Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About Gr0und_Z3r0
Gr0und_Z3r0
Path Finder
Member since:
11-25-2021
12-14-2021
Community Statistics
| Posts | 29 |
| Solutions | 7 |
| Karma Given | 0 |
| Karma Received | 7 |
| Member Since | 11-25-2021 |
Activity Feed
- Posted Re: Exporting results from api search on Getting Data In. 12-03-2021 04:21 PM
- Got Karma for Re: specific field extraction from _raw event data/message. 12-02-2021 08:15 PM
- Posted Re: How to ignore messages logged during application restart? on Alerting. 12-02-2021 06:00 AM
- Got Karma for Re: Data ingestion. 12-02-2021 05:49 AM
- Posted Re: Data ingestion on Getting Data In. 12-02-2021 05:46 AM
- Posted Re: SSL Certificate issue on Splunk Enterprise. 12-02-2021 05:31 AM
- Posted Re: Migration to Splunk cloud on Splunk Cloud Platform. 12-02-2021 05:12 AM
- Posted Re: help on a dropdown list from an lookup on Splunk Enterprise. 12-02-2021 05:02 AM
- Posted Re: help on a dropdown list from an lookup on Splunk Enterprise. 12-02-2021 04:45 AM
- Got Karma for After creating a dashboard having 6 panels, all the jobs are getting queued. Also the search lag health status is yellow. 12-02-2021 04:42 AM
- Posted Re: how to capture the search results from splunk into shell script? on Reporting. 12-02-2021 04:37 AM
- Posted After creating a dashboard having 6 panels, all the jobs are getting queued. Also the search lag health status is yellow on Dashboards & Visualizations. 12-02-2021 04:34 AM
- Posted Re: Add/Update email in alert on Alerting. 12-02-2021 04:32 AM
- Posted Re: I have a field whose value is multiple words having spaces, how do I show the whole value in table? on Dashboards & Visualizations. 12-02-2021 04:05 AM
- Posted Re: needs to delete splunk account on Splunk User Behavior Analytics. 12-02-2021 04:02 AM
- Posted Re: specific field extraction from _raw event data/message on Splunk Search. 12-02-2021 03:59 AM
- Posted Re: I have a field whose value is multiple words having spaces, how do I show the whole value in table? on Dashboards & Visualizations. 12-02-2021 03:34 AM
- Posted Re: space in values does not filter data on Splunk Search. 12-01-2021 03:19 AM
- Posted Re: Get the chart count by in the form of percentage on Splunk Search. 12-01-2021 01:45 AM
- Got Karma for Re: increase the height of sunburst chart. 12-01-2021 01:01 AM
Topics I've Started
No posts to display.
12-03-2021
04:21 PM
Try something like this.... curl -k -u user:password https://localhost:8089/servicesNS/admin/search/search/jobs/export -d search="search index=_internal
| head 3" -d output_mode=csv/xml/json This will store the results in the user path as shown below.
... View more
12-02-2021
06:00 AM
From the looks of it, you want to suppress alerts during a planned/known outage time window and also at the same time want to have alerts during the normal operational window if the system fails/reboots. Unfortunately Splunk doesn't provide alert suppression windows, your only best bet is to disable alerts during the planned outage window and re-enable them once the activity is completed successfully.
... View more
12-02-2021
05:46 AM
1 Karma
I believe you will have to update your inputs.conf and write a scripted input configuration to run the job on scheduled time. https://docs.splunk.com/Documentation/Splunk/8.2.3/Admin/Inputsconf Also the current behavior you mentioned might be due to the enablement of the crcSalt in the inputs.conf that looks for hash change of the file state and if it happens, indexes the new data.
... View more
12-02-2021
05:31 AM
Has the instance being whitelisted to allow traffic from your Splunk instance or from where the request is generated /triggered?
... View more
12-02-2021
05:12 AM
1. Splunk cloud uses TLS 1.2/SSL for data in transit. https://www.splunk.com/en_us/about-splunk/splunk-data-security-and-privacy.html 2. You can configure SAML authentication with Splunk Cloud or enable 2FA - Duo Security as per your requirement https://docs.splunk.com/Documentation/Splunk/8.2.3/Security/SAMLConfigJWT https://duo.com/docs/splunk#configure-duo-for-splunk-6.5-and-later Any confidential data/PII must be ideally masked as per normal standards for governance and compliance purposes, unless there's a business use case for it requiring the data to be stored and processed in cloud.
... View more
12-02-2021
05:02 AM
Try using stats in your dropdown to show the dropdown value... Something like this... | inputlookup site.csv
| stats dc(site) by site Splunk's dropdown can only show up to 1000 rows rest are shown as you type in...
