About Susha

Susha · ‎10-21-2021

Hi All, i am using below query to get forwarder disk utilization .. but its not working .. index=os sourcetype=df host=de1secsplfwd002.dc-r.security.vodafone.com | strcat host '@' Filesystem Host_FileSystem | timechart avg(UsePct) by Host_FileSystem basically our forwarder disk space is getting filled because of some specific intelligence logs.. here we want to highlight respective team that because of their logs its getting sudden surge logs..

Susha · ‎09-15-2021

@richgalloway table command wont work here i believe .. as we are already using stats command ..please correct me if i am wrong ..

Susha · ‎09-14-2021

Hi , i have 2 queries . (index=abc OR index=def) category= * OR NOT blocked =0 AND NOT blocked =2 |rex field=index "(?<Local_Market>[^cita]\w.*?)_" | stats count(Local_Market) as Blocked by Local_Market | addcoltotals col=t labelfield=Local_Market label="Total" | append [search (index=abc OR index=def) blocked =0 | rex field=index "(?<Local_Market>\w.*?)_" | stats count as Detected by Local_Market | addcoltotals col=t labelfield=Local_Market label="Total"] | stats values(*) as * by Local_Market | transpose 0 header_field=Local_Market column_name=Local_Market | addinfo | eval date=info_min_time | fieldformat date=strftime(date,"%m-%d-%Y") | fields - info_* 1> above query is giving me the correct date time ..but when i am scheduling this as report its coming as Epoch time in csv file .. 2> also how can we get date field in first column instead of last column without disturbing the other fields .. thanks in advance

Susha · ‎09-13-2021

thanks a lot @ITWhisperer its working perfectly .. just one more thing .. as of now date column is coming at last column .. how can we place it in first column ..

Susha · ‎09-07-2021

@ITWhisperer this report is scheduled for yesterday so i want to give yesterday date only .. like only 09-06-2021

Susha · ‎09-07-2021

Hi Team, I want to transpose few fields as below .. (index=abc OR index=def) category= * OR NOT blocked =0 AND NOT blocked =2 |rex field=index "(?<Local_Market>[^cita]\w.*?)_" | stats count(Local_Market) as Blocked by Local_Market | addcoltotals col=t labelfield=Local_Market label="Total" | append [search (index=abc OR index=def) blocked =0 | rex field=index "(?<Local_Market>\w.*?)_" | stats count as Detected by Local_Market | addcoltotals col=t labelfield=Local_Market label="Total"] | stats values(*) as * by Local_Market | transpose 0 header_field=Local_Market column_name=Local_Market here i want to add one column of date ( eval Time=strftime(_time,"%m/%d/%y")) which should not be transpose .. date Local_Market Total a b c 05-09-2021 INDIA 3 1 1 1 05-09-2021 UK 5 3 2 0

Susha · ‎09-03-2021

Hi All, we have lots of dashboards where few of them are visited by user and some are not .. here we want to delete those dashboard which has been not seen by any user since long back. How to find last time-stamp of all dashboard when user has seen dashboard? have tried below but its not giving the last visited timestamp.. index="_internal" user!="-" sourcetype=splunkd_ui_access | rex field=uri "en-US/app/(?<app>[^/]+)/(?<dashboard>[^?/\s]+)" | search dashboard!="search" dashboard!="home" dashboard!="alert" dashboard!="lookup_edit" dashboard!="@go" dashboard!="data_lab" dashboard!="dataset" dashboard!="datasets" dashboard!="alerts" dashboard!="dashboards" dashboard!="reports" dashboard!="report"| stats count by app dashboard user

