Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About mahendra559
mahendra559
New Member
Member since:
02-29-2020
07-17-2020
Community Statistics
| Posts | 23 |
| Solutions | 0 |
| Karma Given | 0 |
| Karma Received | 0 |
| Member Since | 02-29-2020 |
Activity Feed
- Posted i want to exclude some field in the before indexing because i do not want to ingest fields into Splunk anymore. on Splunk Search. 07-16-2020 09:13 PM
- Posted how to write splunk query for average ingestion(GB) per sourcetype per day? on Splunk Cloud Platform. 06-17-2020 02:07 AM
- Posted Re: i need search query for status change hear when tha same status will come 2 times it will ignore 2nd event if other status will come it will generate the alert on Splunk Enterprise Security. 06-02-2020 05:12 AM
- Posted Re: i need search query for status change hear when tha same status will come 2 times it will ignore 2nd event if other status will come it will generate the alert on Splunk Enterprise Security. 06-01-2020 09:19 PM
- Posted How to create an alert that triggers when field value status changes? on Splunk Enterprise Security. 06-01-2020 08:18 AM
- Tagged How to create an alert that triggers when field value status changes? on Splunk Enterprise Security. 06-01-2020 08:18 AM
- Tagged How to create an alert that triggers when field value status changes? on Splunk Enterprise Security. 06-01-2020 08:18 AM
- Tagged How to create an alert that triggers when field value status changes? on Splunk Enterprise Security. 06-01-2020 08:18 AM
- Tagged How to create an alert that triggers when field value status changes? on Splunk Enterprise Security. 06-01-2020 08:18 AM
- Posted Re: i need search query for status change hear when tha same status will come 2 times it will ignore 2nd event if other status will come it will generate the alert on Splunk Enterprise Security. 05-31-2020 09:38 PM
- Posted Re: i need search query for status change hear when tha same status will come 2 times it will ignore 2nd event if other status will come it will generate the alert on Splunk Enterprise Security. 05-30-2020 02:02 AM
- Posted Re: how wrirte search query for status change on Splunk Enterprise Security. 05-29-2020 06:03 AM
- Posted how wrirte search query for status change on Splunk Enterprise Security. 05-29-2020 12:02 AM
- Tagged how wrirte search query for status change on Splunk Enterprise Security. 05-29-2020 12:02 AM
- Tagged how wrirte search query for status change on Splunk Enterprise Security. 05-29-2020 12:02 AM
- Tagged how wrirte search query for status change on Splunk Enterprise Security. 05-29-2020 12:02 AM
- Posted i need search query for status change hear when tha same status will come 2 times it will ignore 2nd event if other status will come it will generate the alert on Splunk Enterprise Security. 05-28-2020 03:52 AM
- Tagged i need search query for status change hear when tha same status will come 2 times it will ignore 2nd event if other status will come it will generate the alert on Splunk Enterprise Security. 05-28-2020 03:52 AM
- Tagged i need search query for status change hear when tha same status will come 2 times it will ignore 2nd event if other status will come it will generate the alert on Splunk Enterprise Security. 05-28-2020 03:52 AM
- Tagged i need search query for status change hear when tha same status will come 2 times it will ignore 2nd event if other status will come it will generate the alert on Splunk Enterprise Security. 05-28-2020 03:52 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
07-16-2020
09:13 PM
Hear is the below fields we want to exclude fields values action_flags 0x8000000000000000 action_source from-application app:is_saas no log_forwarding_profile Log to Panorama serial_number 43211001234 devicegroup_level1 14 below i wrote the props and transforms.conf but its not working properly can you please help me with the answer props.conf [sourcetype::pan:traffic] TRANSFORMS-null=setnull transforms.conf [setnull] REGEX=(\d{19})|(from-\w*)|(\d[a-z]\d{16})|(\w+\s\w+\s\w+-\w+)|([L]\w+\s\w+\s\w+)|(\d{12}) DEST_KEY=queue FORMAT=nullQueue
... View more
Labels
- Labels:
-
field extraction
-
fields
-
regex
06-17-2020
02:07 AM
When was the last time we ingested from this host? What is the average ingestion(GB) per sourcetype?
... View more
Labels
06-02-2020
05:12 AM
Hear my condition is we have a 8 status values is if status1 is the latest event then it compare with the up coming events like status2,status3 etc.... status8
If the latest status1==up coming status then no alarm raise
If the new(up coming status) latest status1!=up coming status then alarm raise
(every time it compare with the latest event to up coming event if latest and up coming events are same no alarm then alarm)
Thanks In Advance
... View more
06-01-2020
09:19 PM
Thanks for your answer but it didn't give any statistic value but it has given results in verbose mode i think we need to compare with latest status value and before that latest status value
if latest status and before latest value will be same no alarm raise if it is different alarm should be raise
EX: latest status=Extended recovery
before latest status= Investigation suspended
Extended recovery==Extended recovery (no alert)
Extended recovery== Investigation suspended (alert raise)
(Every time it pick the latest event and compare with all other event values if latest and coming events are same no alert , if latest and coming events are different then raise alert )
... View more
06-01-2020
08:18 AM
Actual requirement is when a status field value changes from one to another, an alert needs to be triggered. Below are the status field values:
Extended recovery
Investigation suspended
False-positive
Investigating
Service degradation
Service restored
Restoring service
Post-incident report published
Ex: If status field value changes from "false-positive" to "investigating" then alert should be triggered. If field value changes from "false-positive" to "false-positive" then no alert should be triggered.
