Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- About marysan
marysan
Communicator
Member since:
06-14-2022
01-07-2026
Community Statistics
| Posts | 59 |
| Solutions | 9 |
| Karma Given | 1 |
| Karma Received | 15 |
| Member Since | 06-14-2022 |
Activity Feed
- Posted Re: Using Tokens in Alert Email on Alerting. 06-07-2024 02:54 AM
- Posted Re: Is it possible to get the count of events matching a p99 value? on Dashboards & Visualizations. 06-07-2024 12:57 AM
- Posted Re: Is it possible to get the count of events matching a p99 value? on Dashboards & Visualizations. 06-06-2024 08:08 PM
- Posted Re: Using Tokens in Alert Email on Alerting. 06-05-2024 11:28 PM
- Got Karma for Re: Eventstats command. 06-03-2024 05:12 AM
- Posted Re: List correlation searches with number of alerts on Splunk Search. 05-31-2024 10:16 PM
- Posted Re: Eventstats command on Splunk Search. 05-31-2024 09:17 AM
- Posted Re: How can I search using an inputlookp with wildcards and spaces? on Dashboards & Visualizations. 05-31-2024 08:40 AM
- Posted Re: Is there a search that will return all changes creation, deletion of global groups? on Reporting. 05-31-2024 08:38 AM
- Posted Re: Eventstats command on Splunk Search. 05-31-2024 08:35 AM
- Posted Re: Searches on Splunk Search. 05-31-2024 08:26 AM
- Tagged Re: Searches on Splunk Search. 05-31-2024 08:26 AM
- Posted Re: How to filter multivalue null values? on Splunk Search. 05-31-2024 08:17 AM
- Got Karma for Re: Splunk Rest Query to see the definitions of all dashboards ( public & private ). 08-03-2023 01:48 AM
- Got Karma for Re: How can I search using an inputlookp with wildcards and spaces?. 05-31-2023 05:42 AM
- Got Karma for Re: Is there a search that will return all changes creation, deletion of global groups?. 01-19-2023 07:55 AM
- Posted Re: How to remove fields with zero value in chart command? on Splunk Enterprise. 07-31-2022 02:50 AM
- Posted Re: remove fields with zero value in chart command on Splunk Enterprise. 07-31-2022 01:27 AM
- Posted How to remove fields with zero value in chart command? on Splunk Enterprise. 07-30-2022 01:37 AM
- Tagged How to remove fields with zero value in chart command? on Splunk Enterprise. 07-30-2022 01:37 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 |
06-07-2024
02:54 AM
Hi @madhav_dholakia I'm not sure please remove the last line of my query , I mean this : subject = $email_subject // Use the dynamically generated subject then in the subject box in "Edit Alert " put this : Alert: $email_subject$ OR $email_subject$ If it doesn't work put an image from edit alert section of your alert hear
... View more
06-07-2024
12:57 AM
@jrs42 you can use 'stats' instead of 'eventstats' to optimize : index=foo message="magic string" | stats p99(duration) as p99val, count(eval(duration > p99(duration))) as count
... View more
06-06-2024
08:08 PM
Hi I think it works for you: index=foo message="magic string" | eventstats p99(duration) as p99val | stats count(eval(duration > p99val)) as count
... View more
06-05-2024
11:28 PM
Hi, Tre this : | inputlookup yourlookuo // Read data from the lookup file | search NOT $empty$ trigger_email=true // Filter for records with email trigger enabled | eval email_subject = "<field_MotherYear> - <field_Customer> - <field_Device>- <field_CheckName> - <field_SelfHealCount>-<field_Status>- <field_Timestamp>" // Construct subject using all fields subject = $email_subject // Use the dynamically generated subject
... View more
05-31-2024
10:16 PM
Hi I suppose that this query works for you :
index=notable
| stats count as alert_num by rule_name
| rename rule_name as csearch_label
| lookup savedsearches csearch_label as csearch_label OUTPUTNEW action.notable.param.security_domain as security_domain, description, eai:acl.app as app
| search app="SplunkEnterpriseSecuritySuite"
| table alert_num, csearch_label, app, security_domain, description | sort - alert_num
... View more
05-31-2024
08:40 AM
@humanBeing If your problem is resolved, then please click one of the "Accept as Solution" buttons to help future readers. 🙂
... View more
05-31-2024
08:38 AM
@DanAlexander1 If your problem is resolved, then please click one of the "Accept as Solution" buttons to help future readers. 🙂
... View more
05-31-2024
08:35 AM
I think this query will work for you :
| tstats summariesonly=true fillnull_value="N/D" dc(All_Email.internal_message_id) as total_emails from datamodel=Email where (All_Email.action="quarantined" OR All_Email.action="delivered") AND NOT [| `email_whitelist_generic`] by All_Email.src_user, All_Email.subject, All_Email.action | `drop_dm_object_name("All_Email")` | eventstats sum(eval(if(action="quarantined", 1, 0))) as quarantined_count_peruser, sum(eval(if(action="delivered", 1, 0))) as delivered_count_peruser by src_user, subject | where total_emails > 50 AND quarantined_count_peruser > 10 AND delivered_count_peruser > 0
... View more
05-31-2024
08:26 AM
there are several queries : for example sourcetype=Sample_sourcetype : 1-
| metadata type=sourcetypes
| search sourcetype=Sample_sourcetype
| table index, sourcetype
2-
| tstats count where sourcetype=Sample_sourcetype by index | table index
... View more
05-31-2024
08:17 AM
Assume that ImpCon is a multivalue field from which you want to remove null values this works for you :
| eval ImpCon=mvfilter(isnotnull(ImpCon) AND ImpCon!="")
... View more
07-31-2022
02:50 AM
this problem was resolved by using |stats count as count by flag, DestAddr
... View more
07-31-2022
01:27 AM
yes it doesn't work . shows nothing !
