Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About BobM
BobM
Builder
Member since:
03-09-2010
06-05-2020
Community Statistics
| Posts | 168 |
| Solutions | 40 |
| Karma Given | 70 |
| Karma Received | 229 |
| Member Since | 03-09-2010 |
Activity Feed
- Got Karma for Re: crcSalt issue. 04-25-2022 09:42 AM
- Got Karma for Re: how to delete old date from splunk. 01-03-2022 02:59 PM
- Got Karma for Re: crcSalt issue. 12-01-2021 06:30 PM
- Got Karma for Re: Merge events base on common field. 09-21-2021 11:46 AM
- Got Karma for Re: Merge events base on common field. 08-19-2020 12:49 PM
- Karma Re: Trial version of Enterprise Security for ekost. 06-05-2020 12:47 AM
- Karma Re: Is default deploymentclient.conf under $SPLUNK_HOME/etc/system/default? for bmunson_splunk. 06-05-2020 12:47 AM
- Karma Re: Splunkd not responding for bmunson_splunk. 06-05-2020 12:47 AM
- Got Karma for Re: Is there an easy way to download an app from the UI?. 06-05-2020 12:47 AM
- Got Karma for Re: Is there an easy way to download an app from the UI?. 06-05-2020 12:47 AM
- Karma Re: external_lookup example: Could not find all of the specified lookup fields in the lookup table for lguinn2. 06-05-2020 12:46 AM
- Karma Re: restmap.conf - Nothing but example values work? for Drainy. 06-05-2020 12:46 AM
- Karma Re: error in "docgen" command for splunktechie. 06-05-2020 12:46 AM
- Karma Re: Extract fields from syslog (new to splunk) for kristian_kolb. 06-05-2020 12:46 AM
- Karma Re: Multiple Deployment Servers Configuration for Eqalis. 06-05-2020 12:46 AM
- Karma Re: adding second TCP listener for SSL for itinney. 06-05-2020 12:46 AM
- Karma Re: Clusters and Apps for Vishal_Patel. 06-05-2020 12:46 AM
- Karma Re: Alerting on unique field occurrence for kallu. 06-05-2020 12:46 AM
- Karma Re: How to configure email alert using gmail smtp? for itinney. 06-05-2020 12:46 AM
- Karma Re: event panel with fields discovery for lguinn2. 06-05-2020 12:46 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 5 | |||
| 1 | |||
| 1 | |||
| 1 | |||
| 2 | |||
| 12 | |||
| 1 | |||
| 2 | |||
| 1 | |||
| 2 |
12-08-2015
05:13 AM
2 Karma
The app can be found in the operating system at
$SPLUNK_HOME/etc/system/static/app-packages/APPNAME.spl
but you can also downloaded it with a URI
https://YOURSERVER:MANAGEMENTPORT/static/app-packages/APPNAME.spl
Replace the words in capitals with your values.
... View more
04-27-2015
04:44 PM
The as av1 just tells splunk to name the average av1.
window=5 says take the average over 5 events (by default) including this one. So the average of slot 1-5 goes in slot 5 , 2-6 in slot 6 and so on. But there is an extra option you can say, current=false . This will then over ride the default and use the previous 5 not including the current one. So slot6 has the average of 1-5, slot7 has 2-6 and so on.
... View more
10-27-2013
09:48 AM
9 Karma
Assuming you have the fields being extracted as A, B, & C you can use stats.
mysearch | stats first(A) as A, first(B) as B, first(C) as C by _time
If you need the whole event merged you can use the less efficient command transactions.
mysearch | transaction _time
and in either if the times are not identical you can use the bucket command
mysearch | bucket _time span=1d | …
Bob
... View more
10-26-2013
04:14 AM
2 Karma
The streamstats command is designed to reference previous events. That is previous in the order you see them on screen so sorting will allow you to reference the next one. Try this.
mysearch | streamstats current=false window=1 first(f1) as next_f1 first(f2) as next_f2
| sort _time | streamstats current=false window=1 first(f1) as previous_f1 first(f2) as previous_f2
| sort _time | table previous_f1 f1 next_f1 previous_f2 f2 next_f2
But be aware that streamstats does not map reduce so should be used as late as possible in a search string.
Bob
... View more
10-25-2013
03:11 AM
1 Karma
No! I'm afraid this is not retroactive. All new data will use this configuration but old data will not be updated. The only way round it is to force splunk to delete and re-index the data. 😞
... View more
It looks like the search should work providing the user has access to all the same knowledge objects and indexes.
