About Ayn

Ayn · ‎08-26-2014

Exactly how does your complete search string in Splunk look?

Ayn · ‎08-26-2014

I imagine the semicolon (;) shouldn't be there?

Ayn · ‎08-26-2014

Please define "digital intelligence"? To me it sounds like a very generic phrase that could be used to describe pretty much anything.

Ayn · ‎08-25-2014

Not sure I follow your exact use-case. A datamodel is not a means of storage, it is a way of representing data already that already exists in your index. This model can then be used by at least pivot and tstats - you can add your filters there. Or, you can do it by adding new constraints in the model itself. I don't know what you mean by "running the whole model" - a regular search with a username constraint like " ... username=foo " isn't looking at all the data in the timerange, it only grabs data which matches the constraint. It's the same with data models. Perhaps if you elaborated a bit more on your exact use-case it would be possible to post a more meaningful response.

Ayn · ‎08-25-2014

Well not custom really, it's what Squid comes with by default out of the box. But yeah, assumptions regarding the format are definitely made.

Ayn · ‎08-25-2014

You're pretty much on your own - Splunk's way of grabbing this data IS via forwarders. If your customer don't want forwarders, there's no ready-made alternate solution. You should be spending your time explaining this to your customer instead.

Ayn · ‎08-24-2014

Yes, that is correct.

Ayn · ‎08-24-2014

You have a transform name mismatch between your props.conf and transforms.conf. In props.conf you call the transform "WhirlpoolMGWBad" whereas you call the transform "WhirlpoolMWGBad" (you've switched the W and G) in transforms.conf.

Ayn · ‎08-22-2014

You really don't provide any details on what you're trying to achieve so it's hard to give really useful advice, but you could look into the map command which does something similar to what you're describing. That said, it's highly likely you could find an even better solution that doesn't involve looping searches like this. If you described your exact problem, your data, your searches more chances are we can help you out with finding alternate solutions.

Ayn · ‎08-22-2014

Nope, there's no such configuration setting. Your problems are due to something else. I don't know exactly what unfortunately, but some troubleshooting tips: Check if events are actually coming in but for some reason getting a wrong timestamp, by doing a realtime search for your host. Or run a search for your host and use the _index_earliest parameters, for instance " _index_earliest=-15m " Check splunkd.log for errors related to these events.

Ayn · ‎08-21-2014

Hm? Splunk doesn't open port 443 at all unless you configured it to do so in some way. It may listen to ports 9997 (log receiving), 8089 (intra-Splunk-traffic) or 8000 (splunkweb) depending on how you configured it, but 443, no.

Ayn · ‎08-21-2014

... NOT yourfield=*

Ayn · ‎08-21-2014

It is what it says - you have an invalid key in your inputs.conf. It's supposed to be "disabled", not "disable". On the other hand, the default for that value is 0 anyway, so it won't make a difference - the stanza should be applied anyway.

Ayn · ‎08-19-2014

earliest and latest only work when you use them in the base search - that is, the implicit search command that runs first of all as the first command in the search pipeline. Your search currently has a base search consisting ONLY of what the subsearch returns. You should rewrite the search so that instead of [|inputlookup Master.csv | where cab!="NULL" AND subbranch="Act" | fields username ] | search index="WMICustom" sourcetype="WMICustom" earliest=-30d latest=+6h Message="*\\ABCD\\*" you do [|inputlookup Master.csv | where cab!="NULL" AND subbranch="Act" | fields username ] index="WMICustom" sourcetype="WMICustom" earliest=-30d latest=+6h Message="*\\ABCD\\*" and your earliest/latest parameters will work.

Ayn · ‎08-17-2014

The output will not be what you want, because you're comparing two sets that will be completely different. The first set will have a number of values for _time that correspond to the time periods the first search covers, which is from 3 days ago up until 2 days ago. The second set on the other hand will have times that include the last day up until now. So set diff will look at these sets, compare them and see that these are different on every line. I'm not sure I follow what you want to do with timechart if all you want is two sets of IP's (also not sure what the eval command before that is for). If you tell us more about what you're trying to achieve it will be easier to help you. set diff would be one option, but this sounds like something that should be doable just using subsearches as well.

Ayn · ‎08-14-2014

As long as you separate the installation directories there won't be a problem. This is what the wiki refers to. It doesn't matter which partition each instance is on.

