Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About troy44112
troy44112
Explorer
Member since:
07-09-2020
Community Statistics
| Posts | 19 |
| Solutions | 0 |
| Karma Given | 6 |
| Karma Received | 0 |
| Member Since | 07-09-2020 |
Activity Feed
- Karma Re: How to specify the time frame in a search? for richgalloway. 06-07-2022 05:43 PM
- Karma Re: if statement search help for ITWhisperer. 06-07-2022 01:06 PM
- Posted How to specify the time frame in a search? on Splunk Search. 06-07-2022 12:53 PM
- Posted How would I write the following if statements in Splunk? on Splunk Search. 05-25-2022 04:40 AM
- Posted Re: Make eval time minutes on Splunk Search. 03-25-2022 05:47 AM
- Posted Re: Make eval time minutes on Splunk Search. 03-23-2022 09:26 AM
- Posted How to create a search that will send an alert when the feed has been delayed for >=70min? on Dashboards & Visualizations. 03-23-2022 06:38 AM
- Karma Re: Make eval time minutes for gcusello. 03-23-2022 06:29 AM
- Karma Re: Make eval time minutes for venky1544. 03-23-2022 06:29 AM
- Posted Re: Make eval time minutes on Splunk Search. 03-22-2022 09:08 AM
- Posted How to make eval time minutes? on Splunk Search. 03-22-2022 09:02 AM
- Posted Reroute host to different index on Getting Data In. 09-23-2021 06:10 AM
- Posted Search optimization on Splunk Search. 11-05-2020 12:59 PM
- Posted Re: Help with dashboard output on Dashboards & Visualizations. 07-13-2020 11:45 AM
- Karma Re: Help with dashboard output for richgalloway. 07-13-2020 11:45 AM
- Tagged Re: Help with dashboard output on Dashboards & Visualizations. 07-13-2020 11:45 AM
- Posted Re: Help with dashboard output on Dashboards & Visualizations. 07-09-2020 11:38 AM
- Posted Re: Help with dashboard output on Dashboards & Visualizations. 07-09-2020 10:39 AM
- Posted Re: Help with dashboard output on Dashboards & Visualizations. 07-09-2020 09:58 AM
- Posted Help with dashboard output on Dashboards & Visualizations. 07-09-2020 07:24 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
06-07-2022
12:53 PM
Hello, How would I specify the time frame in a search to provide me the events between 7am - 5pm weekdays and all results for weekends within the same search
... View more
Labels
- Labels:
-
search job inspector
05-25-2022
04:40 AM
How would I write the following statements in Splunk? Variables are start_access and last_access Statement If 20 days have passed from the start_access AND there was no last_access since the last start_access, then the result is not active.
... View more
Labels
- Labels:
-
search job inspector
03-25-2022
05:47 AM
@gcusello , It still isn't working. The alert subtracts from whenever the search is ran & the "late" variable, then outputs it as latency. Rather than alerting if there is a delay >60min.
... View more
03-23-2022
09:26 AM
@gcusello @venky1544, When I set the alert it runs off of "current time" search, so results are returned even though there isn't a delay. Would you happen to know how to change this search to if there is a delay of >60min. Rather than subtracting the current time from the last ingestion time?
... View more
03-23-2022
06:38 AM
I am looking to create a search that will send an alert when the feed has been delayed for >=70min
... View more
- Tags:
- alert
- splunk-search
Labels
- Labels:
-
other
03-22-2022
09:08 AM
@gcusello What does the 3600 represent? I am trying to figure out the calculation. ie: if I want to change it to 60min, 45min, 90min etc..
... View more
03-22-2022
09:02 AM
What do I need to add to this search, to make this search | where Need >= 60min
| tstats max(_indextime) AS Late where earliest=-24h latest=now (index=bluff) by sourcetype
| eval CurrentTime=now()
| eval Need = CurrentTime - Late, LastIngestionTime=strftime(Late,"%Y/%m/%d %H:%M:%S %Z"), CurrentTime =strftime(CurrentTime,"%Y/%m/%d %H:%M:%S %Z")
| table sourcetype, LastIngestionTime, CurrentTime, Need
| rename LastIngestionTime as "Last", CurrentTime AS "Search time", Need AS "Latency in Minutes"
... View more
- Tags:
- eval
- splunk-search
Labels
- Labels:
-
search job inspector
09-23-2021
06:10 AM
I am trying to figure out how to reroute a specific host to a different index. For example, search results of host=1234test shows in index=best_life... How would I change the index of host1234 from best_life to fall into a different index that exist already ie. (index=other_index)..
... View more
Labels
- Labels:
-
index
07-09-2020
11:38 AM
I apologize. I don't know how to transform the first photo into the last. I was given the last photo as an example and I am attempting to turn the first photo into the last, that is the reason why I am here. I was hoping that someone would know what it would take to transform the first photo into the last. I do not have the code to do that. here is the code to the first solution | makeresults | eval systemName="CE", ID="12345-MA-12345", severity="Critical", vulnCount="10" | append [| makeresults | eval systemName="CE", ID="12345-MA-12345", severity="High", vulnCount="5"] | append [| makeresults | eval systemName="3E", ID="23456-MA-23456", severity="High", vulnCount="10"]
... View more
07-09-2020
10:39 AM
the code for the transition from the first to the last is what I am trying to accomplish. Displaying systemName, ID total of High and Critical by systemName. I attempted to use eval split function and mvindex but couldn't quite figure it out.
... View more
07-09-2020
09:58 AM
I would like to use the data in the first photo (dashboard ) to create the second photo (dashboard).
... View more
07-09-2020
07:24 AM
How would I get from the first output to the final output? First Output Finaloutput
... View more
Labels
- Labels:
-
table
Contact Me
