×

Join the Conversation

Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Ask a Question
kfinn
Explorer
Member since: ‎12-07-2020
‎09-10-2024
Community Statistics
Posts 8
Solutions 0
Karma Given 4
Karma Received 0
Member Since ‎12-07-2020
Activity Feed
Topics I've Started
View All

Re: Unable to remove records from the Deployment S...

by in Deployment Architecture
‎09-10-2024 05:04 AM
‎09-10-2024 05:04 AM
I'm seeing this same behavior since upgrade of Splunk HF to version 9.2.2. There is a server that has been retired, usually I would delete the record, and if that system comes back online for any reason it would show back up. Is there another way to remove, or will it drop off over time? Kevin ... View more

Re: "Cisco AMP for Endpoints Events Input" / amp4e...

by in All Apps and Add-ons
‎02-09-2021 08:00 AM
‎02-09-2021 08:00 AM
I'm waiting on the same thing. This app is holding us from upgrading to splunk version 8. Anyone know when this is going to be released? Splunkbase just indicates not yet for version 8. ... View more

Re: Help with Stats count expression??

by in Splunk Search
‎12-08-2020 06:57 AM
‎12-08-2020 06:57 AM
Thanks. This seems to have worked quite well. One last question. There is one more action, "User choose to answer security questions" | rex field=action "User choose to answer (?<mode>\w+)" This picks up security. What in the expression do I need to add so it will pick up security questions as the action and show like that in the group by mode results? Thanks again for the help. I'm learning quite a bit about this stuff. Kevin     ... View more

Re: Help with Stats count expression??

by in Splunk Search
‎12-07-2020 07:03 PM
‎12-07-2020 07:03 PM
Thanks, that helps. Sorry for not being more clear. Ultimately, within the Subcategory=Delivery Method. There are these 3  actions, that I'm trying to get "stats" on. Counts on. To search and then put into panel dashboard. Wondering what the search would look like to search and get counts on all 3 actions. When I do a stats count by action, it includes the phone number or email address.  I want counts of each, not a total of all 3. I hope this makes more sense. I'll gladly explain more if needed. Again appreciate your assistance. Still trying to get better with this stuff. User selected email delivery User selected text delivery User selected voice delivery ... View more

Re: Help with Stats count expression??

by in Splunk Search
‎12-07-2020 05:29 PM
‎12-07-2020 05:29 PM
I have done this, but it just brings back all the events, including other actions in that Subcategory, not just text. Am I missing something? index=mfa sourcetype=lexus Subcategory="Delivery Method" | rex field=action mode=sed "s/(User selected text delivery).*/\1/"   Once I get this working. I can do stats count by action? or something else to get the count? ... View more

Help with Stats count expression??

by in Splunk Search
‎12-07-2020 03:58 PM
‎12-07-2020 03:58 PM
Hi Everyone, I'm newer-ish to splunk.  I'm doing a search similar to this in splunk : index=mfa sourcetype=lexus Subcategory="Delivery Method". With the search results, I want to do stats count by action, but It brings back results similar to this(see below), with each action having a different phone number. How do I get stats only on the wording "User selected text Deilvery"? and not having 1 stat for every phone number.  There are 100 actions with the different phone numbers. I just want a count by User selected text delivery.    "User selected text delivery to ***-***-****"   I hope this makes sense. I'll gladly provide more info if needed. i'm just pretty new to this, and looking for some help.   Kevin ... View more
Labels
Contact Me
Online Status
Offline
Date Last Visited
‎09-10-2024 02:35 PM
Karma given to
View All