Ayn · ‎08-11-2014

Easiest is to just create a search that will match the events from both indexes. (index=index1 name=John) OR (index=index2 userId=John) You don't explain how the search in Question 1 or 2 is supposed to work, so it's hard to give specific advice. What input will you give? What output do you want?

Ayn · ‎08-04-2014

Well, yes...you said it yourself, hold ctrl 🙂 Unless I'm misinterpreting you, because from the search view I'm thinking about you only do a single click, not a double click.

Ayn · ‎07-15-2014

Could you post relevant configs?

Ayn · ‎07-15-2014

Best practice in general is to run applications as non-admin users whenever possible. This is a defense-in-depth thing - if an attacker were somehow to be able to compromise the Splunk instance in one way or another and access the underlying operating system through it, it's obviously preferable that Splunk (and therefore the attacker in our scenario) doesn't have administrative privileges.

Ayn · ‎07-15-2014

Easiest thing would be to set the correct index directly in inputs.conf on the forwarder. [monitor:///app_qa/vodn_01/logfiles/current/bipc9996.stdout] index = RATABASE_SIT2 ... Otherwise if you don't want that for some reason, this can be done almost like what you've pasted but NOT on the forwarders - it needs to go on the full Splunk instance that performs parsing of the logs, which is often your indexers. props.conf: [source::/app_qa/vodn_01/logfiles/current/bipc9996.stdout] TRANSFORMS-routing_SIT2_bipc9996 = index_redirect_to_RATABASE_SIT2_bipc9996 transforms.conf: [index_redirect_to_RATABASE_SIT2_bipc9996] REGEX = . DEST_KEY = _MetaData:Index FORMAT = RATABASE_SIT2 As you can see I'm simply using "." as regex - this is because the source matching was already performed in props.conf, so no further matching should be needed.

Ayn · ‎07-15-2014

Check local firewall rules. Wireshark/tcpdump will pick up this traffic even if it is then blocked by iptables, so it will look fine even though the traffic is not making it to Splunk.

Ayn · ‎07-15-2014

If you specify index=someindex in your monitor section in inputs.conf, that will change which index the data is sent to unless you have some transform changing that at a later stage.

Ayn · ‎07-10-2014

No, not really. Time range for metadata only affects which entries that will be returned based on recentTime and lastTime. May I suggest another option - use metasearch instead. As a bonus this also enables you to split your stats by multiple fields if you want (so for instance you could do stats count by host,sourcetype). This query should give you something similar to what you get with metadata : | metasearch earliest=-1d | stats latest(_time) as lastTime,count by host

Ayn · ‎07-09-2014

Assuming each line in the log file is treated as one event in Splunk: source="yoursource" | head 1000000

Posts	3370
Solutions	730
Karma Given	1392
Karma Received	3244
Member Since	‎02-28-2010

Online Status	Offline
Date Last Visited	‎06-05-2020 02:02 AM

Backslashes being doubled

How to show events per second in timechart regardl...

How to have a results table always display newest ...

Using host tags (or similar) when searching on fie...

How can i change the time format in Splunk web?

Re: Why am I getting errors writing a query after ...

Re: Why am I getting errors writing a query after ...

Re: What are possible Splunk Digital Intelligence ...

Re: Why Can't I use a datamodel backwards?

Re: Why am I unable to extract fields in Splunk fo...

Re: How to get data into Splunk from Ubuntu Linux ...

Re: Can a universal forwarder send cooked data to ...

Re: Why is nullQueue configuration not working?

Re: Combining searches

Re: Is there a configuration that would set Splunk...

Re: disable port 443 on indexer

Re: How to write a search that shows results whene...

Re: Why am I getting error message 'invalid key in...

Re: Why earliest and latest do not work in my sear...

Re: How to find differences between two searches w...

Re: Can the splunk forwarder and the splunk instan...

Re: How to join two indexes by non unique fields?

Re: Search filter shortcut for "NOT"

Re: Error with blacklisting 4662 events in inputs....

Re: Should we run Splunk as root or non-root user?

Re: Routing Data to specific index based on filena...

Re: Why isn't syslog data being indexed by Splunk ...

Re: Data going to wrong index

Re: |metadata - Need results for Custom time range

Re: search by linecount last 1 million lines.

Join the Conversation