About BahadirS

BahadirS · ‎03-30-2022

Maybe there is a problem in your index time field extractions.

BahadirS · ‎03-21-2022

Hello @zacksoft_wf Your cron expression schedules your alert every minute 9:00 to 10:00 and 21:00 to 22:00. Your expression would be 30 */12 * * * I suggest you to check https://crontab.guru/ before scheduling. to run it once.

BahadirS · ‎03-21-2022

Hello @Daniel_K , I think I understand what you are trying to do. You could use bucket/bin command. Then use time field to group other fields. For X=5 minutes index=something | bucket span=5m _time | stats count by src_ip, _time

BahadirS · ‎03-20-2022

On the panel instead of sourcetype_tok=$sourcetype_tok$ on the panel, can you try it without sourcetype_tok. And same with other fields. | savedsearch searchname $sourcetype_tok$ ...

BahadirS · ‎03-20-2022

Can you click magnifying glass on the slow panel and share the search after tokens replaced with values?

BahadirS · ‎03-20-2022

Hello @SecDesh , If you have Enterprise Security there is a solution for this. It is called Search Driven Lookup. It automatically updates values for defined columns.

BahadirS · ‎03-20-2022

@fredv44 Why dont you filter out other services before calculating? Also you can edit stats row like this for specific results. avg(eval(if(svc="Service2",duration,null)) as avgDuration

BahadirS · ‎03-20-2022

Hello @POR160893, It seems like your filters are not working correctly. Can you add these to your saved search? index=firewal sourcetype=$sourcetype_tok$ dest=$dest$ ...

BahadirS · ‎02-10-2022

You might want to consider more relational database approach since your data seems to have normalized database structure and you want to analyze more. This way you would get a good structured data to play with. index=index1 sourcetype=Error | table err_msg, id, nid | join type=left nid [ search index=index1 sourcetype=Node | table address, id, resultid | rename id as nid] | join type=left resultid [ search index=index1 sourcetype=Result | table id , model | rename id as resultid]

BahadirS · ‎02-09-2022

Hello You have two different formatted tables. You might want to transform the structure either on first search or second. first_search | join type=left Schicht_Datum [ second_search | untable Schicht_Datum segment mid_result ] | xyseries Schicht_Datum segment mid_result

BahadirS · ‎02-08-2022

You can use branch reset group in your expression. Something like this would solve your problem. (?|from\s(?<db>[^:]+):|\s(?<db>[^\s]+)\sjournal)

Posts	12
Solutions	2
Karma Given	0
Karma Received	4
Member Since	‎02-08-2022

Online Status	Offline
Date Last Visited	‎11-03-2022 11:44 AM

Re: Why are indexed real-time searches not returni...

Re: Splunk Alert Scheduling Issue

Re: Group DNS queries per src_ip where two domains...

Re: Slow Panel on Dashboard

Re: Slow Panel on Dashboard

Re: Can a search query result that provides more t...

Re: Combine two searches from same index

Re: Slow Panel on Dashboard

How to export a result with stats count of err_msg...

Re: Joining Tables

Re: Extract field from two slightly different form...