About bandit

bandit · ‎06-30-2021

Dashboard to show forwarder phone home counts per deployment server with host fqdn ip guid Requires you to route your deployment server splunkd.log to your indexers in a distributed environment. <form theme="dark"> <label>Forwarder Phone Home</label> <fieldset submitButton="false"> <input type="time" token="time" searchWhenChanged="true"> <label>Time Range</label> <default> <earliest>-60m@m</earliest> <latest>now</latest> </default> </input> <input type="dropdown" token="deployment_server" searchWhenChanged="true"> <label>Deployment Server</label> <choice value="*">All</choice> <fieldForLabel>host</fieldForLabel> <fieldForValue>host</fieldForValue> <search> <query>index=_internal sourcetype=splunkd_access "phonehome/connection" | dedup host | table host | sort host</query> <earliest>-24h@h</earliest> <latest>now</latest> </search> <default>*</default> </input> <input type="text" token="forwarder_host_pattern" searchWhenChanged="true"> <label>Forwarder Host Pattern</label> <default>*</default> </input> <input type="text" token="forwarder_fqdn_pattern" searchWhenChanged="true"> <label>Forwarder FQDN Pattern</label> <default>*</default> </input> <input type="text" token="forwarder_ip_pattern" searchWhenChanged="true"> <label>Forwarder IP Pattern</label> <default>*</default> </input> <input type="text" token="forwarder_id_pattern"> <label>Forwarder ID Pattern</label> <default>*</default> </input> </fieldset> <row> <panel> <title>Unique Forwarders</title> <single> <search> <query>index=_internal sourcetype=splunkd_access "phonehome/connection" host="$deployment_server$" | rex "phonehome/connection_(?<forwarder_ip>[^\_]+)_80\d\d_(?<forwarder_fqdn>[^\_]+)_(?<forwarder_host>[^\_]+)_(?<forwarder_id>[^\s]+)" | search forwarder_host="*$forwarder_host_pattern$*" forwarder_fqdn="*$forwarder_fqdn_pattern$*" forwarder_ip="*$forwarder_ip_pattern$*" forwarder_id="*$forwarder_id_pattern$*" | dedup forwarder_host forwarder_fqdn forwarder_ip forwarder_id | stats count</query> <earliest>-5m</earliest> <latest>now</latest> <sampleRatio>1</sampleRatio> <refresh>5m</refresh> <refreshType>delay</refreshType> </search> <option name="colorMode">block</option> <option name="drilldown">none</option> <option name="rangeColors">["0x006d9c","0x006d9c"]</option> <option name="rangeValues">[0]</option> <option name="refresh.display">progressbar</option> <option name="useColors">1</option> </single> </panel> </row> <row> <panel> <title>Phone Home Timeline</title> <chart> <search> <query>index=_internal sourcetype=splunkd_access "phonehome/connection" | rex "phonehome/connection_(?<forwarder_ip>[^\_]+)_80\d\d_(?<forwarder_fqdn>[^\_]+)_(?<forwarder_host>[^\_]+)_(?<forwarder_id>[^\s]+)" | search forwarder_host="*$forwarder_host_pattern$*" forwarder_fqdn="*$forwarder_fqdn_pattern$*" forwarder_ip="*$forwarder_ip_pattern$*" forwarder_id="*$forwarder_id_pattern$*" host="$deployment_server$" | eval device=forwarder_ip+"-"+forwarder_id | bucket _time span=5m | dedup _time forwarder_id | timechart partial=false span=5m dc(device) as unqiue_forwarders by host | rename host as deployment_server | addtotals</query> <earliest>$time.earliest$</earliest> <latest>$time.latest$</latest> <sampleRatio>1</sampleRatio> <refresh>5m</refresh> <refreshType>delay</refreshType> </search> <option name="charting.axisTitleX.visibility">collapsed</option> <option name="charting.axisTitleY.visibility">collapsed</option> <option name="charting.axisY.scale">linear</option> <option name="charting.chart">column</option> <option name="charting.chart.overlayFields">Total</option> <option name="charting.chart.showDataLabels">all</option> <option name="charting.chart.stackMode">stacked</option> <option name="charting.drilldown">none</option> <option name="charting.layout.splitSeries">1</option> <option name="charting.layout.splitSeries.allowIndependentYRanges">1</option> <option name="charting.legend.placement">bottom</option> <option name="refresh.display">progressbar</option> </chart> </panel> </row> <row> <panel> <title>Deployment Server Summary</title> <table> <search> <query>index=_internal sourcetype=splunkd_access "phonehome/connection" host="$deployment_server$" | rex "phonehome/connection_(?