Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About JacekF
JacekF
Path Finder
Member since:
08-13-2020
09-16-2022
Community Statistics
| Posts | 37 |
| Solutions | 11 |
| Karma Given | 0 |
| Karma Received | 14 |
| Member Since | 08-13-2020 |
Activity Feed
- Got Karma for Re: Timechart with where and streamstat not retrieving same results as where and stats. 09-16-2022 09:19 AM
- Posted Re: Timechart with where and streamstat not retrieving same results as where and stats on Splunk Search. 09-16-2022 07:25 AM
- Posted Re: Timechart with where and streamstat not retrieving same results as where and stats on Splunk Search. 09-16-2022 06:25 AM
- Posted Re: Data onboarding methods on Splunk Enterprise. 09-16-2022 03:30 AM
- Got Karma for Re: SPL. 09-15-2022 07:19 AM
- Posted Re: SPL on Splunk Search. 09-14-2022 08:57 AM
- Posted Re: Setup a Splunk alert to run on 2 different days during 2 different times on Alerting. 09-14-2022 08:49 AM
- Tagged Re: Setup a Splunk alert to run on 2 different days during 2 different times on Alerting. 09-14-2022 08:49 AM
- Got Karma for Re: Splunk query/condition to check and trigger Alert 2 hours before the Job Completion time. 09-14-2022 03:28 AM
- Posted Re: Splunk query/condition to check and trigger Alert 2 hours before the Job Completion time on Knowledge Management. 09-14-2022 02:37 AM
- Got Karma for Re: How to search each value of a lookup table and update the corresponding column based on SPL?. 09-13-2022 11:16 AM
- Got Karma for Re: How to send an alert for Alert resolution?. 09-13-2022 11:12 AM
- Posted Re: How to search each value of a lookup table and update the corresponding column based on SPL? on Splunk Search. 09-11-2022 11:39 PM
- Posted Re: How to search each value of a lookup table and update the corresponding column based on SPL? on Splunk Search. 09-09-2022 04:29 AM
- Posted Re: How to search each value of a lookup table and update the corresponding column based on SPL? on Splunk Search. 09-08-2022 11:47 PM
- Posted Re: How to send an alert for Alert resolution? on Alerting. 09-08-2022 12:03 AM
- Posted Re: How to send an alert for Alert resolution? on Alerting. 09-07-2022 04:57 AM
- Posted Re: Installing a heavy forwarder and a search head on the same VM on Installation. 07-27-2022 10:12 AM
- Posted Re: Multi (2) line chart shows as one big line on Splunk Search. 07-26-2022 05:04 AM
- Posted Re: Multi (2) line chart shows as one big line on Splunk Search. 07-26-2022 04:16 AM
Topics I've Started
No posts to display.
09-16-2022
07:25 AM
1 Karma
My bad, sorry, below is the correct version | bin _time span=5m | stats sum(diff) as FinalDiff by X_Request_ID, _time | where FinalDiff > 1000 | eval seriesName="Baxter<->Saturn" | timechart count by seriesName
... View more
09-16-2022
06:25 AM
The reason for that is in how streamstats works. Consider this example: | makeresults
| eval data = "a,1;a,1;a,1;b,2;a,1;b,2;a,1;b,2"
| makemv data delim=";"
| mvexpand data
| makemv data delim=","
| eval req_id = mvindex(data,0)
| eval diff = mvindex(data,1)
| streamstats sum(diff) by req_id
| fields - _time data This produces the following table: diff req_id sum(diff) 1 a 1 1 a 2 1 a 3 2 b 2 1 a 4 2 b 4 1 a 5 2 b 6 If now the condition where sum(diff) > 3 is applied, multiple rows for each req_id will match. If you want to do a timechart from your initial SPL query, you can try the following (replacing the last line of your query) | bin _time span=5m | stats sum(diff) as FinalDiff by X_Request_ID, _time | eval seriesName="Baxter<->Saturn" | timechart count by seriesName
... View more
09-16-2022
03:30 AM
Your question is too general to give you specific answer. I'd suggest to read the Splunk documentation where various methods to get data in are described. What data can I index? - Splunk Documentation
... View more
09-14-2022
08:57 AM
1 Karma
Your "if" function is wrong. You should use something like this: if(like(data,"SVV%"), substr(data, 1, 3), substr(data, 1, 7)) I've tested it with the following query: | makeresults
| eval data = "XBY-123-UTB,SVV-123-TBU"
| fields - _time
| makemv data delim=","
| mvexpand data
| eval result = if(like(data,"SVV%"), substr(data, 1, 3), substr(data, 1, 7))
... View more
09-14-2022
08:49 AM
I don't think this can be done with a cron schedule only. You can use a cron similar to that one: */10 20-22,6-8 * * 5,0 This should execute the alert at every 10th minute past every hour from 20 through 22 and every hour from 6 through 8 on Friday and Sunday. In the SPL you can add a condition to check the day of week and the hour and return results depending on day/hour combination.
