Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About mikev
mikev
Path Finder
Member since:
05-08-2013
08-20-2020
Community Statistics
| Posts | 30 |
| Solutions | 1 |
| Karma Given | 11 |
| Karma Received | 1 |
| Member Since | 05-08-2013 |
Activity Feed
- Posted Re: Universal Forwarder props.conf and transforms.conf settings on Getting Data In. 08-20-2020 08:20 AM
- Karma Re: maxKBps option and limiting a Forwarder's rate of thruput for MuS. 06-11-2020 06:49 AM
- Karma Re: Health warning - The percentage of small of buckets created (40) over the last hour is very high ... for shahbhavya. 06-05-2020 12:50 AM
- Karma How to make visio icons appear correctly in Visio ? for devd25. 06-05-2020 12:49 AM
- Karma Re: Automatic Sourcetype Tagging on Syslog Server for woodcock. 06-05-2020 12:49 AM
- Karma Re: Syslog Server vs Heavy Forwarder for xpac. 06-05-2020 12:49 AM
- Karma Re: Clarification regarding search command and stats command for somesoni2. 06-05-2020 12:48 AM
- Karma Re: Splunk App for Windows Infrastructure: Why are we getting error "Page Not Found!" trying to access the app? for gharrison90. 06-05-2020 12:48 AM
- Karma Re: Box Plot isn't calculating outliers correctly for jeffland. 06-05-2020 12:48 AM
- Got Karma for Has anyone successfully extracted Cisco Prime logs with matching field names?. 06-05-2020 12:48 AM
- Karma Re: eval not matching value from Data model for martin_mueller. 06-05-2020 12:47 AM
- Karma Re: How can I receive Splunk security announcements via email? for locose. 06-05-2020 12:46 AM
- Karma Re: How to set the default search time in Splunk 6? for nk-1. 06-05-2020 12:46 AM
- Posted Re: Remove Create New Dashboard Button on Dashboards & Visualizations. 11-12-2018 01:10 PM
- Posted Re: Remove Create New Dashboard Button on Dashboards & Visualizations. 11-12-2018 10:38 AM
- Posted Re: Remove Create New Dashboard Button on Dashboards & Visualizations. 11-12-2018 10:04 AM
- Posted Remove Create New Dashboard Button on Dashboards & Visualizations. 11-12-2018 07:57 AM
- Tagged Remove Create New Dashboard Button on Dashboards & Visualizations. 11-12-2018 07:57 AM
- Posted Re: Splunk App for Windows Infrastructure: Why are we getting error "Page Not Found!" trying to access the app? on All Apps and Add-ons. 04-19-2018 07:52 AM
- Posted Re: How to make visio icons appear correctly in Visio ? on Security. 03-19-2018 01:05 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 0 | |||
| 0 |
08-20-2020
08:20 AM
I know this is an older post but I believe that you should be using DEST_KEY per the documentation: DEST_KEY = <KEY>
* NOTE: This setting is only valid for index-time field extractions.
* Specifies where Splunk software stores the expanded FORMAT results in
accordance with the REGEX match.
* Required for index-time field extractions where WRITE_META = false or is
not set.
* For index-time extractions, DEST_KEY can be set to a number of values
mentioned in the KEYS section at the bottom of this file.
* If DEST_KEY = _meta (not recommended) you should also add $0 to the
start of your FORMAT setting. $0 represents the DEST_KEY value before
Splunk software performs the REGEX (in other words, _meta).
* The $0 value is in no way derived *from* the REGEX match. (It
does not represent a captured group.)
* KEY names are case-sensitive, and should be used exactly as they appear in
the KEYs list at the bottom of this file. (For example, you would say
DEST_KEY = MetaData:Host, *not* DEST_KEY = metadata:host .)
... View more
11-12-2018
01:10 PM
Yes, working on getting all scheduled searches owned by a svc account no individual users. but there are thousands to go through. It's a process for sure.
... View more
11-12-2018
10:38 AM
Yes, agreed, for those that know their way around. we do assign the users to groups and assign those groups their own apps / dashboards, they don't see standard components.
