About jodonald

jodonald · ‎03-03-2021

The license usage in the _internal logs is what Splunk uses to calculate and compare against your license. So that should be considered the "source of truth". The search you posted for searching the licensing logs is purposely excluding the sourcetype(s) starting with modular*, which may be impacted the results. Remove that from the search and see if the numbers are closer. The licensing in the _telemetry is a summarization of the data in the _internal logs that is optionally sent to Splunk for supporting your environment. references: How Splunk Enterprise licensing works - Splunk Documentation Hope that helps.

jodonald · ‎03-02-2021

Hi @hishamjan You will need to add a field to your search query to include the selected host from your dropdown. For example, if the token from the dropdown was named "selected_host" then you would modify the search query for the panel to be: source="vmstat" host=$selected_host$ | dedup host | eval host=upper(host) | eval FreeGBs=FreeMBytes/1024, TotalGBs=TotalMBytes/1024, UsedGBs=UsedMBytes/1024 | table host memFreePct memUsedPct And you will need to modify the dropdown to assign a value or an "*" (for no selected hosts) to the token "selected_host". the Splunk documentation for Create and edit forms would be a great place to review those settings. One more thing to consider, if you want to view the data over time, then you will probably want to modify the search query for your panel to be populated by a timechart instead of eval/table. source="vmstat" host=$selected_host$ | eval host=upper(host) | eval FreeGBs=FreeMBytes/1024, TotalGBs=TotalMBytes/1024, UsedGBs=UsedMBytes/1024 |timechart avg(memFreePct) as memFreePct, avg(memUsedPct) as memUsedPct by $selected_host$ Hope that helps.

jodonald · ‎03-02-2021

Hi @schufi01 Using the distinct_count() function in your timechart will give you the number of different hosts each day. so your search would look like this: | eval Amount= numberLostPackages | timechart span=24h count(Amount) as Count sum(Amount) as Total distinct_count(host) as unique_hosts aligntime=@d | eventstats sum(Count) as TotalCount | addinfo | eval Duration=(info_max_time-info_min_time)/86400 | eval Average=TotalCount/Duration Additionally, you can modify the span to align on days instead of hours which would allow for you to drop the aligntime from your timechart. so the final search would look like this: | eval Amount= numberLostPackages | timechart span=1d count(Amount) as Count sum(Amount) as Total distinct_count(host) | eventstats sum(Count) as TotalCount | addinfo | eval Duration=(info_max_time-info_min_time)/86400 | eval Average=TotalCount/Duration Hope that helps.

jodonald · ‎03-01-2021

probably the indexAndFoward setting It would be greatly helpful if you include your props and transforms. Also please review the splunk docs for routing and filtering data. https://docs.splunk.com/Documentation/Splunk/8.1.2/Forwarding/Routeandfilterdatad

jodonald · ‎03-01-2021

please post your cron schedule

jodonald · ‎03-01-2021

you could use |stats instead of |chart. | eval error= if(count>50, 1, 0) | stats sum(error) by cpwd_nr, host

jodonald · ‎03-01-2021

There is an app in Splunkbase which may help. I would recommend starting there. Hope that helps.

jodonald · ‎06-17-2020

Remote Splunk Architect position for Raleigh, NC company. W2. $140-160 annually. Must be Splunk Architect certified. Contact Tripp Peele at TekSystems. 919.760.4353 or rpeele@teksystems.com and tell him I referred you. POSITION SUMMARY The Splunk Architect - Design and Engineering is responsible for supporting system life cycle of security products and services, as well as the entire technical security posture of the company and all associated deviations. RESPONSIBILITIES • • Support Security Manager, Design & Engineering in developing and delivering the Information Security strategy • • Design, implement and maintain Splunk • • Lead the Splunk architecture and strategy programs, with the ability to drive the implementation of the strategic vision • • Lead the work to solve unique problems across a variety of use cases within Splunk • • Contribute to the design and development of monitoring solutions via the integration of various toolsets into Splunk • • Share best practices and create innovative solutions to push user adoption and maximize the value of Splunk • • Assist in workshops (including training sessions) to help customers leverage the full value of Splunk solutions and participate in periodic stakeholder meetingsQUALIFICATIONS • • At least 5 years of work experience in a Splunk focused role • • Splunk Architect certified • • CISSP Certification preferred or equivalent (ex. CISM) • • Excellent documentation skills • • Expert technical troubleshooting skills required • • Understanding of basic AV technologies and protective strategies • • Understanding of network and system firewalls • • Ability to work and follow ITIL processes for change management and ticket management • • Experience developing security architecture plans (strategic, tactical and project plans). • • Ability to collaborate with a multi-skilled team • • Must be self-motivated with strong sense of ownership, accountability, and urgency • • Quality communications skills and the ability to interact with customers and vendors

Posts	8
Solutions	2
Karma Given	0
Karma Received	2
Member Since	‎03-13-2015

Online Status	Offline
Date Last Visited	‎03-03-2021 09:44 AM

Remote Splunk Architect

Re: License reporting: Usage vs Rollover Summary

Re: Display CPU Utilization per host per time usin...

Re: Add field to timechart

Re: forwarding logs through props.conf

Re: Scheduled searches stuck in past

Re: chart by 2 fields

Re: alerts via health.conf

Remote Splunk Architect