About ytamura

jmsiegma · ‎05-10-2013

From everyone's suggestions this is what I came up with, Thank you index="cisco_asa" (log_level=6 OR log_level=7) (error_code=113005 OR error_code=715046) * | transaction user user_id startswith="AAA failure" endswith="constructing" maxevents=2 | lookup geoip clientip as IP | top limit=100 showcount=false showperc=false _time host user_id src_ip client_country client_region client_city client_lat client_lon| rename host as "ASA IP", user_id as "User ID", src_ip as "Public IP", client_country as "Country", client_region as "Region", client_city as "City", _time as "Time", client_lat as "LAT", client_lon as "LON" | sort -Time | convert ctime(Time)

ytamura · ‎05-08-2013

See if the fieldformat command can help you: http://splunk-base.splunk.com/answers/35124/format-result-set-numbers

ytamura · ‎01-18-2013

I'm not sure if I completely understand your question, but I'm assuming that PxtId is unique to each pair? If so, you can use a transaction to group those pairs into a single event, then do a count by UserId: your search to isolate those two types of logs | transaction PxtId | chart count by UserId This is assuming that both PxtID and UserId have been parsed as fields. You can do a similar search using a join on PxtId.

ytamura · ‎09-17-2012

I think MuS's answer is the cleanest way to do this. However, if you wanted do a quick field extraction on the fly and regex is too daunting, you can take advantage of the eval command to see results quickly: sourcetype="BustedServer" | eval mobileType=case(searchmatch("iphone"),"iPhone",searchmatch("android"),"Android",searchmatch("Blackberry"),"Blackberry",searchmatch("Windows"),"Windows",searchmatch("iPad"),"iPad") | stats count by mobileType

ytamura · ‎09-05-2012

I would try scaling the data first then visualizing the scaled data: | eval scaledData = log(data, 10)

Lowell · ‎07-01-2019

If you want to send all results to a single destination per alert, then you can do that by using the $result.<to_email>$ notation in the "To" field using modern version of Splunk (6.2, and later according to @tfruru), as mentioned in the docs. However, this is somewhat limited. It appears that Splunk just grabs $result.<field>$ based on the first output row. If you need to get fancy and send emails to different to address on a per-row basis, then you should checkout the Sendresults add-on by Discovered Intelligence. Emails with the same email_to field will be grouped into a single email. Very nice!

drapkin11 · ‎08-09-2013

sendemail did not work for me for some reason and I'm using Splunk v4.3.3 What did work was adding the following to the end of the search string: | outputcsv myfile.csv The output file was routed by default to the $SPLUNK_HOME/var/run/splunk folder. Thanks to @yannK for this answer to a different question: http://splunk-base.splunk.com/answers/42067/can-search-results-be-exported-using-a-command-in-the-search-scriptbar/42072

chris · ‎01-27-2014

I updated the answer for Splunk 6. Hope thats ok for ypu sgarvin55

CerielTjuh · ‎03-28-2013

My collegue was searching for a way to change the layout of the page and in the current version (5.0.2) it is possible to change the layout to landscape in the scheduled search.

ytamura · ‎10-14-2011

Please see my answer to this http://splunk-base.splunk.com/answers/31061/pdf-report-issue-landscape-format-and-no-csv-data/32333 for a workaround to part of your problem (the data getting cut off problem). As for the data not showing up problem, there may be different timeout settings for different users and the pdf server itself, but we were not able to resolve this issue despite changing them...

gkanapathy · ‎10-14-2011

To me this seems to be pretty much a bug in the PDF server.

Posts	21
Solutions	2
Karma Given	27
Karma Received	17
Member Since	‎10-14-2011

Online Status	Offline
Date Last Visited	‎06-05-2020 02:03 AM

Dynamically Change Email Recipient?

Re: issue with join and matching multiple lines

Re: How to create mutiple columns for a single fie...

Re: Extract the Data from two line of the logs

Re: Multiple searches in one chart

Re: radial gauge with logarithmic scale?

Re: Dynamically Change Email Recipient?

Re: Splunk 4.3 -> Bug -> Actions: Export Results

Re: pdfserver 'The read operation timed out' on d...

Re: pdf report issue: landscape format and no csv ...

Re: PDF rendering sucks. Badly.

Re: chart too wide in the result portrait PDF

Join the Conversation