Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About splunkrocks2014
splunkrocks2014
Communicator
Member since:
08-13-2014
06-06-2024
Community Statistics
| Posts | 149 |
| Solutions | 0 |
| Karma Given | 12 |
| Karma Received | 13 |
| Member Since | 08-13-2014 |
Activity Feed
- Karma Chicken Butt Nugget Tracker for aromanauskas. 06-06-2024 02:14 PM
- Got Karma for How to hide input based on another input?. 03-03-2022 07:26 AM
- Posted Re: Indexed logs and subset of logs into different indexes on Getting Data In. 10-12-2021 07:32 AM
- Posted Indexed logs and subset of logs into different indexes on Getting Data In. 10-12-2021 07:19 AM
- Got Karma for How to show the key from an inputlookup command from a KVStore?. 07-28-2021 10:35 PM
- Posted Unable to forward syslog from NetScaler Service VMs (SVMs) on Getting Data In. 06-29-2021 10:47 AM
- Got Karma for How to use timepicker from a CSV lookup?. 10-06-2020 05:50 AM
- Karma Re: How to pass a search based on the token value from a text field? for kamlesh_vaghela. 06-05-2020 12:49 AM
- Karma Re: Does bucket/bin command work from a lookup table/KVStore? for woodcock. 06-05-2020 12:49 AM
- Karma Re: Iist IPs from different columns for DalJeanis. 06-05-2020 12:49 AM
- Karma Re: How to use timepicker from a CSV lookup? for micahkemp. 06-05-2020 12:49 AM
- Karma Re: How do you manipulate a token before passing it to a drilldown? for renjith_nair. 06-05-2020 12:49 AM
- Got Karma for Re: Iist IPs from different columns. 06-05-2020 12:49 AM
- Karma Re: How to edit my search to filter results using extracted fields from a lookup and a where clause? for somesoni2. 06-05-2020 12:48 AM
- Karma Re: How to output a CSV file with certain columns from a dbxquery in Splunk DB Connect 2.2.0? for woodcock. 06-05-2020 12:48 AM
- Karma Re: How to output a CSV file with certain columns from a dbxquery in Splunk DB Connect 2.2.0? for vj8210. 06-05-2020 12:48 AM
- Karma Re: Custom Drill-down from Total Row for niketn. 06-05-2020 12:48 AM
- Karma Re: IP Range Lookup for starcher. 06-05-2020 12:48 AM
- Karma Re: Resources used by each saved search for cmerriman. 06-05-2020 12:48 AM
- Got Karma for Is it possible to customize the order of fields in the legend for a stacked column chart?. 06-05-2020 12:48 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
10-12-2021
07:32 AM
Hi Giuseppe, thank you for the quick reply. There is another challenge that I can only use one input from the TA to pull all events. Need to break down the events to different indexes and groups of indexers.
... View more
10-12-2021
07:19 AM
Hi All, I am onboarding data from a heavy forwarder using Splunk TA. Is it possible to 1) index all logs into one index and route to group A indexers 2) index subset of logs into another index and route to group B indexers? Thanks.
... View more
Labels
- Labels:
-
index
-
indexer
-
inputs.conf
-
props.conf
-
transforms.conf
06-29-2021
10:47 AM
We have asked our customers to forward syslog from Netscaler Service VMS (SVMs) to our Splunk syslog servers. We have tried tracroute, sending dummy data to syslog servers, but there weren't any traffics sent out at all. This is not related to Splunk, but I don't know if anyone encountered the same issues and there are any suggestions/workarounds. Thanks.
... View more
Labels
- Labels:
-
syslog
05-13-2019
06:53 AM
I have a SQL query pull relied on two raising columns (see below). In DB input, is it possible to set two raise columns? I am using DB Connect 3.1.4.
SELECT *
FROM table_1
WHERE (timestamp > ? AND logoff_time IS NULL) OR logoff_time> ?
ORDER BY timestamp, logoff_time
... View more
- Tags:
- splunk-enterprise
03-08-2019
01:45 PM
We tried to install "Azure Monitor Add-on for Splunk".
