Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About peter_krammer
peter_krammer
Communicator
Member since:
05-08-2013
04-19-2023
Community Statistics
| Posts | 80 |
| Solutions | 9 |
| Karma Given | 104 |
| Karma Received | 49 |
| Member Since | 05-08-2013 |
Activity Feed
- Got Karma for Re: How to display the count in piechart as labels. 09-04-2023 01:52 AM
- Got Karma for Re: How to display the count in piechart as labels. 02-09-2023 06:57 PM
- Karma Re: How to modify the timerange token in drilldown? for sundareshr. 11-24-2021 08:38 AM
- Karma Re: How can we find size of events in a particular duration? for rajgowd1. 11-22-2021 03:37 AM
- Posted Re: Why does INGEST_EVAL duplicate my events if I assign a value to _raw? on Getting Data In. 08-05-2021 07:50 AM
- Posted Why does INGEST_EVAL duplicate my events if I assign a value to _raw? on Getting Data In. 08-05-2021 06:58 AM
- Tagged Why does INGEST_EVAL duplicate my events if I assign a value to _raw? on Getting Data In. 08-05-2021 06:58 AM
- Tagged Why does INGEST_EVAL duplicate my events if I assign a value to _raw? on Getting Data In. 08-05-2021 06:58 AM
- Got Karma for Re: Vienna Splunk Meetup 2021 Q1. 03-30-2021 11:10 PM
- Posted Re: Vienna Splunk Meetup 2021 Q1 on Vienna User Group. 03-24-2021 08:52 AM
- Posted Vienna Splunk Meetup 2021 Q1 on Vienna User Group. 03-24-2021 07:19 AM
- Posted Re: Filter time-based values from inputlookup by time picker range on Splunk Dev. 03-23-2021 02:40 AM
- Posted Re: Filter time-based values from inputlookup by time picker range on Splunk Dev. 03-23-2021 02:36 AM
- Karma Re: Filter time-based values from inputlookup by time picker range for dnitschke_splun. 03-23-2021 02:36 AM
- Karma How do i get a count of each value of a field, and then extract the values whose count matches a certain number for ezmo1982. 03-22-2021 10:18 AM
- Posted Multiple values field extraction with colon delimiter on Splunk Search. 03-17-2021 07:28 AM
- Got Karma for Re: how to make time_token.earliest in readable format. 03-17-2021 06:32 AM
- Karma Re: Splunk Rex query to extract field after a particular exact word only for Vardhan. 03-17-2021 06:22 AM
- Posted Re: how to make time_token.earliest in readable format on Splunk Search. 03-17-2021 06:15 AM
- Posted Re: Combine two search queries to display count on Splunk Search. 03-17-2021 06:02 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
08-05-2021
07:50 AM
I found a workaround to circumvent this bug. tranforms.conf [fdz_event] INGEST_EVAL = _raw="Test", queue=if(isnull(timestamp),"nullQueue", queue) Because I notices that one of the duplicates has an indexed field "timestamp::none" and the other does not. With this I am routing only one of the to the nullQueue and keep the other.
