About lorscardala985

lorscardala985 · ‎01-25-2024

I'm not sure if I was unclear, but anyway, I wanted to use the token to change, if possible, the data reported by a search that is saved as a report.

lorscardala985 · ‎01-25-2024

"I need help with this XML for a dashboard; essentially, I need to call a token that modifies data within a report, having already created the token with the name 'data.' How can I do this?" <form version="1.1"> <label>Lista IP da bloccare</label> <fieldset submitButton="true" autoRun="false"> <input type="time" token="data"> <label></label> <default> <earliest>rt-24h</earliest> <latest>rt</latest> </default> </input> </fieldset> <row> <panel> <table> <search ref="checkpoint1"></search> <option name="drilldown">none</option> </table> </panel> </row> </form>

lorscardala985 · ‎08-03-2023

this are my sourcetype and the problem with the date

lorscardala985 · ‎08-03-2023

i have a problem with the timestamp when i parsing the data, i want the date to start with 28/04/2023 and end with 03/05/2023 but it start with 30/04 then 29/04 and end with 28/04, who can i start the data with 28/04 and not 30/04

lorscardala985 · ‎07-21-2023

i have events with this timestamp Sep 20 11:13:18 10.50.3.100 Sep 20 11:13:15 and i want to view only the second timestamp

lorscardala985 · ‎07-21-2023

how can i in the props.conf file tell Splunk to take the second timestamp as opposed to the first

lorscardala985 · ‎07-19-2023

how can i identify, because i have file with log events, and i need to ingest on splunk

lorscardala985 · ‎07-19-2023

how can i modify the transforms.conf file so that when i ingest the data it throws away all the events that have the status FAILED after the first ip address

lorscardala985 · ‎07-11-2023

i have 1 ip address that is 127.0.0.1

lorscardala985 · ‎07-11-2023

I need help creating a regex that extracts subnet masks

lorscardala985 · ‎07-07-2023

splunk fsck repair --all-buckets-all-indexes i need to know where i need to put this command on Linux

lorscardala985 · ‎07-06-2023

why doesn't this search populate the multiselect

lorscardala985 · ‎07-05-2023

index=_audit sourcetype=audittrail (action="login attempt" OR action="logout") | stats values(_time) as action_time by user, action | eventstats range(action_time) as range by user | eventstats min(action_time) as min_time max(action_time) as max_time by user, range | where action="login attempt" OR action="logout" | stats values(action_time) as action_time by user | eval login_time=mvindex(action_time, 0), logout_time=mvindex(action_time, -1) | eval session_duration=logout_time - login_time | eval session_duration_str=strftime(session_duration, "%H:%M:%S") | table user session_duration_str from this search I would need to know the duration of the individual days

lorscardala985 · ‎07-05-2023

I thought of something like this : index="_internal" | stats avg(_time) as avg_time by user | eval avg_day = strftime(avg_time, "%Y-%m-%d")

lorscardala985 · ‎07-05-2023

where i can find it??, i'm new in splunk so i don't know everything

lorscardala985 · ‎07-05-2023

i need to knwo how to find the average session duration (the time between when I connect to when I disconnect)

lorscardala985 · ‎07-05-2023

I wanted to know how I can calculate the average daily duration of the sessions

Posts	17
Solutions	0
Karma Given	1
Karma Received	0
Member Since	‎07-05-2023

Online Status	Offline
Date Last Visited	‎01-25-2024 11:16 AM

token

timestamp

How can I take the second timestamp in props.conf?

transform.conf

subnet

bucket repair

populate multiselect

How can I calculate session duration?

Re: token

token

Re: timestamp

timestamp

Re: timestamp props.conf

How can I take the second timestamp in props.conf?

Re: transform.conf

transform.conf

Re: subnet

subnet

bucket repair

populate multiselect

Re: session duration

Re: session duration

Re: session duration

Re: session duration

How can I calculate session duration?

Join the Conversation