Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- Find Answers
- :
- About Dmitriy
Dmitriy
Explorer
Member since:
04-07-2021
08-13-2021
Community Statistics
| Posts | 21 |
| Solutions | 0 |
| Karma Given | 3 |
| Karma Received | 0 |
| Member Since | 04-07-2021 |
Activity Feed
- Tagged search lookup errors on Knowledge Management. 08-12-2021 04:48 AM
- Karma Re: Cisco ice parse fields problem for ITWhisperer. 08-11-2021 09:02 PM
- Karma Re: Cisco ice parse fields problem for richgalloway. 08-11-2021 09:02 PM
- Posted Re: Cisco ice parse fields problem on Knowledge Management. 08-11-2021 06:30 AM
- Posted Re: Cisco ice parse fields problem on Knowledge Management. 08-11-2021 06:17 AM
- Posted Re: Cisco ice parse fields problem on Knowledge Management. 08-11-2021 06:02 AM
- Posted Re: search lookup errors on Knowledge Management. 08-11-2021 05:53 AM
- Posted Re: Cisco ice parse fields problem on Knowledge Management. 08-11-2021 05:53 AM
- Tagged Cisco ice parse fields problem on Knowledge Management. 08-11-2021 05:43 AM
- Posted Cisco ice parse fields problem on Knowledge Management. 08-11-2021 05:07 AM
- Posted search lookup errors on Knowledge Management. 08-11-2021 04:52 AM
- Posted Re: Query with Thousands IDs in searche whit OR on Splunk Search. 08-05-2021 12:05 AM
- Karma Re: Query with Thousands IDs in searche whit OR for kamlesh_vaghela. 08-05-2021 12:05 AM
- Tagged Re: Query with Thousands IDs in searche whit OR on Splunk Search. 08-05-2021 12:05 AM
- Posted Re: Query with Thousands IDs in searche whit OR on Splunk Search. 08-04-2021 11:50 PM
- Posted Re: Query with Thousands IDs in searche whit OR on Splunk Search. 08-04-2021 11:47 PM
- Tagged Re: Query with Thousands IDs in searche whit OR on Splunk Search. 08-04-2021 11:47 PM
- Posted Re: Query with Thousands IDs in searche whit OR on Splunk Search. 08-04-2021 11:04 PM
- Tagged Re: Query with Thousands IDs in searche whit OR on Splunk Search. 08-04-2021 11:04 PM
- Posted Re: Query with Thousands IDs in searche whit OR on Splunk Search. 08-04-2021 10:40 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
08-11-2021
06:30 AM
Could you please give extract syntax to add device-type and device-mac to props.conf
... View more
08-11-2021
06:02 AM
Thanks! But i have one more question How i can save this fields to not in search rex commands? I mean how to auto extract this to fields witout rex commad.
... View more
08-11-2021
05:53 AM
i found the first problem Automatic lookups this 'LOOKUP-cisco_asa_ids_lookup' use app TA-alfa_firepower and permited for all app i change permissions for TA-alfa_firepower only. is this good idea?
... View more
08-11-2021
05:07 AM
Hello! We have index with cisco events and now we need to parse some fields such as device_mac and device_name. But we can't do it by regex because we get unstructured data from cisco (fields are swapped). For example in this log first there is device type, and after mac Dmitriy_1-1628683456038.png And the next one comes first mac, and after device type Dmitriy_2-1628683478592.png Could you please help me? How i can parse this fields? Thanks!
... View more
- Tags:
- field extraction
Labels
- Labels:
-
field extraction
08-11-2021
04:52 AM
Hello, when i search from index=alfa_cisco_ice and see the errors: AutoLookupDriver - Could not load lookup='LOOKUP-cisco_asa_ids_lookup' reason='Error in 'lookup' command: Must specify one or more lookup fields.' Please help, how too fix this problem? And in inspector i see alot of log like SearchOperator:kv - Invalid key-value parser, ignoring it, transform_name='cisco_dest_ipv6'. SearchOperator:kv - Invalid key-value parser, ignoring it, transform_name='cisco_fw_connection' Dmitriy_0-1628682532647.png
... View more
- Tags:
- lookup
Labels
- Labels:
-
lookup
08-05-2021
12:05 AM
YEEHAA !!! Its work now, they give me correct result. Thank you very much.
