About noott211

isoutamo · ‎05-25-2023

Hi I just fixed those props.conf and transforms.conf with the correct definitions. Format of _time field is defined by your localisation. If you need to see it in another format then you should use some other field to show it in your needed way. r. Ismo

noott211 · ‎06-03-2022

I want to check if the user is detected in other areas based on IP. Detection criteria are pre-written scenarios. In this scenario, we inserted numbers such as rule_1 and rule_2. The purpose of this task is to see that a user who should be in a specified location is detected in a scenario in another location. This is my log table country title Area detail userlist ip USA WA Washington Washington Monument user1 192.168.0.100 USA WA Washington Washington Monument user2 192.168.0.101 USA VA Virginia user3 192.168.0.102 USA NJ New Jersey user4 192.168.0.103 i want view

noott211 · ‎05-31-2022

When Splunk loads dashboards after dashboard creation is complete, it is out of range or visually uncomfortable Is there a way to automatically resize the screen like Dashboard Classic?

richgalloway · ‎05-23-2022

I've not implemented this personally as I've not needed the functionality. You may, however, find more information in the Splunk Dashboard Examples app (available on splunkbase). Yes, you can use XML and CSS in Classic dashboards. This is what is used in the Dashboard Examples app. You cannot, AFAIK, put the XML and CSS in the same file. Each has its own place.

ITWhisperer · ‎05-17-2022

| makeresults | eval ip="017.002.100.103" | eval ip=replace(ip,"(^|\.)(0*)(\d+)","\1\3")

noott211 · ‎05-09-2022

There is no problem when checking Btool Is it a matter of setting MetaData?

PickleRick · ‎04-27-2022

Firstly - check your config with btool and see if the limit isn't being overwritten somewhere. Secondly - is it a monitor input, scripted input, eventlog input? Thirdly - maybe you're just limited by bandwidth of your connection?

noott211 · ‎03-23-2022

Yes, I used that method, too.

gcusello · ‎02-18-2022

Hi @noott211, the easiest approach is to do all the field extractions or calculation by GUI in the destination app, so you don't need to modify conf files (and restart Splunk). If you want to use conf files, you can write your evals in props, but it less easy. Why do you want to do this? Ciao. Giuseppe

isoutamo · ‎02-18-2022

It's hard to help more without your real config and sample (scramble) data.

isoutamo · ‎12-28-2021

If I understood right your request you could do it with props.conf and transforms.conf (you need both). Look e.g. CLONE_SOURCETYPE for that. If there are lot of those values then it could be hard to manage all those versions.

richgalloway · ‎12-22-2021

Open a case with Splunk Support.

venkatasri · ‎12-15-2021

Hi @noott211 , Perhaps docs are starting point- https://docs.splunk.com/Documentation/Splunk/8.2.3/SearchReference/Collect It depends on your use case and how you want to use it. At a high level it will write summary information( subset of _raw events) to a separate index.

ashvinpandey · ‎12-15-2021

@noott211 Try using the below queries: Query1: index="my_index" |eval check=if(html_code==200,"error","OK") |stats values(check) as check by src_ip dst_ip |table src_ip , dst_ip , check , count Query2: index="my_index" |eval check=if(html_code==200,"error","OK") |stats values(src_ip) as src_ip values(dst_ip) as dst_ip by check |table src_ip , dst_ip , check , count If this reply helped you an upvote would be appreciated, thank you.

PickleRick · ‎10-07-2021

No. You can't do it this way. If you define a tcp or udp input, splunk binds the port to a given ip (or inaddr_any if you don't specify an address to bind to). Your config would try to define the same input three times. I don't recall at the moment whether it would result in splunk trying three times to bind to the same port (which would fail - you can't listen on the same port more than once) or overwriting subsequent definitions with the last instance. But any way it did, it's definitely not what you want. Furthermore, splunk's udp input is not a very good way to receive syslog event's (partly because of performance issues, partly because of lack of metadata). You'd be much better off using either sc4s, rsyslogd or some other form of intermediate syslog receiving and processing layer. But if it's a small installation and you want to stick to builtin inputs only, bind the inputs on different ports. Oh, and it's worth remembering that udp is unreliable and you might easily be losing events.

ITWhisperer · ‎08-25-2021

You need to include _time in the stats commands index="fw" app="ping" | bin _time span=10m | stats count by _time,client_ip,dest_ip | stats list(dest_ip) AS dest_ip , list(count) AS count by _time,client_ip | table _time, client_ip , dest_ip , count

Posts	33
Solutions	0
Karma Given	2
Karma Received	0
Member Since	‎08-25-2021

Online Status	Offline
Date Last Visited	‎06-26-2022 06:22 AM

How to create Radial tree configuration according ...

Is there a way to automatically resize the screen ...

Is there to modify the column size of the table?

How do I clear 0s from the Ip?

How to set INGEST

How to apply source file date using INGEST as Time...

Where can I adjust the settings for universal forw...

How to retrieve after field extraction, if it's cl...

Is there a way to set all fields using eval in Pro...

Why is it when you don't put a wild card when sear...

Re: How to apply source file date using INGEST as ...

How to create Radial tree configuration according ...

Is there a way to automatically resize the screen ...

Re: Resize dashboard tables

Re: How do I clear 0s from the Ip

Re: How to set INGEST

Re: universal forwarder data input speed

Re: Cannot be retrieved after field extraction

Re: all fields using eval in Props.conf

Re: Why is it when you don't put a wild card when ...

Re: I want source type separation using prop.conf.

Re: windows TA splunk-perfmon.exe will be terminat...

Re: A question about using the "collect" command.

Re: I want to extract the same result from stats.

Re: Failed to add the same UDP port

Re: Check events in time