... View more
08-05-2021
06:58 AM
When I configure INGEST_EVAL to replace _raw with something else, it duplicates the event. Splunk Enterprise Version 8.2.1 props.conf: [source::http:splunk_hec_token] TRUNCATE = 500000 SHOULD_LINEMERGE = false KV_MODE = json TRANSFORMS-fdz_event = fdz_event transforms.conf [fdz_event] INGEST_EVAL = _raw="Test" Output:
... View more
- Tags:
- _raw
- bug
- INGEST_EVAL
Labels
- Labels:
-
HTTP Event Collector
-
transforms.conf
03-24-2021
08:52 AM
1 Karma
Timegap Dashboard <form theme="light">
<label>Timegap Example</label>
<search>
<query>| makeresults | addinfo | eval starttime = strftime(info_min_time, "%m/%d/%Y:%H:%M:%S"), endtime = strftime(info_max_time, "%m/%d/%Y:%H:%M:%S")</query>
<earliest>$gapfill_time.earliest$</earliest>
<latest>$gapfill_time.latest$</latest>
<done>
<set token="starttime">$result.starttime$</set>
<set token="endtime">$result.endtime$</set>
</done>
</search>
<fieldset submitButton="false"></fieldset>
<row>
<panel>
<title>Always Data</title>
<chart>
<search>
<query>index=_internal date_wday="thursday"
| timechart span=1d count</query>
<earliest>-14d@d</earliest>
<latest>now</latest>
<sampleRatio>1</sampleRatio>
</search>
<option name="charting.axisTitleX.visibility">collapsed</option>
<option name="charting.chart">line</option>
<option name="charting.drilldown">none</option>
<option name="charting.legend.mode">standard</option>
<option name="charting.legend.placement">none</option>
</chart>
</panel>
<panel>
<title>No Data</title>
<chart>
<search>
<query>index=_internal date_wday="thursday"
| timechart span=1d count</query>
<earliest>-4d@d</earliest>
<latest>now</latest>
<sampleRatio>1</sampleRatio>
</search>
<option name="charting.axisTitleX.visibility">collapsed</option>
<option name="charting.chart">line</option>
<option name="charting.drilldown">none</option>
<option name="charting.legend.mode">standard</option>
<option name="charting.legend.placement">none</option>
</chart>
</panel>
</row>
<row>
<panel>
<title>Always Data</title>
<single>
<search>
<query>index=_internal date_wday="thursday"
| timechart span=1d count</query>
<earliest>-14d@d</earliest>
<latest>now</latest>
<sampleRatio>1</sampleRatio>
</search>
<option name="drilldown">none</option>
</single>
</panel>
<panel>
<title>No Data</title>
<single>
<search>
<query>index=_internal date_wday="thursday"
| timechart span=1d count</query>
<earliest>-4d@d</earliest>
<latest>now</latest>
<sampleRatio>1</sampleRatio>
</search>
<option name="drilldown">none</option>
</single>
</panel>
</row>
<row>
<panel>
<title>Gapfill - short time</title>
<chart>
<search>
<query>index=_internal date_wday="thursday"
| fields
| eval count=1
| append [
| gentimes start=-14 end=-1 increment=1d
| eval _time=starttime, count=0
| fields _time, count
]
| timechart span=1d sum(count) as count</query>
<earliest>-4d@d</earliest>
<latest>now</latest>
<sampleRatio>1</sampleRatio>
</search>
<option name="charting.axisTitleX.visibility">collapsed</option>
<option name="charting.chart">line</option>
<option name="charting.drilldown">none</option>
<option name="charting.legend.mode">standard</option>
<option name="charting.legend.placement">none</option>
</chart>
</panel>
<panel>
<title>Gapfill - correct time</title>
<chart>
<search>
<query>index=_internal date_wday="thursday"
| fields
| eval count=1
| append [
| gentimes start=-14 end=-1 increment=1d
| eval _time=starttime, count=0
| fields _time, count
]
| timechart span=1d sum(count) as count</query>
<earliest>-14d@d</earliest>
<latest>now</latest>
<sampleRatio>1</sampleRatio>
</search>
<option name="charting.axisTitleX.visibility">collapsed</option>
<option name="charting.chart">line</option>
<option name="charting.drilldown">none</option>
<option name="charting.legend.mode">standard</option>
<option name="charting.legend.placement">none</option>
</chart>
</panel>
</row>
<row>
<panel>
<title>Gapfill - short time</title>
<single>
<search>
<query>index=_internal date_wday="thursday"
| fields
| eval count=1
| append [
| gentimes start=-14 end=-1 increment=1d
| eval _time=starttime, count=0
| fields _time, count
]
