Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About vasanthmss
vasanthmss
Motivator
Member since:
12-06-2013
04-28-2022
Community Statistics
| Posts | 286 |
| Solutions | 55 |
| Karma Given | 407 |
| Karma Received | 355 |
| Member Since | 12-06-2013 |
Activity Feed
- Got Karma for Re: Is there any way to list all the saved searches in Splunk?. 07-06-2023 04:04 AM
- Got Karma for Re: How to add and parse XML data in Splunk?. 12-28-2022 07:24 AM
- Got Karma for Re: How to replace line breaks with delimiters?. 08-15-2022 12:49 PM
- Karma Re: Checklist before installing Splunk for sayaksplunk. 04-28-2022 12:17 AM
- Got Karma for Re: Why are there many duplicate events in the indexer cluster?. 04-15-2022 12:13 PM
- Got Karma for Re: Is there any way to list all the saved searches in Splunk?. 04-07-2022 04:49 AM
- Got Karma for Re: Is it possible to divide all individual values in field1 by the column total of field1?. 02-06-2022 06:07 PM
- Got Karma for Re: How to freeze ONLY first column in table when scrolling the table to right or left. 02-04-2022 08:05 AM
- Got Karma for Re: How to delete events from a summary-index?. 02-03-2022 06:40 AM
- Got Karma for Re: Is there any way to list all the saved searches in Splunk?. 01-07-2022 12:09 PM
- Got Karma for Re: Why is my search producing error "The eval expression has no fields: 'round(on/total*100)'"?. 09-30-2021 10:21 AM
- Got Karma for Re: Why are there many duplicate events in the indexer cluster?. 07-01-2021 06:46 AM
- Got Karma for Re: case and isnull for multiple fields. 02-19-2021 03:42 AM
- Karma Re: Help getting multiple columns from a chart for somesoni2. 06-05-2020 12:51 AM
- Karma Re: How to include another field into the visual for woodcock. 06-05-2020 12:51 AM
- Karma Re: How to include another field into the visual for somesoni2. 06-05-2020 12:51 AM
- Karma Re: List of top URLs with hourly count > 50 for somesoni2. 06-05-2020 12:51 AM
- Karma Re: How can we use deployment server in multi sites? for adonio. 06-05-2020 12:50 AM
- Karma Re: How do I do a CIDR match with an inputlookup? for somesoni2. 06-05-2020 12:50 AM
- Karma Re: Length of every column in a table? for bofasplunkguy. 06-05-2020 12:50 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 2 | |||
| 1 | |||
| 1 | |||
| 1 | |||
| 1 | |||
| 1 | |||
| 2 | |||
| 0 | |||
| 1 | |||
| 2 |
10-15-2019
01:16 PM
Are you able to run the search in web ui with the same user ?
... View more
10-09-2019
02:41 PM
1 Karma
Hi Bofasplunkguy,
Try using foreach command. This will save multiple eval statements..
... your base search | foreach field* [| eval <<FIELD>>_Len=len(<<FIELD>>)]
Description:
field* will iterate the all the field1, field2..
<<FIELD>> will be the actual field field1, field2 ...
<<FIELD>>_Len will be a new field with the eval len() accordingly.
Foreach syntax,
foreach <wc-field>... [fieldstr=<string>] [matchstr=<string>] [matchseg1=<string>] [matchseg2=<string>] [matchseg3=<string>] <subsearch>
For more details https://docs.splunk.com/Documentation/SplunkCloud/7.2.7/SearchReference/Foreach
Hope this helps you
Cheerss!!!
... View more
10-09-2019
02:06 PM
1 Karma
Hi ssharm01,
You could use CURL to run DBX Query.
Note : Make sure the User (in the authentication token) have access to run the dbx query.
Here are the information about the end point. services/search/jobs
GET :Get details of all current searches.
POST : Start a new search and return the search ID ( <sid> )
Above CURL call will create a job and return the Job ID (SID). using the job id, you should make another call to search/jobs/{search_id}/results to get results.
REST Call 1:
curl -H 'Authorization: Basic auth token' -k https://localhost:8089/services/search/jobs -d search=" | dbxquery query=\"SELECT count(*) FROM db.table\" connection=\"connection\"" -d output_mode=json
Rest Call 2:
curl -H 'Authorization: Basic auth token' -k 'https://localhost:8089/services/search/jobs/`<SID>`/results' --get -d output_mode=json
Read this docs for more info: https://docs.splunk.com/Documentation/Splunk/7.3.1/RESTREF/RESTsearch
Hope this helps you
Cheers!!!
... View more
10-07-2019
01:27 PM
Make sure that your index (A) , Index (B) have the matching filed with unique name, if not use the field alias to keep the same field name.
