returning all raw data to panels is not the best practice. Please use stats or timechart command on your base search as a preparation for your panels.

scelikok · ‎04-05-2023

Hi @dsfyxcasdcertzu, To run transform for HEC inputs, your client application must use "raw" endpoint on HEC output. If you are using "event" endpoint it is not possible to change anything on the data.

scelikok · ‎04-05-2023

Hi @Ciarán, Could you please try below search? I think you can achieve your results without subsearch. index=portal sourcetype=app:*** source="log" cls=c.b.m.s.SoapServiceClientService Exit event 'ERROR' | rex "(?i) .*? \[(?P<ResponseCode>\d+)(?=\])" | stats first values(ResponseCode) as ResponseCodeList | search ResponseCodeList=504 | rename first(*) as * | fields - ResponseCodeList

scelikok · ‎04-04-2023

Hi @splunkcol, Splunk DBConnect app uses a checkpoint if the rising mode is configured. These checkpoints are input parameters, not connections. That is why updating the hostname in connection does not effect checkpoints in inputs. If you want to be safe you can follow below path; - Disable input, - Note the current checkpoint , - Update hostname on connection, - Check if checkpoint is still the same, correct if needed - Enable output.

scelikok · ‎04-03-2023

Hi @dhotlosz, You are getting errors because of the wrong operating system installation file. You should reinstall with a package that is compatible with your operating system. If your system has Intel or AMD CPU you should use the 64-bit version of Linux. You can try below; wget -O splunkforwarder-9.0.4-de405f4a7979-Linux-x86_64.tgz "https://download.splunk.com/products/universalforwarder/releases/9.0.4/linux/splunkforwarder-9.0.4-de405f4a7979-Linux-x86_64.tgz"

scelikok · ‎04-03-2023

Hi @AL3Z, Please try below, it will show you any scanner host that scans many destination IP addresses for only one port. index=firewall sourcetype="firewall_cloud" dest_port="*" | stats dc(dest_ip) as dest_count by src_ip dest_port | where dest_count >3

scelikok · ‎04-03-2023

Hi @kanyewestnewmer, Since you are running the exact correlation twice in the same time range, it is normal having duplicate notables. You should use 60 minutes as a cron plan or throttling on the event_id field. https://docs.splunk.com/Documentation/ES/7.1.0/Admin/Configurecorrelationsearches#Throttle_the_number_of_response_actions_generated_by_a_correlation_search

scelikok · ‎04-03-2023

Hi @junmun-chan, Since your token values contains spaces you have use tokens between double-quotes like below; <panel> <title>Error Log</title> <input type="dropdown" token="ProfileLog" searchWhenChanged="true"> <label>Module</label> <fieldForLabel>ESPACE_NAME</fieldForLabel> <fieldForValue>ESPACE_NAME</fieldForValue> <search base="baseSearch"> <query>| stats count by ESPACE_NAME</query> </search> <choice value="*">All</choice> <default>*</default> <initialValue>*</initialValue> </input> <event> <search base="baseSearch"> <query>| search ESPACE_NAME="$ProfileLog$"</query> </search> <option name="list.drilldown">none</option> <option name="refresh.display">progressbar</option> </event> </panel> </row> </form>

scelikok · ‎03-30-2023

Hi @Mr_person, You are hitting the max_action_results on limits.conf which is default 50000. It is not a good idea to increase this limit to 2 million. It seems your only option is using outputlookup in your search although it seems not safe. limits.conf [scheduler] max_action_results = <integer> * The maximum number of results to load when triggering an alert action. * Default: 50000

Posts	1060
Solutions	268
Karma Given	19
Karma Received	470
Member Since	‎14-12-2016

Online Status	Offline
Date Last Visited	Tuesday

Splunk DB Connect 3: How to resolve "HTTP Error 50...

Enterprise Security Indexer Sizing for High Capaci...

Re: How can I search for the alerts usecase?

Re: Total number of inspection by Handset_ID

Re: how to consider multiple status value as one u...

Re: Add a number of hours to a search field

Re: How to repoint the UF to the newly added forwa...

Re: need help on the data which is available in th...

Re: Splunk create new field based on table values

Re: Host name override HTTP Event Collector

Re: How do I Host name override HTTP Event Collect...

Re: If DBConnect host changes, will it download th...

Re: Archived (Frozen) storage calculation

Re: Base search for two time ranges in splunk dash...

Re: Host name override HTTP Event Collector

Re: How to use the map command to match events?

Re: If DBConnect host changes, will it download th...

Re: error comes install splunkforwarder

Re: IP scanners scanning many IPs on a single port...

Re: How can I make an ES Incident Review copy of m...

Re: Dropdown not working with basesearch

Re: Unable to store more than 50,000 results in lo...