| timechart span=1d sum(count) as count</query>
<earliest>-4d@d</earliest>
<latest>now</latest>
<sampleRatio>1</sampleRatio>
</search>
<option name="drilldown">none</option>
</single>
</panel>
<panel>
<title>Gapfill - correct time</title>
<single>
<search>
<query>index=_internal date_wday="thursday"
| fields
| eval count=1
| append [
| gentimes start=-14 end=-1 increment=1d
| eval _time=starttime, count=0
| fields _time, count
]
| timechart span=1d sum(count) as count</query>
<earliest>-14d@d</earliest>
<latest>now</latest>
<sampleRatio>1</sampleRatio>
</search>
<option name="drilldown">none</option>
</single>
</panel>
</row>
<row>
<panel>
<title>Gapfill - timepicker wrong</title>
<input type="time" token="gapfill_time">
<label>gapfill_time</label>
<default>
<earliest>-14d@d</earliest>
<latest>now</latest>
</default>
</input>
<chart>
<search>
<query>index=_internal date_wday="thursday"
| fields
| eval count=1
| append [
| gentimes start=-14 end=-1 increment=1d
| eval _time=starttime, count=0
| fields _time, count
]
| timechart span=1d sum(count) as count</query>
<earliest>$gapfill_time.earliest$</earliest>
<latest>$gapfill_time.latest$</latest>
<sampleRatio>1</sampleRatio>
</search>
<option name="charting.axisTitleX.visibility">collapsed</option>
<option name="charting.chart">line</option>
<option name="charting.drilldown">none</option>
<option name="charting.legend.mode">standard</option>
<option name="charting.legend.placement">none</option>
</chart>
</panel>
<panel>
<title>Gapfill - timepicker correct</title>
<chart>
<search>
<query>index=_internal date_wday="thursday"
| fields
| eval count=1
| append [
| gentimes start=$starttime$ end=$endtime$ increment=1d
| eval _time=starttime, count=0
| fields _time, count
]
| timechart span=1d sum(count) as count</query>
<earliest>$gapfill_time.earliest$</earliest>
<latest>$gapfill_time.latest$</latest>
<sampleRatio>1</sampleRatio>
</search>
<option name="charting.axisTitleX.visibility">collapsed</option>
<option name="charting.chart">line</option>
<option name="charting.drilldown">none</option>
<option name="charting.legend.mode">standard</option>
<option name="charting.legend.placement">none</option>
</chart>
</panel>
</row>
<row>
<panel>
<title>Gapfill - timepicker wrong</title>
<single>
<search>
<query>index=_internal date_wday="thursday"
| fields
| eval count=1
| append [
| gentimes start=-14 end=-1 increment=1d
| eval _time=starttime, count=0
| fields _time, count
]
| timechart span=1d sum(count) as count</query>
<earliest>$gapfill_time.earliest$</earliest>
<latest>$gapfill_time.latest$</latest>
<sampleRatio>1</sampleRatio>
</search>
<option name="drilldown">none</option>
</single>
</panel>
<panel>
<title>Gapfill - timepicker correct</title>
<single>
<search>
<query>index=_internal date_wday="thursday"
| fields
| eval count=1
| append [
| gentimes start=$starttime$ end=$endtime$ increment=1d
| eval _time=starttime, count=0
| fields _time, count
]
| timechart span=1d sum(count) as count</query>
<earliest>$gapfill_time.earliest$</earliest>
<latest>$gapfill_time.latest$</latest>
<sampleRatio>1</sampleRatio>
</search>
<option name="drilldown">none</option>
</single>
</panel>
</row>
</form>
... View more
03-24-2021
07:19 AM
Per Field Throttling Throttle alert per field from the Alert settings page: Alert Throttle for 7 days per error_name | inputlookup alert_lookup_example.csv append=true
| eval now=now(), alerted_time = coalesce(alerted_time, now)
| stats min(alerted_time) as alerted_time, max(now) as now by error_name
| eval throwout_threshhold = now - (3600 * 24 * 7)
| where alerted_time > throwout_threshhold
| outputlookup alert_lookup_example.csv
| where alerted_time = now Errors seen within last 7 days, but not in last 7-14 days | makeresults count=100
| streamstats count as day
| eval error_name=case(day = 15, "error0", day = 8, "error1", day = 6, "error2", day % 3 = 0, "error3", day % 2 = 0, "error4")
| eval _time = _time - (day * 3600 * 24)
| where isnotnull(error_name)
| inputlookup alert_lookup_example.csv append=true
| stats min(_time) as _time by error_name
| where _time >= now() - (3600 * 24 * 14)
| outputlookup alert_lookup_example.csv
