Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About chalak
chalak
Path Finder
Member since:
08-08-2017
06-05-2020
Community Statistics
| Posts | 15 |
| Solutions | 1 |
| Karma Given | 1 |
| Karma Received | 1 |
| Member Since | 08-08-2017 |
Activity Feed
- Karma Re: Alert on any value in any column which exceeds a threshold? for somesoni2. 06-05-2020 12:49 AM
- Got Karma for Magnifying glass/drill-down for alerts is not working on Incident Posture in Alert Manager. 06-05-2020 12:49 AM
- Posted Re: Longest period of time without any events in an index on Alerting. 05-01-2019 07:59 AM
- Posted Re: Longest period of time without any events in an index on Alerting. 05-01-2019 07:56 AM
- Posted Longest period of time without any events in an index on Alerting. 04-26-2019 09:44 AM
- Tagged Longest period of time without any events in an index on Alerting. 04-26-2019 09:44 AM
- Tagged Longest period of time without any events in an index on Alerting. 04-26-2019 09:44 AM
- Tagged Longest period of time without any events in an index on Alerting. 04-26-2019 09:44 AM
- Tagged Longest period of time without any events in an index on Alerting. 04-26-2019 09:44 AM
- Tagged Longest period of time without any events in an index on Alerting. 04-26-2019 09:44 AM
- Posted Re: Is there a way to resolve multiple incidents at once in Alert Manager? on All Apps and Add-ons. 06-01-2018 07:36 AM
- Posted Magnifying glass/drill-down for alerts is not working on Incident Posture in Alert Manager on All Apps and Add-ons. 03-07-2018 02:36 AM
- Tagged Magnifying glass/drill-down for alerts is not working on Incident Posture in Alert Manager on All Apps and Add-ons. 03-07-2018 02:36 AM
- Tagged Magnifying glass/drill-down for alerts is not working on Incident Posture in Alert Manager on All Apps and Add-ons. 03-07-2018 02:36 AM
- Tagged Magnifying glass/drill-down for alerts is not working on Incident Posture in Alert Manager on All Apps and Add-ons. 03-07-2018 02:36 AM
- Tagged Magnifying glass/drill-down for alerts is not working on Incident Posture in Alert Manager on All Apps and Add-ons. 03-07-2018 02:36 AM
- Posted Re: Alert manager app not showing history of an alarm on the Incident Posture tab. on All Apps and Add-ons. 03-05-2018 06:30 AM
- Posted Alert manager app not showing history of an alarm on the Incident Posture tab. on All Apps and Add-ons. 03-05-2018 03:35 AM
- Tagged Alert manager app not showing history of an alarm on the Incident Posture tab. on All Apps and Add-ons. 03-05-2018 03:35 AM
- Tagged Alert manager app not showing history of an alarm on the Incident Posture tab. on All Apps and Add-ons. 03-05-2018 03:35 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 1 | |||
| 0 | |||
| 0 |
05-01-2019
07:59 AM
Hi niketnilay, thank you for the suggestion. Similarly with the previous comment from andonio, the challenge with this is that it will take the last event in the index, which could have happened a second ago. But before that there could have been two weeks period without an event. Would you have a clue how to effectively find out the longest period of time between any events within the given time-frame (a month) with one additional corner case (when there would be completely empty index for a month and just 10 events at the beginning of the month with the same timestamp? In that case the time delta would be 0 between the events, but effectively it would be 29days (which would be correctly pick-up by your search query)
... View more
05-01-2019
07:56 AM
Hi Adonio, thank you for the suggestion. I have tried this before, the challenge with this is that it will take the last event in the index, which could have happened a second ago. But before that there could have been two weeks period without an event. Would you have a clue how to effectively find out the longest period of time between any events within the given time-frame (a month) with one additional corner case (when there would be completely empty index for a month and just 10 events at the beginning of the month with the same timestamp?
