Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About mztopp
mztopp
Explorer
Member since:
07-16-2020
09-13-2021
Community Statistics
| Posts | 16 |
| Solutions | 0 |
| Karma Given | 0 |
| Karma Received | 0 |
| Member Since | 07-16-2020 |
Activity Feed
- Posted Re: Search for a URL from a datamodel NOT in a lookup on Splunk Search. 09-13-2021 08:38 AM
- Posted Re: Search for a URL from a datamodel NOT in a lookup on Splunk Search. 09-13-2021 08:37 AM
- Posted Search for a URL from a datamodel NOT in a lookup on Splunk Search. 09-10-2021 02:14 PM
- Posted Use the "OTHER" value for token-based search on Dashboards & Visualizations. 02-18-2021 10:44 AM
- Posted Re: Search 1hr using IPs from 24hr on Splunk Search. 02-17-2021 04:00 PM
- Posted Search a Datamodel using field values from a lookup csv file on Splunk Search. 02-15-2021 12:30 PM
- Posted Re: Search 1hr using IPs from 24hr on Splunk Search. 02-12-2021 12:22 PM
- Posted Search 1hr using IPs from 24hr on Splunk Search. 02-12-2021 12:21 PM
- Posted Re: Find values for specific distinct counts on Splunk Search. 02-11-2021 06:07 AM
- Posted Re: How do I use a search field as a dynamic URL token in a dashboard drilldown on Dashboards & Visualizations. 02-08-2021 12:34 PM
- Posted Re: How do I add the date each data point to the report on Reporting. 02-08-2021 12:13 PM
- Posted Find values for specific distinct counts on Splunk Search. 02-08-2021 11:24 AM
- Posted Use "OTHER" value in drilldown search on Dashboards & Visualizations. 02-08-2021 10:09 AM
- Posted Re: How to create a single query that can show Internal AND External users all in one table. on Splunk Search. 07-16-2020 07:05 AM
- Posted How to create a single query that can show Internal AND External users all in one table. on Splunk Search. 07-16-2020 07:00 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
09-13-2021
08:38 AM
This appears to be exactly what I needed. Thanks! It is REALLY expensive though, any idea on the limits Splunk has for this type of thing or how I can measure/manage that aspect of this? Thanks again!
... View more
09-13-2021
08:37 AM
The format command did not change my results unfortunately.
... View more
09-10-2021
02:14 PM
For example: | tstats count from datamodel=test where * by test.url, test.user | rename test.* AS * | search NOT [ | inputlookup list_of_domains | rename domain AS url | fields url ] | table url, user I want this to show me the urls from the DM that do NOT appear in the lookup, and then give me the corresponding usernames from the DM. But, this is not working properly. When I run this search, I still see some of the urls that are in the lookup. Please help!
... View more
02-18-2021
10:44 AM
I have a line graph that allows me to click on the line and it populates the Country and the date/time automatically, through the drilldown/XML code, into a new search. The issue is, I have top 10 countries and the rest get consolidated into the OTHER value. Ideally, I want the OTHER value to be able to search for all of the countries not in the top 10. Right now, it's setup that if I click OTHER, then the search would just say: Country="OTHER" (which is obviously not an actual country). Any help is greatly appreciated!
... View more
02-17-2021
04:00 PM
I ended up using a separate lookup to store the IPs. Not really ideal, but I wasn't getting the results I was looking for. Thanks for the help!
... View more
02-15-2021
12:30 PM
I have a lookup: test.csv that has a list of 10 IP's (src_ip). I want to be able to search a datamodel that looks for traffic from those 10 IPs in the CSV from the lookup and displays info on the IPs even if it doesn't match. Currently I have tried: | tstats count from datamodel=DM where [| inputlookup test.csv | rename src_ip to DM.src_ip | fields DM.src_ip] by DM.src_ip | rename DM.src_ip AS src_ip | iplocation src_ip | fillnull value="NULL" | table src_ip, Country The issue is that if the IP from the lookup isnt found in the DataModel, it doesn't include that entire line, so instead of 10 IPs with 10 countries, I get maybe 5-6 IPs and their respective countries. I want the DM to always include all 10 IPs from the lookup in the table. I understand that I can just use the lookup to get countries, but I specifically want to have the datamodel available for other data while always including all 10 IPs in the table.
... View more
02-12-2021
12:22 PM
Just to be clear, my hope is to use this data for a report, so ideally I would be able to accomplish this all in one single search.
... View more
02-12-2021
12:21 PM
How would I take a 24 hour search such as: index=* | iplocation src_ip | stats count by src_ip, Country, dest_ip, dest_port | sort 10 -count that can effectively use the IPs from a 24 hour search, to search for the traffic in the last hour (using the same 10 IPs from the 24hr not the most popular from the last hour)? I have tried to bucket _time span=1hr, but that just searches through for the most active ips in the last hour and changes what I need. Any suggestions are appreciated!
... View more
02-08-2021
12:34 PM
<drilldown> <eval token=$row.rundeck_job_id$> <link target="_blank">https://rundeck.server/project/Project_Name/execution/show/$token$</link> </drilldown> Have you tried something like this?
... View more
02-08-2021
12:13 PM
I'm not sure what search you are using at the moment, but here is a generic example of what I believe you are asking: <search here> | stats count by _time, field1, field2 This would result in: _time field1 field2 count ------------------------------------------------------------------------------------------------------------- 2021-02-08 17:00:00 ex1 ex2 1
... View more
02-08-2021
11:24 AM
Hello all! I was hoping to take a distinct count and show either the count, or if the count is 1, show the value that is being counted. For example, index=random | stats dc(src_port) AS port_count count by src_ip would populate: src_ip | port_count ----------------------------------------------------- 1.2.3.4 6 2.3.4.5 (1) Port 443 3.4.5.6 4 Or something to this effect. Thanks!
... View more
02-08-2021
10:09 AM
Hello all! Currently I have a custom drilldown in place that takes a line graph, pulls the time field for earliest (and +1h for latest) and pulls the country associated with the line. This information is used to populate the search with click tokens. i.e. index=mysearch parameters=* | iplocation src_ip | search Country="$token$" | stats count by _time, src_ip, Country ... My hope is to not have to useother=f, but instead find a workaround for Country="OTHER" to understand it means not the other countries in the top 10. Any help is much appreciated! So, if I were to click the United States line on the graph, all is fine for Country="United States", Canada would be the same success, but OTHER is not an actual value, but a placeholder for the conglomerate of countries that didn't make the top 10. How can I get that to populate as such for the drilldown, but also if a real country is clicked, it would distinguish that as well?
... View more
Labels
- Labels:
-
drilldown
-
other
-
simple XML
-
token
07-16-2020
07:05 AM
AND just to add, if it's possible, if I can set an alert on this that can show the TOTAL of internal and external connections?
... View more
07-16-2020
07:00 AM
All users are located under POP_Address. If the POP_Address = 192.168.* or 172.16.*, etc, we consider them to be internal, if not, external. So how can I create a table that can show both: POP_Address=192.168.* (Internal) AND POP_Address!=192.168.* (External) and output the User_Name and a count of how many times this user connected? Example Output: User_Name Internal/External Count Or something to this effect. In a nutshell, I just want to know how many times each user is connecting and whether it is an internal or external connection, all in one table using just POP_Address. Thanks!
... View more
Labels
- Labels:
-
eval
-
field extraction
-
stats
-
subsearch
-
table
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
09-13-2021
02:08 PM
|