... View more
12-02-2021
04:45 AM
Its not a good idea to have such a long dropdown. It will not be efficient at all. Maybe if you could subdivide the dropdowns into multiple sites. Cascading dropdowns... where the second site dropdown is derived based on the 1st dropdown Region -> Site Or Use text input field to match and drive your dashboard search panels. A similar question was asked earlier in the forum. https://community.splunk.com/t5/Dashboards-Visualizations/What-is-the-maximum-limitation-of-drop-down-values/m-p/481014
... View more
12-02-2021
04:37 AM
One way to do it is run the search using the REST endpoint available from Splunk and build a script around it that will evaluate the result and feed into your script. Some resources to refer https://dev.splunk.com/enterprise/docs/devtools/customrestendpoints/ https://docs.splunk.com/Documentation/Splunk/8.2.3/RESTREF/RESTlist https://docs.splunk.com/Documentation/SplunkCloud/latest/SearchReference/Sendemail https://docs.splunk.com/Documentation/Splunk/8.2.3/RESTTUT/RESTsearches https://dev.splunk.com/enterprise/docs/devtools/java/sdk-java/
... View more
12-02-2021
04:34 AM
1 Karma
Did you try optimizing the queries or build the dashboard with base searches?
... View more
12-02-2021
04:32 AM
You can create a search and send email to any email address you want using the sendemail function. This can be only done by using the Splunk's REST API. You can create custom REST endpoints if needed in Splunk to cater certain functions. Also explore the Splunk's Java and Python SDK. Sharing some resources to explore and refer https://dev.splunk.com/enterprise/docs/devtools/customrestendpoints/ https://docs.splunk.com/Documentation/Splunk/8.2.3/RESTREF/RESTlist https://docs.splunk.com/Documentation/SplunkCloud/latest/SearchReference/Sendemail https://docs.splunk.com/Documentation/Splunk/8.2.3/RESTTUT/RESTsearches https://dev.splunk.com/enterprise/docs/devtools/java/sdk-java/
... View more
12-02-2021
04:05 AM
Try this.... | makeresults
| eval _raw= "BytesReceivedPersec=5057
BytesSentPersec=12654
BytesTotalPersec=17711
CurrentBandwidth=50000000000
Name=Microsoft Hyper-V Network Adapter _2
wmi_type=LocalNetwork"
| rex field=_raw "Name\=(?<Name>[\w\s\-\_]+)\s"
| table Name
... View more
12-02-2021
04:02 AM
Account deletion can only be done by Splunk Support team.
... View more
12-02-2021
03:59 AM
1 Karma
This is one way of doing it.... I've currently set end_date_time & Current to default to null if there is no value. If you want you can set Current to 0 if it doesn't exist by adding one more line | fillnull value=0 Current | makeresults
| eval _raw= "2021-Dec-02 Thu 19:24:52.106 INFO [pool-12-thread-1] - com.automationanywhere.nodemanager.service.impl.NodeMessagingServiceImpl - {} - writeSuccess(NodeMessagingServiceImpl.java:395) - Message eventData { id: \"b0ad6627-a6e1-4f5e-92f4-9c2deaa1ff2a_1cd4b06f83caac09\" bot_execution { start_date_time { seconds: 1638433382 nanos: 210329300 } end_date_time { seconds: 1638433491 nanos: 993822800 } progress { current: 6 total: 6 percentage: 100 } status_type: COMPLETED bot_uri: \"repository:///Automation%20Anywhere/Bots/Test%20A2019/AALogTestBot?fileId=1098948&workspace=PRIVATE\" }} sent to CR successfully."
| rex field=_raw "id\:\s\"(?<ID>[a-z0-9\-\_]+)\"\s"
| rex field=_raw "start\_date\_time\s\{\sseconds\:\s(?<start_date_time>[\d]+)\s"
| rex field=_raw "end\_date\_time\s\{\sseconds\:\s(?<end_date_time>[\d]+)\s"
| rex field=_raw "\{\scurrent\:\s(?<Current>[\d]+)\stotal"
| rex field=_raw "\stotal\:\s(?<Total>[\d]+)\s"
| rex field=_raw "status\_type\:\s(?<Status>[\w]+)\s"
| rex field=_raw "bot_uri\:\s\"(?<bot_uri>.*)\?"
| table _time _raw ID start_date_time end_date_time Current Total Status bot_uri
| fillnull value=null end_date_time Current If it helps, an upvote would be appreciated.
... View more
12-02-2021
03:34 AM
Can you share a sample raw data?
