Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Are you a member of the Splunk Community?
Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- Find Answers
- :
- About mwcentracomm
mwcentracomm
Explorer
Member since:
01-31-2022
02-26-2024
Community Statistics
| Posts | 9 |
| Solutions | 0 |
| Karma Given | 1 |
| Karma Received | 0 |
| Member Since | 01-31-2022 |
Activity Feed
- Posted How to find a seach file on Getting Data In. 02-26-2024 03:49 AM
- Posted Re: Add entry data to an alert on Splunk Search. 02-15-2024 10:14 AM
- Posted Add entry data to an alert on Splunk Search. 02-15-2024 05:26 AM
- Posted Re: I would like to take the hosts feild from the below search and show the most recent event from each host on Splunk Search. 02-12-2024 10:42 AM
- Posted Re: I would like to take the hosts feild from the below search and show the most recent event from each host on Splunk Search. 02-12-2024 10:02 AM
- Posted I would like to take the hosts field from the below search and show the most recent event from each host on Splunk Search. 02-12-2024 09:01 AM
- Karma Re: I would like to see only the last item of a search for richgalloway. 02-12-2024 08:41 AM
- Posted I would like to see only the last item of a search on Splunk Search. 02-12-2024 07:56 AM
- Posted Re: Cannot select custom app for new index on All Apps and Add-ons. 01-31-2022 05:41 AM
- Posted Cannot select custom app for new index on All Apps and Add-ons. 01-31-2022 05:21 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
02-26-2024
03:49 AM
I have inherited a Splunk system and this is one of the alerts
| metadata index=index-cc* type=hosts | eval age = now()-lastTime | where age > 86400 | sort age d | convert ctime(lastTime) | fields lastTime,host,source,age | rename age as "Seconds Since Last Event" | search `Exempted_Dark_Devices`
How do I find the file Exempted_Dark_Devices?
Thank you
... View more
Labels
- Labels:
-
blacklist
02-15-2024
10:14 AM
Sorry, I did not completely explain, - I would like it to return the full name ending in srx.
... View more
02-15-2024
05:26 AM
I am using the search below
| metadata type=hosts | where recentTime < now() - 10800| eval lastSeen = strftime(recentTime, "%F %T") | fields + host lastSeen
I would like to add a field populated by somename that ends in "srx"
Jan 4 13:07:57 1.1.1.1 1 2024-01-04T13:07:57.085-05:00 5995-somename-srx rpd 2188 JTASK_SIGNAL_INFO [junos@2636.1.1.1.2.133 message-name="INFO Signal Info: Signal Number = " signal-number="1" name=" Consumed Count = " data-1="3"]
... View more
Labels
- Labels:
-
regex
02-12-2024
10:42 AM
Yes, that is what I am trying to do, and I obviously have the host, is there a way to extract this out of the event to add to the alert? Jan 4 13:07:57 HOST 1 2024-01-04T13:07:57.085-05:00 somenumber-somename-ks-srx rpd 2188 JTASK_SIGNAL_INFO [junos@2636.1.1.1.2.133 message-name="INFO Signal Info: Signal Number = " signal-number="1" name=" Consumed Count = " data-1="3"] Thanks for all the help
... View more
02-12-2024
10:02 AM
Would there be a way to to search for the first host not reporting and see the most recent event and create an alert on that, and do it for the second and the third and so forth?
... View more
02-12-2024
09:01 AM
I created an alert from the search below, and it emails a pdf - is there a way to add the most recent event from each of the hosts in this search and add it to the email? metadata type=hosts | where recentTime < now() - 10800| eval lastSeen = strftime(recentTime, "%F %T") | fields + host lastSeen
... View more
Labels
- Labels:
-
host
02-12-2024
07:56 AM
Hello I would like a search to show the last entry of host="1.1.1.1", and show the full entry. Thank you
... View more
01-31-2022
05:41 AM
I am new to this environment, so distributed I believe. There is a heavy forwarder, two search heads, an indexer, a server listed as console (which is the server we logon for searches) and another server of which I do not know what it does (simply named DDMD). I have added new indexes and inputs on the main server, but they are showing no events. I have read I also need to add the indexes to the indexer, when trying to do this, I cannot select the same custom app for indexes that all the others on that server are using.
... View more
01-31-2022
05:21 AM
I added a new index to my enterprise server, but on the indexer I cannot add it because it will not allow me to select the custom app.
... View more
Labels
- Labels:
-
administration
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
02-26-2024
01:20 PM
|