... View more
04-26-2019
09:44 AM
Ultimate goal is to find out what is the longest period of time without any event in an index within last month ( and to this across all the indexes automatically, without necessity to specify the indexes within any query)
Currently I have two suggestions:
The first one works across all indexes:
| metasearch index=* | transaction maxevents=2 index host | stats max(duration) AS current_max_delay by index, host
The second one works only for one
index (not helpful, placing here just for possible inspiration):
index=INDEX_A | delta time AS AtimeDelta | eval Apossitive_delta = (abs(AtimeDelta)/3600) | stats max(Apossitive_delta) as A_MaxDelta
FIRST question: How to solve a situation when there might be just one event in last month, where I would like to identify not the delta between events ( as there are no other), but between the event and the current time?
SECOND question: There might be many indexes and large quantity of data. Is there any way how to make this more efficient?
Many thanks for any suggestions.
... View more
06-01-2018
07:36 AM
Thanks for the information.
... View more
03-07-2018
02:36 AM
1 Karma
Hello,
Please would you be able to help?
The magnifying glass/drill-down for alerts is not working for significant number of alerts. When clicked the magnifying glass next to a particular alert the AWS application is opened with the appropriate time range, however the search part of the URL is missing. Effectively the redirection from the icon is as follows:
splunk_app_aws/search?q=search &earliest=YYYY-MM-DD...&latest=YYYY-MM-DD...
Most of these alerts are based on searches which uses accelerated data models. I have noticed that an alert (in index=alerts) has the attribute eventSearch which does not contain full search query.
Thank you for any suggestions.
... View more
03-05-2018
06:30 AM
If anyone would be interested I found a solution:
- alert_manager_admin role need to have the index ("alerts") enabled to be searched by default in the Access controls » Roles » alert_manager_admin
... View more
03-05-2018
03:35 AM
Hello all,
Would you be able to advise how to troubleshoot/enable a displaying history of a particular alarm on the Incident Posture tab in Alert manager. If I change the status, ownership, urgency, comment particular alarm and save these changes. If click on the alarm afterwards through the narrow directly on the left of that alarm, no history is presented.
Thanks for possible advises.
... View more
03-05-2018
01:59 AM
Hi all,
Would you be please able to advise how to achieve closing multiple alerts at once through the Alert Manager app directly (Ideally on the incident posture tab). At the bottom part of the Incident posture tab can be 10 alerts, is there a possibility to have for example checkbox to select certain alerts and close it? Would be there any similar possibility how to achieve this idea?
... View more
02-28-2018
02:27 AM
Exactly what i was looking for. Thank you.
... View more
02-26-2018
07:18 AM
I see your point, however I am trying to achieve a table with the information: IPs (which exceeded the threshold) + number of requests.
Time | 192.168.0.3 | ...
2:00 | 101 | ...
Would you be able to help me to achieve this kind of output?
... View more
02-26-2018
06:17 AM
Thank you for the suggestion. It will leave only values that are higher than the threshold. However it keeps all the columns with all IPs that are not higher as well, with null values. Could you please suggest how I would be able to remove all the null values? (so I would be left only with table : 2:00am | 101 )
I have tried to use CASE with one expression instead of IF command, however my idea does not have the wanted effect as it also displays all columns including the null ones.
... View more
02-22-2018
04:53 AM
I have list of IPs and a number of requests summarized in statistics tab with a following query:
| datamodel X Y search
| timechart span=1h count(request) as num by ip usenull=f useother=f limit=0
the output is in the following format :
Time | 192.168.0.1 | 192.168.0.2 | 192.168.0.3 | ...
1:00 | 20 | 30 | 50 | ...
2:00 | 30 | 50 | 101 | ...
3:00 | 10 | 25 | 30 | ...
I would like to alert if any value in the entire table exceeds a given threshold? (eg. threshold > 100). How can I achieve this?
I have tried several ways, inlcuding: | search num > 100; however, that is not working.
Could you please help me out here.
... View more
- Tags:
- splunk-enterprise
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:03 AM
|