<forwarder_ip>[^\_]+)_80\d\d_(?<forwarder_fqdn>[^\_]+)_(?<forwarder_host>[^\_]+)_(?<forwarder_id>[^\s]+)" | search forwarder_host="*$forwarder_host_pattern$*" forwarder_fqdn="*$forwarder_fqdn_pattern$*" forwarder_ip="*$forwarder_ip_pattern$*" forwarder_id="*$forwarder_id_pattern$*" | dedup forwarder_ip forwarder_id | top host | rename host as deployment_server count as unqiue_forwarders</query> <earliest>-5m</earliest> <latest>now</latest> <sampleRatio>1</sampleRatio> <refresh>5m</refresh> <refreshType>delay</refreshType> </search> <option name="count">10</option> <option name="drilldown">none</option> <option name="refresh.display">progressbar</option> <format type="color" field="deployment_server"> <colorPalette type="sharedList"></colorPalette> <scale type="sharedCategory"></scale> </format> </table> </panel> <panel> <title>Duplicate Hosts</title> <table> <title>(hosts expected to be unique in most cases)</title> <search> <query>index=_internal sourcetype=splunkd_access "phonehome/connection" host="$deployment_server$" | rex "phonehome/connection_(?<forwarder_ip>[^\_]+)_80\d\d_(?<forwarder_fqdn>[^\_]+)_(?<forwarder_host>[^\_]+)_(?<forwarder_id>[^\s]+)" | search forwarder_host="*$forwarder_host_pattern$*" forwarder_fqdn="*$forwarder_fqdn_pattern$*" forwarder_ip="*$forwarder_ip_pattern$*" forwarder_id="*$forwarder_id_pattern$*" | dedup forwarder_host forwarder_fqdn forwarder_ip forwarder_id | stats count by forwarder_host | search count>1 | sort -count | append [| makeresults | eval count=0 | table count ]</query> <earliest>-5m</earliest> <latest>now</latest> <sampleRatio>1</sampleRatio> <refresh>5m</refresh> <refreshType>delay</refreshType> </search> <option name="count">10</option> <option name="drilldown">none</option> </table> </panel> <panel> <title>Duplicate Forwarder IDs (GUIDs)</title> <table> <title>(indicates cloning post install)</title> <search> <query>index=_internal sourcetype=splunkd_access "phonehome/connection" host="$deployment_server$" | rex "phonehome/connection_(?<forwarder_ip>[^\_]+)_80\d\d_(?<forwarder_fqdn>[^\_]+)_(?<forwarder_host>[^\_]+)_(?<forwarder_id>[^\s]+)" | search forwarder_host="*$forwarder_host_pattern$*" forwarder_fqdn="*$forwarder_fqdn_pattern$*" forwarder_ip="*$forwarder_ip_pattern$*" forwarder_id="*$forwarder_id_pattern$*" | dedup forwarder_host forwarder_fqdn forwarder_ip forwarder_id | stats count by forwarder_id | search count>1 | sort -count | append [| makeresults | eval count=0 | table count ]</query> <earliest>-5m</earliest> <latest>now</latest> <sampleRatio>1</sampleRatio> <refresh>5m</refresh> <refreshType>delay</refreshType> </search> <option name="count">10</option> <option name="drilldown">none</option> <option name="refresh.display">progressbar</option> </table> </panel> </row> <row> <panel> <title>Forwarder Summary</title> <table> <search> <query>index=_internal sourcetype=splunkd_access "phonehome/connection" | rex "phonehome/connection_(?<forwarder_ip>[^\_]+)_80\d\d_(?<forwarder_fqdn>[^\_]+)_(?<forwarder_host>[^\_]+)_(?<forwarder_id>[^\s]+)" | search forwarder_host="*$forwarder_host_pattern$*" forwarder_fqdn="*$forwarder_fqdn_pattern$*" forwarder_ip="*$forwarder_ip_pattern$*" forwarder_id="*$forwarder_id_pattern$*" host="$deployment_server$" | dedup forwarder_host forwarder_fqdn forwarder_ip forwarder_id | table _time host forwarder_host forwarder_fqdn forwarder_ip forwarder_id | rename host as deployment_server</query> <earliest>$time.earliest$</earliest> <latest>$time.latest$</latest> <sampleRatio>1</sampleRatio> <refresh>5m</refresh> <refreshType>delay</refreshType> </search> <option name="count">40</option> <option name="dataOverlayMode">none</option> <option name="drilldown">none</option> <option name="percentagesRow">false</option> <option name="refresh.display">progressbar</option> <option name="rowNumbers">true</option> <option name="totalsRow">false</option> <option name="wrap">true</option> <format type="color" field="deployment_server"> <colorPalette type="sharedList"></colorPalette> <scale type="sharedCategory"></scale> </format> </table> </panel> </row> </form>

