About MBerikcurtis

MBerikcurtis · ‎02-12-2013

I have a ton of event that contain SourceName="Symantec AntiVirus". How can I exclude these events fro being indexed?

MBerikcurtis · ‎03-30-2012

Perfect! Can't believe I missed that.

MBerikcurtis · ‎03-30-2012

I like to show results only for times between 7pm and 7am Monday through Friday OR anytime on Saturday or Sunday. I'd like to do this within the same search. I'm using: (date_wday="s*" OR (date_hour > 19 AND date_hour < 7))

MBerikcurtis · ‎02-28-2012

I'm sure there is a better way. I'm trying to get a list of hosts for a given time range. The search I'm using now is host=* | table host this can take a long time to run dependent on the time range I'm looking at.

MBerikcurtis · ‎02-06-2012

We have the PDF report server installed but we are having an issue with it for the same dashboard (http://splunk-base.splunk.com/answers/40046/pdf-report-timeout). Can I use the PDF report server to generate on demand PDF reports?

MBerikcurtis · ‎02-03-2012

I have a dashboard that has 10 searches on it. Viewing in a browser looks great. However, when I print via the browser, the output is over 20 pages. The view in the prowser should only generate 2-3 pages max. In addition, a lot of blank pages are printed.

MBerikcurtis · ‎02-03-2012

I have a large dashboard that has 10 different searches on it. This is scheduled to generate a report via the PDF report server each day at 3am. I'm only getting a PDF from 2 out of 10 days. For the ones that fail, I get this error within the email: An error occurred while generating a PDF of this report: Failed to generate PDF: Appserver failed to dispatch report request to https://172.16.253.141:8089/services/pdfserver/renderpdf: Splunkd daemon is not responding: ('The read operation timed out',) Is it possible that the report is taking too long to render and the server times out? When I view the dashboard in the browser, all the searches finish within 1 minute.

MBerikcurtis · ‎01-12-2012

I have created a dashboard that has a time picker on it. When I print the page out of my browser, the time picker does not print. Is there a way I can add some html to my report that would show the range of time that was indicated in the time picker? I need to indicate the range of time the report represents for audit purposes. Yesterday or Last 24 hours is relative from the time the search was run. I need to indicate a firm From and To date on the report.

MBerikcurtis · ‎11-18-2011

I just installed the Web Intelligence. During the first launch, I'm prompted to configure it. When I click OK to configure, I get this: The path '/en-US/custom/webintelligence/WISetup/show' was not found. This page was linked to from http://appsplunk:8000/en-US/app/webintelligence/setup.

MBerikcurtis · ‎11-02-2011

BUT what about remote computers? The only way I see is to copy the windowsupdate.log from each remote computer and have splunk index it.

MBerikcurtis · ‎11-01-2011

this should be the default. Adding 100,200 and 500

MBerikcurtis · ‎09-20-2011

using netstat from a command prompt, do you see the forwarder ports open? default is 9997.

MBerikcurtis · ‎09-20-2011

on line 24, remove < /module> on line 78, add < /module>

MBerikcurtis · ‎09-20-2011

This solution was sent to me by Lincoln at Splunk: sourcetype="*Security" earliest=-3d@d latest=@d | eval day_value = case(date_wday=="saturday", "0", date_wday="sunday", "0", date_wday=="monday", "1", date_wday== "tuesday", "2", date_wday=="wednesday", "3", date_wday=="thursday","4", date_wday=="friday", "5") | eventstats max(day_value) as high_value | where day_value=high_value | eventstats count as "EventCount" by EventCode | table EventCode EventCodeDescription EventCount | sort EventCode | dedup EventCode earliest=-3d@d latest=@d = We always have to go back 3 days to pick up Friday when it's Monday. eval day_value = case(date_wday=="saturday", "0", date_wday="sunday", "0", date_wday=="monday", "1", date_wday== "tuesday", "2", date_wday=="wednesday", "3", date_wday=="thursday","4", date_wday=="friday", "5") = Splunk stores the day of the week (in lowercase) as a meta field for every event. Here, we're just setting numeric values into a field called day_value which allows us to differentiate and ultimately code events from the previous business day. Saturday and Sunday are given values of zero. We need decrementing values for the other days of the week, so we can distinguish the previous day from the two days prior. This was the hardest part for me to figure out. Took a little extra "noodle power." 🙂 eventstats max(day_value) as high_value = The max function of eventstats determines the largest value inserted into the day_value field by the case function above and puts this value into a new field called high_value. If you run the search on Monday, the max value would be 5 which is contained in Friday's events. Remember, eventstats will code every event (including Saturday and Sunday's events with this value in the high_value field). where day_value=high_value = Now, all that's left is to filter out the events that have lower values in the day_value field and we do that easily enough with the where command.

