Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About castle1126
castle1126
Communicator
Member since:
05-28-2010
06-05-2020
Community Statistics
| Posts | 53 |
| Solutions | 0 |
| Karma Given | 10 |
| Karma Received | 20 |
| Member Since | 05-28-2010 |
Activity Feed
- Got Karma for Revisiting REGEX to extract domain name from an FQDN. 10-29-2020 08:50 AM
- Karma Re: How can I auto refresh my dashboard? for Simeon. 06-05-2020 12:45 AM
- Karma Re: Multi line log issue for southeringtonp. 06-05-2020 12:45 AM
- Karma Re: distributed search issue - duplicate licenses for ftk. 06-05-2020 12:45 AM
- Karma Re: Logs ingested via sinkhole are not receiving the appropriate sourcetype for jrodman. 06-05-2020 12:45 AM
- Karma Re: Set hostname correctly for SYSLOG input coming into Forwarder for tgow. 06-05-2020 12:45 AM
- Karma Re: issue with transactions for southeringtonp. 06-05-2020 12:45 AM
- Karma Calculate time avg time and std deviation between log entries for tradecraft1914. 06-05-2020 12:45 AM
- Karma Re: Calculate time avg time and std deviation between log entries for gkanapathy. 06-05-2020 12:45 AM
- Karma Way to move warm data to cold by time for bmaupin. 06-05-2020 12:45 AM
- Got Karma for Set hostname correctly for SYSLOG input coming into Forwarder. 06-05-2020 12:45 AM
- Got Karma for How do I search for the = character?. 06-05-2020 12:45 AM
- Got Karma for Can I add text to return value of eval/case?. 06-05-2020 12:45 AM
- Got Karma for Can I add text to return value of eval/case?. 06-05-2020 12:45 AM
- Got Karma for Can I add text to return value of eval/case?. 06-05-2020 12:45 AM
- Got Karma for Revisiting REGEX to extract domain name from an FQDN. 06-05-2020 12:45 AM
- Got Karma for Re: Custom view - pie chart not showing all data. 06-05-2020 12:45 AM
- Got Karma for Custom view - pie chart not showing all data. 06-05-2020 12:45 AM
- Got Karma for Custom view - pie chart not showing all data. 06-05-2020 12:45 AM
- Got Karma for Trying to extract field, from a CSV extracted fields. 06-05-2020 12:45 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 1 | |||
| 1 | |||
| 0 | |||
| 0 | |||
| 3 | |||
| 2 | |||
| 0 | |||
| 2 | |||
| 0 |
06-20-2011
10:39 AM
I have an instance where another group of people want to receive an exact copy of data that is indexed on my main Splunk server. I've modified the outputs.conf on my server and the second server receives the data and indexes accordingly.
I've come across a problem, though. My splunk environment is production, with a large number of sources being indexed on my server. The second server, though, has the tendency of being rebooted, services stopped, etc. This wreaks havoc in my production environment - when my server cannot forward it shuts down its listening ports, which causes all my forwarders to shut off their listening ports, and so on and so on.
Is there a way that I can tell my production system that if system #2 is down and forwarding is stopped to continue listening and indexing data?
Thanks!
... View more
- Tags:
- forwarding
- indexing
05-24-2011
08:37 AM
I've tried that, but my issue is the pattern also includes the percent sign. When I try index=proxy uri="abc=321%f=1" I get no results. Thoughts?
... View more
05-24-2011
07:50 AM
1 Karma
In many of our web proxy logs we see the equal sign (=) included in many URLs. I'm searching for certain patterns that include the equal sign - for instance, abc=321%f=1.
I've tried searches like:
index=proxy uri=*abc\=321\%f\=1
index=proxy "uri=*abc\=321\%f\=1"
index=proxy | regex _raw=.*abc\=321\%f\=1.*
all come back without any results. I know the IP address of a client and server that has this pattern in it's URI. So when I run the search against those IPs I get the event that shows the URI I'm looking for.
Is there a special way to format searches to look for the equal sign?
Thanks
... View more
- Tags:
- search
04-07-2011
04:38 PM
The username field does not exist from the third index.