| where _time >= now() - (3600 * 24 * 7) Dokumentation: https://docs.splunk.com/Documentation/Splunk/latest/Alert/ThrottleAlerts Time Filter on Lookups Filter a lookup containing _time with a timepicker | inputlookup mylookup.csv WHERE [
| makeresults count=1
| addinfo
| eval search="( ( _time >= " . info_min_time . " ) AND ( _time < " . replace(info_max_time, "\+Infinity", "2147483647") . " ) )"
| table search
] Dokumentation: https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Inputlookup https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Addinfo https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Makeresults Fill holes in timecharts Fill last 14 days with some events to make sure timechart is continuous. If you need a count, use eval count=1 for real events and count=0 for created events and make sum(count) as count to get real event count. index=_internal date_wday=tuesday
| eval count=1
| append [
| gentimes start=-14 end=-1 increment=1d
| eval _time=starttime, count=0
| fields _time, count
]
| timechart span=1d sum(count) as count <base_search>
| timechart span=1d count
| append [
| gentimes start=-14 end=-1 increment=1d
| eval _time=starttime, count=0
| fields _time, count
]
| timechart span=1d sum(count) as count Dokumentation: https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Gentimes https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Makecontinuous Peters Sample Dashboard <too big, see attachments> Timewrap Using Timewrap makes the timeline specific to your searchframe index=_internal group="per_sourcetype_thruput" sourcetype=splunkd earliest="-2d@d" latest="@h"
| timechart span=1h avg(eps)
| timewrap series=exact time_format="%d-%m-%Y" 1d Using alternative that makes the timeframe to start at 00:00 and end at 23:59 index=_internal group="per_sourcetype_thruput" sourcetype=splunkd earliest="-2d@d" latest="@h"
| bin _time span=1h
| addinfo
| eval date = "avg(eps)_" . strftime(_time,"%d-%m-%Y"), _time = strptime(strftime(info_max_time, "%d-%m-%Y") . " " . strftime(_time,"%H:%M:%S"), "%d-%m-%Y %H:%M:%S")
| chart avg(eps) over _time by date Trick how to get the previous result with using timewrap index=_internal group="per_sourcetype_thruput" sourcetype=splunkd earliest="-2d@d" latest="+1d@d"
| timechart span=1h avg(eps)
| timewrap series=exact time_format="%d-%m-%Y" 1d Dokumentation: https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Timewrap Reltime Example Dashboard <form>
<label>Reltime</label>
<search>
<query>
| makeresults
| addinfo
| eval _time = info_min_time | reltime | rename reltime as reltime1
| eval _time = info_max_time | reltime | rename reltime as reltime2
</query>
<earliest>$time_token.earliest$</earliest>
<latest>$time_token.latest$</latest>
<done>
<set token="reltime1">$result.reltime1$</set>
<set token="reltime2">$result.reltime2$</set>
</done>
</search>
<fieldset submitButton="false">
<input type="time" token="time_token">
<label></label>
<default>
<earliest>-7d@h</earliest>
<latest>now</latest>
</default>
</input>
</fieldset>
<row>
<panel>
<title>Events between $reltime1$ and $reltime2$</title>
<table>
<search>
<query>
| makeresults
| addinfo
| eval _time = info_min_time | reltime | rename reltime as reltime1
| eval _time = info_max_time | reltime | rename reltime as reltime2
</query>
<earliest>$time_token.earliest$</earliest>
<latest>$time_token.latest$</latest>
</search>
<option name="drilldown">none</option>
<option name="refresh.display">progressbar</option>
</table>
</panel>
</row>
</form>
... View more
03-23-2021
02:40 AM
I now use an updated version, that also compensates for choosing "All Time" in the time picker, which makes info_max_time set to "+Infinity" which unfortunately is not a number. | inputlookup mylookup.csv
| addinfo
| where _time>=info_min_time AND (_time<=info_max_time OR info_max_time="+Infinity")
... View more
03-23-2021
02:36 AM
Does doing it this way make it more performant over the alternative to filter afterwards? If yes, could you explain where the performance improvement comes from? I am always interested to learn performance tricks for Splunk.
