About diconium

diconium · ‎01-18-2021

@Splunk_rocks Your search isn't completely working as the rex command it doesn't extract the values. So the search should look as follows: | rest /services/server/introspection/kvstore/collectionstats | mvexpand data | spath input=data | rex field=ns "^(?<App>.+)\.(?<Collection>.+)$" | eval dbsize=round(size/1024/1024, 2) | eval indexsize=round(totalIndexSize/1024/1024, 2),dbsizegb=round(dbsize/1024, 2) | stats first(count) AS "Number of Objects" first(nindexes) AS Accelerations first(indexsize) AS "Acceleration Size (MB)" first(dbsize) AS "Collection Size (MB)" first(dbsizegb) as "Collection Size (GB)" by App, Collection

diconium · ‎10-23-2020

We have some external third-party managed systems whose logs should be indexed using Universal Forwarder. As we do not have exclusive control over its configuration we need to ensure that those Forwarders don't add data to a wrong index. So we want to restrict them to some allowed indices. Unfortunately I couldn't find any solution for this up to now. So how could this be achieved?

diconium · ‎10-07-2020

Finally I solved it using eventstats which creates new field for the total sum: index="active_directory" sourcetype=XmlWinEventLog source="XmlWinEventLog:Security" EventCode=4740 | stats count BY user | eventstats sum(count) AS total_amount | search total_amount > 100 The result of this search looks like this: user count total_amount user1 45 103 user2 27 103 user3 31 103 Afterwards I can filter by its value using the threshold value (e.g. 100). So there will be results only if the total_amount exceeds the theshold.

diconium · ‎09-03-2020

That's not what I need. The search result should look like this: user sum user1 45 user2 27 user3 31 The alert should be triggered if the summary of the second column is above the threshold. But the Splunk users should be able to see the search result to check analyze it without running the search again on their own. So triggering on the number of results won't work as needed because the threshold will mostly be reached with less results. Applied to the example result set the threshold of 100 is reached but there are only 3 results.

diconium · ‎09-03-2020

All those solutions have only one row in the search result. But I want the search result to consist the amount of events for each user and the alert should only be triggered if the overall sum of events is above the threshold.

diconium · ‎09-02-2020

Hi. I created the following search which reports events of Active Directory users being locked aggregated by username: index="active_directory" sourcetype=XmlWinEventLog source="XmlWinEventLog:Security" EventCode=4740 | stats count BY user To be notified if the overall amount is above a threshold I want to create an alert on it. Of course I could extend this base search to only have a result if the number of events is above the threshold and trigger the alert if the number of results is greater than one: index="active_directory" sourcetype=XmlWinEventLog source="XmlWinEventLog:Security" EventCode=4740 | stats count BY user | stats sum(count) AS sum | search sum > 100 But in this case the alert result would only consist of the number of events. To get the list of the events one would then need to manually run the base search with correct time range. So I came to the custom trigger condition. As the documentation doesn't tell if it should work, I just tried to use the last two lines as trigger condition: stats sum(count) AS sum | search sum > 100 Unfortunately this doesn't seem to work. Does anyone have an idea how this could be solved alternatively?

Posts	6
Solutions	1
Karma Given	2
Karma Received	4
Member Since	‎2020.09.02

Restrict Universal Forwarder to allowed indices

Alert trigger condition on field sum

Re: How to clean KVstore on search head cluster no...

Restrict Universal Forwarder to allowed indices

Re: Alert trigger condition on field sum

Re: Alert trigger condition on field sum

Re: Alert trigger condition on field sum

Alert trigger condition on field sum