Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- About ashabc
ashabc
Contributor
Member since:
10-20-2013
06-05-2020
Community Statistics
| Posts | 95 |
| Solutions | 4 |
| Karma Given | 18 |
| Karma Received | 21 |
| Member Since | 10-20-2013 |
Activity Feed
- Got Karma for Re: Pie Chart data labels. 02-21-2024 01:51 PM
- Got Karma for Re: Search output of a stats command. 06-05-2020 12:49 AM
- Karma Re: Is there a way to get a list of Splunk Apps that are installed on a deployment client running a universal forwarder? for somesoni2. 06-05-2020 12:48 AM
- Karma Re: Field extraction from lines with different fields from same source for somesoni2. 06-05-2020 12:48 AM
- Karma Re: How can I get top x results and then do stats on top x for immortalraghava. 06-05-2020 12:47 AM
- Karma Re: Extract fields from single event(s) consisting of mutiple lines for MuS. 06-05-2020 12:47 AM
- Karma Re: How to extract the date and time from a single column in a CSV file as separate fields? for landen99. 06-05-2020 12:47 AM
- Karma Re: Eval for known and unknown field values for martin_mueller. 06-05-2020 12:47 AM
- Karma Re: How to extract the date and time from a single column in a CSV file as separate fields? for woodcock. 06-05-2020 12:47 AM
- Karma Re: display sum value in pie chart for martin_mueller. 06-05-2020 12:47 AM
- Got Karma for Re: How to set an alert when the distinct count is less than 10 over the last hour?. 06-05-2020 12:47 AM
- Got Karma for Splunk Add-on for Cisco WSA: not extracting fields. 06-05-2020 12:47 AM
- Got Karma for How to edit my dashboard searches as I change the time range from Last Hour to Last 30 Days and maintain or improve performance?. 06-05-2020 12:47 AM
- Karma Re: Heavy forwarder cisco ironport web proxy log for jtacy. 06-05-2020 12:46 AM
- Karma Re: single value dashboard customize panel height for rsennett_splunk. 06-05-2020 12:46 AM
- Karma Re: iplocation geostats show count of events from source ip on Google map for Lazarix. 06-05-2020 12:46 AM
- Karma Re: Time range problem in advance XML dashboard (timerangepicker) for Ayn. 06-05-2020 12:46 AM
- Karma Re: cisco firewall add on data in index but no data in dashboard for ShaneNewman. 06-05-2020 12:46 AM
- Karma Re: Daily License Usage by Host for lguinn2. 06-05-2020 12:46 AM
- Karma Re: Legend area width for sansay. 06-05-2020 12:46 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
11-13-2015
12:01 PM
Wow! Why I did not think that way. That is what exactly I was looking for. Thank you.
... View more
11-13-2015
02:58 AM
It will be nice to have a feature like this.
| stats avg(time_taken) by top 5 x_edge_location
... View more
11-13-2015
02:31 AM
I have web page logs that have several fields. The important ones for this are CDN locations x_edge_location and the response time time_taken
How can I first find out top 5 x_edge_location and then do a stats on those top 5 locations for average time_taken ?
Tried the following, does not work
...| top 5 x_edge_location | fields x_edge_location, time_taken | stats avg(time_taken) by x_edge_location
I guess its not working, because top does not return any additional fields other than the field on which top operation is carried out and the count.
... View more
09-16-2015
03:53 AM
Its kind of work.
What I still don't get it is you used eval foo="data_string". Its OK for 2 sets of sample data. When I have thousands of data in the csv file, how can I tackle that?
... View more
09-13-2015
04:18 PM
Here is sample data for 2 users. It basically contains a set of strings and numbers. The userid will be string, followed by some other form of id (property1) in number form, then 2 other properties, both strings and so on.
user1
101253
DTZ
Penrith, Cumberland
user2
2151614
FCC
Balnd, Temora
... View more
09-11-2015
04:41 PM
I have a csv file that has only one column without any header. The data set includes values for userid, property1, property2, property3 and then again userid, propperty1, property2, property3 and so on. How can I extract fields useird, property1, property2 and property3 ?
