Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About sperkins
sperkins
Path Finder
Member since:
04-05-2022
05-09-2024
Community Statistics
| Posts | 21 |
| Solutions | 1 |
| Karma Given | 16 |
| Karma Received | 6 |
| Member Since | 04-05-2022 |
Activity Feed
- Posted Users with the same roles, in the same app, and same search, are getting different results from AWS logs on Splunk Search. 11-24-2023 07:08 AM
- Karma Re: Pass the label of an input to the title of a panel for niketn. 09-27-2023 06:23 AM
- Karma Re: creating a new field using Regex for PowerPacked. 08-01-2022 08:38 AM
- Karma Re: creating a new field using Regex for woodcock. 08-01-2022 08:37 AM
- Karma Re: Conver string to time duration. for richgalloway. 06-29-2022 08:30 AM
- Posted Re: Counting the number of sessions with more than one intent on Splunk Search. 06-08-2022 03:05 AM
- Posted Re: Counting the number of sessions with more than one intent on Splunk Search. 06-07-2022 09:51 AM
- Posted Re: Counting the number of sessions with more than one intent on Splunk Search. 06-07-2022 04:26 AM
- Posted Re: Multisite Replication Factor on Deployment Architecture. 06-06-2022 04:58 AM
- Posted Re: Counting the number of sessions with more than one intent on Splunk Search. 06-03-2022 11:13 AM
- Posted Re: Is it possible for a search head cluster to search multiple index clusters? on Deployment Architecture. 06-03-2022 11:02 AM
- Posted Re: Multisite Replication Factor on Deployment Architecture. 06-03-2022 10:44 AM
- Karma Re: Typing and Index queue shows 100% for richgalloway. 04-26-2022 05:55 AM
- Karma Re: How to line break my XML file by using LINE_BREAKER or editing props.conf? for somesoni2. 04-22-2022 05:18 AM
- Karma Re: REX Syntax Help for ITWhisperer. 04-21-2022 09:29 AM
- Karma Re: Filtering on specific multivalue field value for vnravikumar. 04-21-2022 09:09 AM
- Posted Re: Help with props.conf to detect timestamp on Getting Data In. 04-21-2022 05:32 AM
- Posted Re: Data Onboarding issue on Getting Data In. 04-21-2022 05:08 AM
- Got Karma for Re: How to change timestamp to include another field value?. 04-21-2022 03:54 AM
- Posted Re: How to change timestamp to include another field value? on Reporting. 04-20-2022 12:15 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 |
11-24-2023
07:08 AM
The search they are running is
index=* cloudtrail<bucketnumber>*
across a 7 day period. Environment Details: We are using the Splunk Add-on for AWS on a search head cluster, On-prem. On review of the inspect job log, it looks like one user's search is reaching out to source=s3://<aws smart store info> and the other users search is only searching the local indexes. Resulting in a drastic event return difference of 76 results vs 8500 during the same time period. Steps I've taken: I checked the app they are searching in and roles for each user (they are identical) I checked the user folder in Splunk, their settings are the same even down to the time zone. Even tried adding the index name to the search and having the user with missing logs re-run it. Still no change in her results and the job logs are showing it is not reaching out to S3. Is there something I am missing? Is this an AWS app setting that I need to adjust? I would appreciate any thought you may have on this. Thanks!
... View more
Labels
- Labels:
-
other
-
search job inspector
06-08-2022
03:05 AM
index=conversation botId=ccb | eval intent_count=if(like(intent,"%"), "1", "0") | stats sum(intent_count) as intent_count by sessionId | where intent_count >= 2 | addtotals col=t row=f labelfield=sessionId label="Total Sessions with More Than 2 Intents" | append [search index=conversation botId=ccb | eval intent_count=if(like(intent,"%"), "1", "0") | stats sum(intent_count) as intent_count_small by sessionId | addtotals row=f col=t labelfield=sessionId label="Total Sessions with Less Than 2 Intents" | where intent_count_small < 2] | search sessionId="Total Session*" Maybe changing the intent count field name will eliviate that. I am not sure if bin would work, but it could!
... View more
06-07-2022
09:51 AM
index=conversation botId=ccb | eval intent_count=if(like(intent,"%"), "1", "0") | stats sum(intent_count) as intent_count by sessionId | where intent_count >= 2 | addtotals col=t row=f labelfield=sessionId label="Total Sessions with More Than 2 Intents" | append [search index=conversation botId=ccb | eval intent_count=if(like(intent,"%"), "1", "0") | stats sum(intent_count) as intent_count by sessionId | addtotals row=f col=t labelfield=sessionId label="Total Sessions with Less Than 2 Intents" | where intent_count < 2] | search sessionId="Total Session*" This will return the results with two different column totals. The last Search is just a filter to only the totals will show, but if you want the sessionId's to be listed as well you can just take out that last line. Is this more what you were looking for?
... View more
06-07-2022
04:26 AM
index=conversation botId=ccb
| eval intent_count=if(like(intent,"%"), "1", "0")
| stats sum(intent_count) as intent_count by sessionId
| addtotals col=t row=f labelfield=sessionId intent_count
| where intent_count >= 2 This should only show a Total count and the sessionId's with over two intents.
