Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About jhampton3rd
jhampton3rd
Explorer
Member since:
07-24-2014
06-05-2020
Community Statistics
| Posts | 18 |
| Solutions | 0 |
| Karma Given | 0 |
| Karma Received | 3 |
| Member Since | 07-24-2014 |
Activity Feed
- Got Karma for Re: How do you calculate a percentage from a lookup table?. 06-05-2020 12:49 AM
- Got Karma for Re: How to modify my dashboard design so that it displays all sourcetypes and their current status in one column?. 06-05-2020 12:48 AM
- Got Karma for Help with regex search. 06-05-2020 12:47 AM
- Posted Re: How do you calculate a percentage from a lookup table? on Splunk Search. 09-19-2018 12:46 PM
- Posted Re: How do you calculate a percentage from a lookup table? on Splunk Search. 09-19-2018 12:45 PM
- Posted Re: How do you calculate a percentage from a lookup table? on Splunk Search. 09-19-2018 12:44 PM
- Posted How do you calculate a percentage from a lookup table? on Splunk Search. 09-18-2018 07:28 AM
- Tagged How do you calculate a percentage from a lookup table? on Splunk Search. 09-18-2018 07:28 AM
- Tagged How do you calculate a percentage from a lookup table? on Splunk Search. 09-18-2018 07:28 AM
- Tagged How do you calculate a percentage from a lookup table? on Splunk Search. 09-18-2018 07:28 AM
- Posted LDAP Search Query Error Messages - Error Code 1. on All Apps and Add-ons. 10-25-2017 08:07 AM
- Tagged LDAP Search Query Error Messages - Error Code 1. on All Apps and Add-ons. 10-25-2017 08:07 AM
- Tagged LDAP Search Query Error Messages - Error Code 1. on All Apps and Add-ons. 10-25-2017 08:07 AM
- Posted Re: How to edit my search to display my results in a trendline? on Splunk Search. 01-30-2017 09:13 AM
- Posted Re: How to edit my search to display my results in a trendline? on Splunk Search. 01-23-2017 02:46 PM
- Posted How to edit my search to display my results in a trendline? on Splunk Search. 01-10-2017 08:29 AM
- Tagged How to edit my search to display my results in a trendline? on Splunk Search. 01-10-2017 08:29 AM
- Tagged How to edit my search to display my results in a trendline? on Splunk Search. 01-10-2017 08:29 AM
- Tagged How to edit my search to display my results in a trendline? on Splunk Search. 01-10-2017 08:29 AM
- Tagged How to edit my search to display my results in a trendline? on Splunk Search. 01-10-2017 08:29 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 1 |
09-19-2018
12:46 PM
Thanks for your help. You helped me eventually come up with the correct query.
... View more
09-19-2018
12:45 PM
1 Karma
Thanks for your help. You helped me eventually come up with the correct query.
... View more
09-19-2018
12:44 PM
I would like to thank everyone that assisted. Your queries helped me get to where I needed to be. Ultimately, I wanted to see the overall percentage over a 6 month period. Here's the final query that seems to be working.
|inputcsv audit_check.csv
| rename Time as _time
| timechart span=1w count(User) as count
| eval count=if(count>=1,"1", count)
| stats sum(count) as counttotal, count as totalcount
| eval perc=round((counttotal/totalcount)*100,2)
| fields perc
... View more
09-18-2018
07:28 AM
I have a lookup table that is written to when a user clicks on a button to confirm that they have checked logs on a dashboard. In the lookup table, these are the fields that are available and how the values are written to the CSV file.
Time | User
1521641008 john.doe@splunk.com
1521641345 jane.doe@splunk.com
1521641376 john.doe@splunk.com
1521641456 john.doe@splunk.com
1521727607 john.doe@splunk.com
1523969108 jane.doe@splunk.com
I want to check to verify that a user has checked logs per week over a span of time (lets say 6 months). I want to see how many times the logs were checked and give a percentage.
I've gotten to this point in my search but I'm unable to figure this out. I'm running this search over a the last 6 months
| inputcsv audit_check.csv
| rename Time as _time
| timechart span=1w count(User)
| addcoltotals
I get the following
_time | count(User)
2018-03-01 0
2018-03-08 0
2018-03-15 4
2018-03-22 1
2018-03-29 0
2018-04-05 0
etc......