You mention restricting capabilities in authorize - whole different can of worms. We did set schedule_search = disable but that also prevented them from running scheduled searches so I have to revisit that one and figure that out as well. Documentation says only for new searches not for existing scheduled searches. Different topic for different thread if I can prove that is the problem.
... View more
11-12-2018
10:04 AM
It's not a matter of restricting the search functionality, that is fine, they can search within their index structure. It is more the matter of creating a dashboard that they have local and scheduling it to run every minute. Initially this system had over 2k searches running every minute, we are trying to prevent them from getting back to that.
The education part, totally agree, every user is required to take training through power user training before getting access to Splunk. They do have the knowledge, there are monthly training sessions and a weekly blog. All of the best practices have been outlined, but there are those that have the mindset that theirs is the most important application of all time, even when you tell them it isn't 🙂
In lieu of the user ignoring what has been said and what they have learned, we try to control what damage they can do in prod, they do have a development and a QA environment in which to test. Prod data is replicated to QA so they have "live" data.
I'm just looking for a method to remove the "Create New Dashboard" button, without having to main a whole library of changes to also test / install every time a upgrade takes place.
... View more
11-12-2018
07:57 AM
Help Please. Splunk 6.6.3 - SHC - search app -> dashboards.
In this environment the production Splunk needs to be read-only.
One of the items that we came across is that users can still create dashboards and embed searches in them to get around the no modification rule.
Now following this in answers
https://answers.splunk.com/answers/345407/hide-create-new-dashboard-button.html
I was able to allow only the admins to see and create dashboards, but the users couldn’t even see any dashboards not even those assigned to them.
Keep in mind I’m not a JS coder, but there were no errors, so it was good right :-). When modifying the code - Splunk\share\splunk\search_mrsparkle\exposed\js\build\dashboardspage.js it also caused errors with the manifest being out of sync.
When I inspect the dashboard page, I can see the code:
<div class="add-dashboard-controls pull-right"> <button class="btn btn-primary add-dashboard">Create New Dashboard</button> </div>
I cannot seem to find which XML file contains this. So, the real question; is there a way to remove the create new dashboard button, if so, which xml file contains it, I have searched through them all, I think. I cannot find this code in any of the dashboard(x).xml files.
As we will be upgrading to 7.x in the near future (within 6 months) modifying mrsparkle also creates issues as now that code needs to be maintained across upgrades there has to be somewhere that we can modify the dashboard to exclude the button and place it in a local directory
Thanks in advance for any assistance / guidance.
... View more
- Tags:
- splunk-enterprise
04-19-2018
07:52 AM
While it's an oldie, it still applies toe the latest version of the app. This helped me to resolve the same issue. Thanks!!! , I upvoted.
... View more
03-19-2018
01:05 PM
I just downloaded the Visio stencils and have the same issue using Visio 2013. I have to mess with the transparency to get any of the actual lines / pictures, but the background is still the blue shown here. Doesn't make sense that I would have to modify each stencil every time I use it.
... View more
01-24-2018
08:01 AM
Thank yo, this worked fine for eliminating the error I was having. In re-reading the transforms.conf.spec documentation I saw where it said to use field: or fields: Further reading showed me the errors of my ways. I was trying to do this as a index time not a search time replacement. Fields can only be used for search time modifications. This is a cloud search head so now trying to figure out how to make it work there as you don't have access to the cli to to transforms. The Gui does have some capabilities, but I'm not seeing it for host replacement. Your answer was correct, again thank you!
... View more
01-22-2018
05:25 PM
We are sending RSA secureid logs to syslog then using a Universal Forwarder to send to a Heavy Forwarder which then sends everything to Splunk Cloud. All that works fine except for the host name in splunk if using the standard inputs.conf entry of host_segment=x because the file produced by rsa is todays' date ex: 2018-01-22 so that becomes the host.
