Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About rakes568
rakes568
Explorer
Member since:
04-27-2017
06-05-2020
Community Statistics
| Posts | 26 |
| Solutions | 0 |
| Karma Given | 2 |
| Karma Received | 2 |
| Member Since | 04-27-2017 |
Activity Feed
- Got Karma for How to calculate uptime percentage based on my data?. 06-28-2020 02:26 AM
- Got Karma for Published an app to Splunkbase but I can't install it to Splunk Cloud. Why?. 06-05-2020 12:49 AM
- Karma Re: Splunk displays incorrect location on using iplocation for mattymo. 06-05-2020 12:48 AM
- Karma Re: Join two searches based on a condition for woodcock. 06-05-2020 12:48 AM
- Posted Re: Published an app to Splunkbase but I can't install it to Splunk Cloud. Why? on All Apps and Add-ons. 09-21-2017 03:06 PM
- Posted Published an app to Splunkbase but I can't install it to Splunk Cloud. Why? on All Apps and Add-ons. 09-20-2017 11:20 PM
- Tagged Published an app to Splunkbase but I can't install it to Splunk Cloud. Why? on All Apps and Add-ons. 09-20-2017 11:20 PM
- Tagged Published an app to Splunkbase but I can't install it to Splunk Cloud. Why? on All Apps and Add-ons. 09-20-2017 11:20 PM
- Posted Re: How to calculate uptime percentage based on my data? on Splunk Search. 07-26-2017 12:22 AM
- Posted How to calculate uptime percentage based on my data? on Splunk Search. 07-24-2017 10:33 AM
- Tagged How to calculate uptime percentage based on my data? on Splunk Search. 07-24-2017 10:33 AM
- Posted Re: Plot step function to display state change of machines based on timestamp? on Splunk Search. 07-13-2017 08:51 AM
- Posted Plot step function to display state change of machines based on timestamp? on Splunk Search. 07-13-2017 05:05 AM
- Tagged Plot step function to display state change of machines based on timestamp? on Splunk Search. 07-13-2017 05:05 AM
- Tagged Plot step function to display state change of machines based on timestamp? on Splunk Search. 07-13-2017 05:05 AM
- Posted How to plot a line graph to display state change of machines based on timestamp? on Splunk Search. 07-11-2017 12:37 PM
- Tagged How to plot a line graph to display state change of machines based on timestamp? on Splunk Search. 07-11-2017 12:37 PM
- Tagged How to plot a line graph to display state change of machines based on timestamp? on Splunk Search. 07-11-2017 12:37 PM
- Tagged How to plot a line graph to display state change of machines based on timestamp? on Splunk Search. 07-11-2017 12:37 PM
- Posted Re: Join two searches based on a condition on Splunk Search. 06-23-2017 07:38 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 1 | |||
| 1 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
09-21-2017
03:06 PM
This is not a custom app. Our app is already present in splunkbase. I just want to install it on my splunk cloud.
... View more
09-20-2017
11:20 PM
1 Karma
I have created a splunk app and uploaded it on splunkbase. We can install this app on Splunk Enterprise. But on trying to install it on splunk cloud from Apps -> Browse more apps -> , it displays this message:
This app is not yet certified for Splunk Cloud. Please file a support case to request this app.
How can I get this certification? Is this certification available for free?
Also is there a way to manually install an app downloaded directly from Splunkbase?
... View more
07-26-2017
12:22 AM
It's not on a regular basis. It gets reported only when status changes. But there can also be some cases, when two status consecutively received are Up(or Down).
... View more
07-24-2017
10:33 AM
1 Karma
Lets say my data is like this:
8/27/12 10:30:00.000 AM server=test1 and status=Down
8/27/12 10:29:00.000 AM server=test2 and status=Up
8/27/12 10:28:00.000 AM server=test3 and status=Down
8/27/12 10:27:00.000 AM server=test4 and status=Up
8/27/12 10:26:00.000 AM server=test1 and status=Up
8/27/12 10:25:00.000 AM server=test2 and status=Down
8/27/12 10:24:00.000 AM server=test3 and status=Up
8/27/12 10:23:00.000 AM server=test4 and status=Down
I want to calculate total uptime % for each server using total uptime(sum of all time differences between up status and next down status) divided by the total time starting when Splunk receives the first status message for a server.