Check try the following 2 searches.
index="login_data" sourcetype="Login_Data | stats count by SignonID
index="hrxref_data" sourcetype="HR_XREF" | stats values(LVL1_MOID) values(MOID) values(SignonID) values(EMP_NAME)
If any of the searches or columns are empty, look to see if the user can see the index and that field extractions are not private.
... View more
10-25-2013
01:54 AM
2 Karma
Hi Timothy
You have a mistake in your time format %m is the month %M is the minute. You have entered month twice. Also with no delimiters in your data splunk could take the date from the wrong place so it would be a good practice to force it's location with TIME_PREFIX and MAX_TIMESTAMP_LOOKAHEAD. The time prefix should be a PCRE regular expression to match what comes before the timestamp.
I would try the following
[CPOF]
NO_BINARY_CHECK = 1
SHOULD_LINEMERGE = FALSE
PULLDOWN_TYPE = 1
TIME_PREFIX = \w \w\w\d\d
TIME_FORMAT = %Y%m%d%h%M
MAX_TIMESTAMP_LOOKAHEAD = 12
You may have to play with the time prefix if your data changes, you might try " ^.{6} " to say six digits in from the beginning of the line.
Bob
... View more
06-21-2013
01:49 PM
5 Karma
I have read Managing Indexers and Clusters trying to find what the requirements are for a cluster master. It says 'The hardware storage needs of the master node are obviously lower than those specified in the "Reference hardware" topic, since the master does not index external data.'
But surely a master node doesn't need 12 cores to manage 4 indexers and a search head. So what factors do we have to take in to account.
... View more
06-04-2013
07:19 AM
1 Karma
Three questions in one.
Are hot buckets faster than warm for search.
If so is it because they are in memory or because the file is already open?
Is it a good idea to have 30+ hot buckets to speed up data access?
For background, we are indexing 100GB/day and searches over a few hours seem slow so looking for ways to optimise.
... View more
06-02-2013
03:19 AM
You will need to put your command in a bat file. Save the file in a bin directory in the system or your app.
$SPLUNK_HOME/etc/system/bin/
$SPLUNK_HOME/etc/apps/<APPNAME>/bin/
Then add it as a scripted input. The following page will give you more detail.
http://docs.splunk.com/Documentation/Splunk/latest/Data/Setupcustominputs
... View more
06-02-2013
02:37 AM
Or if you are looking for the last few in other circumstances, you can use tail.
... | tail 20
... View more
06-01-2013
01:39 AM
so add another function.
| stats values(ip) as IPs dc(ip) as ipCount by url | sort - ipCount
... View more
05-29-2013
02:06 AM
1 Karma
If you do not have that extraction, you are probably missing other usefull information. I suggest you install the free "Technology Add on for Cisco ASA" to all your indexers and search heads.
http://splunk-base.splunk.com/apps/58196/technology-add-on-for-cisco-asa
... View more
05-29-2013
01:54 AM
1 Karma
I think the problem is the order that you do the transactions. If you join by the ProjectID first, you have an event with many MessageID's that you are trying to match to an event with one. So try joining on MessageID first then in a separate transaction on ProjectID.
... | transaction MessageID | transaction ProjectID
... View more
05-24-2013
09:29 AM
1 Karma
For most firewalls, though technically we probably could install a forwarder, it is recommended by security experts to set the device up to send it's logs by syslog. You will have to look at the manufacturers instructions on how to do that.
Then you can set splunk to listen for syslog. The easiest way to do this is explained here
http://docs.splunk.com/Documentation/Splunk/5.0.2/Data/SyslogUDP
... View more
05-22-2013
09:25 AM
Assuming the number after the + is 10,000ths of a second you can tell splunk to use this with :-
TIME_FORMAT = %Y-%m-%dT%H:%M:%S+%4N
If it is consistently +0000 you can specify it in the time format.
TIME_FORMAT = %Y-%m-%dT%H:%M:%S+0000
... View more
05-22-2013
03:01 AM
Whitelists and blacklists are only used at inputs phase and match against source names, normally file names or folders. It sounds like you want to discard individual events which can not be done until parsing phase.
This must be done on the indexer and the link Ayn provided explains how to do this.
... View more
05-19-2013
01:11 AM
If the network knows that computer by the name world then yes. Quite often a computer will use a name for itself that the network does not understand and this may be the case here. If this is on a private network you may have to use the ip address.
To find out the computers ip address open a cmd, dos or terminal window and run the command
ipconfig
You wil see a set of 4 numbers seperated by dot probably starting 192.168. Use this in place of the computer name.
... View more
05-19-2013
12:41 AM
3 Karma
Full documentation is available via the download page here.
http://docs.splunk.com/Documentation/DBX/latest/DeployDBX/Abouttheconnector
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:02 AM
|
Karma from
Karma given to
