Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About smlrwd
smlrwd
Explorer
Member since:
06-11-2015
06-05-2020
Community Statistics
| Posts | 7 |
| Solutions | 1 |
| Karma Given | 0 |
| Karma Received | 2 |
| Member Since | 06-11-2015 |
Activity Feed
- Got Karma for Removing duplicate substrings from a multivalue field?. 06-05-2020 12:47 AM
- Got Karma for Splunk App for Enterprise Security: How does Identity Management work?. 06-05-2020 12:47 AM
- Posted How would you find trends in ticket system data. on Splunk Search. 06-18-2015 07:40 AM
- Tagged How would you find trends in ticket system data. on Splunk Search. 06-18-2015 07:40 AM
- Tagged How would you find trends in ticket system data. on Splunk Search. 06-18-2015 07:40 AM
- Tagged How would you find trends in ticket system data. on Splunk Search. 06-18-2015 07:40 AM
- Posted Splunk App for Enterprise Security: How does Identity Management work? on Splunk Enterprise Security. 06-12-2015 07:47 AM
- Tagged Splunk App for Enterprise Security: How does Identity Management work? on Splunk Enterprise Security. 06-12-2015 07:47 AM
- Tagged Splunk App for Enterprise Security: How does Identity Management work? on Splunk Enterprise Security. 06-12-2015 07:47 AM
- Tagged Splunk App for Enterprise Security: How does Identity Management work? on Splunk Enterprise Security. 06-12-2015 07:47 AM
- Tagged Splunk App for Enterprise Security: How does Identity Management work? on Splunk Enterprise Security. 06-12-2015 07:47 AM
- Posted Re: Removing duplicate substrings from a multivalue field? on Splunk Search. 06-11-2015 10:44 AM
- Posted Re: Removing duplicate substrings from a multivalue field? on Splunk Search. 06-11-2015 08:32 AM
- Posted Re: Removing duplicate substrings from a multivalue field? on Splunk Search. 06-11-2015 08:22 AM
- Posted Re: Removing duplicate substrings from a multivalue field? on Splunk Search. 06-11-2015 07:49 AM
- Posted Removing duplicate substrings from a multivalue field? on Splunk Search. 06-11-2015 07:11 AM
- Tagged Removing duplicate substrings from a multivalue field? on Splunk Search. 06-11-2015 07:11 AM
- Tagged Removing duplicate substrings from a multivalue field? on Splunk Search. 06-11-2015 07:11 AM
- Tagged Removing duplicate substrings from a multivalue field? on Splunk Search. 06-11-2015 07:11 AM
- Tagged Removing duplicate substrings from a multivalue field? on Splunk Search. 06-11-2015 07:11 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 1 | |||
| 1 |
06-18-2015
07:40 AM
Hello everyone,
All of our service desk tickets are collected by Splunk. I want to create a search that finds trends in the incoming tickets.
For example:
The exchange server goes down unexpectedly. Multiple people open tickets for email being down.
The problems:
1) Tickets have a lot of similar field data in Splunk.
2) People don't use the same words to describe the problem. (i.e. email isn't working vs. Outlook is down)
What would be the best way to go about trying to find a trend in this type of data?
Thanks in advance.
... View more
06-12-2015
07:47 AM
1 Karma
Hello everyone,
I was tasked with changing over our Identity management information in splunk since we switched vendors for the information. The person who worked with splunk during the install to set everything up doesn't work here anymore and I don't quite understand how it works.
In ES I go to Configure->Identity Management and I see a static asset lookup @ lookup://simple_asset_lookup
In ES I go to Configure->Data Enrichment->Lists and Lookups->Assets and it shows assets.csv
What is the difference between these two and what are they each used for? Right now, they look identical. Do they have to be?
I have created a search to populate the csv files with data from the new source.
Can I populate the csv files with more fields than are currently there?
How can I configure what can be put into these csv files and what information is monitored?
Thanks for any help you can provide.
... View more
06-11-2015
10:44 AM
I worked out something thanks to woodcock. It may not be the prettiest but it seems to work. (Ignore the % instead of spaces, the spaces were getting in the way earlier so i switched them out) I broke the list of OSes into 4 categories: Win XP, Win 7, Win Server, and Other. I created a macro to perform the code woodcock provided to single out an OS from the 3 Win categories, then appended them all together. From what I can tell it works as I intended.
... | mvexpand OS | eval os1=case(match(OS, "XP"), OS) | eval os2=case(match(OS, "SRV"), OS) | eval os3=case(match(OS, "Win%7"), OS) | eval os4=case( (NOT match(OS, "XP")) AND (NOT match(OS, "SRV")) AND (NOT match(OS, "Win%7")), OS) | stats values(*) as * by nt_host | fillnull value="" os1, os2, os3, os4 | `return_longest_from_mv( os1, nt_host )` | `return_longest_from_mv( os2, nt_host )` | `return_longest_from_mv( os3, nt_host )` | eval OS=mvappend(os1, os2, os3, os4)
Thanks again woodcock.
... View more
06-11-2015
08:32 AM
Yes, you assumed correctly. I have been trying to fix this off and on since yesterday and I just can't seem to get it quite right. Maybe regex would be helpful. I tried matching groups but it's over my head. Edit: I updated the original question to include this example.
... View more
06-11-2015
08:22 AM
This works perfectly for workstations. The only problem is that this method doesn't work well for the servers that report multiple OSes. Any ideas on how this could be modified to work with:
Win SRV 2008
Win XP
Win XP Pro
... View more
06-11-2015
07:49 AM
I updated the original post to clarify. Thank you.
... View more
06-11-2015
07:11 AM
1 Karma
Hello everyone,
I am creating a custom asset inventory and am combining data from multiple sources. These sources don't return the same OS version and a multivalue field is created in the process. I tabled out the OS version to take a look at the different multivalue fields. Below is an example of one of the multivalue entries in the OS field.
Win XP
Win XP Pro
How would I go about matching the smaller string to the larger one and removing it?
Edit:
To clarify, I want to remove the less descriptive OS version if it matches another version already in the list. In the example above I want to remove "Win XP".
A more difficult example is:
Win XP
Win SRV 2008
Win XP Pro
With an output of
Win XP Pro
Win SRV 2008
... View more