MBerikcurtis · ‎09-20-2011

I'm using index=main earliest=-1d@d latest=@d | stats distinct_count(host) by host | addcoltotals fieldname=sum | rangemap field=sum in an attempt to get a count of hosts in to a single value module on a dashboard. Using this search, I get the name of the first host in the single value module.

MBerikcurtis · ‎09-13-2011

once I put in the missing[ the world started spinning again!

MBerikcurtis · ‎09-12-2011

Could you tell me if Splunk has a way of filtering based on previous business day or previous weekday? I’m using earliest=-1d@d latest=@d to get results from the previous day but that doesn’t help me on Mondays.

MBerikcurtis · ‎09-12-2011

I have implemented the solution posted by acdevlin and it works! I have added dedup so that the search reads sourcetype="*Security" | eventstats count as "EventCount" by EventCode | table EventCode EventCodeDescription EventCount | sort EventCode | dedup EventCode

MBerikcurtis · ‎09-12-2011

I have implemented what you sudgested and am now using: sourcetype="*Security" | stats count first(EventCodeDescription) by EventCode | table EventCode EventCodeDescription count | sort EventCode but still nothing is shown in the EventCodeDescription column.

MBerikcurtis · ‎09-12-2011

I've been filtering Windows Security events for a while now without any issue by using: props.conf [WMI:WinEventLog:Security] TRANSFORMS-wmi=wmisecnull transforms.conf [wmisecnull] REGEX=(?m)^EventCode=(8|33|674|916|4770|5145|5157|4688|4689) DEST_KEY=queue FORMAT=nullQueue then I made these edits props.conf [WMI:WinEventLog:Security] TRANSFORMS-wmi=wmisecnull WMI:WinEventLog:Application] TRANSFORMS-wmi=wmiappnull transforms.conf [wmisecnull] REGEX=(?m)^EventCode=(8|33|674|916|4770|5145|5157|4688|4689) DEST_KEY=queue FORMAT=nullQueue [wmiappnull] REGEX=(?m)^EventCode=(916) DEST_KEY=queue FORMAT=nullQueue after these edits, the events that used to be filter are nolonger filtered.

MBerikcurtis · ‎09-09-2011

amazing! thanks for the fast answer.

MBerikcurtis · ‎09-09-2011

I'm using the search to get a count of Windows Event Codes. If I remove stats count by EventCode, I get the Event Description colum to populate. As soon as I include count, the colum goes blank. sourcetype="*Security" | stats count by EventCode | table EventCode EventCodeDescription count | sort EventCode

MBerikcurtis · ‎05-05-2011

This worked for me as well. Cheers!

Posts	23
Solutions	0
Karma Given	9
Karma Received	13
Member Since	‎05-05-2011

Online Status	Offline
Date Last Visited	‎06-05-2020 02:02 AM

Exclude from index

Need some help with Syntax

list of hosts for a given time range

Printing dashboard out of a browser.

PDF Report timeout

Time Picker on view does not print

Web Intelligence app setup problem

Count of hosts in to Single value dashboard module

Previous business / week day

Filtering Windows Application and Security events

Exclude from index

Re: Need some help with Syntax

Need some help with Syntax

list of hosts for a given time range

Re: Printing dashboard out of a browser.

Printing dashboard out of a browser.

PDF Report timeout

Time Picker on view does not print

Web Intelligence app setup problem

Re: Monitoring Windows Updates from Splunk

Re: How to expand "Results per Page" dropdown? WIT...

Re: Running splunk command returns no output

Re: Error on dashboard - splunk agent monitoring a...

Re: Previous business / week day

Count of hosts in to Single value dashboard module

Re: Filtering Windows Application and Security eve...

Previous business / week day

Re: Problem with count

Re: Problem with count

Filtering Windows Application and Security events

Re: Problem with count

Problem with count

Re: Error on dashboard - splunk agent monitoring a...