Index A - A_field_match (match_field)
Index B - B_field_match (match_field)
Once you have the field alias setup the field match_field will be common for both the index.
Standalone search to produce index A results
| stats c | fields - c | eval index="a" | eval match_field="match"| eval A_interesting_field_1="A_interesting_field_1"| eval A_interesting_field_2="A_interesting_field_2"| eval A_interesting_field_3="A_interesting_field_3"
Standalone search to produce index B results
| stats c | fields - c | eval index="b" | eval match_field="match"| eval B_interesting_field_1="B_interesting_field_1"| eval B_interesting_field_2="B_interesting_field_2"| eval B_interesting_field_3="B_interesting_field_3"
Here is the sample search,
| stats c | fields - c | eval index="a" | eval match_field="match"| eval A_interesting_field_1="A_interesting_field_1"| eval A_interesting_field_2="A_interesting_field_2"| eval A_interesting_field_3="A_interesting_field_3"
| append
[| stats c | fields - c | eval index="b" | eval match_field="match"| eval B_interesting_field_1="B_interesting_field_1"| eval B_interesting_field_2="B_interesting_field_2"| eval B_interesting_field_3="B_interesting_field_3"]
| stats values(*) as * by match_field
So your search looks something like this,
(index=<index a> [filters for a if any]) OR (index=<index b> [filters for b if any]) .. |table required fields .... | stats values(*) as * by `match_field`
... View more
10-07-2019
12:55 PM
1 Karma
Try the below run anywhere search,
|makeresults | eval url=split(("/hk-zh/shop/buy-phone/phone-1/5.8-%E5%90%8B%E9%A1%AF%E7%A4%BA%E5%99%A8-256gb-%E9%8A%80%E8%89%B2 1059,
/hk/shop/buy-phone/phoneSS/5.5-inch-display-128gb-rose-gold 493,
/hk-zh/shop/buy-phone/one6/5.5-%E5%90%8B%E8%9E%A2%E5%B9%95-128gb-%E7%8E%AB%E7%91%B0%E9%87%91%E8%89%B2 375,
/shop/buy-tab/mini-3/128gb-gold-wifi 90,
/shop/buy-tab/mini-3/128gb-silver-wifi 90,
/hk-zh/shop/buy-phone/phone-sm/5.8-%E5%90%8B%E9%A1%AF%E7%A4%BA%E5%99%A8-64gb-%E9%8A%80%E8%89%B2 60,
/hk-zh/shop/buy-phone/phone-ap/5.5-%E5%90%8B%E8%9E%A2%E5%B9%95-128gb-%E4%BA%AE%E9%BB%91%E8%89%B2 59,
/hk-zh/shop/buy-phone/phone-lg/5.8-%E5%90%8B%E9%A1%AF%E7%A4%BA%E5%99%A8-64gb-%E5%A4%AA%E7%A9%BA%E7%81%B0 59"),",")
|mvexpand url
| eval decoded_url=urldecode(url)
| rex field=url "shop(?<ex_url>[a-zA-Z\/\-0-9\.]+)"
| rex field=ex_url mode=sed "s/-$//g"
| eval ex_url="/shop"+ex_url
| table url, decoded_url, ex_url
url- actual url from samples
decoded_url - decoded url using urldecode function.
ex_url - is the extracted url.
Hope this helps you..
Cheers !!!
... View more
07-25-2019
04:01 PM
2 Karma
Here is the sample code which used _internal index and freezes first column with similar logic for other columns.
myTable is the table id, and using hidden html style applied the css. Make sure that one extra column with similar to first column. here frozen column is host , created one more column host1 which holds the same data.
<dashboard hideEdit="false">
<label>Fixed Column Test</label>
<row depends="$never$">
<panel>
<html>
<style>
#myTable div [data-view="views/shared/results_table/ResultsTableMaster"] td:nth-child(1) {
position: fixed;
}
#myTable div [data-view="views/shared/results_table/ResultsTableMaster"] th:nth-child(1) {
position: fixed;
}
</style>
</html>
</panel>
</row>
<row>
<panel>
<table id="myTable">
<search>
<query>index=_internal sourcetype=splunkd |head 100 |eval host1=host | table host,host1, _time, sourcetype, source date* _raw *</query>
<earliest>-60m@m</earliest>
<latest>now</latest>
<sampleRatio>1</sampleRatio>
<refresh>5m</refresh>
<refreshType>delay</refreshType>
</search>
<option name="count">15</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">none</option>
<option name="percentagesRow">false</option>
<option name="rowNumbers">false</option>
<option name="totalsRow">false</option>
<option name="wrap">false</option>
<format type="color" field="index9">
<colorPalette type="sharedList"></colorPalette>
<scale type="sharedCategory"></scale>
</format>
<format type="color" field="host">
<colorPalette type="sharedList"></colorPalette>
<scale type="sharedCategory"></scale>
</format>
</table>
</panel>
</row>
</dashboard>
Note: This uses column fix so if you have bigger table or multiple table you may see the fixed column for a while then it will hide. Use rows per page to limit the records.
