Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About riderofyamaha
riderofyamaha
Explorer
Member since:
05-26-2010
06-05-2020
Community Statistics
| Posts | 21 |
| Solutions | 0 |
| Karma Given | 0 |
| Karma Received | 3 |
| Member Since | 05-26-2010 |
Activity Feed
- Got Karma for pushing splunk results automatically. 06-05-2020 12:45 AM
- Got Karma for pushing splunk results automatically. 06-05-2020 12:45 AM
- Got Karma for multiple searches in form view. 06-05-2020 12:45 AM
- Posted Re: quick fields question. Time connected/time disconnect? on Splunk Search. 07-19-2010 07:20 PM
- Posted Re: quick fields question. Time connected/time disconnect? on Splunk Search. 07-16-2010 01:19 PM
- Posted Re: quick fields question. Time connected/time disconnect? on Splunk Search. 07-14-2010 07:03 PM
- Posted Re: time start and time end on Getting Data In. 07-14-2010 03:15 PM
- Posted Re: quick fields question. Time connected/time disconnect? on Splunk Search. 07-13-2010 06:23 PM
- Posted Re: time start and time end on Getting Data In. 07-13-2010 03:05 PM
- Posted Re: time start and time end on Getting Data In. 07-13-2010 01:55 PM
- Posted time start and time end on Getting Data In. 07-13-2010 12:07 PM
- Tagged time start and time end on Getting Data In. 07-13-2010 12:07 PM
- Tagged time start and time end on Getting Data In. 07-13-2010 12:07 PM
- Posted quick fields question. Time connected/time disconnect? on Splunk Search. 07-12-2010 06:44 PM
- Tagged quick fields question. Time connected/time disconnect? on Splunk Search. 07-12-2010 06:44 PM
- Posted Re: multiple inputs parser error on Getting Data In. 07-07-2010 06:35 PM
- Posted multiple inputs parser error on Getting Data In. 07-07-2010 05:54 PM
- Tagged multiple inputs parser error on Getting Data In. 07-07-2010 05:54 PM
- Tagged multiple inputs parser error on Getting Data In. 07-07-2010 05:54 PM
- Tagged multiple inputs parser error on Getting Data In. 07-07-2010 05:54 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 2 | |||
| 0 |
07-19-2010
07:20 PM
goddamn i give up
... View more
07-16-2010
01:19 PM
??????? come one guys
... View more
07-14-2010
07:03 PM
i dont know what you mean by device. Do u mean server brand? but a data example is:
Jul 12 12:48:54 foobar.net Jul 12 2010 12:25:03: %ASA-4-113019: Group = foobar, Username = Username1, IP = 10.238.96.133, Session disconnected. Session Type: IPsecOverNatT, Duration: 0h:27m:44s, Bytes xmt: 1879054, Bytes rcv: 591784, Reason: User Requested
specifics removed for security...
could someone please show me how to display a field for when a user connecting and disconnecting the network?
... View more
07-13-2010
06:23 PM
the sourcetype is syslog....as far as i can tell...is that what you mean? im new to the IT world, thanks for your patience and help 🙂
... View more
07-13-2010
03:05 PM
im searching sys logs, on a windows system....ive also read through the documentation text with no success so far. I want to show a connection start and end time in a form search results field
... View more
07-13-2010
01:55 PM
so people will click minus one but cant answer a simple question. This site really is disappointing me
... View more
07-13-2010
12:07 PM
im doing a username search and i want two fields in my results table to be the time the user sarted the connection and also when they disconnected the session to the network. What is this information classified as, and wat field would it be called?
thanks
happy splunking
blake
... View more
- Tags:
- connection
- time
07-12-2010
06:44 PM
I want my table to show a column with what time a username connected to the network and another column showing when they disconnected the network...what is the field called and the shortcut to extract this info from my data?
thanks,
blake
... View more
- Tags:
- search-language
07-07-2010
06:35 PM
what do u mean actual search? im searching for usernames or ip address's.... there is an input box on the left, time range picker in the center, and another input box on the right feeding a table.
... View more
07-07-2010
05:54 PM
When i try and run a multiple input search running 4.1.2 on windows 7 im getting an error message that causes search app to always return zero results as well as two error codes.
A red bar comes across the top saying:
Error in 'UnifiedSearch': Unable to parse the 'Invalid LHS for comparison' search.
and in the results table it says: [SimpleResultsTable module] Server reported HTTP status=400 while getting mode=events Error in 'UnifiedSearch': Unable to parse the 'Invalid LHS for comparison' search.