... View more
12-01-2021
01:45 AM
That part is me creating a test data for my query. You can ignore it. For you it will be the main search that will derive your paths and response codes. Post which you can use the foreach operations to derive the percentage table.
... View more
12-01-2021
12:27 AM
1 Karma
Hi @supraja Not sure how to set it exactly for the required height without changing the CSS. But you can play around with the height & width of the panel as per your dashboard. Use the panel resizing (DOT) seen under the visualization and align with the other panels on the dashboard. <dashboard>
<label>Test Sunburst Visualization</label>
<row>
<panel id="sunburst_panel1">
<viz type="sunburst_viz.sunburst_viz">
<search>
<query>index=_internal | eval component = coalesce(component,"") | eval log_level = coalesce(log_level,"") | stats count by sourcetype component log_level</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
<sampleRatio>1</sampleRatio>
</search>
<option name="drilldown">none</option>
<option name="height">422</option>
<option name="trellis.enabled">0</option>
<option name="trellis.scales.shared">1</option>
<option name="trellis.size">medium</option>
</viz>
</panel>
<panel id="sunburst_panel2">
<viz type="sunburst_viz.sunburst_viz">
<search>
<query>index=_internal | eval component = coalesce(component,"") | eval log_level = coalesce(log_level,"") | stats count by sourcetype component log_level</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
<sampleRatio>1</sampleRatio>
</search>
<option name="drilldown">none</option>
<option name="height">466</option>
<option name="sunburst_viz.sunburst_viz.breadcrumbs">hide</option>
<option name="sunburst_viz.sunburst_viz.color">schemeDark2</option>
<option name="sunburst_viz.sunburst_viz.colormode">root</option>
<option name="sunburst_viz.sunburst_viz.labelcolor">#000000</option>
<option name="sunburst_viz.sunburst_viz.labels">show</option>
<option name="sunburst_viz.sunburst_viz.labelsize">100</option>
<option name="sunburst_viz.sunburst_viz.labelwidth">100</option>
<option name="sunburst_viz.sunburst_viz.maxrows">1500</option>
<option name="sunburst_viz.sunburst_viz.mode">static</option>
<option name="trellis.enabled">0</option>
<option name="trellis.scales.shared">1</option>
<option name="trellis.size">medium</option>
</viz>
</panel>
</row>
<row depends="$alwaysHidden$">
<panel>
<html>
<style>
#sunburst_panel1{
height: 60% !important;
width: 40% !important;}
#sunburst_panel2{
height: 60% !important;
width: 60% !important;}
</style>
</html>
</panel>
</row>
</dashboard> If it helps, an upvote will be appreciated!
... View more
12-01-2021
12:09 AM
| makeresults
| eval months="January February March April May June July August September October November December"
| makemv delim=" " months
| mvexpand months
| eval short-month=upper(substr(months,1,3))
| fields - _time
... View more
11-30-2021
11:34 PM
Hi @bijodev1 , Try this way of using foreach function for the result table. | makeresults count=4
| streamstats count
| eval http_200 = case(count=1, 2500, count=2, 3904, count=3, 3156, count=4, 40566)
| eval http_400 = case(count=1, 250, count=2, 32, count=3, 101, count=4, 50)
| eval http_403 = case(count=1, 22, count=2, 390, count=3, 310, count=4, 400)
| eval path = case(count=1, "Path_A", count=2, "Path_B",count=3, "Path_C",count=4, "Path_D")
| fields - count
| addtotals
| table path http_200 http_400 http_403 Total
| foreach http_200
[ eval http_200%= tostring(round(<<FIELD>>/Total*100,2))+"%"]
| foreach http_400
[ eval http_400%= tostring(round(<<FIELD>>/Total*100,2))+"%"]
| foreach http_403
[ eval http_403%= tostring(round(<<FIELD>>/Total*100,2))+"%"]
| table path http_200% http_400% http_403% Please do upvote if it helps!
... View more
11-30-2021
11:05 PM
Hi @ethanthomas1 , There will be a better way to do this... but here's a dirty way to do it Checking if the last character of the string is a quote if not append it. | makeresults
| eval string1="\"My Name \"is Ethan\""
| eval string2="\"My Name \"is Ethan \""
| rex mode=sed field=string1 "s/\s\"/ /g"
| rex mode=sed field=string2 "s/\s\"/ /g"
| eval string3= if(substr(string1, len(string1), 1)="\"",string1, trim(string1)+"\"")
| eval string4= if(substr(string2, len(string2), 1)="\"",string2, trim(string2)+"\"")
| table string1 string2 string3 string4 .
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
12-14-2021
04:53 AM
|