... View more
03-25-2011
02:36 AM
1 Karma
Hi,
I have three indexes that I'm trying to build a transaction from. the first two indexes each have a field named User_Name, which makes the transaction statement pretty easy. This creates the base transaction I'm looking for.
The first index also has a field called ip. What I want to do is use this field to retrieve the events from the third index into the first transaction (unfortunately the User_Name field does not exist in the third index). I've tried so many different searches, all never result in a transaction containing all the pertinent records.
Any thoughts on how to create this type of transaction?
Thanks!!
... View more
- Tags:
- transactions
01-12-2011
05:54 PM
Hey gkanapathy, could you make your comment an answer so I could vote for it answering my question?
... View more
01-12-2011
05:53 PM
Actually the distinct count on IP by subject seems to do it. Thanks gkanapathy!!
... View more
01-12-2011
04:56 PM
I'm trying to come up with a search that would help me find emails that share the same subject line but the IP address of the sender varies from message to message (as if a bot network sends a SPAM campaign).
So far I'm able to get the base information via this search:
index=smtp | transaction qid keepevicted=true | table subject,ip
I'm not sure if there's a way in Splunk to evaluate the common "subject" against the different IP addresses, with the results just showing the common subjects that have different IP addresses. Or should I look to export this table to a CSV then write another script that would parse the CSV?
Any thoughts or input would be great!
Thanks!!
... View more
- Tags:
- search-help
12-30-2010
05:45 PM
No I haven't tried with the Splunk PEMs created during install. These are certs built against our PKI infrastructure here, and check out as valid and correct within our environment.
... View more
12-29-2010
09:15 PM
Trying to configure SplunkLightForwarder with SSL for both encryption and mutual authentication, but no connection is made. On the receiver the connection is failing with the error message:
ERROR TcpInputProc - Error encountered for connection from host=10.2.3.4, ip=10.2.3.4. error:140890B2:SSL routines:SSL3_GET_CLIENT_CERTIFICATE:no certificate returned
On the sender side:
sslCertPath=$SPLUNK_HOME/etc/auth/cert/sender.pem
sslPassword=password
sslRootCAPath=$SPLUNK_HOME/etc/auth/cert/root.crt
sslVerifyServerCert=true
sslCommonNameToCheck=receiver.example.com
On the receiver side:
[splunktcp-ssl://12345]
disabled = false
[SSL]
serverCert=$SPLUNK_HOME/etc/auth/cert/reciever.pem
password=password
RootCA=$SPLUNK_HOME/etc/auth/cert/root.crt
dhfile=$SPLUNK_HOME/etc/auth/cert/dhparams.pem
requireClientCert=true
Thoughts anyone???
... View more
12-29-2010
04:39 PM
1 Karma
I ended up using this option, which seems to fix the issue I was having:
0
... View more
12-15-2010
06:50 PM
OK. But not knowing too much on the "if" logic, could you add the text as I am looking for? If so could you give me an example?
... View more
12-14-2010
04:53 PM
3 Karma
I'm writing a search that performs a simple eval:
eval changed = case (NOT address="-",address,NOT city="-",city,NOT state="-",state)
One thing I want to do is add some text value to the returned value of the case, based on which boolean worked. For instance, if the address <> "-" I want to return "Address changed to", followed by the value of the field "address", to the new field named "changed".
Is there a way to get the case statement to return that sort of result?
... View more
- Tags:
- eval
12-09-2010
07:32 PM
I copied/pasted this REGEX into a field extract. It does grab the different .co.xx domains, but now Splunk doesn't show the other "normal" domains, like google.com, etc. I've tested the REGEX in RegexBuddy and it does extract correctly.
Any idea what may be missing?
... View more
12-09-2010
07:03 PM
2 Karma
I've read and used the REGEX commands in this URL: http://answers.splunk.com/questions/8028/extracting-domain-name-out-of-a-url, but still come across issues with my extractions. In many cases the logs will have domains that end in .co.cc, .co.uk and .co.au - to name a few. The REGEX examples in the link above only extract the tail end - for example .co.cc. I need to figure out how to grab the name prior - for example guardian.co.uk.