5
So anything over 1 is considered checked. 0 is considered not checked. I'd like to get the percentage of successful audit checks per week over the 6 month period.
Thanks for your help.
... View more
10-25-2017
08:07 AM
After running the following query:
| ldapsearch domain=**mydomain** basedn="ou=,dc=**mydomain**,dc=local" search="(objectclass=group)" attrs="cn,description,primaryGroupToken"
| eval joiner=mvappend(dn,primaryGroupToken)
| rename dn as groupDN,cn as groupName,primaryGroupToken as primaryGroupID
| table groupDN,groupName,primaryGroupID,joiner
| mvexpand joiner
| join type=inner joiner
[ ldapsearch domain=**mydomain** basedn="ou=,dc=**mydomain**,dc=local" search="(sAMAccountName=*)" attrs="memberOf,primaryGroupID"
| eval joiner=mvappend(memberOf,primaryGroupID)
| table joiner
| mvexpand joiner]
| dedup groupDN
| table groupDN,groupName,primaryGroupID
| sort primaryGroupID
I receive the following error messages with no results found:
External search command 'ldapsearch' returned error code 1. Script output = " ERROR Cannot find the configuration stanza for domain=mydomain in ldap.conf. "
[drspkil01.mydomain.local] External search command 'ldapsearch' returned error code 1. Script output = " ERROR "KeyError at ""/opt/splunk/var/run/searchpeers/wdcspkesl01.mydomain.local-1508941844/apps/SA-ldapsearch/bin/packages/splunklib/client.py"", line 1653 : u'ldap'" "
[drspkil02.mydomain.local] External search command 'ldapsearch' returned error code 1. Script output = " ERROR "KeyError at ""/opt/splunk/var/run/searchpeers/wdcspkesl01.mydomain.local-1508941844/apps/SA-ldapsearch/bin/packages/splunklib/client.py"", line 1653 : u'ldap'" "
[drspkil03.mydomain.local] External search command 'ldapsearch' returned error code 1. Script output = " ERROR "KeyError at ""/opt/splunk/var/run/searchpeers/wdcspkesl01.mydomain.local-1508941844/apps/SA-ldapsearch/bin/packages/splunklib/client.py"", line 1653 : u'ldap'" "
[subsearch]: External search command 'ldapsearch' returned error code 1. Script output = " ERROR Cannot find the configuration stanza for domain=mydomain in ldap.conf. "
[subsearch]: [drspkil01.mydomain.local] External search command 'ldapsearch' returned error code 1. Script output = " ERROR "KeyError at ""/opt/splunk/var/run/searchpeers/wdcspkesl01.mydomain.local-1508941844/apps/SA-ldapsearch/bin/packages/splunklib/client.py"", line 1653 : u'ldap'" "
[subsearch]: [drspkil02.mydomain.local] External search command 'ldapsearch' returned error code 1. Script output = " ERROR "KeyError at ""/opt/splunk/var/run/searchpeers/wdcspkesl01.mydomain.local-1508941844/apps/SA-ldapsearch/bin/packages/splunklib/client.py"", line 1653 : u'ldap'" "
[subsearch]: [drspkil03.mydomain.local] External search command 'ldapsearch' returned error code 1. Script output = " ERROR "KeyError at ""/opt/splunk/var/run/searchpeers/wdcspkesl01.mydomain.local-1508941844/apps/SA-ldapsearch/bin/packages/splunklib/client.py"", line 1653 : u'ldap'" "
[subsearch]: [wdcspkil01.mydomain.local] External search command 'ldapsearch' returned error code 1. Script output = " ERROR "KeyError at ""/opt/splunk/var/run/searchpeers/wdcspkesl01.mydomain.local-1508941844/apps/SA-ldapsearch/bin/packages/splunklib/client.py"", line 1653 : u'ldap'" "
[subsearch]: [wdcspkil02.mydomain.local] External search command 'ldapsearch' returned error code 1. Script output = " ERROR "KeyError at ""/opt/splunk/var/run/searchpeers/wdcspkesl01.mydomain.local-1508941844/apps/SA-ldapsearch/bin/packages/splunklib/client.py"", line 1653 : u'ldap'" "
[subsearch]: [wdcspkil03.mydomain.local] External search command 'ldapsearch' returned error code 1. Script output = " ERROR "KeyError at ""/opt/splunk/var/run/searchpeers/wdcspkesl01.mydomain.local-1508941844/apps/SA-ldapsearch/bin/packages/splunklib/client.py"", line 1653 : u'ldap'" "
[wdcspkil01.mydomain.local] External search command 'ldapsearch' returned error code 1. Script output = " ERROR "KeyError at ""/opt/splunk/var/run/searchpeers/wdcspkesl01.mydomain.local-1508941844/apps/SA-ldapsearch/bin/packages/splunklib/client.py"", line 1653 : u'ldap'" "
[wdcspkil02.mydomain.local] External search command 'ldapsearch' returned error code 1. Script output = " ERROR "KeyError at ""/opt/splunk/var/run/searchpeers/wdcspkesl01.mydomain.local-1508941844/apps/SA-ldapsearch/bin/packages/splunklib/client.py"", line 1653 : u'ldap'" "
[wdcspkil03.mydomain.local] External search command 'ldapsearch' returned error code 1. Script output = " ERROR "KeyError at ""/opt/splunk/var/run/searchpeers/wdcspkesl01.mydomain.local-1508941844/apps/SA-ldapsearch/bin/packages/splunklib/client.py"", line 1653 : u'ldap'" "
Can't seem to figure out how to fix this error message. Thanks in advance for your help.