bandit · ‎03-09-2021

Vote for Trellis 1000 on Splunk Ideas! https://ideas.splunk.com/ideas/EID-I-862

bandit · ‎03-05-2021

Posted to Splunk ideas https://ideas.splunk.com/ideas/EID-I-859

bandit · ‎10-07-2020

Thanks @brwalker_splunk - will do

bandit · ‎10-06-2020

Hi @thambisetty it tells me @Rob_Jordan is already taken - looks like that is an even older account of mine - wonder if they could be merged? I think one was rob_jordan and one was Rob_Jordan on the old system and they collided on the new system. Maybe old system was case-sentive?

bandit · ‎10-05-2020

Hi, I've have had the screen name rob_jordan on Splunk Answers since 2013. Somehow it changed to rob_jordan1 during the recent Splunk Answers migration. Is there someone who can help me correct it? Thanks, Rob for reference: https://www.splunk.com/en_us/blog/splunklife/smart-answers-59.html

bandit · ‎08-14-2020

Thanks for the updated answer @preactivity 🙂 as most of the older answers are no longer valid on the newer Splunk releases. Rob

bandit · ‎07-06-2020

Ok, I would first start with verifying that either the "RUNNING"/"NOT RUNNING" values (I'm assuming there is an inverse value to RUNNING) are recognized by Splunk as a field. You can check apps.splunk.com to see if there is an addon that will parse your sourcetype into key/value pairs or you may have to write regex to capture the value of the run state into a field. Once it's in a field you can run statistic commands against that field such as | top state by host example inline regex command to extract the state | rex "(?<state>(RUNNING|DOWN))" If you are getting overwhelmed, you may want to start with one of the free classes which will cover fields in Splunk https://www.splunk.com/en_us/training/free-courses/splunk-fundamentals-1.html I also noticed you are running a script from crontab. You could modify the format of your log to log in key-pair values. i.e. process_status="RUNNING" or process_status="UP" or process_status="DOWN" etc. When Splunk encounters key/pair values it will auto extract fields which should make this task much simpler. https://dev.splunk.com/enterprise/docs/developapps/logging/loggingbestpractices/

bandit · ‎07-06-2020

I'm not familiar with your specific dataset, however you would want to come up with a base query that matches the events in Splunk that have the states you are trying to track. i.e. index=myindex sourcetype=mysourcetype host IN (host1,host2,host3) service IN (service1,service2,service3) note: you can wildcard parts of the host or service filters with * as well. If wanting all hosts and services, you probably don't need to add a host or service constraint.

bandit · ‎07-06-2020

your base query | dedup host application | chart values(state) over host by application note: modify fields names to match your dataset then you can color code in a table or single value chart using trellis option

bandit · ‎06-11-2020

My Karma points went down as I believe they have a new scoring system, however, my relative ranking is about the same.

bandit · ‎06-04-2020

Thanks @anthonymelita - @vnguyen46 - it seems it gets broken when I try to export the code from the simple xml source code and post here as code. I appologize for the incovenience. Sample of query Sample of source code

bandit · ‎03-10-2020

Try something like this for yesterday index="your_index_here" EventCode="*" | eval bytes=len(_raw) | bucket _time span=1d | stats count sum(bytes) as bytes by _time sourcetype EventCode | eval KB=round(bytes/1024,0) | eval MB=round(bytes/1024/1024,0) | eval GB=round(bytes/1024/1024/1024,2) | table _time sourcetype EventCode count bytes KB MB GB | sort -bytes You can also filter for specific codes like this using the IN command with a list of codes or patterns index="your_index_here" EventCode="" EventCode IN(515,462*,40962) | eval bytes=len(_raw) | bucket _time span=1d | stats count sum(bytes) as bytes by _time sourcetype EventCode | eval KB=round(bytes/1024,0) | eval MB=round(bytes/1024/1024,0) | eval GB=round(bytes/1024/1024/1024,2) | table _time sourcetype EventCode count bytes KB MB GB | sort -bytes I haven't tried getting an exact match, however you may have to search all time and use _indextime as constraint. _indextime being the time the indexer see the event. That's the time that should match with the ingest volume.

