Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Are you a member of the Splunk Community?
Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- Find Answers
- :
- About nswondem
nswondem
Path Finder
Member since:
12-16-2013
06-05-2020
Community Statistics
| Posts | 16 |
| Solutions | 2 |
| Karma Given | 2 |
| Karma Received | 3 |
| Member Since | 12-16-2013 |
Activity Feed
- Karma Re: Splunk ES Duplicate of Notable Events displaying in Incident Review Dashboard for starcher. 06-05-2020 12:50 AM
- Got Karma for Re: In Splunk 7.0.1 Enterprise, how do I get data from my machine to the Splunk server?. 06-05-2020 12:50 AM
- Got Karma for Re: Is there a potential data loss with UDP?. 06-05-2020 12:50 AM
- Got Karma for Re: In a visualization that returns successful job statues, can you help me with an issue I'm having with single value coloring?. 06-05-2020 12:49 AM
- Karma Re: Alert - Subject - Possible to add host name? for the_wolverine. 06-05-2020 12:46 AM
- Posted Re: Null value for urgency in incident_review lookup on Splunk Enterprise Security. 09-24-2019 08:43 AM
- Posted Re: iplocation command showing wrong location for some of the IPs on Splunk Dev. 01-17-2019 09:38 AM
- Posted Re: Is there a potential data loss with UDP? on Getting Data In. 01-17-2019 09:35 AM
- Posted Re: What is the best analogy for explaining 'sourcetypes'? on Getting Data In. 01-16-2019 09:19 AM
- Posted Re: How do I extract field values from XML logs? on Dashboards & Visualizations. 10-10-2018 07:28 AM
- Posted Re: Why am I unable to get to _internal index with a custom role? on Security. 10-09-2018 11:15 AM
- Posted Re: How do I count time differently than 00:00 ~ 24:00? on Dashboards & Visualizations. 10-09-2018 10:59 AM
- Posted Re: In Splunk 7.0.1 Enterprise, how do I get data from my machine to the Splunk server? on Getting Data In. 10-05-2018 12:41 PM
- Posted Re: In a visualization that returns successful job statues, can you help me with an issue I'm having with single value coloring? on Dashboards & Visualizations. 10-05-2018 12:39 PM
- Posted Re: How come the text input token is not filtering out all results? on Splunk Search. 10-05-2018 12:09 PM
- Posted Re: How come the text input token is not filtering out all results? on Splunk Search. 10-05-2018 12:07 PM
- Posted Re: How to remove something from being indexed? on Deployment Architecture. 06-07-2018 12:23 PM
- Posted Re: Logging Volume by event on All Apps and Add-ons. 05-31-2016 12:00 PM
- Posted Re: Single value visualization showing output as "N/A" instead it should show 0 on Dashboards & Visualizations. 05-31-2016 11:27 AM
- Posted Re: Sometime my dbconnect is to disabled. on All Apps and Add-ons. 05-31-2016 11:25 AM
Topics I've Started
No posts to display.
09-24-2019
08:43 AM
One of my customers had this situation before and it turned out that the severity was being assigned an unknown value in the correlation search. Take a look at the ES documentation for determining urgency.
https://docs.splunk.com/Documentation/ES/5.3.1/User/Howurgencyisassigned
In the customer's case, the assigned priority was being overwritten in the correlation search. It was being set to a value that was not in the blue or gold sections of the urgency table (see link).
So for example ES expects the Assigned Priority to be Unknown, Low, Medium, High, or Critical. If your correlation search mistakenly sets a field called priority to Informational then ES cannot correctly calculate the urgency. You will get a NULL value.
... View more
01-17-2019
09:38 AM
You may need to update your iplocation source database. Check out this link. Also, ensure that its not an internal IP.
https://docs.splunk.com/Documentation/Splunk/7.2.3/SearchReference/Iplocation
... View more
01-17-2019
09:35 AM
1 Karma
By definition, UDP is not reliable. Try the tuning but remember that on the network layer UDP is not going to try. No handshake.