Susha · ‎08-26-2021

@ITWhisperer thanks but it seems given code is only for the 3 data but i have huge list of LM .. how can we get that .. i have tried below as well ..but its not working as required (index=abc OR index=def) category= * OR NOT blocked =0 AND NOT blocked =2 |rex field=index "(?<Local_Market>[^cita]\w.*?)_" | stats count(Local_Market) by Local_Market | rename count(Local_Market) as Total_Blocked | addcoltotals col=t labelfield=Local_Market label="Total Blocked" | transpose 0 header_field=Local_market column_name=Local_market)] | append [search (index=abc OR index=def) blocked =0 | rex field=index "(?<Local_Market>\w.*?)_" | stats count by Local_Market | rename count as Detected_Count | addcoltotals col=t labelfield=Local_Market label="Total Detected" | transpose 0 header_field=Local_market column_name=Local_market)]

Susha · ‎08-25-2021

Hi All, we have a query as below (index=abc OR index=def) category= * OR NOT blocked =0 AND NOT blocked =2 |rex field=index "(?<Local_Market>[^cita]\w.*?)_" | stats count(Local_Market) by Local_Market | rename count(Local_Market) as Total_Blocked | addcoltotals col=t labelfield=Local_Market label="Total Blocked" | append [search (index=abc OR index=def) blocked =0 | rex field=index "(?<Local_Market>\w.*?)_" | stats count by Local_Market | rename count as Detected_Count | addcoltotals col=t labelfield=Local_Market label="Total Detected")] Local_market total Blocked total detected Germany 20 ghana 80 India 91 total Blocked 191 Germany 10 Ghana 20 India 10 total detected 40 i want data like Local_Market Germany ghana India Total total Blocked 20 80 91 191 Total Detected 10 20 10 40

Susha · ‎08-24-2021

Hi All, we have lots of Alerts and reports configured in splunk which is in disabled state.. How can we find their list in excel sheet.. also how can we find all list of dashboards in splunk in one excel sheet to review it so that we can delete the unwanted one .. PLease Note:- its not about orphaned search .. that i got them from search app dashboard .. thanks..

Susha · ‎08-10-2021

thanks @manjunathmeti . but its not working since we have value as Customer="ABC DEF" where ABC keeps changing.. also i am getting below error :- Error in 'makeresults' command: This command must be the first command of a search.

Susha · ‎08-10-2021

Hi Team, We have one field as Customer=ABC DEF where one space in between where if i am giving any as Customer = *DEF* then its not giving any value..

Susha · ‎08-05-2021

@jotne i have below 2 queries now .. 1.now again getting only Blocked and Not Blocked .. 2.how can we go with" act!="REQ_BLOCKED*","Not Blocked"," does it would be "Notmatch(act,"REQ_BLOCKED*")" .... | eval BlockedStatus = case(Like(src,"11.11.111.%") AND match(act,"REQ_BLOCKED*")," Blocked",1==1," Not Blocked",Like(src,"222.22.222.%") AND match(act,"REQ_BLOCKED*"),"Blocked",1==1,"Not Blocked", NOT Like(src,"11.11.111.%") AND match(act,"REQ_BLOCKED*"),"Non access Blocked",1==1,"Non accessNot Blocked", NOT Like(src,"222.22.222.%") AND match(act,"REQ_BLOCKED*"),"Non access Blocked",1==1,"Non access Not Blocked") | stats count by Customer , BlockedStatus | rename Customer as "Local Market",count as "Total Critical Events"

Susha · ‎08-04-2021

Hi Team, I am trying to run below query .. now here problem is its not showing any "Blocked" data .. its showing only "Non access Not Blocked " .. is there any syntax error in * OR %? please suggest .. :::|| eval BlockedStatus = case(Like(src,"11.11.111.%") AND act= "REQ_BLOCKED*" ,"Blocked", Like(src,"222.22.222.%") AND act="REQ_BLOCKED*","Blocked", Like(src,"11.11.111.%") AND act!="REQ_BLOCKED*","Not Blocked", Like(src,"222.22.222..%") AND act!="REQ_BLOCKED*","Not Blocked", NOT Like(src,"11.11.111.%") AND act="REQ_BLOCKED*","Non access Blocked", NOT Like(src,"222.22.222..%") AND act="REQ_BLOCKED*","Non access Blocked", NOT Like(src,"11.11.111.%") AND act!="REQ_BLOCKED*","Non access Not Blocked", NOT Like(src,"222.22.222..%") AND act!="REQ_BLOCKED*","Non access Not Blocked") | stats count by Customer , BlockedStatus | rename Customer as "Local Market",count as "Total Critical Events"

Susha · ‎07-06-2021

thanks @Joannna for quick revert .. please consider condition here as a alert which will trigger the events everyday at 9 and it will send that data in CSV .. here problem is i am getting nothing if no data .. if i will convert this in report then it will sent report/email will blank data no matter if data is there or not..