... View more
- Tags:
- I don't
09-14-2022
02:37 AM
1 Karma
You have provided a very little information on your environment, but If I understand your problem correctly, the following should allow you to determine if current time is later than the checking trigger time (2AM) | makeresults | eval triggerTime = relative_time(now(), "@d") + (2*3600) | eval check = if(now() > triggerTime, "Trigger", "Don't") The relative_time function is used to round epoch time down to the beginning of the day and then the number of seconds 2 hours have (2*3600) is added.
... View more
09-11-2022
11:39 PM
You are reaching one of the Splunk limits defined in limits.conf. This is why you receive the total number of 50000 records. I would suggest that you mark this thread as resolved, and open a new one regarding the limited number of rows in the result. This will, from one hand, allow others with the same problems as initial one in this thread, to find a solution, and from the other hand you will more likely find the answer to the limited results problem, as more people will take a look at it.
... View more
09-09-2022
04:29 AM
Most likely you hit the stats command limit. This can be changed in limits.conf file. You may find this thread useful: Solved: Why do I receive "Limit (50000 results) reached." ... - Splunk Community
... View more
09-08-2022
11:47 PM
1 Karma
Will bellow query meet your requirements? index="idx1"
[| inputlookup table1.csv
| eval index=lower(index)
| eval host=lower(host)
| eval sourcetype=lower(sourcetype)
| table index, host, sourcetype
| rename index AS orig_index, host AS orig_host, sourcetype AS orig_sourcetype]
| stats max(_time) AS last_seen BY orig_index, orig_sourcetype, orig_host
| rename orig_index as index orig_sourcetype as sourcetype orig_host as host
| append [ | inputlookup table1.csv ]
| dedup index sourcetype host
| outputlookup table1.csv Please note that if you have many rows in your lookup file this solution will be time and resource consuming, as it will need to load the entire lookup twice.
... View more
09-08-2022
12:03 AM
1 Karma
Then it looks like you need a query with a time range covering last two samples, and then compare latest value with the earliest. If latest value is below the threshold and earliest is above it, it means that there is more free space available and an alert (notification) can be sent. Or maybe I completely misunderstood your case?
... View more
09-07-2022
04:57 AM
You haven't provided much details about your data but in general you can try something like that: | stats min(disk_usage) as min_usage max(disk_usage) as max_usage | where min_usage < threshold and max_usage > threshold This needs to be run for a time range which will cover at least 2 last disk usage samples. I assume that you already have an alert to be triggered when disk_usage is above the threshold
... View more
07-27-2022
10:12 AM
To avoid multiple VMs, you can also use Splunk in docker splunk/splunk - Docker Image | Docker Hub
... View more
07-26-2022
05:04 AM
You've missed two lines from your original query. The entire query should look like this: index="myIndex"
host="myHost"
myScript
Running OR Stopped
| eval running= if(like(_raw, "%Running%"), 1, 0)
| eval stopped= if(like(_raw, "%Stopped%"), 0, 1)
| timechart latest(running) as UP latest(stopped) as DOWN span=5m
... View more
07-26-2022
04:16 AM
Will this meet your requirements? | makeresults | eval data = "0,1|1,0|1,0|0,1|1,0|0,1|1,0|1,0|0,1|1,0" | makemv data delim="|" | mvexpand data | makemv data delim="," | eval UP=mvindex(data,1) | eval DOWN=mvindex(data, 0) | fields - data | streamstats count | eval _time = relative_time(_time, "+".(count*5)."m") | fields - count | timechart latest(DOWN) as DOWN latest(UP) as UP span=5m Please note that everything up to the timechart command is just to generate some data, you don't need it in your search.