I have looked at doing regex extractions, but there are two ip's side by side and the regex returns extra garbage as well. I removed the host_segment component by everything now has the Universal Forwarder name as the host (which it should). I followed this link: https://answers.splunk.com/answers/425848/how-to-set-host-from-an-extracted-field.html and still get only the UF as the host so I'm looking for some help from the community. A sample of the log file:
Jan 22 18:42:30 2018-01-22 18: 42:30,628, , audit.runtime.com.rsa.ims.authn.impl.AuthenticationBrokerImpl, INFO, e557de7144271b0a1923ceae96e5d594,eb5901ed44271b0a08022c8910d01e29,10.27.39.70,10.27.39.68,AUTHN_LOGIN_EVENT,13002,SUCCESS,AUTHN_METHOD_SUCCESS,e51fd3fb44271b0a19221f45f6896695-TBO8ACj0TWh7,0b3e94e944271b0a1b44c6d742dc0057,6e14e43644271b0a1b1d3a065fe5da7f,000000000000000000001000e0011000,aegariba,Ashley,Garibaldi,3bcfac6e44271b0a1ba38a9b14338de7,000000000000000000001000e0011000,10.27.39.70,tcblap13.ad.texaschildrenshospital.org,7,000000000000000000002000f1022000,SecurID_Native,,,AUTHN_LOGIN_EVENT,5,1,,,,,55dc625944271b0a1994cfc708171ab3,xxxxxxx16440
Jan 22 18:43:53 2018-01-22 18: 43:53,647, , audit.admin.com.rsa.authmgr.internal.admin.principalmgt.impl.AMPrincipalAdministrationImpl, INFO, 39a2797444271b0a1a7aa7418ac85efa,eb5901ed44271b0a08022c8910d01e29,,10.27.39.68,UPDATE_AM_PRINCIPAL,20002,SUCCESS,,,,,,,,,,PRINCIPAL,d8e2bab244271b0a1c2f73c87092dd83,6e14e43644271b0a1b1d3a065fe5da7f,000000000000000000001000e0011000,rmvadala,,,,,,
Sometime the second IP can also be a FQDN entry, not often but every so often its there the second entry is missing the calling_ip hence the ,,10.27.39.68 (it is not always this IP, that would be too easy).
For the transforms this is what is in play:
Default:
[rsa_securid_runtime_syslog_extract_field_0]
FIELDS = "syslog_header", "milliseconds", "unused21", "logger_name", "log_level", "unused22", "unused23", "client_ip", "server_ip", "vendor_event_type", "unused24", "vendor_action", "vendor_action_description", "session_id", "actor_guid", "unused27", "unused28", "user_name", "user_first_name", "user_last_name", "agent_guid", "unused210", "agent_ip", "agent_name", "agent_type", "unused214", "authentication_type", "unused215", "authentication_description","argument1","argument2","argument3","argument4","argument5","argument6","argument7","argument8","argument9","argument10"
DELIMS = ","
Local:
[rsa_host_name]
SOURCE_KEY = server_ip (This is created in a FIELDS extraction above)
REGEX = (.*)
DEST_KEY = MetaData:Host
Props:
Only Local;
[rsa:secureid:system:syslog]
TRANSFORMS-rsahost = rsa_host_name
[rsa:secureid:admin:syslog]
TRANSFORMS-rsahost = rsa_host_name
[rsa:secureid:runtime:syslog]
TRANSFORMS-rsahost = rsa_host_name
The default props uses the same field server_ip for CIM renames:
FIELDALIAS-dest = server_ip as dest
FIELDALIAS-dvc = server_ip as dvc
Everything looks good in Btool
On start-up receive this:
Undocumented key used in transforms.conf; stanza='rsa_host_name' setting='SOURCE_KEY' key='server_ip'
Based upon the error it doesn't like SOURCE_KEY
What values should I be using so I can use server_ip as my host name?
Thanks in advance!
... View more
10-24-2017
03:04 PM
I downvoted this post because this does not answer the question of why the system is checking in every minute and updating the files.
... View more
05-26-2017
07:01 AM
Mikael,
The logs are sent to syslog-ng then ingested by Splunk, no problem. I was able to get in contact with someone who has access to the Prime environment and will be working with them next week. For the logs, most are status for the systems so I'm going to see if we can get them to narrow what they what to see. I have identified 45 different types of entries (those in the braces - [topology] for example) most of them I have been able to get useful information out of. The ones that are the real issue are the multi-line items.
