About Shakira1

Shakira1 · ‎09-21-2025

Yes, I just installed it in one of my license server and it was worked. apparently, its not working in a free license anymore.

Shakira1 · ‎02-20-2025

Yes. this is my localhost so I use admin local user (the default one) and its have the max permission

Shakira1 · ‎02-19-2025

I have the same issue I installed it locally on Splunk local host, and the page "home" is empty any idea?

Shakira1 · ‎02-06-2025

I want to be able to support adaptive response action in Splunk Enterprise Security but when I put some value there Im getting the error, even its not empty what I did wrong?

Shakira1 · ‎03-12-2024

HI, I would like to know how can I create a new filter by field like "slack channel name" / phantom artifact id? how its been created? thanks!

Shakira1 · ‎11-06-2023

when I run your search I got too many results , with rare I got only 10 results. there is no options to use rare and add more fields to the table?

Shakira1 · ‎11-05-2023

but I want to get the most unique SHA256HashData in the last 24h for example. and then fwd to summary index and start static about it, so for that I need to get more data

Shakira1 · ‎11-05-2023

hello! I have this search, and I want to add more parameters like time etc. the thing is - when I'm using rare its show only the SHA256HashData and count ```index=myindex | stats count by SHA256HashData | rare SHA256HashData any idea? thanks!

Shakira1 · ‎10-19-2023

sure. attached the valueCount and Pct. also the number of events: 1,380,350 events

Shakira1 · ‎10-18-2023

its looking very good! thank you. I just dont understand the calculate results. for example: in valueCount I have 294723 from the total which is 1360007 should be ≈ 21.67% but in Pct field value I have 0.33, Do you know why? all my results in Pct are not correct.

Shakira1 · ‎10-17-2023

I would like to get the percentage of some count field from the total count for example: after using fieldsummary I got this: [{"value":"/System/Library/LaunchAgents/com.apple.mdworker.shared.plist","count":61372} under value key and the total count events is1,039,803, so in a new field I want to get the calculate for how much in percentage the count (61372) is from the total (1,039,803), this result I want to get to all my fields.

Shakira1 · ‎10-17-2023

HI I need to get the count of all fields in some index and then calculate how many times in percentage it occurred out of all events. hope its clear. thank you!

Shakira1 · ‎10-04-2023

Ok, now i see and get the data. thanks!

Shakira1 · ‎10-04-2023

now I see first I missed double quote, so you are correct - so my search is: | mstats avg("value1") prestats=true WHERE "index"="my_index" span=10s BY host | timechart avg("value1") span=10s useother=false BY host WHERE max in top5 now, if I want to search by what you worth: | mstats avg("value1") prestats=true WHERE "index"="my_index" span=10s BY host | untable _time host average | stats dc(host) as c_host OR | timechart avg("value1") span=10s useother=false BY host WHERE max in top5 | untable _time host average | stats dc(host) as c_host Anyway, I want to use mstats function and get a count for the host.

Shakira1 · ‎10-04-2023

not sure why you say that. but its working. just to be clear = value1 = to some internal parameter. index = my index. and base on that Im getting information about the hosts . now I just want to count how many hosts reporting, when its less then 3 I want to trigger about it. hope its clear now.

Shakira1 · ‎10-04-2023

this is my search: | mstats avg("value1) prestats=true WHERE "index"="my_index" span=10s BY host | timechart avg("value1") span=10s useother=false BY host WHERE max in top5 which is working fine. I just want to create a new alert that triggered when the host count is less then 3. how can I do that?

Shakira1 · ‎10-04-2023

Hi, I have this command: | mstats avg("value1) prestats=true WHERE "index"="my_index" span=10s BY host | timechart avg("value1") span=10s useother=false BY host WHERE max in top5 and I would like to count the host and trigger when I have less then 3 hosts. I tired something like that: ```|stats dc(host) as c_host | where c_host > 3,``` but its not working as usual . any idea? thanks!

Shakira1 · ‎09-21-2023

thank you, its working!

Shakira1 · ‎09-21-2023

I have this date string example: Mon, 01 May 2023 00:00:00 GMT how can I convert it to epoch? thanks!

Shakira1 · ‎03-15-2023

this one? this is working for me in SPL and I add automatic lookup - which not working ( didnt extract the fields)

Shakira1 · ‎03-14-2023

The purpose is to enrichment the data automatically I did it in the UI under automatic lookup: my lookup id AS id OUTPUT my fields_from_the_lookups it always working but the diff here is that I'm using KVstore thanks

Shakira1 · ‎03-12-2023

I have kvstore which generate the data by API. when I use | lookup mylookup id output data - its working I want to convert it to automatic lookup in some index, but its not working. any idea why?

Shakira1 · ‎12-28-2022

thanks!

Shakira1 · ‎12-28-2022

I have all_ip filed that contains all my ips. now I want to split it to public ip and private ip: public_ip, private_ip, all_ip: and when private_ip is null I want to put the value from all_ip in public_ip field. first I did: | eval private_ip=if(like(all_ip,"XXXX.%") OR like(all_ip,"XXX.%"),all_ip,null()) and now I need to do (all the rest fill it in public_ip field. this is possible? thanks!

Shakira1 · ‎11-29-2022

BTW, I have created 2 fields base on my lookup - when the ip is exist I have new fields : my_ip = True this is can be easer to compare now? without using lookup

Posts	48
Solutions	0
Karma Given	1
Karma Received	1
Member Since	‎06-29-2021

Online Status	Offline
Date Last Visited	‎09-21-2025 03:17 AM

Support adaptive response action in Splunk Enterpr...

how to create Actions from Acrtifact?

rare command

get all fields

mstats command

How to convert date to epoch?

Add automatic lookup for kvstore?

Contains "is null" with if command

How to compare CIDR from event to lookup?

How to compare multiple value in lookup to single ...

Re: Splunk Add-On Builder UI is Blank/Won't Load

Re: Splunk Add-On Builder UI is Blank/Won't Load

Re: Splunk Add-On Builder UI is Blank/Won't Load

Support adaptive response action in Splunk Enterpr...

how to create Actions from Acrtifact?

Re: rare command

Re: rare command

rare command

Re: get all fields

Re: get all fields

Re: get all fields

get all fields

Re: mstats command

Re: mstats command

Re: mstats command

Re: mstats command

mstats command

Re: convert date to epoch

How to convert date to epoch?

Re: add automatic lookup for kvstore

Re: add automatic lookup for kvstore

Add automatic lookup for kvstore?

Re: Contains "is null" with if command

Contains "is null" with if command

Re: How to compare CIDR from event to lookup?

Join the Conversation