bandit · ‎03-09-2020

If you're looking estimate license volume for specific events, you can use the length of an event in bytes and then convert to MB/GB. index=your index here your search constraints here | eval bytes=len(_raw) | timechart sum(bytes) as bytes | eval KB=bytes/1024 | eval MB=bytes/1024/1024 | eval GB=bytes/1024/1024/1024

bandit · ‎03-08-2020

Also consider that timestamps and index time can factor into this calculation as well. If you add a new input on to a forwarder, you could potentially ingest data today that is more than a day old. The license counts against data ingested in the current day regardless of whether the event timestamp is in the past or the future. tstats will use what Splunk considers the event time (_time) in count not the index time (_indextime)

bandit · ‎03-06-2020

Spitballing... Possibly two forwarders on the same host and put one rule on each forwarder? https://www.splunk.com/en_us/blog/tips-and-tricks/running-two-universal-forwarders-on-windows.html Collect remotely using WMI and let a Heavy Forwarder route to QRadar https://docs.splunk.com/Documentation/Splunk/latest/Data/MonitorWindowseventlogdata#Use_WMI Write code to query the data from the Splunk REST API, reformat message, and post to to QRadar https://docs.splunk.com/Documentation/Splunk/latest/RESTUM/RESTusing PowerShell script to periodically query events and either write to a new log, post to Splunk HTTP Event Collector, or directly to QRadar https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.diagnostics/get-winevent?view=powershell-7 https://docs.splunk.com/Documentation/Splunk/latest/Data/HECExamples Splunk Data Stream Processor https://www.splunk.com/en_us/software/stream-processing.html

bandit · ‎02-17-2020

Shared datamodels are available as of Splunk 8x https://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Sharedatamodelsummaries

bandit · ‎02-17-2020

Shared datamodels are available as of Splunk 8x https://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Sharedatamodelsummaries

bandit · ‎02-17-2020

Shared datamodels are available as of Splunk 8x https://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Sharedatamodelsummaries

bandit · ‎02-17-2020

Shared datamodels are available as of Splunk 8x https://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Sharedatamodelsummaries

Posts	391
Solutions	16
Karma Given	320
Karma Received	432
Member Since	‎03-19-2013

Online Status	Offline
Date Last Visited	‎08-18-2021 03:10 PM

Splunk Answers Username

How to call $SPLUNK_HOME or %SPLUNK_HOME% from a ....

Splunk Cloud HEC (http event collector) - Does it ...

FEATURE REQUEST: Splunk Cloud View of Licensed Dai...

Can I request/purchase additional Development/QA S...

Where can I find the Splunk Cloud (splunkcloud.com...

Where should the kvstore be deployed in a distribu...

FEATURE REQUEST: Trellis timechart with color by f...

SSL Certificate Checker: How to configure the add-...

FEATURE REQUEST: Splunk Alert: All Clear Notificat...

Re: How to determine which deployment server a for...

Re: Is there a way to display more than 20 charts ...

Re: FEATURE REQUEST: Splunk Alert: All Clear Notif...

Re: Splunk Answers Username

Re: Splunk Answers Username

Splunk Answers Username

Re: How to Reset the Admin password?

Re: how to create a live up or down Dahboard view

Re: how to create a live up or down Dahboard view

Re: how to create a live up or down Dahboard view

Re: What happened to Answers? The change is for th...

Re: How to list my Splunk users and their email ad...

Re: EPD compare to | tstats count

Re: EPD compare to | tstats count

Re: EPD compare to | tstats count

Re: Ingesting same Windows log with two different ...

Re: Can we share the data Models present in the in...

Re: datamodel acceleration on multiple search head...

Re: Is there a way to share a Data Model across 2 ...

Re: How do I use the same data model on multiple s...