About ITWhisperer

ITWhisperer · ‎09-22-2020

<search> <query>...</query> <earliest>...</earliest> <latest>..</latest> <done> <set token="search_results">$job.resultCount$</set> </done> </search>

ITWhisperer · ‎09-22-2020

OK This is getting complicated. The idea is that for each day we add an extra day with count as zero. We then sum the counts by day, and take only the last day of the original time period index="ABC" sourcetype=XYZTimeout* | bin span=1d _time | stats count by PAGE_URL _time /* create an event for following day with count = 0 */ | eval tomorrow=_time+(60*60*24) | eval time=mvappend(_time,tomorrow) | mvexpand time | eval count=if(time=tomorrow,0,count) | eval _time=time | fields - time tomorrow /* autoregress to get previous day's count */ | autoregress count p=1 /* set previous day's count to 0 for the first event for the PAGE_URL */ | eventstats first(_time) as firsttime by PAGE_URL | eval count_p1=if(_time = firsttime,0,count_p1) /* join the daily counts together */ | stats sum(count) as count sum(count_p1) as count_p1 by URL, _time /* only keep the event for the last day of the query time */ | addinfo | where _time=relative_time(info_max_time-1,"@d") /* calculate the difference between the counts for the last day and the previous day */ | eval diff=count_p1 - count | rename count as count1, count_p1 as count2 | fields PAGE_URL count1 count2 diff | sort diff

ITWhisperer · ‎09-22-2020

Rather than blurred screenshots, please can you share a raw event or two in a code block, anonymising the data appropriately because there seems to be something that we are all missing which might become clearer if we could see the raw data?

ITWhisperer · ‎09-22-2020

How is this data coming into splunk? Are the comma-separated lines? Is it XML? Is it JSON? Can you share the raw data (anonymised)? That is, you share it is a format that rex can be applied to?

ITWhisperer · ‎09-22-2020

... your search | eval URL=split(URL,"\n") | mvexpand URL | rex field=URL "-(?<fieldA>\d{2}).*\/(?<fieldB>\d+$)"

ITWhisperer · ‎09-22-2020

What do the source file records actually look like? (Obviously, you should anonymise any real data.)

ITWhisperer · ‎09-22-2020

It is hard to keep up with these ever-changing requirements! However, rather than removing the first occurrence for the URL, how about setting the count_p1 to zero index="ABC" sourcetype=XYZ Timeout* | bin span=1d _time | stats count by PAGE_URL _time | autoregress count | eventstats first(_time) as firsttime by PAGE_URL | eval count_p1=if(_time = firsttime,0,count_p1) | eval diff=count - count_p1 | rename count as count1, count_p1 as count2 | fields PAGE_URL count1 count2 diff|sort diff

ITWhisperer · ‎09-22-2020

Panels can be shown/hidden depending on the presence of a token. This token could be set/unset based on the number of results in the query of the panel <panel depends="$results1$"> ...

ITWhisperer · ‎09-22-2020

Yes - the minutesago calculation allows the colours to be set appropriately

ITWhisperer · ‎09-22-2020

You have multiple evals where country is UNITED STATES OF AMERICA so you might want to group these together | eval Assignee=if(HR_Country="America",case((Support_tier="908"), "DG 908", (Support_tier="909"), "Jimmy Terrell", (substr(Support_tier, -2)="01"), "Jeremy Scala", (substr(Support_tier, -2)="02"), "Jeremy Scala", 1=1 ,"Meinke, Lance and Terry"), Assignee) Essentially, if it is 908, 909, ends in 01, or ends in 02, it goes to specified people, everything else goes to Meinke, Lance and Terry

ITWhisperer · ‎09-22-2020

<dashboard> <label>24 HOUR LOG FEED MONITOR</label> <description>Log feed monitor for 24 hour monitoring</description> <row> <panel> <title>24_hour_log_feed_monitor</title> <table> <search> <query>| tstats latest(_time) as latest where index=* earliest=-48h by host | eval minutesago=round((now()-latest)/60,0)</query> <earliest>-24h</earliest> <latest>now</latest> <sampleRatio>1</sampleRatio> </search> <option name="drilldown">none</option> <format type="color" field="minutesago"> <colorPalette type="list">[#53A051,#F8BE34,#DC4E41]</colorPalette> <scale type="threshold">10,1440</scale> </format> </table> </panel> </row> <row> <panel> <title>10 MINUTES LOG FEED MONITOR</title> <table> <search> <query>| tstats latest(_time) as latest where index=* earliest=-10m by host | eval minutesago=round((now()-latest)/60,0)</query> <earliest>-10m</earliest> <latest>now</latest> <sampleRatio>1</sampleRatio> </search> <option name="count">20</option> <option name="dataOverlayMode">none</option> <option name="drilldown">none</option> <option name="percentagesRow">false</option> <option name="rowNumbers">false</option> <option name="totalsRow">false</option> <option name="wrap">true</option> <format type="color" field="minutesago"> <colorPalette type="list">[#FF000,#F8BE34,#DC4E41]</colorPalette> <scale type="threshold">1,10</scale> </format> </table> </panel> </row> </dashboard>