For instance the entry - ERROR [PollTask] [xmppollerAsync-2] above with this timestamp - May 11 03:31:25 192.168.122.8 05/11/17 02:30:18.490 is different than the same error entry above it, and I believe that the following entries below it are all associated with this record as the timestamp is not complete - so supplied by syslog-ng ( May 11 03:31:25 192.168.122.8) although it does not follow the prime convention of end... begin... for those records over 1024 bytes of which most of them are not.
I know the customer will want anything with error, high, critical in it so what am I looking for? The ability to have this hodgepodge of "crap" broken down into something useful for at least the items containing issues.
sdemoss mentioned the Cisco Prime API, I will have the customer look into that as well, in the mean time I'm still trying to figure the best way to get all of the multi-line items joined, I am up for suggestions. I can supply the community with larger sample files it it helps.
... View more
05-25-2017
12:02 PM
Mikael,
I've included a sample of the various entries. One thing to note, Cisco truncates @ 1024, for those entries they end with ... and begin with ... on the following entry.
Hope that helps. I would be willing to get you a larger sample if it will make more sense.
May 11 03:31:12 192.168.122.8 05/11/17 02:30:05.471 INFO [jobmanager] [seqtaskexecutor-10208] INFO: [TaskResultUpdateWorker: doPersistJobElement: created result for task with id=11333891].
May 11 03:31:12 192.168.122.8 05/11/17 02:30:05.496 INFO [logging] [seqtaskexecutor-10208] IFM-SAM-INFO: Total number of clients processed for the time: 1494494704409 is processed::0 pushed:0 Removed:0.
May 11 03:31:25 192.168.122.8 05/11/17 02:30:18.484 ERROR [PollTask] [xmppollerAsync-2] AesLogImpl.error:6598594_10.10.29.19Exception when query PollUnitIFAVAILABILITYDeviceUnreachableException: Device not reachable: 10.10.29.19/161, nested exception=java.io.IOException: Cannot discover SNMPv3 engine ID 10.10.29.19/161
May 11 03:31:25 192.168.122.8 05/11/17 02:30:18.490 ERROR [PollTask] [xmppollerAsync-2] AesLogImpl.throwing: class: PollUnit, method:pollDevice, Trace: DeviceUnreachableException: Device not reachable: 10.10.29.19/161, nested exception=java.io.IOException: Cannot discover SNMPv3 engine ID 10.10.29.19/161
at com.cisco.xmp.snmp.mediation.impl.MediationOperation.reportException(MediationOperation.java:133)
at com.cisco.xmp.snmp.mediation.impl.MediationOperation.onTarget(MediationOperation.java:458)
at com.cisco.xmp.snmp.mediation.impl.MediationOperation$2.onDone(MediationOperation.java:72)
at com.cisco.xmp.snmp.sessionmgr.util.AbstractFuture.notifyListener(AbstractFuture.java:49)
at com.cisco.xmp.snmp.sessionmgr.util.AbstractFuture.setCompletionStatus(AbstractFuture.java:72)
at com.cisco.xmp.snmp.sessionmgr.util.AbstractFuture.reportException(AbstractFuture.java:88)
at com.cisco.xmp.snmp.sessionmgr.async.TargetFuture.onDone(Ta...
