Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- Find Answers
- :
- About sbattista09
sbattista09
Contributor
Member since:
07-22-2014
06-05-2020
Community Statistics
| Posts | 156 |
| Solutions | 8 |
| Karma Given | 59 |
| Karma Received | 27 |
| Member Since | 07-22-2014 |
Activity Feed
- Got Karma for How to search how much bandwidth a forwarder is using?. 05-04-2022 08:46 AM
- Got Karma for Re: Why am I getting "Missing enough suitable candidates to create a replicated copy" building a multisite indexer cluster staging environment?. 10-20-2021 06:23 AM
- Got Karma for Re: Why am I getting "Missing enough suitable candidates to create a replicated copy" building a multisite indexer cluster staging environment?. 07-19-2021 09:48 AM
- Got Karma for Re: Why am I getting "Missing enough suitable candidates to create a replicated copy" building a multisite indexer cluster staging environment?. 04-07-2021 08:45 AM
- Got Karma for How to take the perc of each action and display it in a single value panel on a dashboard?. 10-15-2020 08:18 PM
- Karma Re: standard deviation to alert us when we see source types and/or indexes grow more then expected for _gkollias. 06-05-2020 12:50 AM
- Karma Re: standard deviation to alert us when we see source types and/or indexes grow more then expected for jacobpevans. 06-05-2020 12:50 AM
- Karma Re: standard deviation to alert us when we see source types and/or indexes grow more then expected for jacobpevans. 06-05-2020 12:50 AM
- Karma Re: still not sending email for alerts for darshini2790. 06-05-2020 12:50 AM
- Karma Re: still not sending email for alerts for kamlesh_vaghela. 06-05-2020 12:50 AM
- Got Karma for Any good examples of run books for upgrading splunk 7.x to 8.x using Ansible?. 06-05-2020 12:50 AM
- Got Karma for Re: standard deviation to alert us when we see source types and/or indexes grow more then expected. 06-05-2020 12:50 AM
- Got Karma for standard deviation to alert us when we see source types and/or indexes grow more then expected. 06-05-2020 12:50 AM
- Got Karma for Re: How does Splunk connect to the Universal forwarders — using IP or HostNames?. 06-05-2020 12:50 AM
- Karma Re: Top 20 Memory-Consuming Searches for rphillips_splk. 06-05-2020 12:49 AM
- Karma Monitor Role Changes in _Audit Trail for lathwal. 06-05-2020 12:49 AM
- Karma Re: Is there documentation on how to migrate a search head deployer and a cluster master to new servers? for sloshburch. 06-05-2020 12:49 AM
- Karma Re: Search syntax for comparing events over 30-day timespan for elliotproebstel. 06-05-2020 12:49 AM
- Got Karma for What would be the best way to ensure redundancy in opsec lea add-on when the heavy weight forwarder running the app fails?. 06-05-2020 12:49 AM
- Karma How to configure DMC for heavy forwarder monitoring? for koshyk. 06-05-2020 12:48 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 1 | |||
| 1 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
05-15-2015
01:19 PM
we have a server that the time time is reporting in with an odd format,
15/May/2015:15:20:38 -0400
how would i make the stanza to get Splunk to parse this correctly to something like 05/15/2015 03:20:38 PM?
... View more
04-29-2015
09:08 AM
After installing the Splunk add on for F5 BigIP, we are having issues with collecting LTM traffic and SSL handshakes. We can see it in the BigIP under val/log/ltm, but it's not sending over to Splunk.
We are getting all other logs that we need however, we are unsure of how to set up the BigIP to send the LTM traffic over.
... View more
04-03-2015
01:05 PM
downgraded java from 8 to 7.
... View more
03-31-2015
10:55 AM
just installed db connect v1 on a heavy forwarder running 6.2.2 and cannot add an external database. My username, password, port and server names are all correct. the post is open on the database server as well. The java bridge is up and running.
Encountered the following error while trying to save: Splunkd daemon is not responding: ('Error connecting to /servicesNS/"username"/dbx/dbx/databases: The read operation timed out',)
Not sure what else i would need to check in the case.....
... View more
03-09-2015
01:29 PM
your the MAN! thanks!
... View more
03-09-2015
01:20 PM
host UF WMI
serverA 54332 0
serverB 906 221
server32 332 0
server5 0 3432
I want to change this to-
host UF WMI Both
serverA Yes no
serverB 0 0 Yes
server32 Yes 0
server5 0 Yes
... View more
03-09-2015
12:57 PM
thank you! however, for some reason this did not work to well for me. I think it may be because im counting the number of logs for each sourcetype. that's why i think i need to do where count >1 output yes IF 0 output no IF >1 for both then have another Column say Both. would this be possible?