ITWhisperer · ‎09-22-2020

OK this new condition has to appear earlier in the case statement (at least before (substr(Support_tier, -2)!="02") AND (HR_Country="America"),"Terri") | eval Assignee= case(((Support_tier="908") AND (HR_Country="America")), "DG 908", (substr(Support_tier, -2)="02") AND (HR_Country="America"), "Jeremy", (substr(Support_tier, -2)!="02") AND (HR_Country="America"),"Terri")

ITWhisperer · ‎09-22-2020

Can you extract the x-axis and y-axis values into separate event rather than multi-value fields? if not, you could mvzip them together with a suitable delimiter, then mvexpand to get separate events. Then split the field and re-evaluate x-axis and y-axis. Then you will have something to chart.

ITWhisperer · ‎09-22-2020

Which version of splunk are you running?

ITWhisperer · ‎09-22-2020

Try this: | eval x_axis=mvmap(x_axis, tonumber(x_axis)) | eval y_axis=mvmap(y_axis, tonumber(y_axis))

ITWhisperer · ‎09-22-2020

Based on the example log, there are no brackets around MID value and I suspect you just want the MID near the beginning of the log, so try | rex "info:\s+MID\s+(?<MID>[^\s]+)"

ITWhisperer · ‎09-22-2020

| timechart span=1d ... | fillnull value=0 Target Total Timechart will give you continuous time bins, fillnull will allow you to set the value you want in a field if it is not present

ITWhisperer · ‎09-22-2020

In what way does it not work? What is the value of HR_Country in this instance? Also, your if have SupportTier not Support_tier, is this just a typo or a different field?

ITWhisperer · ‎09-22-2020

The first part just creates sample data - you don't need this as you already have the data. The important parts are the renames your first search | rename "alert id" as id | append [ your second search | rename "closed id" as id ] | table id message server opentriggredtime closedtriggredtime

ITWhisperer · ‎09-22-2020

ITWhisperer · ‎09-22-2020

Create a new panel - use a similar query to one you used for the single, except it sounds like you don't want the stats count.

ITWhisperer · ‎09-22-2020

What is the field name that you have extracted the MID into?

ITWhisperer · ‎09-22-2020

| stats values(sender) as sender, values(message_subject) as message_subject, values(recipient) as recipient, values(reason) as reason, values(virus_vendor_category) by virus_vendor_category by MID | fields - MID The fields line removes the MID from the table if you don't want to show that

ITWhisperer · ‎09-22-2020

Which field identifies these as all being part of the same threat? | stats values(sender) as sender, values(message_subject) as message_subject, values(recipient) as recipient, values(reason) as reason, values(virus_vendor_category) by virus_vendor_category by id | fields - id

ITWhisperer · ‎09-22-2020

Which part of the message do you want? Can you copy it into a code section so it isn't formatted?

Posts	11577
Solutions	2330
Karma Given	89
Karma Received	3512
Member Since	‎2020-08-18

[Puzzles] Solve, Learn, Repeat: Matching cron expr...

[Puzzles] Solve, Learn, Repeat: Duplicate Bridge S...

[Puzzles] Solve, Learn, Repeat: Advent of Code - D...

[Puzzles] Solve, Learn, Repeat: Advent of Code - D...

[Puzzles] Solve, Learn, Repeat: Advent of Code - D...

[Puzzles] Solve, Learn, Repeat: Advent of Code - D...

[Puzzles] Solve, Learn, Repeat: Word Search

[Puzzles] Solve, Learn, Repeat: Advent of Code - D...

[Puzzles] Solve, Learn, Repeat: Advent of Code - D...

[Puzzles] Solve, Learn, Repeat: Advent of Code - D...

Re: Dashboard XML Hiding/Displaying Panels

Re: Search Query to show the number of counts and ...

Re: Always got zero for count

Re: Name Extraction needed

Re: New rows for each of the Extracted values from...

Re: Name Extraction needed

Re: Search Query to show the number of counts and ...

Re: Dashboard XML Hiding/Displaying Panels

Re: create a dashboard that tracks 1 or 2 log feed...

Re: If else help

Re: Splunk colored based on some threshhold (last...

Re: If else help

Re: Convert Multivalue field into Number

Re: Convert Multivalue field into Number

Re: Convert Multivalue field into Number

Re: splunk concatenate field in table

Re: How to fill missing values in a time range

Re: If else help

Re: how to combine two searched by row which have ...

Re: Search Query to show the number of counts and ...

Re: How to export event data to csv from Single va...

Re: splunk concatenate field in table

Re: splunk concatenate field in table

Re: splunk concatenate field in table

Re: cpu and mem usage

Join the Conversation