Hope that helps,
Cheers !!!
... View more
07-25-2019
03:58 PM
3 Karma
Here is the sample code which used _internal index,
myTable is the table id, and using hidden html style applied the css. Make sure that one extra column with similar to first column. here frozen column is host , created one more column host1 which holds the same data.
<dashboard hideEdit="false">
<label>Fixed Column Test</label>
<row depends="$never$">
<panel>
<html>
<style>
#myTable div [data-view="views/shared/results_table/ResultsTableMaster"] td:nth-child(1) {
position: fixed;
}
#myTable div [data-view="views/shared/results_table/ResultsTableMaster"] th:nth-child(1) {
position: fixed;
}
</style>
</html>
</panel>
</row>
<row>
<panel>
<table id="myTable">
<search>
<query>index=_internal sourcetype=splunkd |head 100 |eval host1=host | table host,host1, _time, sourcetype, source date* _raw *</query>
<earliest>-60m@m</earliest>
<latest>now</latest>
<sampleRatio>1</sampleRatio>
<refresh>5m</refresh>
<refreshType>delay</refreshType>
</search>
<option name="count">15</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">none</option>
<option name="percentagesRow">false</option>
<option name="rowNumbers">false</option>
<option name="totalsRow">false</option>
<option name="wrap">false</option>
<format type="color" field="index9">
<colorPalette type="sharedList"></colorPalette>
<scale type="sharedCategory"></scale>
</format>
<format type="color" field="host">
<colorPalette type="sharedList"></colorPalette>
<scale type="sharedCategory"></scale>
</format>
</table>
</panel>
</row>
</dashboard>
Note: This uses column fix so if you have bigger table or multiple table you may see the fixed column for a while then it will hide. Use rows per page to limit the records.
Hope that helps,
Cheers !!!
... View more
03-06-2019
01:46 PM
two changes requried in your xml,
2 <change> tag not required. use one and add the condition inside <change><condition>..</condition> <condition> </condition></change>
lowest use lower case in the depends
Select the options to get more details
Top5
lowest
Showpanel
Showpanel
true
true
Top 5 Indexes
$query$
$myTimePickerToken.earliest$
$myTimePickerToken.latest$
Index with least License usage
$query2$
$myTimePickerToken.earliest$
$myTimePickerToken.latest$
... View more
02-15-2019
09:28 PM
Standalone / Distributed env.? Spunk version..?
Check
https://docs.splunk.com/Documentation/Splunk/7.2.4/Data/Configureindex-timefieldextraction
... View more
02-15-2019
09:08 PM
You are using indexed time extration. You have to supply required fileds props and transforms to the search peers. If you are using heavy forwarder confs should to be in hf.
https://docs.splunk.com/Documentation/Splunk/7.2.4/Data/Configureindex-timefieldextraction
... View more
02-15-2019
08:46 PM
Your data is not dropping that's good.
whats your splunk version ? are you using splunk default cert for ssl?
should be ssl warning / ansible callback 3rd pary callback plugin.
Try to use the curl REST to post the data and see the error. If no issues then have to check the callback plugin.
... View more
02-15-2019
08:22 PM
1 Karma
Hi Ron,
Splunk search filter Inclusion is better than exclusion.
are ("sccm.migrate" OR "configmgr.ssia" OR "configmgr.sql.ssrs" OR "configmgr.nac") these are your account names? if so please mention the Account_Name=<value1> OR Account_Name=<value2> . (Account_Name!="-") is not require sine you are filtering the account names.
index="wineventlog" source="wineventlog:security" (Account_Name="sccm.migrate" OR Account_Name="configmgr.ssia" OR Account_Name="configmgr.sql.ssrs" OR Account_Name="configmgr.nac") | stats count by Account_Name | sort - count | rename Account_Name to "User Name", count to "Number of Entries"
Hope this helps.
... View more
02-15-2019
05:56 PM
As per my understanding, There is no such out of the box functionality to post csv file to remote search head.
Dynamic lookup update from remote Workaround would be use KV Store lookup and REST API to handle it. However you may need a script to handle the csv read and post the data. You have to create the kv-lookup file manually with fields to refer the collection.
Note: you can use "batch_save" to post multiple records but the limitation is 1000 records per POST
You can create, read, update, delete, and manage KV Store data and collections using the Splunk REST API, which you access on the Splunk management port (the default port is 8089).