... View more
03-09-2015
12:24 PM
it looks like it was because the file was renamed and added a few times throwing things off. I deleted the files i didn't need in Splunk and that seemed to have solved my problem.
The Directory had two files in it but, Splunk was seeing 4. Ill admit i don't fully understand why the time was getting messed up but everything seems back to normal.
thank you for your time and input rich.
... View more
03-09-2015
12:11 PM
this was a data export error. Splunk was not creating this issue.
... View more
03-09-2015
12:09 PM
1 Karma
i want to get a list of servers that are reporting into splunk via UF or WMI or both, i have this going for me, but i want to add something to it that would show if count count for WMI is >1 then yes , if count for UF is >1 then yes, If count on UF and WMI >1 then both. would this be possible? I'm not sure how to do where count equals in Splunk yet.
sourcetype=WinEventLog OR sourcetype=WMI:WinEventLog [|inputlookup wmi.csv | fields WIM | rename WIM as host] |chart count(eval(sourcetype="WinEventLog")) as UF,count(eval(sourcetype="WMI:WinEventLog")) as WMI by host
... View more
03-06-2015
11:41 AM
is there a XML setting i do not know about because bar graphs show the current month stats and when i pic line, they only show the past months. it looks like its cutting it off.
search:
index=foo host="foofoo" "foofoofoo"=Yes| timechart span=1mon count(this) by "thisfoo"
XML:
<panel>
<chart>
<title> Title</title>
<searchString>index=foo host="foofoo" "foofoofoo"=Yes| timechart span=1mon count(this) by "thisfoo""</searchString>
<earliestTime>$time.earliest$</earliestTime>
<latestTime>$time.latest$</latestTime>
<option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
<option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
<option name="charting.axisTitleX.visibility">visible</option>
<option name="charting.axisTitleY.visibility">visible</option>
<option name="charting.axisTitleY2.visibility">visible</option>
<option name="charting.axisX.scale">linear</option>
<option name="charting.axisY.scale">linear</option>
<option name="charting.axisY2.enabled">false</option>
<option name="charting.axisY2.scale">inherit</option>
<option name="charting.chart">column</option>
<option name="charting.chart.nullValueMode">gaps</option>
<option name="charting.chart.sliceCollapsingThreshold">0.01</option>
<option name="charting.chart.stackMode">default</option>
<option name="charting.chart.style">shiny</option>
<option name="charting.drilldown">all</option>
<option name="charting.layout.splitSeries">0</option>
<option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
<option name="charting.legend.placement">right</option>
</chart>
</panel>
<panel>
... View more
03-03-2015
01:23 PM
it looks like it was because the file was renamed and added a few times throwing things off. I dleted the files i didn't need in Splunk and that seemed to have solved my problem.
The Directory had two files in it bu,t Splunk was seeing 4. Ill admit i don't fully understand why the time was getting messed up but everything seems back to normal.
thank you for your time and input!
... View more
03-03-2015
08:57 AM
would there bee a way to force splunk to use a date to avoid this?
... View more
03-03-2015
08:54 AM
a new csv file was added, it has the same formatting.
... View more
03-03-2015
08:11 AM
im not getting any new logs into splunk after i set up a new input "file monitor". the CSV has no time stamps so splunk should see the creation date of the file? has anyone ran into this before?
This input worked once and now its not getting this error-
splunkd log-
03-03-2015 09:23:11.015 -0500 WARN DateParserVerbose - A possible timestamp match (Fri Mar 18 23:01:49 2005) is outside of the acceptable time window. If this timestamp is correct, consider adjusting MAX_DAYS_AGO and MAX_DAYS_HENCE. Context: source::\\fileserver\file.CSV|host::list|csv|101514
[monitor://\\fileserver\file]
disabled = false
followTail = 1
host = list
index = index1
crcSalt = <SOURCE>
sourcetype = csv
... View more
03-02-2015
12:53 PM
sorry, you are correct.
thanks for the help!
... View more
03-02-2015
12:21 PM
when the ra_date_fulfilled is the same as the request_date it defaults it to 31 days. is there a way to get to say 1 day?