Susha · ‎07-06-2021

Hi , I have some alerts which i want to change as report . the reason is , if there are no events then alert is not sending any data/email where in case of report we can receive atleast one blank csv attacehed report/email if there is no data .. so as per business requirement we want to change allalert to report .. how can we do that ?

Susha · ‎06-08-2021

@ITWhisperer now i tried with below query to get another values as well but its not working ..its just showing src_ip,index and eventcount index=abc | stats count as eventcount by src_ip, index, sensor, fw_rule, ids_policy, dest_ip, msg, sid, blocked | append [| inputlookup deattackerv1_2.csv | table ip | rename ip as src_ip] | eventstats values(index) as indexes | eval index=if(isnull(index),indexes,index) | table eventcount src_ip index | mvexpand index | stats count as sourcecount values(eventcount) as eventcount by src_ip, index, sensor, fw_rule, ids_policy, dest_ip, msg, sid, blocked | where sourcecount > 1 | table src_ip eventcount index ,sensor, fw_rule, ids_policy, dest_ip, msg ,sid, blocked

Susha · ‎06-08-2021

yes..i tried .. its not working.. How can i get more fields from index abc with respect to src_ip ? ex. status , time

Susha · ‎06-07-2021

R U talking about limit.conf file in indexer?

Susha · ‎06-07-2021

thanks.. but still i am getting message as below :- INFO MESSAGES: [subsearch]: Subsearch produced 221180 results, truncating to maxout 50000. also warning message as below :- WARNING MESSAGES: [de1secsplind001.dc-r.security.vodafone.com] The search you ran returned a number of fields that exceeded the current indexed field extraction limit. To ensure that all fields are extracted for search, set limits.conf: [kv] / indexed_kv_limit to a number that is higher than the number of fields contained in the files that you index

Susha · ‎06-07-2021

Hi All, i have 221180 ips in csv(deattackerv1.csv) with only one field "ip" .. where i want to check if we have any hit in splunk for that ip's in given one index .. How can we achieve that .. below is the query .. but i am getting error as "Subsearch produced 221180 results, truncating to maxout 10000." index=*_abc | search [| inputlookup deattackerv1.csv | table ip | rename ip as src_ip] | stats count by src_ip,index Note:- src_ip is one column in index=*_abc .

Posts	21
Solutions	0
Karma Given	0
Karma Received	0
Member Since	‎06-07-2021

Online Status	Offline
Date Last Visited	‎11-16-2021 07:07 AM

forwarder disk space issue

Epoch Date format in reporting

transpose on selected fields

how to find last time-stamp of all dashboard when ...

convert the row value to column

deletion of disabled alerts and reports

Field extraction for space

Like Command with special charecter

Alert to Report

Subsearch produced 221180 results, truncating to m...

forwarder disk space issue

Re: Epoch Date format in reporting

Epoch Date format in reporting

Re: transpose on selected fields

Re: transpose on selected fields

transpose on selected fields

how to find last time-stamp of all dashboard when ...

Re: convert the row value to column

convert the row value to column

deletion of disabled alerts and reports

Re: Field extraction for space

Field extraction for space

Re: Like Command with special charecter

Like Command with special charecter

Re: Alert to Report

Alert to Report

Re: Subsearch produced 221180 results, truncating ...

Re: Subsearch produced 221180 results, truncating ...

Re: Subsearch produced 221180 results, truncating ...

Re: Subsearch produced 221180 results, truncating ...

Subsearch produced 221180 results, truncating to m...