Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About omgwut56k
omgwut56k
Path Finder
Member since:
08-14-2014
06-05-2020
Community Statistics
| Posts | 30 |
| Solutions | 1 |
| Karma Given | 4 |
| Karma Received | 1 |
| Member Since | 08-14-2014 |
Activity Feed
- Karma Re: Indexer recv-q high and certain sources lagging. How do I fix that? for vcarbona. 06-05-2020 12:47 AM
- Karma Re: Automatic field extraction is failing for one field for jeffland. 06-05-2020 12:47 AM
- Karma Re: excluding holidays and weekends a count of days with events and a count of total days excluding weekends and holidays for somesoni2. 06-05-2020 12:47 AM
- Got Karma for How find hosts that are missing a particular sourcetype. 06-05-2020 12:47 AM
- Karma Re: splunkd is at 100% cpu, lag in indexing for oreni. 06-05-2020 12:46 AM
- Posted Re: How break out user and ip from a single field on Splunk Search. 08-19-2016 06:18 AM
- Posted Re: How break out user and ip from a single field on Splunk Search. 08-18-2016 07:59 AM
- Posted How break out user and ip from a single field on Splunk Search. 08-18-2016 07:52 AM
- Tagged How break out user and ip from a single field on Splunk Search. 08-18-2016 07:52 AM
- Tagged How break out user and ip from a single field on Splunk Search. 08-18-2016 07:52 AM
- Posted Re: Find a time average? on Splunk Search. 06-01-2016 06:19 AM
- Posted Re: Find a time average? on Splunk Search. 05-31-2016 02:46 PM
- Posted Re: Find a time average? on Splunk Search. 05-31-2016 02:44 PM
- Posted Re: Find a time average? on Splunk Search. 05-31-2016 12:51 PM
- Posted Find a time average? on Splunk Search. 05-31-2016 12:05 PM
- Tagged Find a time average? on Splunk Search. 05-31-2016 12:05 PM
- Tagged Find a time average? on Splunk Search. 05-31-2016 12:05 PM
- Posted Re: excluding holidays and weekends a count of days with events and a count of total days excluding weekends and holidays on Splunk Search. 01-14-2016 08:40 AM
- Posted Re: excluding holidays and weekends a count of days with events and a count of total days excluding weekends and holidays on Splunk Search. 01-14-2016 06:41 AM
- Posted Re: excluding holidays and weekends a count of days with events and a count of total days excluding weekends and holidays on Splunk Search. 01-13-2016 02:29 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 1 |
08-19-2016
06:18 AM
I 'accepted' the answer. Not sure where here to mark it as solved.
... View more
08-18-2016
07:59 AM
Thank you. However if the field has an ip address I would like that to be expressed src_ip, if it's a user I would like it expressed as user.. Is that possible?
... View more
08-18-2016
07:52 AM
My data for field entity contains either a username or an ip address.
How can make a new field for either user or src_ip?
for example
entity=rhoward
entity=10.0.0.1
entity=192.168.1.1
entity=jbozo
I would like a new field for user and src_ip
Thank you!
... View more
- Tags:
- new
- splunk-enterprise
06-01-2016
06:19 AM
Agreed, since _time is in epoch and growing averaging the number is pointless. Weirdly enough I can do this in Excel which in this case is my unfortunate solution.
... View more
05-31-2016
02:46 PM
searching stuff here.. finding the average time of day a person opens the front door.
| eval day_of_swipe=(date_month + " "+ date_mday + " "+ date_wday )
| eval day_of_swipe=(date_month + " "+ date_mday + " "+ date_wday ) | eval Month=strftime(_time,"%b")
| stats first(JobTitle) as JobTitle first(UserName) as UserName count(dvc_name) as swipes_per_day first(Manager_Name) as Manager_Name first(department) as department first(_time) as first_time last(_time) as last_time values(_time) as time_values values(Month) as Month by nick,date_mday
| stats first(first_time) as first_time last(last_time) as last_time mean(last_time) as last_mean values(time_values) as time_values by nick,date_mday
| convert timeformat="%H:%M:%S" ctime(first_time) AS first_time
| convert timeformat="%H:%M:%S" ctime(last_time) AS last_time
| convert timeformat="%H:%M:%S" ctime(time_values) AS time_values | convert timeformat="%H:%M:%S" ctime(last_mean) AS last_mean
... View more
05-31-2016
12:51 PM
I had the same idea, however it does not appear to work that way.