... View more
- Tags:
- y
08-04-2021
11:50 PM
i can not find in logs why the thake only firs value in lookup. I think the problem in query
... View more
08-04-2021
11:47 PM
start search index=alfa [|inputlookup IIN_oleg.csv |rename IIN as search | fields search] search.log 08-05-2021 12:36:55.531 ERROR LookupProviderFactory - Must specify one or more lookup fields. 08-05-2021 12:36:54.743 INFO SearchParser - PARSING: search index=alfa [|inputlookup IIN_oleg.csv |rename IIN as search | fields search] | 08-05-2021 12:36:55.531 ERROR LookupProviderFactory - Must specify one or more lookup fields.
08-05-2021 12:36:55.531 ERROR AutoLookupDriver - Could not load lookup='LOOKUP-cisco_asa_ids_lookup' reason='Error in 'lookup' command: Must specify one or more lookup fields.'
08-05-2021 12:36:55.531 ERROR LookupProviderFactory - Must specify one or more lookup fields.
08-05-2021 12:36:55.531 ERROR AutoLookupDriver - Could not load lookup='LOOKUP-cisco_asa_intrusion_severity_lookup' reason='Error in 'lookup' command: Must specify one or more lookup fields.'
... View more
- Tags:
- lookup
08-04-2021
10:40 PM
we dont have field like IIN in index data Dmitriy_0-1628141909747.png index=alfa
| rex field=_raw "parameter\sname=\\\\\"(?<name>.*)\\\\\"\svalue=\\\\\"(?<value>\d+)\\\\\"\/>"
| where name="IIN"
| stats count by value Result 0
... View more
- Tags:
- lookup
08-04-2021
10:31 PM
index=alfa name="IIN" | stats count by value result 0
... View more
- Tags:
- inputlookup
08-04-2021
10:16 PM
lookup data Dmitriy_0-1628140417808.png data in index Dmitriy_1-1628140600609.png
... View more
08-04-2021
10:06 PM
Hello, i need help. I have 6500 IIN (like id) and put this id to lookup then tried search: index=alfa [|inputlookup IIN_oleg.csv |rename IIN as search | fields search] They given result only for one firs IIN in lookup. If i search whit out lookup just 10 IIN whit "OR" the give me 10 result
... View more
- Tags:
- inputlookup
Labels
- Labels:
-
lookup
08-04-2021
09:00 PM
Hi, please help, i have 6500 IIN (like id) and put this id to lookup then tried search: index=alfa [|inputlookup IIN_oleg.csv |rename IIN as search | fields search] They give result only for one firs IIN in lookup. If i search whit out lookup just 10 IIN use OR the give me 10 result
... View more
06-11-2021
01:26 AM
I found the way how to search | inputlookup es_notable_events | eval last_modified_timestamp=_time | eval myTime=relative_time(time(),"-1h") | where last_modified_timestamp>myTime | fields - time |search rule_name="Threat Activity Detected"
... View more
06-10-2021
12:49 AM
Hi, please help to make search by date in inputlookup "es_notable_events". I thried to search by "earliest" its not work. Dmitriy_1-1623311243178.png
... View more
04-07-2021
08:12 PM
Hi, please help to resolved problem. DB connect not indexing data to index, in log files "splunk_app_db_connect_server.log" i see that the job is finished with status: COMPLETED no errors, but in index i not see any data. I Checked HTTP Event Collector the token is correct. I have no ides how to fix.
... View more
Labels
- Labels:
-
Windows
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
08-13-2021
01:30 AM
|