... View more
07-30-2022
01:37 AM
Hello everybody my query :
index=logarithm SrcAddr="192.168.148.1"
|eval flag=case(DestAddr="192.168.148.7" OR DestAddr="192.168.148.8" OR DestAddr="192.168.148.24" ,"LAN 1",DestAddr="192.168.148.21" OR DestAddr="192.168.148.36" OR DestAddr="192.168.148.37" ,"LAN 4" , DestAddr="192.168.148.33" OR DestAddr="192.168.148.34" OR DestAddr="192.168.148.35","LAN 5")
|chart count over flag by DestAddr useother=f usenull=f
and in trellis mode there are all DestAddrs for each flag! (as we can see in picture) but I want not to show DestAddrs with 0 values in every chart by "LAN 1" just show "192.168.148.7" or "192.168.148.8" or "192.168.148.24" by "LAN 4" just show "192.168.148.21" or "192.168.148.36" or "192.168.148.37" by "LAN 5" just show "192.168.148.33" or "192.168.148.34" or "192.168.148.35 "
... View more
- Tags:
- chart
Labels
- Labels:
-
using Splunk Enterprise
07-17-2022
05:30 AM
Hi in Edit Alert ->"Trigger Conditions" -> Trigger you must select "Once" option instead of "For each result"
... View more
index=MyIndex EventCode IN (4728,4729,4730) user=* | eval time=_time | convert ctime(time) | eval msg="A user "+user+" was "+action+" on the host "+host+" by "+src_nt_domain+"\\"+src_user+" at "+time |table msg,EventCode,action,user,signature,status
... View more
07-17-2022
04:30 AM
1 Karma
| inputlookup file1.csv | eventstats dc(Tests) as file1_tests_count | dedup file1_tests_count | inputlookup append=T file2.csv | eventstats dc(Tests) as file2_tests_count | dedup file2_tests_count | fields file1_tests_count,file2_tests_count | eval percentage=(file1_tests_count/file2_tests_count*100)
... View more
07-17-2022
04:14 AM
|mvexpand fieldA |mvexpand fieldB |eval flag=if(match(fieldA ,fieldB),1,0) OR |mvexpand fieldA |mvexpand fieldB |eval flag=if(match(fieldB ,fieldA),1,0)
... View more
07-17-2022
04:00 AM
1 Karma
|mvexpand Account |eval flag=if(match(Account,user),1,0) |search flag=0
... View more
07-17-2022
03:59 AM
1 Karma
|mvexpand Account |eval flag=if(match(Account,user),1,0) |search flag=0
... View more
- Tags:
- match
- multivalue
07-02-2022
12:33 AM
1 Karma
Hello in input settings there is a Dynamic option . you can use a report or search to show new customers . like this
... View more
06-29-2022
04:40 AM
Hi you can use mvappend command to append 3 different fields as a fields: | inputlookup CUCM_lboro_assigned_numbers_27_6_22.csv | rename DN AS phone | search NOT [ search index=cucm cdrRecordType=1 duration>0 |eval phone=mvappend(callingPartyNumber ,originalCalledPartyNumber , finalCalledPartyNumber ) |table phone] but I doubt that "search NOT" works for you !
... View more
06-28-2022
11:57 PM
Hi I suppose that you need join command for example : index=index1 abc=123-678 def=678+943 , ghi=678-123 | fields abc,def,ghi | join type=inner abc,def,ghi [| search index=index2]
... View more
06-28-2022
10:55 PM
Hi you should add append=T to tour outputlookup command |outputlookup append=T test.csv did you di that ?
... View more
06-28-2022
10:21 PM
Hi, this must work |rex field=a "stopped: "(?<pause>.*)" seconds," |where pause> 0
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
01-07-2026
04:01 AM
|
Karma from