... View more
07-13-2017
08:51 AM
I need exact timestamp, that's why I used chart instead of timchart. How will column chart help? It displays a bunch of bars with value of 1, and doen't make any sense.
... View more
07-13-2017
05:05 AM
We have a list of machines in our system with their state change as On or Off along with timestamp.
2017-07-11 12:39:01 M1 Up
2017-07-11 12:25:39 M2 Down
2017-07-11 10:58:27 M1 Down
2017-07-11 10:44:32 M3 Down
2017-07-11 10:27:33 M3 Up
2017-07-11 09:47:52 M3 Down
I want to plot a step function of State change for all machines based on timestamp. I tried this query, but this just connects Up/Down states with slant lines, instead of creating a step function.
mysearch| eval State=if(state="Up",1,0) | chart max(State) as StateChange by _time,machine
I am using linechart for visualization. So can we create a step function visualization? Also is there a way to display StateChange as Up/Down instead of 1/0 in visualization?
... View more
07-11-2017
12:37 PM
We have a list of machines in our system with their state change as On or Off along with timestamp.
2017-07-11 12:39:01 M1 Up
2017-07-11 12:25:39 M2 Down
2017-07-11 10:58:27 M1 Down
2017-07-11 10:44:32 M3 Down
2017-07-11 10:27:33 M3 Up
2017-07-11 09:47:52 M3 Down
Is there a way to plot a line graph of state change for all machines based on their timestamp?
I tried following query using timechart, but it displays dotted values with 0 and 1, instead of a continuous linechart.
mysearch| eval State=if(state="Up",1,0) | timechart span=5m max(State) by machine
... View more
06-23-2017
07:38 AM
Hey thanks for answering. Unfortunately this got posted by mistake, while I was editing the question. Please see this https://answers.splunk.com/answers/550677/join-two-searches-based-on-a-condition-2.html for complete question. Your answer looks good, but I need a bit more than that. Can you go to another link and fix your answer? I'd appreciate that. I am going to delete this post.
... View more
06-23-2017
05:45 AM
Splunk had join function since long time. Problem is, searches can be joined only on a field, but I want to pass a condition to it. Please read the complete question. I can clarify the question more if you want.
... View more
06-23-2017
02:27 AM
We have two kind of logs for our system:
First one logs all the user sessions with user name, src ip, dst ip, and login/logout time.
Jun 22 10:11:00 : UserSession: User=user1, SRC=192.168.0.1, Login=2017-06-22 10:00:00, Logout=2017-06-22 10:10:00
Jun 22 10:21:00 : UserSession: User=user2, SRC=192.168.0.2, Login=2017-06-22 10:11:00, Logout=2017-06-22 10:20:00
Jun 22 10:31:00 : UserSession: User=user3, SRC=192.168.0.1, Login=2017-06-22 10:21:00, Logout=2017-06-22 10:30:00
Jun 22 10:41:00 : UserSession: User=user1, SRC=192.168.0.1, Login=2017-06-22 10:31:00, Logout=2017-06-22 10:40:00
Jun 22 10:51:00 : UserSession: User=user1, SRC=192.168.0.4, Login=2017-06-22 10:41:00, Logout=2017-06-22 10:50:00
SRC IP above comes from a pool, and can be reassigned to another user, if it's not being used by anyone else at the time.
Another log is from IPTable, and lets say logs src and dst ip for each tcp connection for all users between their login/logout time.