... View more
Labels
05-31-2020
09:38 PM
Actual requirement is when status field values are changed from one to another alert needs to be triggered
below are the status field values
Extended recovery
Investigation suspended
False positive
Investigating
Service degradation
Service restored
Restoring service
Post-incident report published
Ex: if status field value from false positive to investigating then alert should be triggered
If field value false positive to false positive then no alert should be triggered.
Thanks in advance
... View more
05-30-2020
02:02 AM
Tanks for your answer to4kawa but its not giving any results
hear my requirement is:
if 22nd and 23rd is same status then it will pick 22nd event only
and then 23rd and 24th are different status at that time it will pick 23rd and 24th events as well
and 24th, 25th same status so it will pick 24th one only
(simply when ever status change at that time it will pick the event other wise it will not pick the same event again and again )
... View more
05-29-2020
06:03 AM
if 22nd and 23rd is same status then it will pick 22nd event only
and then 23rd and 24th are different status at that time it will pick 23rd and 24th events as well
and 24th, 25th same status so it will pick 24th one only
(simply when ever status change at that time it will pick the event other wise it will not pick the same event again and again )
... View more
05-29-2020
12:02 AM
hear if we have a multiple same status is there it will pick only first status event and if the different status events will come then it will pick the other status events how we can write the query for this
ex: status values and its dates False positive (25 may) False positive (24 may) Investigating (23 may) Investigating (22 may) Service degradation (21 may)
thanks
... View more
Labels
- Labels:
-
using Enterprise Security
05-28-2020
03:52 AM
event status : False positive (25 may) False positive (24 may) Investigating (23 may) Investigating (22 may) Service degradation (21 may)
Hear status changed Service degradation to investigating then alert wants to raised then status changed investigating to investigating then alert is not raised. then status changed from investigating to false positive then alert wants raised.
dash board query: index="mail_activity" sourcetype="service:message" DisplayName="Exchange Online" | eval myTimeNewEpoch=strptime(UpdatedTime,"%Y-%m-%dT%H:%M:%S") | eval UpdatedTime=strftime(myTimeNewEpoch,"%Y-%m-%d %H:%M:%S") | table LastUpdatedTime DisplayName Status Description | rename UpdatedTime as Time DisplayName as Application | sort -Time
please help me with the query to create the alert
Thanks in advance
... View more
Labels
- Labels:
-
Other
04-21-2020
02:42 AM
i have a field name is file_name in that field value is there
ex: file_name= Operating System-Linux-Server-Support-GENVE0001VA.gmail.com.au-GEN-Adm02
in this field i want to display only "GENVE0001VA.gmail.com.au" this value remaining value i dont want please let me know how to write regex in splunk search query
... View more
03-26-2020
10:58 PM
why we are using heatmap what are the usages any apps and add-ons to this
any example queries
... View more
Labels
- Labels:
-
using ITSI
03-19-2020
08:44 PM
I need ans this format please
... View more
03-19-2020
10:11 AM
25days convert to seconds and
difference with current time to seconds and display the difference time
... View more
03-17-2020
09:38 PM
| mstats c(System.System_Up_Time) as Uptime prestats=t WHERE index="em_metrics" AND host="*" by host,metric_name span=1m
| where Uptime < (now() - 2160000)
| eval diff=tostring(now() - Uptime,"duration")
| fields host Uptime diff
| sort – Uptime
getting no result
i have 2 hosts one host is coming metric log(System.System_Up_Time) other host is not coming so i want to display it as down
... View more
03-13-2020
02:47 AM
I am not receiving this log last 10 days from one host.
I want to display 2 hosts one host showing up other host showing down based on system.system_up_time metric log name
2 hosts host one receiving System.System_Up_Time metric log host two not receiving System.System_Up_Time past 7 days
... View more
Labels
- Labels:
-
configuration
-
Other
03-12-2020
09:24 PM
Hi I tried this query but not showing the down host
And it is metric log query I searched with system.system_up_time metric log
... View more
03-12-2020
03:21 AM
2hosts one host logs are not coming in to the splunk that host we want display as a Down
... View more
Labels
- Labels:
-
troubleshooting
03-01-2020
06:27 AM
these are metric logs i need cpu ,ram,disk space metric logs and all these 3 names in one single value panel with colors and percentage
... View more
03-01-2020
06:26 AM
these are metric logs i need cpu ,ram,disk space metric logs and all these 3 names in one single value panel with colors and percentage
... View more
03-01-2020
06:26 AM
these are metric logs i need cpu ,ram,disk space metric logs and all these 3 names in one single value panel with colors and percentage
... View more
03-01-2020
06:25 AM
these are metric logs i need cpu ,ram,disk space metric logs and all these 3 names in one single value panel with colors and percentage
... View more
02-29-2020
04:19 AM
i want to display multiple fields in single value display, how to display multiple fields in single value display panal (CPU,Disk Space,RAM)
... View more
Labels
- Labels:
-
configuration
-
using ITSI
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
07-17-2020
12:39 AM
|