... View more
03-17-2021
07:28 AM
| rex max_match=1000 "(?://=(?[^:,]+))" | table _time, error_code Output: _time error_code 2021-03-17 14:23:41 404.EBS.SYSTEM.101 404.IMS.SERVERIN.103 404.IES.SERVER.105 404.IES.SERVEROUT.105
... View more
03-17-2021
06:15 AM
1 Karma
You can probably achieve it with the reltime command and setting it to a token from within a hidden search. https://docs.splunk.com/Documentation/Splunk/8.1.2/SearchReference/Reltime Here is an example dashboard: <form>
<label>Reltime</label>
<search>
<query>
| makeresults
| addinfo
| eval _time = info_min_time | reltime | rename reltime as reltime1
| eval _time = info_max_time | reltime | rename reltime as reltime2
</query>
<earliest>$time_token.earliest$</earliest>
<latest>$time_token.latest$</latest>
<done>
<set token="reltime1">$result.reltime1$</set>
<set token="reltime2">$result.reltime2$</set>
</done>
</search>
<fieldset submitButton="false">
<input type="time" token="time_token">
<label></label>
<default>
<earliest>-7d@h</earliest>
<latest>now</latest>
</default>
</input>
</fieldset>
<row>
<panel>
<title>Events between $reltime1$ and $reltime2$</title>
<table>
<search>
<query>
| makeresults
| addinfo
| eval _time = info_min_time | reltime | rename reltime as reltime1
| eval _time = info_max_time | reltime | rename reltime as reltime2
</query>
<earliest>$time_token.earliest$</earliest>
<latest>$time_token.latest$</latest>
</search>
<option name="drilldown">none</option>
<option name="refresh.display">progressbar</option>
</table>
</panel>
</row>
</form>
... View more
03-17-2021
06:02 AM
Maybe something like this? (<YOUR FIRST SEARCH>) OR (<YOUR SECOND SEARCH>)
| eventstats values(TYPE) as TYPE by ID
| stats count by ID, TYPE, timerName
... View more
03-17-2021
04:24 AM
Note: This option only works correctly if every row in the input has only 1 of the fields with a value.
... View more
03-17-2021
04:16 AM
Here is another solution for the originally requested example: generate sample events: | makeresults count=11 | streamstats count | eval f1 = case(count=1, "foo", count=2, "bar", count=3, "baz") | eval f2 = case(count=4, "x", count=5, "y") | eval f3 = case(count=6, "a", count=7, "b") | eval f4 = case(count=8, "1", count=9, "2", count=10, "3", count=11, "4") | fields - count, - _time output: f1 f2 f3 f4 ---------------------------- foo bar baz x y a b 1 2 3 4 solution SPL: <yoursearch> | foreach * [| eval field = if(isnotnull(<<FIELD>>), "<<MATCHSTR>>", field )] | streamstats count as index by field | stats values(*) as * by index | fields - field, - index output: f1 f2 f3 f4 ---------------------------- foo x a 1 bar y b 2 baz 3 4
... View more
03-17-2021
03:18 AM
The code above solves this example: header, values (mv field)
a = { a1, a2, a3 }
b = { b1, b2 }
c = { c1, c2, c3, c4 }
target table (each value in separate row/field)
a b c
-------------------
a1 b1 c1
a2 b2 c2
a3 c3
c4
... View more
03-17-2021
03:15 AM
1 Karma
I tried to solve this for you, but the query might be a bit inefficient: | makeresults
| eval a = mvappend("a1", "a2", "a3"), b = mvappend("b1", "b2"), c = mvappend("c1", "c2", "c3", "c4" ) | rename * as *_values
| foreach *_values [| eval max = if(max > mvcount(<<FIELD>>), max, mvcount(<<FIELD>>) )] | foreach *_values [| eval <<MATCHSTR>>_filler = mvrange(mvcount(<<FIELD>>), max, 1), <<MATCHSTR>>_filler = mvmap(<<MATCHSTR>>_filler, " "), <<FIELD>> = mvappend(<<FIELD>>, <<MATCHSTR>>_filler)] | foreach *_values [| eval <<FIELD>> = mvmap(<<FIELD>>, "<<MATCHSTR>>=\"" . <<FIELD>> . "\"")] | fields - *_filler | eval raw = mvmap(mvrange(0, max, 1), " ") | foreach *_values [| eval raw = mvzip(raw, <<FIELD>>)] | fields raw | mvexpand raw | rename raw to _raw | extract
