About thebankitgui

mmccul · ‎02-07-2024

First thing to check is of course btool splunk btool inputs list --debug for the respective inputs. If it shows renderXml set to false, for those inputs, then some other setting is overriding the setting you are trying to apply. Adding the --debug flag lets you know which file provides the winning setting, so you can figure out where it is coming from.

yuanliu · ‎06-23-2023

Give this a try: (index=main) sourcetype=perfmon:LogicalDisk instance!=_Total instance!=Harddisk* | eval FreePct-Other=case( match (instance, "C:"), null(), match(instance,"D:"), null(),true(),storage_free_percent), FreeMB-Other=case( match (instance, "C:"), null(), match(instance,"D:"), null(), true(),Free_Megabytes), FreePct-{instance}=storage_free_percent,FreeMB-{instance}=Free_Megabytes | search counter="% Free Space" ``` why is this not in the index search? ``` | eval data=strftime (_time,"%Y-%m-%d %H:%M:%S") . "|" . instance . "|" Value | stats values(data) as data by host | mvexpand data | tail 3 | eval data = split(data, "|") | eval Time = mvindex(data, 0), Drive = mvindex(data, 1), "Free%" = mvindex(data, 2) | rename host AS "Host"

thebankitgui · ‎01-30-2023

Alright, now I have the alert set up and it works but then the e-mail it sends will include all results over 1 minute with lots of duplicates. Now I need a way to say in the alert which host had low disk space. I have a custom trigger alert for free% < 10 so it will give me a long list of hosts repeated and the one less than 10 is in there (SSBDESKTOP2 in this instance). Just need to get it narrowed down:

thebankitgui · ‎01-26-2023

Giuseppe, I appreciate your replies, I really do. Unfortunately I figured out the inputs.conf through trial and error, looking at indexes to see when the wrong one was set and adding a stanza in one case. Now that I've got that solved on my own, I put in some SPL that I could use help with optimizing but I can do another thread for that. It's all part of the same issue because the perfmon data is for free disk space.

thebankitgui · ‎09-16-2022

We are attempting to use Alert Manager as a way to maintain an audit trail. We open cases and note them before closing but there are some that we'd want to auto suppress. I'm sure I'm missing something simple here hence the post. The page in Alert Manager says: Usage Use "$result.fieldname$" (without quotes) to refer to a field from results. Can either be used in "field" or "value" Use "$fieldname$" (without quotes) to refer to a metadata field, such as "$title$". Can either be used in "field" or "value" Use "_time" (without quotes) in "field" to compare the incident timestamp against a value (e.g. for maintenance windows) Note: All of the rules configure must be true for a valid suppression. If I try to just put $title$ in the field space and specify a title, nothing gets suppressed. Do I need to use different language / arguments here? Thank you in advance.

gcusello · ‎09-09-2022

Hi @thebankitgui, thank you, I'll try. Ciao. Giuseppe

thebankitgui · ‎09-09-2022

I cannot seem to get more than myself and Unassigned for users in Alert Manager. If I switch from "Builtin" to "alert_manager" it will still say Both. The install info for Alert Manager mentions typing in alert_manager users but I have nowhere to type these. I did see an older thread from 2018 where the person mentioned inheritance and roles but I couldn't make sense of it. Any help is appreciated, thank you!

thebankitgui · ‎06-10-2022

Any thoughts on sorting by time descending? I've tried a few different ways and it only sorts by the month at the beginning with 1 on top or 12 on top but not accurate to the whole date. I've tried | sort _time desc and asc and few other variations. Thank you. Edit: Disregard, one well placed "| sort - _time" before the table sorted by desc.

Posts	20
Solutions	0
Karma Given	10
Karma Received	2
Member Since	‎06-09-2022

Online Status	Offline
Date Last Visited	‎09-03-2024 09:56 AM

WinEventLog vs XmlWinEventLog

Is there a way to limit the results to UP TO 3 per...

Help with a free disk space query

Why is Perfmon data missing from two servers / Fre...

How to use Alert Manager to use the auto suppress ...

Alert Manager Users Issue

How to extract value from a field?

Re: WinEventLog vs XmlWinEventLog

Re: Returning up to 3 results per host

Re: Help with a free disk space query.

Re: Perfmon data missing from two servers.

How to use Alert Manager to use the auto suppress ...

Re: Alert Manager App JS errors on Splunk Cloud

Alert Manager Users Issue

Re: How to extract value from a field?

Join the Conversation