About priya0709

priya0709 · ‎01-23-2021

I am currently running a search which provides Name of host which are unregistered at a particular time and then after 1 hour run same search to fetch unregistered host Then I manually compare 2 reports for name of host were unregistered in first report and now changed to registered in next report. Based on the data compared for unregistered an registered host I take necessary action on unregistered host.. My question--is there a way we can compare the data for 1 hour in 1 single search?? Query currently use is - - | input lookup R2VirtualDedktopAssignments | where Environment=PROD And Registrations tate =Unregistered

priya0709 · ‎11-05-2020

Please see attached

priya0709 · ‎11-05-2020

My requirement is to exclude all subjects which has words "Alert: Processor > % Processor Time" in subject Please see attached my query

priya0709 · ‎11-05-2020

I have to exclude all subject with some similar set of words in subject. Eg. Inc00452| RE: Exchange 2K16: Alert: Processor > % Processor Time So I have to exclude all subject with 'Alert: Processor > % Processor Time' So all subject with above keyword should be excluded

priya0709 · ‎10-23-2020

We use outlook categories while categorizing alerts received in several outlook folder of specific mailbox, as we perform monitoring of applications like exchange, Skype, sharepoint. Categories are defined by us. Is there a way we can connect that outlook data of that particular mailbox and get those categories for individual alerts in splunk? Other data like sender, recipient, subject, time can be by performing message tracking in exchange on particular mailbox from splunk Only difficulty is how to get the categories assigned by individual team member through splunk

priya0709 · ‎10-20-2020

I want to setup a 30 days report, but I want to receive this report on email on last day of the month,depending on the last day bet it 30th, 31st or 28th. But my requirement is to receive on last day of month? How can I setup the schedule for the above report

priya0709 · ‎10-03-2020

Yes, I was able to join the 2 queries. Please see attached query

priya0709 · ‎10-03-2020

I wanted to update my query to exclude Saturday and Sunday from attached query which is running for last 30 days Please suggest Query searches for host which generated event code 52 in last 30 days

priya0709 · ‎09-30-2020

I have a query saved to display all Hard Disk error for hosts. We generate this data daily from the query and send it to the respective Assignee every Wednesday. My requirement is to prepare a visualization for 30 days data of these scheduled search?? Please help me with the query

priya0709 · ‎09-29-2020

I need help to join two of my reports 1St report fetches host name with Event code 52 and in time picker this report runs for 24 hrs 2nd report fetches host name with Event code 52 and count of host name which are been repeated in last 30 days I want to join both reports based on host name 2nd report running for 30 days should match host name running for last 24 hours and give the count also for how many days dat particular host is getti g repeated with Event code 52

priya0709 · ‎09-26-2020

Will this also provide instances of a particular report I have scheduled?? (daily instance of report) which I will accumulate to prepare a 30.days dashboard?

priya0709 · ‎09-25-2020

How can access all historical reports in splunk. My requirement is to prepare a visualization for last 30 days report data.

priya0709 · ‎09-25-2020

My current attached query search for host which are generating event code 52 in last 24hours, but my requirement is to highlight hosts which are repetitively generating event code 52 from last 1 month.

priya0709 · ‎09-23-2020

I have a table which generates hosts with Event code 52 in last 24 hours, however my requirement is to highlight hosts which are repetitive eg:- hosts which are generating event code 52 from last 2,3 days or 1 week and also can I get a count of days from which host is generating event code 52

priya0709 · ‎09-23-2020

Thank you for your great help👍👍👍

priya0709 · ‎09-22-2020

Please refer attachment

priya0709 · ‎09-22-2020

The new query doesn't work as for SupportTier 908 & HR_Country Assignee field turns out to be 'Terri'

priya0709 · ‎09-22-2020

I will write the conditions again:-- SupportTier =908 & HR_Country = America, Assignee = DG 908 Also to be added with below command |eval Assignee= case((substr(Support_tier, -2)="02") AND (HR_Country="America"), "Jeremy", (substr(Support_tier, -2)!="02") AND (HR_Country="America"),"Terri")

priya0709 · ‎09-22-2020

HR_Country =America only when SupportTier is 908

priya0709 · ‎09-22-2020

I have an if condition | eval Assignee=if(SupportTier="908","DG 908",Assignee) Which does not work with query below. PLEASE HELP TO FIX THE QUERY |eval Assignee= case((substr(Support_tier, -2)="02") AND (HR_Country="America"), "Jeremy", (substr(Support_tier, -2)!="02") AND (HR_Country="America"),"Terri")

priya0709 · ‎09-18-2020

Getting error with above query Error in 'eval' command: Type checking failed. 'AND' only takes boolean arguments

priya0709 · ‎09-18-2020

Thank for your reply. I have modified my query |eval Assignee= case(substr(Support_tier, - 2)="02" AND HR_Country="America", "Jeremy") But other than above Condition all HR_Country to be America should have value "Terri" Unable to add 2nd condition in my query?

priya0709 · ‎09-17-2020

In my query Support_tier is a field with 3 numbers eg:- 102, 103, 901,802, 908, 103, 107 and HR_Country is America My requirement is to have Assignee field to display value based on below:-- If Support_tier have 01 & 02 at the end from above numbers and HR_Country is America then value of Assignee should be 'Earl Vieuten' apart from this all HR_Country which are America should have Assignee as 'Terri'

priya0709 · ‎09-17-2020

I have a table generating fields Assignee, Support_tier, HR_Country, Hostdomain, I have to Assign some values to 'Assignee' based on some values in other fields Eg: if Support_tier is 901 and HR_Country is Canada the Assignee value should be 'priya' also if Support_tier is 908 & 909 Assignee should be 'udit' Kindly help with the query??

priya0709 · ‎09-16-2020

Hi Thanks for your reply Computername is from raw dat But actual field is 'Hostdomain' under which I want to display 'corp' from computername Computername format - - <HOST>. Corp. <domain>. com

Posts	59
Solutions	1
Karma Given	12
Karma Received	1
Member Since	‎08-03-2020

Online Status	Offline
Date Last Visited	‎11-18-2021 08:30 AM

Compare data for 1 hour

Exclude words from subject

Outlook categories integration with splunk

Cron schedule for monthly report

Exclude Saturday and Sunday from monthly repirt

Saved search usage

Join two reports

Historical data required

Highlight duplicate host value for hostfield

If else help

Compare data for 1 hour

Re: Exclude words from subject

Re: Exclude words from subject

Exclude words from subject

Outlook categories integration with splunk

Cron schedule for monthly report

Re: Join two reports

Exclude Saturday and Sunday from monthly repirt

Saved search usage

Join two reports

Re: Historical data required

Historical data required

Re: Highlight duplicate host value for hostfield

Highlight duplicate host value for hostfield

Re: If else help

Re: If else help

Re: If else help

Re: If else help

Re: If else help

Re: If else help

Re: If else help

Re: If else help

If else help

If statement help

Re: Split and display