Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About sbatino
sbatino
Observer
Member since:
04-23-2015
05-03-2022
Community Statistics
| Posts | 7 |
| Solutions | 0 |
| Karma Given | 0 |
| Karma Received | 0 |
| Member Since | 04-23-2015 |
Activity Feed
- Posted Re: How many CPUs are recommended in a windows server running the splunk universal forwarders agent? on Splunk Enterprise. 05-03-2022 03:50 AM
- Posted Re: Agent Universal Forwarders on Windows Server on Splunk Enterprise. 05-03-2022 03:23 AM
- Posted How many CPUs are recommended in a windows server running the splunk universal forwarders agent? on Splunk Enterprise. 04-08-2022 03:13 AM
- Tagged How many CPUs are recommended in a windows server running the splunk universal forwarders agent? on Splunk Enterprise. 04-08-2022 03:13 AM
- Posted Re: How to modify Splunk search only for logon_name users that are inside CSV? on Splunk Search. 04-07-2022 10:33 AM
- Tagged How to modify Splunk search only for logon_name users that are inside CSV? on Splunk Search. 03-31-2022 12:52 AM
- Posted How to modify Splunk search only for logon_name users that are inside CSV? on Splunk Search. 03-30-2022 12:21 PM
- Posted Re: I have two fields Field-A and Field-B . Filed-A with numerical values , and Field-B with characters/words..how can i have a barchart with X-axis = Field-B values and Y-axis = Field-A values. on Dashboards & Visualizations. 09-04-2018 04:32 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 |
05-03-2022
03:50 AM
ok, thanks !
... View more
05-03-2022
03:23 AM
Sorry to reply you late, I was busy. Another team manages these affected VMs but I can say that they have deleted a lot of old log files on the Apache folder. , and now the CPU is between 2% -3%. . Good .! Does Splunk ingest all files ..?
... View more
04-08-2022
03:13 AM
Hi,
it seems the "splunkd service" process has significant CPU consumption (eg 40%; 31% and so on). These virtual machines have 2 cores. how many CPUs are recommended in a windows server running the splunk universal forwarders agent?
... View more
Labels
- Labels:
-
troubleshooting
04-07-2022
10:33 AM
Query is working now. index=index-f5 sourcetype="f5:bigip:apm:syslog" ((New session) OR (Username) OR (Session deleted)) | transaction session_id startswith="New session" endswith="Session deleted"| rex field=_raw "Username '(?<login_name>.\\S+)'" | search [|inputlookup user.csv |fields login_name] | eval sessione_time=tostring(duration, "duration")| table _time login_name session_id session_time Thanks in advance for your help.
... View more
03-30-2022
12:21 PM
Hello Hello I have the following Splunk search syntax which returns me detailed log connection for a all user to the VPN concentrator (F5) in the past 90 days. I would need to do the same search only for 30 login_name users from csv, how can i build the search syntax? my actual search for all user with " | search login_name=* " is : index=index-f5 sourcetype="f5:bigip:apm:syslog" ((New session) OR (Username) OR (Session deleted)) | transaction session_id startswith="New session" endswith="Session deleted"| rex field=_raw "Username '(?<login_name>.\\S+)'" | search login_name=* | eval sessione_time=tostring(duration, "duration")| table _time login_name session_id session_time
... View more
Labels
- Labels:
-
other
09-04-2018
04:32 AM
ok, but the value 12 for January is from a single row or it's the sum of more rows?
this is the main question: if it's a single value, you have to use:
index=my_index
| stats values(Field-A) AS A BY Field-B Field-A
| fields - A
if instead it's the sum of more rows, you have to use:
index=my_index
| stats sum(Field-A) AS Field-A BY Field-B
Bye.
Giuseppe
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
05-03-2022
09:26 AM
|