... View more
01-16-2019
09:19 AM
Your explanation sounds very much like the description of objects in object oriented programming. The sourcetype allows you to group data in similar object types. This makes it easier to write configurations such as field extractions, tagging, etc on each sourcetype. Also, when you add new data, if it already fits one of the molds that you already have, you don't need to rewrite the configs all over again.
... View more
10-10-2018
07:28 AM
Hello aruotolo,
Please refer to a previously answered question at https://answers.splunk.com/answers/587570/index-time-field-extraction-for-xml-data-1.html
Thanks
nswondem
... View more
10-09-2018
11:15 AM
Hi Brent,
Take a look at the descriptions of these two settings in the docs https://docs.splunk.com/Documentation/Splunk/7.2.0/Admin/Authorizeconf.
Are you specifying an index in the search (index=blah | ...)? Your settings show that the indexes to search by default are the predix indexes. It does not include _internal. So you will get that error.
Nadine
... View more
10-09-2018
10:59 AM
Hi hyngjoon,
The goal would be to identify whether an event occurred yesterday or today, then compare the datehours.
Calculate the start of yesterday
Calculate the start of today
Get the datehour using strftime
Convert the hr to a number (since it is a string)
Determine whether the event time is yesterday and the hour is after 12pm OR whether the event time is today and the hour is before 2am.
Nadine
...
| eval yesterday=relative_time(now(), "-1d@d")
| eval today=relative_time(now(), "@d")
| eval hr=strftime(_time, "%H")
| eval hr=tonumber(hr)
| where (_time >= yesterday AND hr > 12) OR (_time >= today AND hr <=2)
... View more
10-05-2018
12:41 PM
1 Karma
Hello bccocek,
Do you have the Windows TA installed? Also, you may want to consider the inputs specified in this previous Answers response.
https://answers.splunk.com/answers/134501/applocker-monitoring.html
Good luck!
... View more
10-05-2018
12:39 PM
1 Karma
The following lines tell Splunk that you would like to use teechat as the unit and to place the unit before the value:
<option name="unit">teeChat</option>
<option name="unitPosition">before</option>
So it appears that Splunk is doing as asked. You might want to consider using an if statement to set count to "teechat" if count is 1. That way the only value being passed to the visualization is teechat.
| eval count=if(count=1, "teechat","something else") | table count
... View more
10-05-2018
12:09 PM
Here's an example:
[search index="cms_app_server" earliest="10/01/2018:00:00:00" latest="10/01/2018:24:00:00" Application=* "$appfield$" | fields VM Application]
... View more
10-05-2018
12:07 PM
Consider adding Application=* to eliminate any null values.
... View more
06-07-2018
12:23 PM
Is this a test system? If so, you may try the delete command. Be careful though. You also want to disable the input once you find it.
... View more
05-31-2016
12:00 PM
Are you asking for a method to determine license usage for index=java? If so, this question has been answered in this thread - https://answers.splunk.com/answers/4897/how-to-determine-daily-license-usage-in-gb.html.
... View more
05-31-2016
11:27 AM
Please see https://answers.splunk.com/answers/49559/single-value-return-n-a-instead-of-0.html.
... View more
05-31-2016
11:25 AM
This should be helpful - http://docs.splunk.com/Documentation/DBX/1.2.0/DeployDBX/Troubleshoot.
... View more
12-19-2013
01:41 PM
Did you get an answer to this question? I am running a single server with a data input from a local Mysql database. I get the following error message when I run the search query. However, the error is not consistent. In other words, I get the error only about 50% of the time with the same search query.
Search query:
host="XXXX" sourcetype="dbmon:kv" | geoip source_ip
Error:
Traceback (most recent call last):
File "C:\Program Files\Splunk\etc\apps\maps\appserver\modules\GoogleMaps\GoogleMaps.py", line 53, in generateResults
for result in getattr(job, entity_name)[offset:end]:
File "C:\Program Files\Splunk\Python-2.7\Lib\site-packages\splunk\search_init.py", line 1332, in __getitem_
self.job.pushValidation()
File "C:\Program Files\Splunk\Python-2.7\Lib\site-packages\splunk\search_init_.py", line 637, in pushValidation
raise splunk.SearchException, fatality
SearchException: Error in 'script': Getinfo probe failed for external search command 'geoip'
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:03 AM
|