Tried something like below (e.g. for userid), does not work
.....| rex field=_raw "(?<userid>^(.*)\n)"
... View more
09-11-2015
02:10 PM
Thank you both Woddcock and Landen. Both works!
... View more
09-10-2015
04:04 PM
Thanks Woodcock. It certainly works.
One other question in relation to this. If I now want the duration between DeclareDate and RevokeDate, how can I get that. I tried the example in the url below, but seems not working.
http://answers.splunk.com/answers/39463/calculate-time-difference-between-2-fields-sum-and-group-by-month.html
I tried this:
| convert timeformat="%d/%m/%yT%H:%M" mktime(RevokedDate) mktime(DeclaredDate) | eval duration=RevokedDate-DeclaredDate
... View more
09-10-2015
05:43 AM
I have a CSV file with headers which have date and time stamp fields in a single column. I want to extract date and time as separate fields. e.g. on 1st row of dataset the DeclaredDate is "26/12/2008 10:30" I want to extract fields DeclareDate as 26/12/2008 in date format and 10:30 as DeclareTime in time format.
If I import data using default CSV input type, the DeclareDate is extracted as timestamp for the event. However, I want both DeclaredDate as well as RevokedDate to be extracted in time format..
Can someone give me some clue? I do not have background in regex.
Sample data below:
Id,Name,DeclaredDate,RevokedDate,RegionId,LgaId,Area,AgencyId,ReferenceNo
1,Mt Mologone S44,26/12/2008 10:30,29/12/2008 12:00,4,800,Bland District,NULL,NULL
2,Gulp Road,6/01/2009 15:00,18/01/2009 20:00,1,8350,"Wingecarribee District, nm",NULL,NULL
3,Beaumont,15/01/2009 14:00,16/01/2009 17:00,1,4000,Hornsby Local Goverment Area,NULL,NULL
... View more
Thank you Pablo for pointing me to the right direction.
I ended up using below
.... | stats dc(cs_username) as unique_user | where unique_user < 10
and set an alert if the return result is greater > 0
Also used the cron job to run at 15th minute of every hour between 9 am to 6 pm during weekdays as per below . Hopefully should work.
15 09-18 * * 1-5
... View more
09-01-2015
05:45 AM
I have a search like below:
... | stats dc(cs_username) as unique_user
I want to run an hourly job and raise an alert when the unique_user number falls below 10 over last hour. How can I achieve this?
... View more
06-19-2015
11:23 PM
Thanks for a pormpt response, Woodcok. Not sure my question is clear. I want to display the actual value i.e. the sum of TotalCost for each product type in the pie chart. ... | chart sum(TotalCost) by ProductCode will only display the pie chart and not the actual values.
... View more
06-19-2015
10:58 PM
02-23-2015
02:36 AM
1 Karma
I have a dashboard that displays a number of charts taking into account the last one hour of data and automatically refreshes every 5 minutes. It works fine.
Now my management wants the similar chart for last one month's data instead of last one hour. Obviously, if I try to run my search as is with last 30 days data, it runs like a snail, which is expected.