... View more
07-26-2022
03:42 AM
Please note, that you need to put local folder inside the application folder, not directly as a subdir of $SPLUNK_HOME\etc\apps. If you are using Splunk_TA_windows app, you need to put your inputs.conf in the following local folder: $SPLUNK_HOME\etc\apps\Splunk_TA_windows\local With regards to ldapsearch, test if it works by executing some search with | ldapsearch command. In my environment once saved, password is also not visible.
... View more
07-25-2022
09:03 AM
1 Karma
The following returns table you are expecting: | makeresults
| eval data=" \"connector\": {
\"state\": \"RUNNING\",
},
\"tasks\": [
{
\"id\": 0,
\"state\": \"FAILED\",
}
],
\"type\": \"sink\"
}
GROUP TOPIC PARTITION CURRENT-OFFSET LOG-END-OFFSET LAG CONSUMER-ID HOST CLIENT-ID
connect-XYZ XYZ.cardtransactionauthorizationalertsent 0 27775 27780 5 connector-consumer-XYZ /10.231.95.97 connector-consumer-XYZ.Cardtransactionauthorizationalertsent-0
connect-XYZ XYZ.cardtransactionauthorizationalertsent 1 27740 27747 7 connector-consumer-XYZ /10.231.95.97 connector-consumer-XYZ.Cardtransactionauthorizationalertsent-0
connect-XYZ XYZ.cardtransactionauthorizationalertsent 2 27836 27836 0 connector-consumer-XYZ /10.231.95.97 connector-consumer-XYZ.Cardtransactionauthorizationalertsent-0"
| rex max_match=0 field=data "\n(?<Group>[^\s]+)\s(?<Topic>[^\s]+)\s(?<Partition>[^\s]+)\s+(?<Current_Offset>[^\s]+)\s+(?<Log_End_Offset>[^\s]+)\s+(?<Lag>[^\s]+)\s+(?<Consumer_ID>[^\s]+)\s*(?<Host>[^\s]+)\s+(?<Client_ID>[^\s]+)"
| table Group,Topic,Partition,Lag,Consumer_ID
| eval Group=mvzip(Group, Topic)
| eval Group=mvzip(Group, Partition)
| eval Group=mvzip(Group, Lag)
| eval Group=mvzip(Group, Consumer_ID)
| fields Group
| mvexpand Group
| makemv Group delim=","
| eval Topic=mvindex(Group, 1)
| eval Partition = mvindex(Group, 2)
| eval Lag = mvindex(Group, 3)
| eval Consumer_ID=mvindex(Group, 4)
| eval Group=mvindex(Group, 0)
... View more
07-25-2022
06:31 AM
The stats function will return a table with two columns: methodName and count and as many rows as many you have different method names in methodName field. The "| fields - count" command will remove count column leaving only methodName column.
... View more
07-25-2022
05:21 AM
I've made a mistake, there should be | fields - count sorry for that. You need to add below part to the end of your query | stats count by methodName | fields - count
... View more
07-25-2022
04:01 AM
Try add max_match=0 argument to the rex command. | rex max_match=0 field=_raw <rest of your rex code>
... View more
07-24-2022
10:01 PM
You can do the following: | stats values(methodName) as methodName | mvexpand methodName The above will be limited to 100 unique values by default. If you have more values than that (Splunk will tell you if there are more) you can try different approach: | stats count by methodName | fields - methodName | fields - count
... View more
07-22-2022
03:05 AM
1 Karma
You can populate the dropdown with the following query: | rest splunk_server="local" "/servicesNS/-/-/admin/macros" | fields title definition Use title as label field and definition as value and assign it to a token, which can later be used to display definition.
... View more
07-21-2022
01:15 AM
1 Karma
You can try: | eventstats count by IP | where count > 1
... View more
07-21-2022
12:50 AM
If count value is null set count value to -1, use the count value otherwise (i.e. if count value is not null do not change it).
... View more
07-18-2022
05:41 AM
I think you can achieve this functionality with tokens as you can set token value using the drilldown. Here you can find example: Manage token values in the current dashboard - Splunk Documentation
... View more
07-18-2022
04:56 AM
1 Karma
You only need those props and transforms conf files on indexers/heavy forwarders.
... View more