Sample:
curl -k -u admin:yourpassword -d name=kvstorecoll https://localhost:8089/servicesNS/nobody/search/storage/collections/config
curl -k -u admin:yourpassword https://localhost:8089/servicesNS/nobody/search/storage/collections/config/kvstorecoll -d 'field.id=number' -d 'field.name=string' -d 'field.address=string' -d 'accelerated_fields.my_accel={"id": 1}'
curl -k -u admin:yourpassword https://localhost:8089/servicesNS/nobody/search/storage/collections/data/kvstorecoll -H 'Content-Type: application/json' -d '{"name": "Splunk HQ", "id": 123, "address": { "street": "250 Brannan Street", "city": "San Francisco", "state": "CA", "zip": "94107"}}'
curl -k -u admin:yourpassword https://localhost:8089/servicesNS/nobody/search/storage/collections/data/kvstorecoll/batch_save -H 'Content-Type: application/json' -d '[{"name": "Splunk Sweden"}, {"name": "Splunk Singapore"}]'
Link: http://dev.splunk.com/view/webframework-developapps/SP-CAAAEZG
Hope this helps you!!!
... View more
10-19-2018
01:52 PM
1 Karma
what error you are getting? are you using table / chart?
does "click.value" populating?
refer: http://docs.splunk.com/Documentation/Splunk/7.2.0/Viz/DrilldownIntro
http://docs.splunk.com/Documentation/Splunk/7.2.0/Viz/PanelreferenceforSimplifiedXML#Predefined_drilldown_tokens
add the token in the panel title to check its populating correctly.
" < panel > <title>$click.value$</title>"
... View more
10-19-2018
01:26 PM
when you try to compare the value add double quotes.
$click.value$ as "$click.value$"
so,
case("$click.value$" == "Overview Page",0, "$click.value$" == "Rules Page",1, "$click.value$" == "History Page",2, "$click.value$" == "Settings Page",3, "$click.value$" == "Camera Page",4, "$click.value$" == "Paring (Manage Devices) Page",5, "$click.value$" == "Third-Party Card Page",6, "$click.value$" == "Cloud Page",7, "$click.value$" == "Custom Page",8, 1=1)
would help
... View more
10-19-2018
11:28 AM
Glad that works, Accept the answer.
... View more
06-11-2018
09:15 AM
1 Karma
Hi,
This can be achieve by a simple token you can use refer the below sample.
Description:
Token named "token" can be set to the search based on user selection. With this example i've used the internal index, you may want to try with your index.
Note: This sample will run only you
have access to internal index.
<form>
<label>Sample</label>
<fieldset submitButton="false">
<input type="dropdown" token="token" searchWhenChanged="true">
<label>Your Token</label>
<choice value="index=_internal | head 10 | stats c by host">host</choice>
<choice value="index=_internal | head 10 | stats c by sourcetype, host">sourcetype, host</choice>
<choice value="index=_internal | head 10 | stats c by source, host, sourcetype">source, host, sourcetype</choice>
<default>index=_internal | head 10 | stats c by host</default>
<initialValue>index=_internal | head 10 | stats c by host</initialValue>
</input>
</fieldset>
<row>
<panel>
<table>
<search>
<query>$token$</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
<sampleRatio>1</sampleRatio>
</search>
<option name="drilldown">none</option>
<option name="refresh.display">progressbar</option>
</table>
</panel>
</row>
</form>
Thanks,
V
... View more
10-09-2017
03:53 PM
1 Karma
Check the below app "IMAP Mailbox"
This app will download email messages from an IMAP account/mailbox and index it into Splunk. Each email message will be treated as a separate splunk event.
https://splunkbase.splunk.com/app/1739/#/details
Description and details are available in the app.
Hope this will helps you.
... View more
08-30-2017
10:05 AM
2 Karma
When there is an similar Application comes all the notes will be added into Newnote field.
Try the below search,
... your base search | eventstats values(Note) as Newnote by Application | nomv Newnote
Hope this will helps you.
... View more
08-29-2017
01:55 PM
1 Karma
Have you check your distsearch.conf?
... View more
08-29-2017
01:51 PM
1 Karma
have you tried JXplorer? Check this, http://jxplorer.org/
Read this link, there were plenty of tools for LDAP Browser for linux,
http://www.ldapbrowserlinux.com/
... View more
08-29-2017
11:53 AM
1 Karma
Hi Marcus,
Below steps will help you for the quick fix,
create a script that will download the file and store it in a folder.
Schedule the script with cron tab.
Either monitor the folder and index the data OR use it as lookup. 😉
sample script will be, you have to replace the URL. go to the report you want and download it, check the browser downloaded files and there you can get the url to download.
wget -O <filename> https://data.montgomerycountymd.gov/api/views/j7rm-vyfs/rows.csv?accessType=DOWNLOAD
Hope this will helps you.
... View more