... View more
03-16-2021
09:45 AM
1 Karma
So you want to filter to only the subjects that have a count greater than 5? index=email_log RejType="Virus Signature Detection" | stats count by subject | where count>5
... View more
03-16-2021
09:41 AM
2 Karma
Have you tried to setup throttling on the user_id field? --> https://docs.splunk.com/Documentation/Splunk/latest/Alert/ThrottleAlerts Alternatively you can use a CSV to save the alerted user as an intermediary. You can use that within the search that generates your alert even! <your search> | inputlookup alert_lookup_example.csv append=true | eval now=now(), alerted_time = coalesce(alerted_time, now) | stats min(alerted_time) as alerted_time, max(now) as now by user_id | eval throwout_threshhold = now - (3600 * 24 * 14) | where alerted_time > throwout_threshhold | outputlookup alert_lookup_example.csv | where alerted_time = now This will auto generate and fill the lookup csv and never alert for the same user twice. The throwout_threshold defines how long a user_id would be sitting within the csv before it gets thrown out.
... View more
05-25-2020
12:47 AM
Yes, now you should have the buttons for Introspection back and there is a button in the popup menu, that says "Reset all Configurations".
Hit it and afterwards it should be fine again.
... View more
03-26-2020
05:20 AM
I also had problems with the Data inventory after an update.
I found that the Data in my kv store lookup "data_inventory_products_lookup" was likely outdated from a previous version.
The Addon ships with newer data in SSE-default-data-inventory-products.csv but on update was not loaded into the KV store.
So my issue was fixed by:
| inputlookup SSE-default-data-inventory-products.csv
| outputlookup data_inventory_products_lookup
... View more
03-26-2020
05:17 AM
Based on you own findings I found that the Data in my kv store lookup "data_inventory_products_lookup" was likely outdated from a previous version.
So my issue was fixed by:
| inputlookup SSE-default-data-inventory-products.csv
| outputlookup data_inventory_products_lookup
... View more
03-26-2020
05:06 AM
Error still in Version 3.0.6
... View more
02-04-2020
09:11 AM
you could filter after the lookup:
| tstats max(_time) AS _time WHERE index=_internal sourcetype=splunkd source=*metrics.log by host
| lookup serverswithsplunkufjan2020 host OUTPUT host as match
| where isnotnull(match)
depending on the amount of hosts in your lookup you can also do this to filter in tstats already:
| tstats max(_time) AS _time WHERE index=_internal sourcetype=splunkd source=*metrics.log [
| inputlookup serverswithsplunkufjan2020 | table host
] by host
the subsearch will expand to:
(host="host1" OR host="host2" ...)
... View more
01-15-2020
04:15 AM
When using the add-on builder this code works for me:
def process_event(helper, *args, **kwargs):
service = client.Service(
token=helper.settings.get('session_key'),
owner='nobody',
app='SplunkEnterpriseSecuritySuite')
myitem = service.confs["myconf"]["mystanza"]["myitem"]
helper.log_info("myitem={}".format(myitem))
... View more
09-27-2019
04:52 AM
Yes please, I need this too.
... View more
06-13-2019
01:09 AM
1 Karma
I don't know if it is still relevant here, but I had success with:
events = helper.get_events()
for event in events:
event_id = event.get("event_id")
helper.log_info("event.get(\"event_id\")={}".format(event_id))
... View more
05-28-2019
10:05 AM
Thanks!
Has the same problem today and changing the captain did not help.
But running this on the problematic host, solved it.
... View more
05-28-2019
09:09 AM
Yes of course.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
04-19-2023
09:13 AM
|
Karma from
Karma given to