... View more
05-31-2016
12:05 PM
I am trying to determine the mean or average time when a event occurs.
I would like to find an average of the last column if at possible.
My example data:
first --------------------last--------------------lastmode
09:16:26 -------------06:26:51---------------19:47:38
10:49:29 -------------06:43:22
11:36:55--------------07:33:50
06:19:09 ------------ 10:26:29
... View more
01-14-2016
08:40 AM
Bonus points if you can solve this one.
I have my results which are correct for a single month span. I would like to run this against the previous year and see the results in 1 month buckets. Can you point me to a solution?
Thank you!!!
... View more
01-14-2016
06:41 AM
EXCELLENT! Thank you kind sir.
... View more
01-13-2016
02:29 PM
I do and it is working correctly.
holidays.csv
holiday,type,holiday_description
25-12-2015,global,christmas
16-02-2015,global,presidents day
transforms.conf
[holidays]
filename = holidays.csv
min_matches = 1
props.conf
EVAL-holiday = strftime(_time,"%d-%m-%Y")
LOOKUP-isaholiday = holidays holiday OUTPUTNEW
... View more
01-13-2016
12:48 PM
I need to get a count of possible days an event could be happening while excluding weekends and holidays, for example
index=physical date_wday!="saturday" date_wday!="sunday"
| WHERE holiday!=*
| eval day_of_swipe=(date_month + " "+ date_mday + " "+ date_wday )
| stats count(dvc_name) as swipes_per_day by user,day_of_swipe
| eventstats dc(day_of_swipe) as work_days
| eventstats dc(day_of_swipe) as days_swiped by nick
| eval perc_present=round((days_swiped/work_days*100))
eventstats is giving me the total number of days being search and not the excluded, I need to get the total number of possible working days m-f and excluding any holidays are being identified with a lookup table and filtered
Any ideas?
... View more
Hi Greg,
Curious if you found an answer here. I'm also interested.
Thanks,
omg
... View more
09-15-2015
07:31 AM
We have a 54 node cluster and we are seeing these events streaming continuously every few minutes from each node. Can anyone comment if this is normal activity for the CM, or an issue? Can anyone tell me what we are seeing here?
Thank you
09-15-2015 10:22:52.306 -0400 INFO CMPeer - peer=140E75CA-9E39-4992-B857-C34200944483 peer_name=server bid=index_name~3494~8DA53A52-7E20-4178-BB4D-9210C489FBCA transitioning from=Searchable to=SearchablePendingMask oldmask=0x0 newmask=0x4 reason="swap primaries"
... View more
08-20-2015
06:19 AM
It's been a while since this post, does the current remove logs? or do I need to find another solution to keep this from filling up our heavy forwarder?
... View more
06-17-2015
07:22 AM
Perfect! Thank you.
... View more
06-17-2015
07:01 AM
I have edited the original question, let me know if that helps.
Thank you,
... View more
06-17-2015
07:01 AM
Hi Woodcock, I've re-phrased my question, it might not have been phrased very clearly.
props only contains a couple of unrelated field extractions and no transforms. Is there something specific you are interested in?
... View more
06-17-2015
06:33 AM
I have a field value named 'category' the raw values are for example.
"Audit Global - ABC - Login and Logout Audit"
"Audit Global - ABC - Login - SQL Exception"
When searching, the values for category are returned as only 'Audit' or the first 5 characters of the raw value. The field extraction is not working correctly for this field.
Any ideas on what to look at?
Thank you
... View more
05-22-2015
09:31 AM
I have a list of computers running splunkweb , I am trying to remove results that are logging to the _internal index which would indicate the servers are part of our main infrastructure.
How can I filter out hosts that have reported to events to the _internal index?
... View more
- Tags:
- search-language