1. Jun 22 10:04:00 Iptable: SRC=192.168.0.1 DST=10.0.0.10
2. Jun 22 10:06:00 Iptable: SRC=192.168.0.1 DST=10.0.0.10
3. Jun 22 10:09:00 Iptable: SRC=192.168.0.1 DST=10.0.0.11
4. Jun 22 10:15:00 Iptable: SRC=192.168.0.2 DST=10.0.0.12
5. Jun 22 10:25:00 Iptable: SRC=192.168.0.1 DST=10.0.0.13
6. Jun 22 10:35:00 Iptable: SRC=192.168.0.1 DST=10.0.0.13
7. Jun 22 10:44:00 Iptable: SRC=192.168.0.4 DST=10.0.0.10
8. Jun 22 10:45:00 Iptable: SRC=192.168.0.4 DST=10.0.0.14
Now I want to correlate these two logs on SRC, and get a table with number of src to dst ip connections for each user. Note that each connection is valid only between login and logout time.
So query should be something like:
join UserSession Iptable where UserSession.SRC == Iptable.SRC and (Iptable._time>Login and Iptable._time and then calculate Num_connections as unique set of User,SRC,DST.
Finally, I should get connection stats like this:
User SRC DST Num_connections
user1 192.168.0.1 10.0.0.10 3 (IPTable logs 1,2 and 7 connections belong here)
user1 192.168.0.1 10.0.0.11 1 (IPTable log 3)
user1 192.168.0.1 10.0.0.14 1 (IPTable log 😎
user2 192.168.0.2 10.0.0.12 2 (IPTable logs 4,5)
user3 192.168.0.1 10.0.0.13 1 (IPTable log 6)
I have been scratching my head over this since last few days, and I couldn't find any doc on joining based on a specific condition. Any help is appreciated.
... View more
06-23-2017
02:23 AM
Hi, We have two kind of logs for our system:
First one logs all the user sessions with user name, src ip, dst ip, and login/logout time.
Jun 22 10:11:00 : UserSession: User=user1, SRC=192.168.0.1, Login=2017-06-22 10:00:00, Logout=2017-06-22 10:10:00
Jun 22 10:21:00 : UserSession: User=user2, SRC=192.168.0.2, Login=2017-06-22 10:11:00, Logout=2017-06-22 10:20:00
Jun 22 10:31:00 : UserSession: User=user3, SRC=192.168.0.1, Login=2017-06-22 10:21:00, Logout=2017-06-22 10:30:00
Jun 22 10:41:00 : UserSession: User=user1, SRC=192.168.0.1, Login=2017-06-22 10:31:00, Logout=2017-06-22 10:40:00
Jun 22 10:51:00 : UserSession: User=user1, SRC=192.168.0.4, Login=2017-06-22 10:41:00, Logout=2017-06-22 10:50:00
SRC IP above comes from a pool, and can be reassigned to another user, if it's not being used by anyone else at the time.
Another log is from IPTable, and lets say logs src and dst ip for each tcp connection for all users between their login/logout time.
1. Jun 22 10:04:00 Iptable: SRC=192.168.0.1 DST=10.0.0.10
2. Jun 22 10:06:00 Iptable: SRC=192.168.0.1 DST=10.0.0.10
3. Jun 22 10:09:00 Iptable: SRC=192.168.0.1 DST=10.0.0.11
4. Jun 22 10:15:00 Iptable: SRC=192.168.0.2 DST=10.0.0.12
5. Jun 22 10:25:00 Iptable: SRC=192.168.0.1 DST=10.0.0.13
6. Jun 22 10:35:00 Iptable: SRC=192.168.0.1 DST=10.0.0.13
7. Jun 22 10:44:00 Iptable: SRC=192.168.0.4 DST=10.0.0.10
8. Jun 22 10:45:00 Iptable: SRC=192.168.0.4 DST=10.0.0.14
Now I want to correlate these two logs on SRC, and get a table with number of src to dst ip connections for each user. Not that each connection is valid only between login and logout time.
So query should be something like:
join UserSession Iptable where UserSession.SRC == Iptable.SRC and (Iptable._time>Login and Iptable._time
... View more
06-17-2017
10:48 PM
I have data like this:
Item1 Item2 Status
A B On
C D Off
Now I want to generate an email alert if this search result changes over last 5 minutes. For example:
1. If status of any two items already present in search result changes, generate an alert.
2. If a new row gets added, generate an alert.
3. If a rwo gets deleted, generate an alert.
... View more
06-07-2017
02:03 PM
Hi, We are using free version of Splunk cloud. We want to migrate to Splunk enterprise(free). Is there a way to migrate all my data to Splunk enterprise?