During the configuration, it requires to run "python azure_monitor_metrics.py", and Python requires version 2.7. Unfortunately, my server built only has python 2.6. I used the Splunk Python, "splunk cmd python azure_monitor_metrics.py", and I got the following error:
Traceback (most recent call last):
File "azure_monitor_metrics.py", line 32, in <module>
from splunklib.modularinput import Script, Scheme, Argument
ImportError: No module named splunklib.modularinput
I wonder if anyone has any clues how to resolve this issue. Thanks.
... View more
12-10-2018
01:36 PM
Thanks somesoni2, but I wanted to make it work from the configuration files.
... View more
12-10-2018
12:58 PM
I am able to use "SEDCMD" to mask the sensitive data during the index time, but is it possible to mask the sensitive data during the search time? Thanks.
... View more
- Tags:
- splunk-enterprise
09-11-2018
06:32 AM
Never thought about this way 🙂 ... thanks.
... View more
09-10-2018
02:13 PM
How do you manipulate a token before passing it to a drilldown?
For example, the following dashboard has a a statistic table with a field, country with value "United States of America (USA)", and I just want to pass "USA" to the drilldown. But the token ("country") is not changed to "USA" from the eval function when passed to the deep link. Any clues? Thanks.
<dashboard>
<label>testing</label>
<row>
<panel>
<table>
<search>
<query>| makeresults
| eval Country="United States of America (USA)"
| table Country</query>
<earliest>-15m</earliest>
<latest>now</latest>
<sampleRatio>1</sampleRatio>
</search>
<option name="count">100</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">row</option>
<option name="percentagesRow">false</option>
<option name="rowNumbers">false</option>
<option name="totalsRow">false</option>
<option name="wrap">true</option>
<drilldown>
<eval token="country">replace(replace(mvindex(split($click.value$," "),-1,-1),"\(",""),"\)","")</eval>
<link target="_blank">
<![CDATA[https://en.wikipedia.org/wiki/$country$]]>
</link>
</drilldown>
</table>
</panel>
</row>
</dashboard>
... View more
07-18-2018
02:09 PM
I have a search returns two rows of records (check the result from the following query):
| makeresults
| eval date="2018-07-16", col1=4, col2=5, col3=6, col4=7
| append [| makeresults
| eval date="2018-07-17", col1=8, col2=9, col3=16, col4=17]
| fields - _time
| table date col1 col2 col3 col4
Is there a way to get the difference between the date from all the columns? Here is the expected result:
| makeresults
| eval date="2018-07-16", col1=4, col2=5, col3=6, col4=7
| append [| makeresults
| eval date="2018-07-17", col1=8, col2=9, col3=16, col4=17]
| append [| makeresults
| eval date="diff", col1=4, col2=4, col3=10, col4=10]
| fields - _time
| table date col1 col2 col3 col4
Thanks
... View more
- Tags:
- splunk-enterprise
07-09-2018
08:12 AM
it doesn't seem working. I can use "delta" command, but the "delta" command only apply one field. For example,
| makeresults | eval item="item 1", count_a=12, count_b=23, count_c=50, date="07/06/2018"
| append [| makeresults | eval item="item 1", count_a=3, count_b=123, count_c=41, date="07/05/2018"]
| append [| makeresults | eval item="item 1", count_a=31, count_b=13, count_c=21, date="07/04/2018"]
| table date item count_a count_b count_c
| sort - date
| delta count_a
| append [| makeresults | eval item="item 1", count_a=12, count_b=23, count_c=50, date="07/06/2018"
| append [| makeresults | eval item="item 1", count_a=3, count_b=123, count_c=41, date="07/05/2018"]
| append [| makeresults | eval item="item 1", count_a=31, count_b=13, count_c=21, date="07/04/2018"]
| table date item count_a count_b count_c
| sort - date
| delta count_b]
| append [| makeresults | eval item="item 1", count_a=12, count_b=23, count_c=50, date="07/06/2018"
| append [| makeresults | eval item="item 1", count_a=3, count_b=123, count_c=41, date="07/05/2018"]
| append [| makeresults | eval item="item 1", count_a=31, count_b=13, count_c=21, date="07/04/2018"]
| table date item count_a count_b count_c
| sort - date
| delta count_c]
... View more
07-06-2018
01:37 PM
The following is a list of items per date from different counts. How can I get the delta from count_a, count_b, and count_c based on the same item compared to the previous date? Thanks.