Any ideas on how to get this REGEX to work?
... View more
- Tags:
- regex
12-03-2010
02:57 PM
I had previously posted this question earlier: http://answers.splunk.com/questions/9264/am-i-bumping-into-limits-issue-with-subsearch-results. I've done some deeper digging and I believe I'm having a general issue with transactions.
I've done a simple search over an index for a 15 minute window and come up with 75,000 events returned. When I run a simple search to build the transactions ( index=smtp [search index=smtp | fields + messageid] | transaction messageid ) I end up receiving the same error:
Error in 'UnifiedSearch': Unable to parse the 'The specified search is too large. Please try to simplify your search.
What can be done to help resolve this issue?
Thanks!
... View more
- Tags:
- transactions
12-01-2010
06:40 PM
Nick, I've tried using the search that you added to your updated answer, but still no luck. I do not get the information required. Any other ideas?
... View more
12-01-2010
06:38 PM
2 Karma
Hi,
One of the pieces of a custom app written for us takes some information from a CSV file and creates a pie chart. The XML file that defines the custom views has this section that takes information from a CSV and displays the pie chart:
<chart>
<title>Type</title>
<searchName>LookupQuery - Count by Type</searchName>
<option name="charting.chart">pie</option>
<option name="drilldown">none</option>
</chart>
The pie chart shows up nicely, but it only shows 10 elements or pieces of the pie. Running the search manually shows there are more entries than the 10 displayed. Is there a way to code into the XML an option that will show all elements from the CSV file in the pie chart?
Thanks!
... View more
- Tags:
- charting
- simple-xml
11-26-2010
07:37 PM
Nick, unfortunately neither search works for me. The mail gateway we are using does not put all values in one record/line for me. Each line has a different value I need (from, to, ip, subject, etc). The line that has the rule is a line unto itself with no other fields I'm looking for. So the results of the first search "rule=x" never returns an IP, subject, etc. This is why I run the initial search as a subsearch, then feed the messageid field back to then do the transaction with which then gives me the fields I'm looking for - from, to, etc.
... View more
11-24-2010
02:32 PM
Hey Nick, what actually is returned from the subsearch is tens of thousands of rows - each row different from the others, with a unique messageid, different timestamps, etc. So running DEDUP won't help in this situation, unfortunately.
I'm wondering if I'm relegated to having to run the search over a smaller timeframe. In my case not run the search over a month window, but run one search for each day of the month. Not the most efficient way of getting the output, but not sure what else to do.
... View more
11-23-2010
11:59 PM
As you can see from the inner search, I'm only grabbing the messageid where the rule=x. So the messageid field coming out of the subsearch is unique, so a dedup won't help much.
One thing I've noticed is that by running this search over a 30 day window (which is what the users here are looking for) causes the error. But if I break the search down to 4 hours or a day, things run OK.
... View more
11-23-2010
11:54 PM
Hey Nick, here's the search I was running:
index=smtp sourcetype=smtp [search index=smtp sourcetype=smtp rule=x | fields + messageid] | transaction messageid | search NOT ip=127.0.0.1 score<50 | table messageid ip envfrom envto subject
... View more
11-23-2010
08:49 PM
Hi,
I have come across an issue similar to this link on Answers: (http://answers.splunk.com/questions/3092/cant-get-past-subsearch-limit). If I run a simple search ( sourcetype=smtp | fields messageid ) over a set amount of time I get over 15,000 results. When I change this search to make it a subsearch
index=smtp sourcetype=smtp [search index=smtp sourcetype=smtp rule=x | fields + messageid] | transaction messageid | search NOT ip=127.0.0.1 score<50 | table messageid ip envfrom envto subject
I end up getting the error "Error in 'UnifiedSearch': Unable to parse the 'The specified search is too large. Please try to simplify your search.' search."
The contents of the limits.conf are:
[subsearch]
maxout = 100000
[format]
maxresults = 100000
After reading the link above I've tried adding the pipe to the subsearch for "format maxresults=20000", but I continue to get this error.
The server is running Splunk 4.1.5 (64 bit on RHEL 5.4). What do you think I'm missing?
Thanks!
... View more