May 11 03:31:25 192.168.122.8 ...rgetFuture.java:84)
at com.cisco.xmp.snmp.sessionmgr.util.AbstractFuture.notifyListener(AbstractFuture.java:49)
at com.cisco.xmp.snmp.sessionmgr.util.AbstractFuture.setCompletionStatus(AbstractFuture.java:72)
at com.cisco.xmp.snmp.sessionmgr.util.AbstractFuture.reportException(AbstractFuture.java:88)
at com.cisco.xmp.snmp.sessionmgr.async.EngineIDFuture.onDone(EngineIDFuture.java:121)
at com.cisco.xmp.snmp.sessionmgr.async.ResponseFuture.notifyListener(ResponseFuture.java:120)
at com.cisco.xmp.snmp.sessionmgr.async.ResponseFuture.onResponse(ResponseFuture.java:298)
at org.snmp4j.Snmp$PendingRequest.run(Snmp.java:1637)
at java.util.TimerThread.mainLoop(Timer.java:555)
at java.util.TimerThread.run(Timer.java:505)
Caused by: java.io.IOException: Cannot discover SNMPv3 engine ID 10.10.29.19/161
at com.cisco.xmp.snmp.sessionmgr.async.EngineIDFuture.onDone(EngineIDFuture.java:119)
... 5 more
:
May 11 03:31:25 192.168.122.8 DeviceUnreachableException: Device not reachable: 10.10.29.19/161, nested exception=java.io.IOException: Cannot discover SNMPv3 engine ID 10.10.29.19/161
May 11 03:31:25 192.168.122.8 DeviceUnreachableException: Device not reachable: 10.10.29.19/161, nested exception=java.io.IOException: Cannot discover SNMPv3 engine ID 10.10.29.19/161
May 11 03:31:25 192.168.122.8 at com.cisco.xmp.snmp.mediation.impl.MediationOperation.reportException(MediationOperation.java:133)
May 11 03:31:25 192.168.122.8 at com.cisco.xmp.snmp.mediation.impl.MediationOperation.onTarget(MediationOperation.java:458)
May 11 03:31:25 192.168.122.8 at com.cisco.xmp.snmp.mediation.impl.MediationOperation$2.onDone(MediationOperation.java:72)
May 11 03:31:25 192.168.122.8 at com.cisco.xmp.snmp.sessionmgr.util.AbstractFuture.notifyListener(AbstractFuture.java:49)
May 11 03:31:25 192.168.122.8 at com.cisco.xmp.snmp.sessionmgr.util.AbstractFuture.setCompletionStatus(AbstractFuture.java:72)
May 11 03:31:25 192.168.122.8 at com.cisco.xmp.snmp.sessionmgr.util.AbstractFuture.reportException(AbstractFuture.java:88)
May 11 03:31:25 192.168.122.8 at com.cisco.xmp.snmp.sessionmgr.async.TargetFuture.onDone(TargetFuture.java:84)
May 11 03:31:25 192.168.122.8 at com.cisco.xmp.snmp.sessionmgr.util.AbstractFuture.notifyListener(AbstractFuture.java:49)
May 11 03:31:25 192.168.122.8 at com.cisco.xmp.snmp.sessionmgr.util.AbstractFuture.setCompletionStatus(AbstractFuture.java:72)
May 11 03:31:25 192.168.122.8 at com.cisco.xmp.snmp.sessionmgr.util.AbstractFuture.reportException(AbstractFuture.java:88)
May 11 03:31:25 192.168.122.8 at com.cisco.xmp.snmp.sessionmgr.async.EngineIDFuture.onDone(EngineIDFuture.java:121)
May 11 03:31:25 192.168.122.8 at com.cisco.xmp.snmp.sessionmgr.async.ResponseFuture.notifyListener(ResponseFuture.java:120)
May 11 03:31:25 192.168.122.8 at com.cisco.xmp.snmp.sessionmgr.async.ResponseFuture.onResponse(ResponseFuture.java:298)
May 11 03:31:25 192.168.122.8 at org.snmp4j.Snmp$PendingRequest.run(Snmp.java:1637)
May 11 03:31:25 192.168.122.8 at java.util.TimerThread.mainLoop(Timer.java:555)
May 11 03:31:25 192.168.122.8 at java.util.TimerThread.run(Timer.java:505)
May 11 03:31:25 192.168.122.8 Caused by: java.io.IOException: Cannot discover SNMPv3 engine ID 10.10.29.19/161
May 11 03:31:25 192.168.122.8 at com.cisco.xmp.snmp.sessionmgr.async.EngineIDFuture.onDone(EngineIDFuture.java:119)
May 11 03:31:25 192.168.122.8 ... 5 more
May 11 03:31:25 192.168.122.8 05/11/17 02:30:18.493 ERROR [PollTask] [xmppollerAsync-2] AesLogImpl.error:6598594_10.10.29.19Process is aborted. No data is being saved.
