About ipoluda

ipoluda · ‎03-13-2024

Hello! I have a log that shows locking/unlocking PCs: 1710320306,u09,unlocked 1710320356,u09,locked 1710320360,u10,unlocked 1710320363,u10,locked 1710320369,u11,unlocked 1710320374,u11,locked 1710320379,u09,unlocked 1710320384,u09,locked 1710320389,u10,unlocked 1710321119,u10,locked 1710321126,u11,unlocked 1710322754,u11,locked 1710322760,u09,unlocked 1710324580,u09,locked 1710326550,u09,unlocked 1710328364,u09,locked The first field - unix timestamp, second - user, third - action. I need to get a statistics for PCs beeing unlocked by users. So it will the sum of seconds between unlocked-locked actions for each user. Please, help with search query

ipoluda · ‎04-25-2023

Thank you! It is the same I was needed!))

ipoluda · ‎04-12-2023

Hi, I have four indexes with call data. Each index is populated with the data of the corresponding SIP operator, i.e. XML in one index, Key-Value in the second, CSV in the third, and JSON in the last. I need to get statistics on these calls: who called, how many times and what is the total time of these conversations. That is, as in the attached picture. The question is how to "glue" these statistics together. the main difficulty is that before getting normalized statistics (or a table), I have many transformations for each index. Please help me figure out the best way to do this.

ipoluda · ‎08-16-2021

I was also confused why the Add-on is not working, but the reason lies in just one space)) Namely, in the REGEX line. If you look at the incoming events, you can notice that there is a space between "CEF:" and its value ("0" in my case). That space is not counted in the default regular expression: 2021-08-16T12:11:47.000 fp-dlp.local CEF: 0|Forcepoint|Force.... So just replace the default REGEX line with this one: (.+)\s+CEF:\s*(\d+)(?<!\\)\|(.+?)(?<!\\)\|(.+?)(?<!\\)\|(.+?)(?<!\\)\|(.+?)(?<!\\)\|(.+?)(?<!\\)\|(.+?)(?<!\\)\|(.+)$ P.S. \s* means zero or unlimited spaces, so even if there is no space in some cases, the regex will still work correctly

ipoluda · ‎04-08-2021

I have proxy logs, in which I am interested in 4 fields: the ip address of the user's computer, the category of the site he visits and the total amount of incoming and outgoing traffic for each category. Now I got such a table, but I needed it to be like in the second table on the screenshot. I just can't find a solution, I ask the SPL guru to help me))) My query: index=proxy | stats sum(bytes_in) as totalBytesIn, sum(bytes_out) as totalBytesOut, values(category) by src_host

ipoluda · ‎01-15-2021

Hello! I need to collect some data from PCs, that are the part of the industrial machines. These computers run Windows XP (x86) and 7 (both x86 and x64), which are no longer supported by either Microsoft or Splunk. Also, the organization has deployed Splunk Enterprise version 8.1, that is, I eventually need to enter data from these computers into Splunk server. To summarize, I need installation files of the latest releases of Splunk for: 1. Splunk UF for Windows XP x86 2. Splunk UF for Windows 7 x86 3. Splunk UF for Windows 7 x64 4. Splunk Enterprise (x64) which is compatible with Windows XP UF (for HF deployment) 5. Splunk Enterprise (x64) which is compatible with Windows 7 UF (for HF deployment) Also, I found that Splunk didn't remove installation files from download site, only remove the links from download page. For example, I found the direct download link for 6.2.0 version, but I don't know for which Windows version it is: https://download.splunk.com/products/splunk/releases/6.2.0/windows/splunk-6.2.0-237341-x64-release.msi I would be very grateful if someone shares such links or the installation files themselves, because the Splunk Support replied that "nothing can help"...

ipoluda · ‎12-14-2020

Hello! I want to ping some host on the Internet from every UF in my network to quickly find out about its availability/unavailability. The simplest way would be to write a script, but no matter how much I tried to write a bat, nothing came of it. Perhaps someone has already solved this issue and can share the script, or else help to write it correctly. No matter what format the output of the script will be, the main thing is that this output can be used to determine the availability of the host. Here's what I tried: ping -n 1 www.google.com @echo off ping -n 1 www.google.com | find "TTL=" > nul if errorlevel 0 echo Ping successful Both scripts inject the system into recursion and do not output any ping results. I am a noob in bat scripts, please, help me...

ipoluda · ‎01-29-2020

We have Splunk Light Cloud instance with ~2TB of collected data. We want to migrate to on-prem Splunk Enterprise. Is there the possibility to export all data (indexes) from Splunk Light Cloud (very important data for us) and import its to Splunk Enterprise? How can we do it? Will it cost some extra money?

Posts	8
Solutions	0
Karma Given	4
Karma Received	1
Member Since	‎10-29-2019

Online Status	Offline
Date Last Visited	4 weeks ago

How to calculate statistics for using PC

How to split four tables from different indexes in...

How to split stats command results into rows

Previous releases of Splunk Enterprise/UF

How to ping a host on the internet from a UF?

How to migrate from Splunk Light Cloud to On-Prem?