Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About msmapper
msmapper
Path Finder
Member since:
02-03-2012
06-05-2020
Community Statistics
| Posts | 33 |
| Solutions | 2 |
| Karma Given | 0 |
| Karma Received | 12 |
| Member Since | 02-03-2012 |
Activity Feed
- Got Karma for Is there a way to audit when an alert is changed or disabled?. 10-22-2020 09:24 PM
- Got Karma for Re: SEDCMD not working for credit masking. 06-05-2020 12:46 AM
- Got Karma for How can I search a specific index via the API using curl?. 06-05-2020 12:46 AM
- Got Karma for How can I search a specific index via the API using curl?. 06-05-2020 12:46 AM
- Got Karma for Chart the actual value over time and not an average, etc.. 06-05-2020 12:46 AM
- Got Karma for Chart the actual value over time and not an average, etc.. 06-05-2020 12:46 AM
- Got Karma for Chart the actual value over time and not an average, etc.. 06-05-2020 12:46 AM
- Got Karma for Chart the actual value over time and not an average, etc.. 06-05-2020 12:46 AM
- Got Karma for Chart the actual value over time and not an average, etc.. 06-05-2020 12:46 AM
- Got Karma for Re: How do I format the output. 06-05-2020 12:45 AM
- Got Karma for Re: How do I format the output. 06-05-2020 12:45 AM
- Got Karma for Re: How do I format the output. 06-05-2020 12:45 AM
- Posted Is there a way to audit when an alert is changed or disabled? on Alerting. 10-12-2018 11:08 AM
- Posted Re: Does full key value not extract properly if it starts with a number? on Splunk Search. 06-27-2018 10:04 AM
- Posted Does full key value not extract properly if it starts with a number? on Splunk Search. 06-27-2018 09:48 AM
- Tagged Does full key value not extract properly if it starts with a number? on Splunk Search. 06-27-2018 09:48 AM
- Posted Re: Is appendcols or join better for search performance? on Splunk Search. 08-09-2016 03:57 PM
- Posted Re: Is appendcols or join better for search performance? on Splunk Search. 08-09-2016 01:30 PM
- Posted Re: Is appendcols or join better for search performance? on Splunk Search. 08-09-2016 10:54 AM
- Posted Is appendcols or join better for search performance? on Splunk Search. 08-09-2016 10:36 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 1 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 5 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
Hi all,
I have been checking in index=_audit and I can't seem to find any sort of audit messaging about when an alerts gets disabled by a user or if the alert itself is changed. Does anyone know if this information can be found in Splunk?
Regards
Jen
... View more
06-27-2018
10:04 AM
Thanks ddrillic! Not sure how I missed that in the documentation after all these years.
... View more
06-27-2018
09:48 AM
I have created a new log message that looks like
2018-06-27 11:28:01,743 WARN TestReporting , id="LJ99YUT5F1K", trans_timestamp="6/27/18 3:42 AM", 3d_secure_data="", arn="", purchase_amount="57.80", currency="USD"
All of my Key-value pairs do auto-extract but the one named 3d_secure_data does not seem to extract the full name. When you look at the Interesting Fields, the key is actually named d_secure_data, the 3 is being dropped off somehow. See screenshot
Is this a known key naming convention where keys can only start with alpha char or is this an issue with auto-extraction? I am using Splunk Enterprise 6.6.3.
I can work around the issue by remaining the key and spelling out the word three, Ijust want to know if this a known configuration setup or a bug.
Regards
Jen
... View more
08-09-2016
03:57 PM
Hi somesoni2,
The query performance is a bit better but I am still experiencing the same issue with the results not being on the same line together. Getting the data from each timeframe to show on one line with the best performance is my goal. Right now 30 Day and Today numbers are completely separate rows in the table. I have only every seen join and appendcols put data like that in the same row.
Regards
msmapper
... View more
08-09-2016
01:30 PM
Hi somesoni2,
While the query works really well, it doesn't put the results from Last 30 Days and Today on the same row. I get 2 rows per Field, one for Last 30 Day and one for Today stats. This doesn't seem to give any performance boost over the subsearch or the join or appendcols, in fact it actually seems a bit slower to run. The subsearch runs in less than 1 min and your query takes 2 min, this is over 1.8 million rows.
Am I doing something wrong with your query?