May 11 03:31:25 192.168.122.8 05/11/17 02:30:18.493 ERROR [PollTask] [xmppollerAsync-3] AesLogImpl.error:6598593_10.10.29.18Exception when query PollUnitIFAVAILABILITYDeviceUnreachableException: Device not reachable: 10.10.29.18/161, nested exception=java.io.IOException: Cannot discover SNMPv3 engine ID 10.10.29.18/161
May 11 03:31:37 192.168.122.8 05/11/17 02:30:30.525 INFO [sam] [CDBPool-DVAVAILABILITY-thread-1] Thread Id : [1,265] : SAM_COLLECTION_INFO: [Truncated table is: DEVICEAVAILABILITY$ERR]
May 11 03:35:08 192.168.122.8 05/11/17 02:34:01.233 ERROR [logging] [Thread-78] IFM-SAM-ERROR: ApplicationServiceDefinitionLoader - Though file is modified, file version tag value is same as in DB. Not updating taxonomy file content to PI..
May 11 03:38:04 192.168.122.8 05/11/17 02:36:58.221 INFO [apic] [pool-40-thread-1] Thread Id : [255] : IFM_APIC_INFO: [ApicPollingService: Polling APIC controller for device ]
May 11 03:42:07 192.168.122.8 05/11/17 02:41:00.595 INFO [IpepCacheTQImpl] [ipepTimerFactory] changeMapSize: 0
May 11 03:45:09 192.168.122.8 05/11/17 02:44:02.861 INFO [systemmonitoring] [seqtaskexecutor-2558] [1,186,640] Starting getLocation
... View more
05-17-2017
07:57 AM
For some reason it won't let me submit when I use the "Code Sample" button. I also tried to paste directly into the window and it won't let me submit that way, both say I have characters left just the submit button goes grey. Other suggestions?
... View more
05-17-2017
07:52 AM
Mikael,
I've included a sample of the various entries. One thing to note, Cisco truncates @ 1024, for those entries they end with ... and begin with ... on the following entry. Hope that helps. I would be willing to get you a larger sample if it will make more sense.
... View more
05-17-2017
07:46 AM
Thanks!, not my call on the API, I don't have access to the device and limited access to the folks that support it. I'll keep it in mind.
... View more
05-15-2017
11:41 AM
Mikael,
If I can contact you out of band, I can send you a large file as it is all over, some of it WLC, some of it network, I think a larger sample would be best for you.
... View more
05-15-2017
10:59 AM
1 Karma
Thanks in advance.
We just installed Cisco Prime (well Cisco installed it), it is feeding a syslog-ng server. I have tried both sourcetype=syslog and sourcetype=cisco:ios, while I do get more fields extracted via cisco:ios, we are still not getting good field types and / or data extractions.
Has anybody successfully extracted Prime logs with matching field names? I have scoured the forums and while Mikael Bjerkeland has done quite a bit of work with the Cisco Networks Add-on for Splunk Enterprise: https://splunkbase.splunk.com/app/1467 , still not seeing any further items that will help pull in the data. As a side note, SNMP is not an option so it has to be the feed from syslog.
If anyone has common fields and or props / transforms they would like to share that would be great.
Again thanks for any assistance provided,
Mike
... View more
05-12-2017
02:16 PM
Any further progress on Cisco Prime? I have a client that has a vary large Prime install base. The current TA when set to sourcetype=cisco:ios doesn't resolve much, while I do get more fields that when set to syslog, I'm grasping at straws on what I should be extracting.
... View more
11-01-2016
08:24 AM
Without know more than general items (helpful would be version of Splunk) but any of the 6.x version are alike.
Basic steps would be to use the Dashboard and Form Editor:
Select Add Input here you can select a Text box, Radio Button, Dropdown Box, Checkbox, Multiselect , Time and Submit.
I generally recommend always adding Time and Submit for a basic dashboard. You should be able to do this without having to edit the XML directly, but you can as well. You can have functions perform drill downs on the line clicked.
... View more
03-30-2016
02:06 PM
I too like the write-up, from everything I can determine ( I dug into the js code as well) box-plot is following the 25/50/75 rule with outliers / extreams at irq*1.5 . It is just puzzling as to why it works consistently with higher numbers but strings of numbers with a lot of zeros or very low end numbers always seems to be incorrect. I appreciate the response from Jeff and Satoshi, I just wish I could figure out the rhyme / reason it is not correct. I'm surely not going to tell the boss the numbers he has been looking at are not correct 😉 Thanks for the tip on makeresults vs. stats count. As there is no solution, I can't select either as the answer, but I do appreciate the comments, keep 'em coming.