... View more
06-06-2022
04:58 AM
because forwarders are automatic load balancers they distribute across all the indexers. So say one search needs to pull 4 buckets of one index (index=example) depending on parameters set) indexer 1 could have the primary copy of bucket one and 2 of index example indexer 2 has the primary copy of bucket three and the back ups for bucket one and two indexer 3-4 have the back ups for bucket 3 and 4. and indexer 5 has the primary of bucket 4. Etc… so in this search indexer 1,2, and 5 would participate.
... View more
06-03-2022
11:13 AM
Do you have a couple sample events to work the search against. Because in this event with the eval you are doing, it looks like it will only return values of 1 or 0 for intent_total. So I don’t think you can use that to | where >2 against. Unless you are trying to do |where against the new field that is sum in which case it should be written | stats sum(intent_total) as intent_total by sessionId
... View more
06-03-2022
11:02 AM
Yes you can. Here is the doc that shows the configs to do so. https://docs.splunk.com/Documentation/Splunk/8.2.6/Indexer/Configuremulti-clustersearch https://docs.splunk.com/Documentation/Splunk/8.2.6/DistSearch/SHCandindexercluster
... View more
06-03-2022
10:44 AM
To ensure that exactly one copy of each bucket participates in a search, one searchable copy of each bucket in the cluster is designated as primary. Searches occur only across the set of primary copies. This is to ensure that there isn’t duplicate data/events being returned in a search. https://docs.splunk.com/Documentation/Splunk/8.2.6/Indexer/Basicclusterarchitecture So if the primary copies are stored in one site then that is the site the Search Head will search. The others are “back-ups” in the event that one of the Indexers goes down. This is feature is more for data loss prevention and user search ability not being interrupted. Also check to be sure your SH is configured to disable search affinity: https://docs.splunk.com/Documentation/Splunk/8.2.6/Indexer/Multisitesearchaffinity
... View more
04-21-2022
05:32 AM
You can set your Timezone in props.conf example: [host::nyc*]
TZ = US/Eastern https://docs.splunk.com/Documentation/Splunk/latest/Data/Applytimezoneoffsetstotimestamps
... View more
04-21-2022
05:08 AM
I am not sure it is your whole issue, but your time format doesn't match the example: [2022-04-04 23:10:30.643] It should be %Y-%m-%d %H:%M:%S.%N I would also add in a LINE_BREAKER = <REGEX>
... View more
Fantastic!!
... View more
Ahhh change the eval to capitalize the field name | eval time_epoch = strptime(SESSION_TIMESTAMP, "%Y-%m-%d %H:%M:%S")
... View more
Does the strptime format match the time format of the SESSION_timestamp in your data?
... View more
04-20-2022
11:55 AM
| timechart span=1d count | fullnull
... View more
Convert the time to epoch, reformat it without the seconds, and then concatenate with strcat:: | eval time_epoch = strptime('SESSION_timestamp', "%Y-%m-%d %H:%M:%S") | convert ctime(time_epoch) as hour_minute timeformat="%Y-%m-%d %H:%M" | strcat hour_minute ":" SEQUENCE combo_time combo_time= 2022-04-20 12:23:101
... View more
04-12-2022
06:39 AM
1 Karma
You could do | transaction user startswith=(login_time=* ) maxspan=8h This will group events by the user, where the first event starts with login_time and it won't go more than eight hours. That way it can start with the time of login. Unless you want it to start from a certain time. In which case the string time value makes sense.
... View more
04-11-2022
12:27 PM
index=* SrcCountry=Mexico | timechart span=1week count by SrcCountry This gives you a count by Country per week. Run the search across 2 weeks. (If you want complete weeks you can "snap down" to the nearest week by using span=1w@w) Or, index=* SrcCountry=Mexico | timechart count by SrcCountry span=1d | timewrap 1week This returns a daily count by country, that is compared to the previous week days. I used Mexico as the example country. Any countries with spaces need quotes: like "United States"
... View more
04-11-2022
12:16 PM
You can use fields to group transactions together. So group it by the user field and use the maxspan time to make sure the first activities and last are no more than 8 hours apart. | transaction user maxspan=8h
... View more
04-11-2022
12:10 PM
1 Karma
try: | eval Epoch_login =strptime(login_time,”%Y-%m-%d %H:%M:%S”) | eval log_out = relative_time(Epoch_login,"+8h") Use %I instead of %H, if it isn't in 24 hour time format, but in 12 hour. To use relative_time the time has to be in Epoch which is why I converted it first. Then added 8 hours to the epoch time to give you the log_out time https://docs.splunk.com/Documentation/SCS/current/SearchReference/DateandTimeFunctions#relative_time.28.26.2360.3Btime.26.2362.3B.2C.26lt.3Bspecifier.26gt.3B.29
... View more
04-11-2022
09:52 AM
Are you using dashboard studio, or classic?
... View more
04-11-2022
06:03 AM
You can use the field extractor to extract the fields based on the "," as the delimiter. Or | rex in the search bar. Using the K=V pair extraction. (?<_KEY_1>[^=]+)=(?<_VAL_1>[^,]+),? https://regex101.com/ Then use |eval <field> = mvindex(<ref_field>, #) To reference each value in a search, or you can use the | eval mvexpand() function to split them into multiple events based on the field specified. https://docs.splunk.com/Documentation/SplunkCloud/latest/SearchReference/mvexpand
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
05-09-2024
12:44 PM
|
Karma given to