Also in your example as is the eval statements for the Total and Percent fields aren't populating. There are a few typo's that I want to correct for others to use later
| eval "Last 30 Day Total"=if(period=="Last 30 Day",count,null())| eval "Last 30 Days %"=if(period="Last 30 Day",percent,null())| eval "Today Total"=if(period="Today",count,null()) | eval "Today %"=if(period="Today",percent,null())|stats values(*) as * by field1, field2, field3 ) |table field1, field2, field3 "Last 30 Day Total" "Last 30 Days %" "Today Total" "Today %"
... View more
08-09-2016
10:54 AM
Hi sjohnson,
Great reminder of the timeout and maxtime for subsearches. Do you know if it goes, 2 min for search time out and then 1 minute for maxtime, for a total of 3 min?
Right now, the query takes about 30-45 secs to fully display but I am concerned about how it will perform once more pages go live. I want to make sure I start off with the optimal query as well. I do also plan on turning on acceleration for the query once it is finalized to help performance and results.
Regards
msmapper
... View more
08-09-2016
10:36 AM
Hi there,
I am trying to decide which Splunk command I should use to give better long-term performance on the search and the search head and am looking for advice. The functions are join type=left OR appendcols override=true . The goal is to see information that may or may not be in both searches (saw page hits in the last 30 days but no hits to that page today)
Example result
field1 field 2 field3 Last 30 Day Total Last 30 Days % Today % Today Total
website1 URL1 Page1 40618 8.605436 7.814981 1083
website1 URL2 Page2 6 0.001271
website2 URL1 Page1 95650 12.050409
website2 URL2 Page2 43862 5.525928 8.103728 50
I have a search with the left join
index=abc data=billing scoring_type=decisioned latest=@d earliest=-30d@d| top field1, field2 by field3 countfield="Last 30 Day Total" percentfield="Last 30 Days %" | join type=left [search index=abc data=billing latest=now earliest=@d| topfield1, field2 by field3 countfield="Today Total" percentfield="Today %"]
And then the same search using appendcols override=true
index=abc latest=@d earliest=-30d@d| top field1, field2 by field3 countfield="Last 30 Day Total" percentfield="Last 30 Days %" |appendcols override=true [search index=abc latest=now earliest=@d| topfield1, field2 by field3 countfield="Today Total" percentfield="Today %"]
Both searches give me the results I am looking for, but they are both long running and I want to know performance-wise which is the better method.
Thanks for the responses
msmapper
... View more
07-18-2016
12:59 PM
nnshey
think this might be what your looking for
charting.chart.showLabels Boolean true Indicates whether to display labels.
charting.chart.showPercent Boolean false Indicates whether to display percentage values with the labels.
http://docs.splunk.com/Documentation/Splunk/6.4.2/Viz/ChartConfigurationReference#General_chart_properties
... View more
06-20-2016
05:15 PM
Hi there,
I think this is the answer i was looking for and it doesn't use Timewrap.
data=device latest=now earliest=@d |stats sum(total_amount) AS Today by device_type | appendcols [search latest=-7d@m earliest=-7d@d|stats sum(total_amount) AS Last_Week by device_type ]
This allows me to compare to the exact same Today to Last week, to the Minute. I just couldn't get to the level I wanted with Timewrap at this time. It's a great command, but I think I just need to experiment with it more.
Regards
... View more
06-20-2016
12:25 PM
Hi Raghav2384,
the timewrap d definitely gives me that date that i was looking for but it still give me data for Yesterday (june 19) and last week (june 13).
What i am trying to show is always the Current Day and the Same Day the previous week. I don't want Yesterday and Yesterday's same day the previous week. I have tried
data=device earliest=-14d@d
Any ideas on how to show Today in timewrap?
regards
Jen
and still get Yesterday as the
... View more
06-17-2016
02:28 PM
Hi there,
I just started to use Timewrap and I am having an issue with the displayed week label. I am trying to show the time chart for today and the same day last week only. In date terms, I want to only show June 17 (today) and June 10 (last Friday).
My search is:
data=device earliest=-2w | timechart count span=1h | where strftime(_time, "%A") == strftime(now(),"%A") | timewrap w series=exact|
When the search completes, the chart line labels read the week of June 10 and the week of June 03. There isn't a label for the week of June 17th (which is today). Also, how do I change the exact label to be the Day, not the "week of"
All help is appreciated
Regards
... View more
04-18-2014
12:24 PM
Has anyone found an answer to this question? I am running into the same issue. The data appears to be there if I look at the events returned in Verbose mode but in the table view or in Smart mode, the results are zero.
... View more
03-26-2014
02:50 PM
3 Karma
The best option would be to use | fieldformat amount= "$" + tostring(amount, "commas"). Using fieldformat vs. eval keeps the data numeric, whereas email considers the data to be a string.