... View more
03-29-2016
09:22 AM
Was able to get back to this, and it looks good. For sure was making it more difficult than it needed to be. Appreciate the answer and help!
... View more
03-25-2016
01:56 PM
I'm off-site, I'll let you know on Monday
... View more
03-24-2016
11:18 AM
We have dashboards that show the average of user work for the last month this could be for any of the various departments. We also have a box-plot dashboard which will show which users have extreme entries (higher than their normal range) using the information from the box-plot there is a heat map dash that is utilized to show the exact entries, this is exported to manually produce those individuals for further review.
To try and have Splunk produce the report automatically each month we have tried about every combination to make all of the searches into one, probably trying to make it to difficult. Here is a sampling of the data from the heat map.
UserID 2/1/16 2/2/16 2/3/16 2/4/16 2/5/16
Auser 0 10 40 32 55
Buser 56 48 27 94 53
Cuser 3 0 14 3 3
Duser 145 34 246 118 60
Euser 0 0 0 0 0
Fuser 0 3 4 3 0
Guser 51 76 121 154 120
Huser 12 65 19 2 0
Juser 12 7 24 8 15
Kuser 0 97 0 13 1
Luser 0 0 6 0 1
Muser 296 202 308 87 0
We add each day user counts – which in this case is a timestamp so each time they enter something it writes a new timestamp. Then for the month we take all of those counts and divide them by the number of users for them month to get the average for the group. We want to see which of those users were above the monthly average *4 and display the user, the date, and their entries. For example the average for last month was 52 * 4 = 208 so we would want to see any users above 208.
User Date Count
Duser 2/3/16 246
Muser 2/1/16 296
2/3/16 308
A lot of explanation but I think necessary. The search that gets us closest follows:
index="foo" Classification="bar"
| eval combined_lookup=ClientID."-".PersonID
| dedup UserID combined_lookup
| timechart span=24h count(DateOfAccess) as Daily_Count dc(UserID) as User_Count
| eventstats sum(Daily_Count) as daytot sum(User_Count) as usertot
| eval Daily_Avg=round(daytot/usertot,0)
| appendcols [search index="foo" Classification="bar"
| eval combined_lookup=ClientID."-".PersonID
| dedup UserID combined_lookup
| eval Date=strftime(_time, "%D")
| chart count by UserID Date ]
| where UserID > Daily_Avg * 4
Problem is the results don’t give me the format above, it provides a day by day total with a 1 user listed as above not multiple users listed.
_time daily avg UserId usertot (should be total for the day)
2016-02-09 200 Muser 653
I would prefer to not do the appendcols but could not think of another way to re-use the value of UserID. UserID counts are both individual and group counts.
Any guidance is appreciated.
... View more
03-21-2016
11:04 AM
In using box plot (successfully we thought) a request came through to identify all upper outliers (extreme) when trying to determine what the math was behind the box plot calculations it came to light that if a user had low numbers then the calculations don't work out correctly. Here is one set of numbers that does not work:
0
0
0
0
1
1
2
2
2
5
7
9
9
11
12
17
18
46
62
74
103
136
188
193
In the above instance box plot said the upper whisker was 18 so all numbers above 18 are outliers, in performing the math, the upper whisker is 122 so all above 103 would be outliers
Here are a set of number that work correctly:
0
0
0
7
13
14
16
45
62
76
119
126
136
145
151
154
156
164
176
232
298
334
382
472
This was tagged correctly with the upper whisker coming in at 382, so the only outlier is 472.
I know that Satoshi Kawasaki only bundled box plot into the visualizations package, but if anyone has any idea as to why it is not working as it should, it would be great. I did look into the JS, but I am not a java script coder and to mee it looks good, I can follow what it is done just not sure why it is not working as it should for the sample data.
Thanks Mike
... View more
12-10-2015
08:24 AM
Any other suggestions on how to have it loop and print only each classification not all classifications?
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
08-20-2020
12:09 PM
|