... View more
01-30-2017
09:13 AM
Thanks DalJeanis,
I think I'm going to try sending the results to a .csv file. I believe this will be the easiest approach. Just trying to get that to work since this will be the first time I've done this. Thanks for the suggestions though. Still wasn't able to get the query to produce a trendline.
... View more
01-23-2017
02:46 PM
I'll be trying these suggestions tomorrow when I get back to the office. Thanks for everyone's input. Was away for a couple of weeks.
... View more
01-10-2017
08:29 AM
I'm trying to graph this same type of trendline (2nd Screenshot) in Splunk with daily results from 12pm-12pm. I'm using the following search which gives me my results per 24 hours (1st screenshot) but I'm unable to find the trendline command to give me results like in the 2nd screenshot:
index=#### sourcetype=#####
| lookup csirt_asset_list ip OUTPUT sublocation
| search hasBeenMitigated=0 sublocation=*
| stats dc(ip) as Total1 by sublocation
| join [ search index=#### sourcetype=##### pluginID<1000000 baseScore>0
| lookup csirt_asset_list ip OUTPUT sublocation
| search hasBeenMitigated=0 sublocation=*
| stats dc(ip) as Total2 by sublocation]
| join [search index=#### sourcetype=##### pluginID<1000000 baseScore>0
| lookup csirt_asset_list ip OUTPUT sublocation
| search hasBeenMitigated=0 sublocation=*
| stats count as counted by baseScore, sublocation
| fields + sublocation, baseScore, counted
| sort-baseScore
| lookup weight_lookup baseScore OUTPUT wmultiplier
| eval aaa=(counted * wmultiplier)
| eventstats sum(aaa) as test1, sum(counted) as test2
| eval bbb=(test1 / test2)
| eval bbb=round(bbb,2)]
| eval cvss_overall_score=bbb*(Total2/Total1)
| stats last(cvss_overall_score) by sublocation
Thanks for your help.
... View more
09-26-2016
08:21 AM
1 Karma
Thanks everyone for your help. Was able to use everything you guys answered with to come up with the following fix:
| eval timeDiff = now()-latest
| eval status=case(timeDiff>=1 AND timeDiff<=1800, "RUNNING",timeDiff>=1801, "DOWN", timeDiff<=0, "OFFLINE")
| fields host, sourcetype, status
| chart count by sourcetype status
| eval state=case(RUNNING>0 AND DOWN<=0,"RUNNING",DOWN>0, "DOWN",OFFLINE>0, "OFFLINE/EVENT IN THE FUTURE")
| fields sourcetype state
This did exactly what I was looking for. Thanks again
... View more
09-22-2016
08:15 AM
Thanks for the quick response. You definitely put me on the right path. I'm now trying to consolidate the two columns into one column.
... View more
09-22-2016
05:07 AM
I was able to almost get what I wanted. Instead of there being two columns, I would like for it to be just one column saying either "DOWN" or "RUNNING". I'm trying to figure out how to put a clause in this search where if the sourcetype status has a DOWN and RUNNING, it will display the word "DOWN". If sourcetype is RUNNING, it will display the word "RUNNING". If the sourcetype status is DOWN, it will display the word "DOWN" The reason it's showing like this in the screenshot, the sourcetypes has many hosts so there may be some hosts that are down and some that are running at the same time.
