About deodeshm

deodeshm · ‎10-18-2023

I am trying find a way where I can send a test email through SOAR to check the connectivity. Where can I see the option? Splunk SMTP app is also present.

deodeshm · ‎08-03-2023

Receiving below errors, can someone help with the solution: Streamed search execute failed because: Error in 'lookup' command: Script execution failed for external search command '/splunk/var/run/searchpeers/xxxx/apps/utbox/bin/ut_shannon.py'

deodeshm · ‎06-20-2023

Where can I see ES content searches performance in terms of avg. time taken to run a particular correlation rule or saved search?

deodeshm · ‎02-27-2023

Hello, Is there any way to send scheduled reports (csv) to a specific Google Drive location? OR Is there any add-on available for sharing csv reports for Google Data Studio?

deodeshm · ‎08-25-2022

Sorry, found the solution, I selected events as a panel so wasn't able to see any results. Thanks for the response.

deodeshm · ‎08-25-2022

I am trying to build a dashboard with time input, how can I use the time selected to pass to below query? | tstats `summariesonly` earliest(_time) as _time from datamodel=Incident_Management.Notable_Events_Meta by source,Notable_Events_Meta.rule_id | `drop_dm_object_name("Notable_Events_Meta")` | `get_correlations` | stats count by rule_name e.g. if I select 7 days, it should show data for 7 days only.

deodeshm · ‎08-25-2022

Thanks for the answer, below is the search query, I can plot the chart with seconds but want the label in D+hh:mm:ss format, is there any way? index=<> | eval month=strftime(_time,"%B %Y") | rename fields.customfield_17410 AS alert_time | eval g_e_time = strptime(gsoc_engagement_time,"%Y-%m-%dT%H:%M:%S") | eval a_time = strptime(alert_time,"%Y-%m-%dT%H:%M:%S") | eval cl_time = strptime(closed_time,"%Y-%m-%dT%H:%M:%S") | eval mtta_diff = g_e_time-a_time | eval mttt_diff = cl_time - a_time | stats avg(mtta_diff) AS MTTA, avg(mttt_diff) AS MTTT by month | eval MTTA=tostring(round(MTTA,0), "duration") | eval MTTT=tostring(round(MTTT,0), "duration")

deodeshm · ‎08-17-2022

Hello, I used below to convert seconds into D+HH:MM:SS format which is now in string format. However, I want to create charts based on duration taken to publish the turn around times. eval strSecs=tostring(secs,"duration") How can I use these strings to create chart or is there any way to convert seconds to HH:MM:SS format which is quantifiable and not a string? Thanks, Deovrat

deodeshm · ‎06-08-2022

As I understand es_notable_events is KVStore and it stores notable event information for last 48 hours/ also there is a panel in ES Audit dashboard that shows Notable Events By Owner - Last 48 Hours. Is there any way to build a similar chart for older Notables? Thanks, Deovrat

Posts	9
Solutions	0
Karma Given	2
Karma Received	1
Member Since	‎06-08-2022

Online Status	Offline
Date Last Visited	‎10-19-2023 11:14 AM

How to send a test email to test connectivity in S...

Why receiving the URL Toolbox errors?

Where can I see ES content searches performance in...

Is there a way to send scheduled Splunk Reports to...

Help with Dashboard with time span for with tstats

Chart by Duration (D+HH:MM:SS) which is in string...

How to search Notable Events By Owner and Severity...