This is a simple search and it should be running without any problems as i ve used the same code for another search....
the xml is:
<form>
<label>Multiple inputs</label>
<searchTemplate>index=_host=cvpn00bay-inside.bay.cbeyond.net
$SearchHere$ | fields Username, Host, IP, _time, vpn_poolip, Group</searchTemplate>
<fieldset>
<input type="text" token="series">
<label>sourcetype</label>
<default></default>
<seed>splunkd</seed>
<suffix>*</suffix>
</input>
<input type="text" token="otherFilter">
<label>events per second greater than:</label>
<prefix>eps></prefix>
<default>-1</default>
<seed>0</seed>
</input>
<!-- add default TimePicker -->
<input type="time" />
<input token="SearchHere" />
</fieldset>
<row>
<!-- show results as a table -->
<table>
<options name="fields"> Username, Host, IP, _time, vpn_poolip, Group</options>
<title>activity</title> <option name="count">50</option>
</table> </row> <fields>_raw</fields> </form>
i REALLY need to figure this out, can count on u guys helping me out
... View more
07-06-2010
07:30 PM
thank you very much lowell and nick for your fast responses, ill give this a try and check back here
... View more
07-06-2010
06:41 PM
I'm having a problem with getting simple xml working on a form search that is meant to be used searching for a username or specific ip address. The search should be used to find out certain attributes and group them in a table like pool ip, time, host etc. This should be fairly straight forward but im having problems with the searches not bringing back complete results and sometimes just showing the host and time in the results table. the xml so far is as follows, im sure there is something that im over looking though...
<form> <label>Search ME</label> <searchTemplate>(host=cvpn00bay-inside.bay.cbeyond.net)
$SearchHere$ | fields + host, username, ip, _time, vpn_poolip </searchTemplate> <earliestTime>-
30d</earliestTime> <latestTime>-0d</latestTime> <html> Enter a sourcetype in the field below
and this view will pull back the most recent 100 events from the metrics log concerning that
sourcetype. </html> <fieldset> <input token="SearchHere" /> </fieldset> <row> <table>
<title>activity</title> <option name="count">50</option> </table> </row> <fields>_raw</fields>
</form>
suggestions?
... View more
- Tags:
- simple-xml
07-01-2010
12:36 PM
I have a question on how to put multiple form searches on the same page that both feed a separate table.
The first search is used in finding a specific I.P. address and what user is connected to it, pool ip, time etc.
The second search below this has an Input field to put the username you just found in and see what recent activity they’ve logged.
So, two searches and tables on same page…the problem im having is both tables are showing the results for the first search, instead of being separate so i tryed this xml using two form commands but the xml is invalid when i try and make a view. If i but dashboard at the beginning and end it accepts it but its a blank dashboard.
PLEASE HELP....i have to get this done today
cheers guys
<form>
<label>patrick help</label>
<searchTemplate>(host=cvpn00bay-inside.bay.cbeyond.net)
713228 $inputIP$ | fields _time, vpn_poolip, Username, </searchTemplate>
<earliestTime>-24h</earliestTime>
<latestTime>-0d</latestTime>
<fieldset>
<input token="inputIP" />
</fieldset>
<row>
<table>
<title>Users assigned to IP in last 24 hours</title>
<option name="count">25</option>
</table>
</row>
</form>
<form>
<searchTemplate> $inputUser$ </searchTemplate>
<earliestTime>-24h</earliestTime>
<latestTime>-0d</latestTime>
<fieldset>
<input token="inputUser" />
</fieldset>
<row>
<table>
<title>Users activity in last 24 hours</title>
<option name="count">25</option>
</table>
</row>
</form>
... View more
- Tags:
- dashboard
- form-search
06-30-2010
03:17 PM
Is the wildcard search star * supported by logs in splunk? Im trying to see if splunk is seeing changes being made in log files..
... View more
- Tags:
- wildcards
06-24-2010
02:30 PM
i need to construct a form search in a dashboard that brings back the vpnpool ip address's of any username i type into the input field, im at a loss as how to do this.
... View more
- Tags:
- dashboard
06-22-2010
01:44 PM
1 Karma
i have a simple form view set up to retrieve a specific ip address or username from the system. the results are then shown in a source list of the first 200. my question is i would like to add a second simple search field to the same view so i can search using both at once on the same page, using one for ip address's and one for the ip activity. how would i go about doing that?
... View more
- Tags:
- search-help
06-10-2010
03:28 PM
2 Karma
I have a question regarding having specific splunk data that is automatically searched for exported to a different database automatically. not much information i know, but i cant think of how else to ask, thanks for your input
... View more
- Tags:
- export
05-27-2010
06:02 PM
I am having trouble getting my form search to bring back anything. The xml is accepted by splunk but the search won't bring back anything. It always says 0. here is the xml code...
<form>
<label>My Search Engine</label>
<searchTemplate>"$SearchHere$" | head 250</searchTemplate>
<earliestTime>-30d</earliestTime>
<latestTime>-0d</latestTime>
<html>
Enter a sourcetype in the field below and this view will pull back the most recent 100 events from the metrics log concerning that sourcetype.
</html>
<fieldset>
<input type="text" token="username">
<label>Enter a user name</label>
<default>Last 24 Hours</default>
</input>
</fieldset>
<row>
<chart>
<title>User logins</title>
<option name="charting.chart">pie</option>
</chart>
<event>
<title>Matching events</title>
<fields>_raw</fields>
<option name="count">250</option>
</event>
</row>
</form>
... View more
- Tags:
- search
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:02 AM
|