Here's the search string:
| tstats latest(_time) as latest WHERE index=* sourcetype!="*too_small" by host sourcetype | search ( OMMITTED )| eval timeDiff = now() - latest | eval status=case(timeDiff>=1 AND timeDiff<=1800, "RUNNING", timeDiff>=1801, "DOWN", timeDiff<=0, "OFFLINE")| table host, sourcetype, status | chart count by sourcetype status | eval RUNNING=if(RUNNING>0,"RUNNING",null()) | eval DOWN=if(DOWN>0,"DOWN",null()) | eval OFFLINE=if(OFFLINE>0,"OFFLINE/EVENT IN THE FUTURE",null())
Thanks for the help
... View more
09-20-2016
07:39 AM
I'm trying to redesign a dashboard that currently gives the status of certain sourcetypes. The dashboard is working but I'd like to change the format a little. Instead of the two columns showing how many sourcetypes that are up or down. I'd like just one column showing if all of the source types are running or if just one or more is down displaying "RUNNING", "DOWN" or OFFLINE/EVENT IN THE FUTURE".
Here's the search:
| tstats latest(_time) WHERE index=* sourcetype=* by index host sourcetype
| search sourcetype!="*too_small"
| search ( OMITTED )
| rename latest(_time) as latest
| eval unixTimeNow=now()
| eval timeDiff = unixTimeNow - latest
| eval timeDiff=if(timeDiff>=0, timeDiff, 0)
| eval status=case(timeDiff>= 1 AND timeDiff < 1800, "RUNNING",
timeDiff> 1801, "DOWN",
timeDiff=0, "OFFLINE/EVENT IN THE FUTURE")
| table host, sourcetype, timeDiff, status
| eventstats count(eval(status="RUNNING")) as up by sourcetype
| eventstats count(eval(status="DOWN")) as down by sourcetype
| stats values(up) as RUNNING, values(down) as DOWN by sourcetype
| rename sourcetype AS Sourcetype
| sort Sourcetype
I also want to keep the capability to click on either "RUNNING", "DOWN" OR "OFFLINE" to see the list of hosts that are or aren't reporting.
Thanks for your help.
... View more
09-13-2016
11:51 AM
Using regex to strip the first 12 characters fixed the issue. Thanks
... View more
09-13-2016
11:50 AM
Thanks!!!! This fixed the issue!!!
... View more
09-13-2016
11:49 AM
Thanks for your help. Using regex to peel the first 12 characters did the trick.
... View more
09-12-2016
06:37 AM
I have a dashboard that shows the status of certain logs reporting to Splunk. Within this dashboard, it also shows the last time an event was sent. Most of my log sources reports in 12 character Epoch time but I do have a few that reports in 18 character epoch time. For the ones that report in 18 characters, Splunk thinks that these events are happening in the future. Is there a way to fix this so that Splunk understands the 18 characters?
The source for the dashboard is the following:
| metadata index=* type=sourcetypes | stats max(lastTime) as lastEvent by sourcetype | convert ctime(*Event) | search sourcetype!="*too_small" | search ( **OMITTED** ) | eval LastEventEpoch = lastEvent | eval lastEventEpoch = strptime('lastEvent', "%m/%d/%Y %H:%M:%S") | eval nowEpoch=now() | eval diff = nowEpoch - lastEventEpoch| eval diff=if(diff>0, diff, 0) | eval status=case(diff >= 1 AND diff <=1800, "RUNNING", diff > 1801, "DOWN", diff=0, "OFFLINE/EVENT IN THE FUTURE") | sort - status| rename sourcetype AS Sourcetype, lastEvent AS "Last Seen Event", status AS Status | table Sourcetype, "Last Seen Event", Status
Thanks for your help
... View more
07-24-2014
02:45 PM
1 Karma
Good Afternoon,
I would like to use a regex search to get "Inbound TCP connection denied" and "High". What's the correct regex command to pull these out of the CEF event. Also, I'll eventually would like to create a table showing how many "High", "Medium", "Low" events show up in the last hour.
Jul 24 11:32:11 host-host-h05 CEF:0|CISCO|ASA||106001|Inbound TCP connection denied|High| eventId=1247891
Thanks for your help.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:03 AM
|
