About happy035

happy035 · ‎07-23-2014

Thanks for comment PPape, When I executed my script, I got a unsorted set in "N of target". I want descended sorting data with "N of Target" field. 100 means if count is greater than 100, I will include data set.

happy035 · ‎07-23-2014

Hi Strive. It's correct. I want to extract destination list if count is greater than 100. But before it, I'd like to descending sort with N of Target.

happy035 · ‎07-23-2014

I extracted some data from my set with this "stats count by failure_reason, dst | stats list(dst) as Target list(count) as "N of Target" by failure_reason " The I got follow result set. failure_reason dst [N of Target] not a http reply line 107.23..199 27 108.168..6 5 110.75.***.240 9 I'd like to sort dst field using [N of Target]. Could you tell me how can I do that please? Then one more question, I want to watch dstes over count such as over 100 count. How can I complete that? Many Thanks

happy035 · ‎10-23-2013

Hi markovic, Thanks for your interesting. I have resolved this problem few days ago. But my solution runs only in Ubuntu machine. Please follow steps, 1. open "/etc/default/rcS" file 2. check this line if exists assume that the BIOS clock is set to UTC time (recommended) UTC=no 3. if UTC=Yes, Ubuntu server set up your localtime as UTC. I work in Asia. Because my local time is UTC, so I try to configure my loca time(UTC+9), all time stamp are future value. Please change the value from UTC=yes to UTC=no. Cheers~~

happy035 · ‎10-07-2013

Hi there, I am using Splunk 5, Few day ago, I migrated old splunk data to new server via file copy. After moved all data, I restarted splunk server but from that time, Last Update time is in the future time. My linux server time has been configured with KST(UTC +9:00). If linux server time is Mon Oct 7 16:28:06 KST 2013 but last update time, Last update time in Splunk is Mon Oct 8 10:34:47 KST 2013. How do I fix this problem?

happy035 · ‎08-21-2013

Appreciate for your perfect answer. It works and much helpful to me. Nice day.

happy035 · ‎08-21-2013

Hello, I'm trying to compose search, that will show me srcIP, dstIP, count by dstIP like this: srcIP dstIP count 1.1.1.1 2.2.2.2 15 2.2.2.3 10 2.3.4.3 10 5.5.5.5 6.6.6.6 8 7.7.7.7 8 I used like this status="failure" | stats count(dst) by src, dst, but I was unable to get distinct value of srcIP. Could you please advise me how to do that? Thanx in advance.

happy035 · ‎03-12-2013

Thank you for your kind answer, Rui. I did success running this app. As your thought, no_sid_file config valuse may some problem. But I am not sure that. I changed no_sid_file value from -2 to 0. After that I can watch all data. Thank you for your help. Regards,

happy035 · ‎03-12-2013

Hi there, I installed splunk for netwitness and set up all configuration. But It's not working well. Error log is below. "ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/netwitness/bin/nwsdk.py" 2013-Mar-12 18:04:35 - INFO: No new sessions to read from http://netbox_IP:50105/ And then my splunk box info is here. Linux 3.5.0-25-generic #39~precise1-Ubuntu SMP Tue Feb 26 00:07:14 UTC 2013 x86_64 x86_64 x86_64 GNU/Linux when I ping to netwitness, everything is OK. my config file which named nwsdk.conf located in /opt/splunk/etc/apps/netwitness/local/nwsdk.conf. I have no idea why this app was not worked from my linux box.

Posts	9
Solutions	0
Karma Given	0
Karma Received	1
Member Since	‎03-07-2013

Online Status	Offline
Date Last Visited	‎06-05-2020 02:04 AM

How to sort listed data?

Last update time is future time

group by srcIP and total count dstIP

Splunk for netwitness is not working.

Re: How to sort listed data?

Re: How to sort listed data?

How to sort listed data?

Re: Last update time is future time

Last update time is future time

Re: group by srcIP and total count dstIP

group by srcIP and total count dstIP

Re: Splunk for netwitness is not working.

Splunk for netwitness is not working.

Are you a member of the Splunk Community?