About ezamit

ezamit · ‎01-13-2025

I have attached the raw data to the post. I am trying the following query to identify the ResourceTypes and the count but it is not giving me any results : index=app_shared source=aws.config | stats count by resourceType | table resourceType I think we can also narrow down to only - "detail-type": "Config Configuration Item Change"

ezamit · ‎01-13-2025

I have attached the raw data to the post. I am trying the following query to identify the ResourceTypes and the count but it is not giving me any results : index=app_shared source=aws.config | stats count by resourceType | table resourceType I think we can also narrow down to only - "detail-type": "Config Configuration Item Change"

ezamit · ‎01-31-2024

I have a records that comes with multiple items in a single row. Is there a way i can break it down in a single row. The rest of the values will be same and can be copied. In the screen shot below, can we break down the first row in two rows, second in 5 rows etc.. Thanks in advance to the Splunk Community. They are super helpful.

ezamit · ‎01-31-2024

😀Thanks Guys. it is working !!!!😀

ezamit · ‎01-31-2024

Thanks @gcusello . That's a great suggestion. I added | delta EpochOT p=1 to the search and it gave me the following results Is there a way we can do every other row in delta. I want Row 3 - Row 2, Row 5 - Row 4, Row 7 - Row 6 etc. Thanks again for your help

ezamit · ‎01-31-2024

I have AWS Cloudtrail data and want to find out how long an EC2 instance was stopped. Is it possible to subtract the EpochOT from Row 3 to Row 2 and Row 5 to Row 4 etc..

ezamit · ‎01-30-2024

My original time format in the search is eventID: d7d2d438-cc61-4e74-9e9a-3fd8ae96388d eventName: StartInstances eventSource: ec2.amazonaws.com eventTime: 2024-01-30T05:00:27Z eventType: AwsApiCall I am not able to convert it using the strptime function eval dt_year_epoc = strptime(eventTime, "%Y-%m-%dThh:mm:ssZ") eval dt_day= strftime(dt_year_epoc, "%d") Nothing comes up in dt_day

ezamit · ‎01-30-2024

How can i take the eventName , instanceId and eventTime in a Pivot Table from the search below : index=aws_cloudtrail sourcetype="aws:cloudtrail" (eventName="StartInstances" OR eventName="StopInstances" OR eventName="StartDBInstance" OR eventName="StopDBInstance" OR eventName="StartDBCluster" OR eventName="StopDBCluster") AND (userIdentity.type="AssumedRole" AND userIdentity.sessionContext.sessionIssuer.userName="*sched*") | spath "requestParameters.instancesSet.items{}.instanceId" | search "requestParameters.instancesSet.items{}.instanceId"="i-0486ba14134c4355b" | spath "responseElements.instancesSet.items{}.instanceId" | spath "recipientAccountId" Events : awsRegion: us-east-1 eventCategory: Management eventID: 3a80a688-fa82-4950-b823-69ffc3283862 eventName: StartInstances eventSource: ec2.amazonaws.com eventTime: 2024-01-30T11:00:38Z eventType: AwsApiCall eventVersion: 1.09 managementEvent: true readOnly: false recipientAccountId: XXXXXXXXXXX requestID: b404437a-ee56-4531-842e-1b10c01f01d3 requestParameters: { [-] instancesSet: { [-] items: [ [-] { [-] instanceId: i-0486ba14134c4355b } ] } }

Posts	9
Solutions	0
Karma Given	2
Karma Received	0
Member Since	‎01-30-2024

Online Status	Offline
Date Last Visited	‎06-10-2025 10:59 AM

Dev environment - Splunk Cloud

how to break down a record in multiple rows

How to subtract filed values in a column

Time conversion for AWS Cloudtrail logs using strp...

AWS cloudtrail data

Re: AWS Config data in Splunk