... View more
Labels
- Labels:
-
license
06-04-2017
10:11 AM
Thanks. Works perfectly after updating Splunk.
... View more
06-04-2017
02:55 AM
On using iplocation, Splunk returns incorrect coordinates for an IP, and displays location incorrectly on map with geostats.
For IP 52.43.227.70, it returns coordinates 39.56450, -75.59700.
Whereas actual coordinates for IP address 52.43.227.70 using infosnipper.net (or any other online APIs for that matter) are 45.8696, -119.688, and location is in Oregon region.
Has anyone seen this issue?
... View more
05-15-2017
01:29 AM
Hey thanks. I was able to publish my app after fixing a small issue(missing description from app.conf). I can see and manage my app from Splunkbase now. However I cant find my app on searching for relavant keywords in my Splunk enterprise, Apps->Find More Apps. Do I need to do something to add my app in the search results?
... View more
05-11-2017
12:32 PM
Thanks for your prompt response. I have checked my conf files, and there doesn't seem to be any syntax error. I also validated my xml files with $SPLUNK_HOME/bin/splunk cmd python validate_all.py. Is there any other way to upload app on Splunkbase(cli maybe?) which will give proper error message? Could you please update your answer once bug on Splunkbase is fixed? I'd appreciate that. Thanks.
... View more
05-11-2017
11:00 AM
We have created a Splunk app for our products which has couple of dashboards, and are trying to upload our app on Splunkbase.
I went through this link: http://dev.splunk.com/view/webframework-developapps/SP-CAAAEMY
And after preparing and packaging app, I submitted the .spl packaged app to Splunkbase: https://splunkbase.splunk.com/develop/
Unfortunately, it's stuck in validation process for more than 24 hours now, and clicking on Continue gives error as expected.
See attachment for reference
I am not sure what's taking that long. Can someone please help us understand what's the issue here?
... View more
- Tags:
- app
- package
- splunkbase
05-03-2017
05:56 AM
I have two kinds of logs
sourcetype = abc IP = a.b.c.d status=active
sourcetype = abc IP = a.b.c.e status=active
sourcetype = abc IP = a.b.c.f status=active
sourcetype = abc IP = x.x.x.x status=inactive
sourcetype = abc IP = a.b.c.d status=inactive
I want to get a list of IP with status=active, but IP with whose status has changed to inactive should get filtered out.
Like in the example output should be:
a.b.c.e
a.b.c.f
... View more
04-27-2017
01:24 PM
This won't work because there are no events with both DST_IP and Hostname present together.
... View more
04-27-2017
01:17 PM
Please see my comment on cmerriman's answer.
... View more
04-27-2017
01:16 PM
Seems like a neat trick, but it doesn't output anything. Are you sure we can search on stats output?
... View more
04-27-2017
11:46 AM
Coalescing will return all the data with SRC in S1 and SRC_IP in S2. In this case, some of the SRC_IP in S2 might not be present in S1(as SRC), so they won't have Hostname values either. So current output as per your search query results in a table with few rows having empty Hostname. I want a subset of SRC/SRC_IP which are present in both sourcetypes, and get corresponding DST_IP and Hostname. I think someone changed question's title, so it looks otherwise.
... View more
04-27-2017
09:56 AM
New to Splunk.
Suppose I have two sets of data in separate sourcetypes S1 and S2.
S1:
SRC Hostname Field1 Field2
S2:
SRC_IP DST_IP
Now SRC in S1 and SRC_IP in S2 may contain some common values. I want to create a table of SRC_IP, DST_IP and Hostname where S1.SRC==S2.SRC_IP.
I understand that I need to use join with subsearch.
I wrote this search:
sourcetype=S1 | join SRC [search sourcetype=S2 | rename SRC_IP AS SRC]
But this just results in S1 data where S1.SRC==S2.SRC_IP. How can I add Hostname field to it, and create a table from the 3 mentioned fields?
... View more