| makeresults | eval item="item 1", count_a=12, count_b=23, count_c=50, date="07/06/2018"
| append [| makeresults | eval item="item 1", count_a=3, count_b=123, count_c=41, date="07/05/2018"]
| append [| makeresults | eval item="item 1", count_a=31, count_b=13, count_c=21, date="07/04/2018"]
| append [| makeresults | eval item="item 2", count_a=1, count_b=42, count_c=12, date="07/04/2018"]
| append [| makeresults | eval item="item 2", count_a=21, count_b=142, count_c=122, date="07/05/2018"]
| table date item count_a count_b count_c
... View more
- Tags:
- splunk-enterprise
06-14-2018
08:29 AM
Hi. I wanted to use a macro to call a different macro based on the parameter and the definition of the sub-macro is from the "tstats" command. For example,
[parentMacro(1)]
args=source
definition=CASE($source$="xyz", `childMacro_xyz`, $source$="abc", `childMacro_abc`)
[childMacro_xyz]
definition= tstats count WHERE index=blah where source="xyz"
[childMacro_abc]
definition= tstats count WHERE index=blah where source="abc"
I got "Search Factory: Unknown search command 'case'" while using the following
| makeresults
| eval source="xyz"
|`parentMacro(source)`
Any clues? Thanks.
... View more
- Tags:
- splunk-enterprise
06-05-2018
08:33 AM
There are lots of posts about this topic; however, I used the rest command which was suggested from most of the posts. The command doesn't return all my lookup files from the app.
| rest /services/data/lookup-table-files
Does anyone know why the command doesn't include all the lookup files? Is there a way to make my lookup files visible from the command? Thanks.
... View more
05-04-2018
09:14 AM
For instance, how to show "_msg" from the search result? Thanks.
| makeresults
| eval _msg="Hello World"
... View more
- Tags:
- splunk-enterprise
05-04-2018
08:53 AM
Yes. I defined a custom key field named as "key", but I tried both queries, and the key field is still missing.
| inputlookup my_kvstore_lookup | eval view_key=key
| inputlookup my_kvstore_lookup | eval view_key=_key
... View more
05-01-2018
12:36 PM
I was thinking the way you described, but it doesn't work.
... View more
05-01-2018
10:56 AM
1 Karma
I defined a key as "key" for a KVStore. How to show the key value from an inputlookup command from a KVStore? Thanks.
... View more
04-27-2018
11:46 AM
How can I delete data from a KV store based on some criteria, for instance, to delete the aged data based on a timestamp field?
Thanks.
... View more
- Tags:
- splunk-enterprise
04-21-2018
01:20 PM
Thanks elliotproebstel. This is what I am looking for. I have another question: between "reverse" and "delta" subsearch, how can I loop through a lookup table and calculate the diff only matched to the lookup? Thanks.
... View more
04-20-2018
12:42 PM
Hi.
How to use Splunk query to compare to the "count" field from previous day from a lookup table? For instance, the lookup table has fields:
date item count
------- ------- ---------
04/20/2018 box 12
04/19/2018 box 20
The end result looks like:
date item count diff
------- ------- --------- ------
04/20/2018 box 12 -8
Thanks.
... View more
04-05-2018
06:42 AM
When used Splunk Java SDK extract the data from a search, Splunk automatically sorts the results based on the alphabet order of the fields. Is it possible to turn off the auto sorting so that we can keep the fields order from initial search? Thanks.
... View more
03-13-2018
12:48 PM
I defined a custom key field for my KVStore and have a savedsearch loads contents to all fields (include key); however, when checking the data, the key field is missing from the KVStore. Any clues?
... View more
- Tags:
- splunk-enterprise
03-04-2018
06:43 PM
I have list of the domains and groups, how to use ldapsearch to pull the sAMAccountName name and AccountIsDisabled associated with the groups? Thanks.
... View more
- Tags:
- splunk-enterprise
03-02-2018
02:09 PM
It doesn't work for me. Here is the data:
_time _raw
2018-03-02 16:43:45 03/01/2018 11:00:00 -0500, info_min_time=1520023380.000, info_max_time=1520027024.000, info_search_time=1520027024.435, report=testing123
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-06-2024
05:35 PM
|
Karma from
Karma given to