... View more
03-02-2015
11:54 AM
THANKS!!!!
host=Access_Admin |Rename "Remote Access Date Fulfilled" AS "ra_date_fulfilled" | Rename"R_Drive Date Fulfilled" AS "rdrive_date_fulfilled" | Rename "Request Date" AS "request_date" | eval ra_date_fulfilled_epoch=strptime(ra_date_fulfilled, "%m/%d/%Y") | eval rdrive_date_fulfilled_epoch=strptime(rdrive_date_fulfilled, "%m/%d/%Y") | eval request_date_epoch=strptime(request_date, "%m/%d/%Y") | eval fulfill_date_epoch=max(ra_date_fulfilled_epoch,rdrive_date_fulfilled_epoch) | eval duration=fulfill_date_epoch -request_date_epoch | eval "days open"=strftime(duration,"%d") | table ra_date_fulfilled rdrive_date_fulfilled request_date "days open"
... View more
03-02-2015
11:03 AM
This is awesome but, i have a few questions,
1.I need to use the latest date between "Remote Access Date Fulfilled" and "R_Drive Date Fulfilled" since it could be one or the other but it has to be the latest date, "Remote Access Date Fulfilled" and "R_Drive Date Fulfilled" could be in the same log for example: "Remote Access Date Fulfilled" may have been completed on 2/25/15 and "R_Drive Date Fulfilled" was done on 2/28/15 meaning i would need to use "R_Drive Date Fulfilled" and find how many day this was open for by the "Request Date" field.
request_date is not the "_time" field. How would i change results showing like this 1424926800.000000 to a human readable formant?
... View more
03-02-2015
09:51 AM
Splunk support helped me out on this, i had to add the stanza on the heavy forwarder and not the indexers
[host::<yourHost>]
TIME_PREFIX = ^1\s
TIME_FORMAT = %Y-%m-%dT%H:%M:%S.%3NZ
MAX_TIMESTAMP_LOOKAHEAD = 30
thanks everyone for helping me out!
... View more
03-02-2015
09:49 AM
I have three fields "Request Date" , "Remote Access Date Fulfilled" and "R_Drive Date Fulfilled". I need to find how many days open a request was but, i need to use the latest date between "Remote Access Date Fulfilled" and "R_Drive Date Fulfilled" since it could be one or the other. the dates are in month/day/year "2/26/2015" with no time. I'm not sure how to build out this search or what eval statements to use.
... View more
02-19-2015
01:12 PM
I have tried a few different things in props.conf right now i have it set as-
MAX_TIMESTAMP_LOOKAHEAD=150
NO_BINARY_CHECK=1
TIME_PREFIX=\1\s
I have also tried changing the time zone with no luck. Also, it should be EST.
... View more
02-19-2015
12:38 PM
not sure if the will make sense but, i built it out a little differently and it works, i named the fileds in the CSV's the same that i need to compare counts-
[|inputlookup ipsav.csv] index=summaryindex host=host1 | timechart count | Rename count As "total count of host1" | appendcols[search [|inputlookup ipsav.csv] index=summaryindex host=host1 OR host=host2 |stats count by "FIELD NAMED THE SAME IN BOTH HOSTS"| Where count = 1 | stats count | Rename count as " show count if the count is only one"]
thanks for the help guys.
... View more
02-19-2015
12:31 PM
1 Karma
Splunk is not showing the correct time that logs are coming in. They are behind by five hours. The time on the server is correct and so are the logs themselves, but Splunk's time is not correct.
My log that splunk is saying came in at 10:29AM-
1 2015-02-19T15:20:29.916Z Alert - "SOME TEXT FROM LOG" timestamp="2015-02-19 15:17:43 EST" LOGSTUFF="Logout completed by user from 8.8.8.8"
I have made changes to the props.conf files on our indexers with no luck. Any one run into this issue before?
... View more
02-02-2015
05:54 PM
still getting odd results-
|timechart count(eval RISK=4) as "High" count(eval RISK=5) as "Severe" by SUBCATEGORY useother=f usenull=f gave me a chart however it did not count anything, all the results were 0.
|eval RISK=case(RISK==4,"High",RISK==5,"Severe") |timechart count by RISK, SUBCATEGORY useother=f usenull=f gave me "Error in 'timechart' command: The argument 'SUBCATEGORY' is invalid."
Thanks for the help!
... View more
- « Previous
- Next »
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:03 AM
|
Karma from
Karma given to
| User | Karma Count |
|---|---|
| 2 | |
| 1 | |
| 1 | |
| 1 | |
| 1 |