Can anyone suggest me clue as how to make it faster? Is summary index a good option or there are other ways to run searches faster? I have listed the search commands that I used in my dashboard below:
index=webproxy eventtype=ironport_proxy | eval download=sc_bytes/1024/1024 | stats sum(download) by host
index=webproxy eventtype=ironport_proxy | stats count by "Display Name" | sort limit=10 count desc
index=webproxy eventtype=ironport_proxy | eval MegaByte=sc_bytes/1048576 | stats max(MegaByte) by "Display Name" | sort limit=10 max(MegaByte) desc
index=webproxy eventtype=ironport_proxy | eval MegaByte=sc_bytes/1048576 | stats max(MegaByte) by c_ip | sort limit=10 max(MegaByte) desc
index=webproxy eventtype=ironport_proxy | rex field=cs_url "\/\/(?P<s_hostname>[^/]*)" | eval MegaByte=sc_bytes/1048576 | stats max(MegaByte) by s_hostname | sort limit=10 max(MegaByte) desc
index=webproxy eventtype=ironport_proxy | stats count by c_ip | sort limit=10 -count
index=webproxy eventtype=ironport_proxy s_hostname!="-" sc_bytes=* | bucket _time span=1w | eval download=sc_bytes/1024/1024 | eval minute=strftime(_time,"%H:%M") | chart sum(download) over minute by host
... View more
02-07-2015
05:05 PM
Sorry my bad. Its was indded a syntax from my end. Thank you so much for your help, Martin.
... View more
02-07-2015
04:59 PM
Thank you Martin for responding to my post. When I use the command you suggested, it throws an error "Unknown search command 'case'. "
Any syntax issue in 1=1, srcip ?
... View more
02-07-2015
02:05 AM
I am using a search command to rename ip address output to device names something like below:
sourcetype=syslog | eval srcip = case(srcip = "192.168.x.5","Samsung S4", srcip = "192.168.x.8","iPhone5", srcip = "192.168.x.10","Laptop") | rename "srcip" as "Device Name" | stats count by "Device Name"
The problem is with the above command is, it only displays the devices that are in the case statement. How can I display all the devices in the sourcetype/log both defined in the case statement and those are not defined (the IP address instead of name is fine for the devices which are not defined in the case statement). For example there could be a device in the logfile with srcip=192.168.x.21 which is not defned in the case statement, and hence will not show in the output, but I would lke this device be displayed as 192.168.x.21 in the stats command output.
... View more
01-06-2015
03:50 PM
Tired that. It resulted one or two extracted fields and very strange other fields.
I logged a support call with Splunk and been advised its a bug. Reported as ADDON-2774. They provided me a new regex as a work around, but that did not work either.
I rolled back the apps to older version.
... View more
01-06-2015
01:59 AM
I tried both in search as well as TA for wsa apps (by making it visible). Both same result. It may potentially a bug in the apps.
... View more
01-05-2015
05:38 PM
index=webproxy sourcetype=cisco:wsa:squid
... View more
01-03-2015
05:27 AM
1 Karma
Not sure if anyone came across this. I just installed Splunk Add-on for Cisco WSA v 3.1.1.
Ironport WSA Log is indexed as sourcetype cisco:wsa:squid
However, in my search window I am not being able to see any of the fields that is suppose to be extracted by props.conf and transforms.conf of the TA. I am only seeing default fields such as host, source, sourcetype etc,
TA is installed in heavy forwarder, indexer and the search head.
... View more
01-03-2015
05:03 AM
I am having some issues with this TA. Version 3.1.1. Using sourcetype cisco:wsa:squid
However, it seems that the combination of transforms.conf and props.conf is not extracting the desired fields. I am only seeing the defaults fields extracted by splunk form WSA logs and none of the fields defined in props.conf. TA is installed in heavy forwarder, indexer and the search head.
Any idea, what I may be doing wrong?
... View more
02-12-2014
02:19 AM
Got some help from splunk support and been advised to use Google map apps and the following worked
| stats count by src_ip | eval _geo_count = count | geoip src_ip
... View more
02-06-2014
05:29 PM
I am trying to show the number of event from various source IPs on a map
when I run the command
| stats count by src_ip | sort -count
the number of events from individual IPs are quite high.
However, when I use the following command (so that I can show the heat map)
| iplocation src_ip | geostats count by src_ip | sort -count
I am seeing much smaller number of events on the map.
I must be doing something wrong. Can anyone provide me some clue?
I am using splnuk 6 with built-in maps feature
... View more
