About ghnwmlguy

ghnwmlguy · ‎02-01-2011

Thanks David, I can't beleive that have never noticed the transaction command.

ghnwmlguy · ‎02-01-2011

I am trying to collect stats from login events from evening hours. I would like to run reports for any time range (last 60m, 7d, etc.) but only view results that show logons between the hours of 5pm and 7am.

ghnwmlguy · ‎01-31-2011

I am trying to gather average login session times for a server given multiple users logon and logoff log entries. I am using ossec to filter the logs first so standard windows fields may not apply, but I have extracted the user field (called "user"). I am not really sure where to start since I cannot seem to figure out how to gather average user session times for any time period given there are multiple users. Any ideas?

ghnwmlguy · ‎01-31-2011

I apologize for not giving the thumbs up yet...I have run into space issues on the primary host and need to put in new drive. When that is done I will use this process.

ghnwmlguy · ‎12-29-2010

I currently have two instances of splunk running on two separate hosts. I recently purchased a license so that I can consolidate the two onto one host. Is there a way to consolidate indexed logs/databases onto one host without losing data?

ghnwmlguy · ‎04-23-2010

search string: | stats sum(value) by variable

ghnwmlguy · ‎04-23-2010

I played with the sort command a little but found that it only worked with columns in tables. My search string goes like this: | stats sum(value) by variable where the log entries contain "variable=value" I looked a way to create a table in this 'thing' but couldn't find anything. Not sure if I really want to put up a screen shot.

ghnwmlguy · ‎04-23-2010

The results of a report show the following in a table: -variable value -Allowed 1 -Allowed_Tagged 1 -Blocked 2 -Quarantined 1 -Total 10 -Viruses 5 How can I change the order of Rows so that 'Total' shows up at the bottom?

ghnwmlguy · ‎04-16-2010

Found that I could change it from 'system' to 'none' but that did not work. I did find that if I make the actual files available to all apps (through the manager) the errors would go away. That does not seem right though.

ghnwmlguy · ‎04-16-2010

I found that props was: export = system Not sure what the value would need to be to make it just within the app.

ghnwmlguy · ‎04-16-2010

I have configured automatic lookups with the intention of using it in only one app (my own ossec app). However, when I run searches in another app an error appears: The lookup table 'ostype' does not exist. It is referenced by configuration 'ossec'. How can I make sure that this Automatic lookup only occurs in my ossec app.

Posts	11
Solutions	0
Karma Given	0
Karma Received	1
Member Since	‎04-16-2010

Online Status	Offline
Date Last Visited	‎06-05-2020 02:02 AM

Search within sub-time range

Logon session time

Consolidate Databases from multiple splunk instanc...

Sort rows in tables

Automatic lookups showing up in other apps

Re: Logon session time