... View more
02-26-2014
03:15 PM
thanks yannk!
is both blacklist and whitelist required? initally i used the whitelist and got errors.
also can you explain the benefit of indexAndForward=true? the documentation wasn't very clear because it read like it would supercede the blacklist and forward all indexes.
here is an example of my outputs.conf
[tcpout:defaultGroup]
server = 10.244.4.185:9997
useACK=true
autoLB = true
forwardedindex.<1>.whitelist = _internal
forwardedindex.<2>.whitelist = sos
forwardedindex.<3>.whitelist = summary
forwardedindex.<4>.blacklist = notable
forwardedindex.<5>.blacklist = access_summary2
... View more
02-26-2014
01:32 PM
Hi there,
I am looking to setup the tcpout config on my search heads to send my summary index and sos/internal indexes to our indexers but we have the PCI app and its add-on installed on the search heads as well. I wanted to know if there is any way to setup the tcpout configs to send the summary, internal and sos indexes and IGNORE all of the PCI related indexes on the search head.
Thanks
Jen
... View more
02-19-2014
02:38 PM
This is exactly what i was looking for, I didn't think using |fields -total would remove the splunk generated field of total but it does. please submit it as an answer and i will accept it
... View more
02-18-2014
09:11 AM
yannK,
While your suggestion works just as well as the timechart query I had, it still doesn't provide a way to get rid of the "total" line that automatically gets generated. Is there any way to get rid of that? It totally skews the chart I am interested in the individual names not the totals.
... View more
02-13-2014
04:54 PM
5 Karma
I know this should be a simple thing but I am trying to just chart out the trend of a value over time. I don't want an average or median or anything stats, i want the literal value that is being logged every 10secs or so. My log message is formatted in the following way
Feb 13 18:13:02 server01 PROCESS=enginedepth NAME=high VALUE=0
Feb 13 18:13:12 server01 PROCESS=enginedepth NAME=high VALUE=50
Feb 13 18:13:22 server01 PROCESS=enginedepth NAME=high VALUE=70
Feb 13 18:13:32 server01 PROCESS=enginedepth NAME=high VALUE=100
Feb 13 18:13:42 server01 PROCESS=enginedepth NAME=high VALUE=20
Feb 13 18:13:52 server01 PROCESS=enginedepth NAME=high VALUE=900
I am just looking to put number from the VALUE field in a chart for each NAME field.
The search query of "host=server01 PROCESS=enginedepth | timechart span=1m values(VALUE) by NAME limit=40 usenull=false useother=f" get close to what I am looking for but I get the additonal "total" line which throws off the charting. Plus I want to see all of the changes in the VALUE FIELD.
So my two questions are, is values() the correct stat to be used in this situation and is there a way to get rid of the auto-generated "total" field (green line in graph screenshot)?
... View more
09-13-2013
08:57 PM
1 Karma
I was able to figure out how to make it work. here is my final version for props.conf
[reporting_test]
SEDCMD-ccmask= s/(((\%20|\%2C)?(6\d{3}|5\d{3}|4\d{3})(\-|\%20|\%2C)?\d{4}(\-|\%20|\%2C)?\d{4}(\-|\%20|\%2C)?\d{4}(\%20|\%2C))|((\%20|\%2C)+3\d{3}(\-|\%20|\%2C)?\d{6}(\-|\%20|\%2C)?\d{4,5}(\%20|\%2C)))/####CC-SCRUBBED###/g
thanks
jen
... View more
09-13-2013
07:51 PM
Turk,
here is an example, the fake cc number in the example is near the end but in our logs it can be anywhere after "notes="
Sep 10 20:47:26 server.chi <local4-notice> logger: 111.111.444.18 - - [10/Sep/2013:20:47:25 -0500] "GET /ajaxHandler?request=process&transId=5237260030018826951&bucketId=1&Id=R_5237260000000015722&Text=ALLOW¬es=frd.inv.ok%20to%20process.pc-no%2di-no%2CAvs%20Z%2Clinked%20order%3A500834127%2Cbil2shp2%20tch%20hm%20addr.bank%2099-400-9999%20rep%20stated%20no%20phn%20merchant%20vrfctn%20allowed%2Cnon%20susp%20order%20details%20so%20processing.celia%2Ftofc%0A%0A%0AXXXX-XXXX-XXXX-XXXX%20 HTTP/1.1" 200 75
Regards
Jen
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:03 AM
|
