About sperkins

sperkins · ‎11-24-2023

The search they are running is index=* cloudtrail<bucketnumber>* across a 7 day period. Environment Details: We are using the Splunk Add-on for AWS on a search head cluster, On-prem. On review of the inspect job log, it looks like one user's search is reaching out to source=s3://<aws smart store info> and the other users search is only searching the local indexes. Resulting in a drastic event return difference of 76 results vs 8500 during the same time period. Steps I've taken: I checked the app they are searching in and roles for each user (they are identical) I checked the user folder in Splunk, their settings are the same even down to the time zone. Even tried adding the index name to the search and having the user with missing logs re-run it. Still no change in her results and the job logs are showing it is not reaching out to S3. Is there something I am missing? Is this an AWS app setting that I need to adjust? I would appreciate any thought you may have on this. Thanks!

sperkins · ‎06-08-2022

index=conversation botId=ccb | eval intent_count=if(like(intent,"%"), "1", "0") | stats sum(intent_count) as intent_count by sessionId | where intent_count >= 2 | addtotals col=t row=f labelfield=sessionId label="Total Sessions with More Than 2 Intents" | append [search index=conversation botId=ccb | eval intent_count=if(like(intent,"%"), "1", "0") | stats sum(intent_count) as intent_count_small by sessionId | addtotals row=f col=t labelfield=sessionId label="Total Sessions with Less Than 2 Intents" | where intent_count_small < 2] | search sessionId="Total Session*" Maybe changing the intent count field name will eliviate that. I am not sure if bin would work, but it could!

sperkins · ‎06-06-2022

because forwarders are automatic load balancers they distribute across all the indexers. So say one search needs to pull 4 buckets of one index (index=example) depending on parameters set) indexer 1 could have the primary copy of bucket one and 2 of index example indexer 2 has the primary copy of bucket three and the back ups for bucket one and two indexer 3-4 have the back ups for bucket 3 and 4. and indexer 5 has the primary of bucket 4. Etc… so in this search indexer 1,2, and 5 would participate.

sperkins · ‎06-03-2022

Yes you can. Here is the doc that shows the configs to do so. https://docs.splunk.com/Documentation/Splunk/8.2.6/Indexer/Configuremulti-clustersearch https://docs.splunk.com/Documentation/Splunk/8.2.6/DistSearch/SHCandindexercluster

blbr123 · ‎04-22-2022

when i select always i get below error: FilesystemChangeWatcher [xxxxxx MainTailingThread] - error getting attributes of path "/opt/sw/ss/splunklogs/system.log.xxxxxxxxx.xxxxxx": Permission denied Insufficient permissions to read file='/opt/sw/ss/si/install/logs/noapp.log.xxxx.xxxx' (hint: Permission denied , UID: xxxxxx, GID: xxxxxxx) and the user has changed the permission to read the files for splunk user, and i have added restartSplunkd=true in server class to restart the splunk service for changes to be applied. But still same issue

isoutamo · ‎04-21-2022

I have seen that there are still some e.g. network equipments which needs reboot after summer/normal time has changed. But as @PickleRick said you should try to get TZ information on source side into events. Then there shouldn't be any issues with it especially when source system and splunk indexer/heavy forwarder are in different time zone! r. Ismo

sperkins · ‎04-20-2022

Fantastic!!

sperkins · ‎04-20-2022

| timechart span=1d count | fullnull

sperkins · ‎04-12-2022

You could do | transaction user startswith=(login_time=* ) maxspan=8h This will group events by the user, where the first event starts with login_time and it won't go more than eight hours. That way it can start with the time of login. Unless you want it to start from a certain time. In which case the string time value makes sense.

sperkins · ‎04-11-2022

index=* SrcCountry=Mexico | timechart span=1week count by SrcCountry This gives you a count by Country per week. Run the search across 2 weeks. (If you want complete weeks you can "snap down" to the nearest week by using span=1w@w) Or, index=* SrcCountry=Mexico | timechart count by SrcCountry span=1d | timewrap 1week This returns a daily count by country, that is compared to the previous week days. I used Mexico as the example country. Any countries with spaces need quotes: like "United States"

zoe · ‎04-11-2022

@sperkins I am using classic...

sperkins · ‎04-11-2022

You can use the field extractor to extract the fields based on the "," as the delimiter. Or | rex in the search bar. Using the K=V pair extraction. (?<_KEY_1>[^=]+)=(?<_VAL_1>[^,]+),? https://regex101.com/ Then use |eval <field> = mvindex(<ref_field>, #) To reference each value in a search, or you can use the | eval mvexpand() function to split them into multiple events based on the field specified. https://docs.splunk.com/Documentation/SplunkCloud/latest/SearchReference/mvexpand

Posts	21
Solutions	1
Karma Given	16
Karma Received	6
Member Since	‎04-05-2022

Online Status	Offline
Date Last Visited	‎02-16-2024 04:48 PM

Users with the same roles, in the same app, and sa...

Users with the same roles, in the same app, and sa...

Re: Counting the number of sessions with more than...

Re: Multisite Replication Factor

Re: Is it possible for a search head cluster to se...

Re: Data Onboarding issue

Re: Help with props.conf to detect timestamp

Re: How to change timestamp to include another fie...

Re: Using timechart to get count, why is returning...

Re: Search for group user activities based on Log...

Re: week to week comparison of counts by SrcCountr...

Re: how to change the dashboard layout while chang...

Re: Split events in multiline raw data and extract...