About inventsekar

inventsekar · ‎08-11-2016

the "status" is the variable i am using the extract the word "running".

inventsekar · ‎08-11-2016

your search | rex field=_raw "(?<first>\w)\sis\s(?<status>\w+)" | table first status first column will have only one letter (a or b or .. ) or it can have a few letters (host1, etc ) status will have only "running" or what other values it can have (running, not running, failed, etc..)

inventsekar · ‎08-10-2016

http://docs.splunk.com/Documentation/Splunk/6.4.2/Knowledge/Managesummaryindexgapsandoverlaps Use the backfill script to add other data or fill summary index gaps The fill_summary_index.py script backfills gaps in summary index collection by running the saved searches that populate the summary index as they would have been executed at their regularly scheduled times for a given time range. check this one as well.. FYI - This document refers to 3.x versions of Splunk. http://wiki.splunk.com/Community:Summary_Indexing_Back_Fill

inventsekar · ‎08-10-2016

we are trying to create the rex query with just our own understanding of your issue. could you please update us an event, and your current query, please.

inventsekar · ‎08-10-2016

Sir, i am trying this one.. but its not working. also may i know, what this one does - ([snrt][hd]) please sourcetype=monthyear | rex field=_raw mode=sed "s/(? \w{3,4}\s\d\d?)([snrt][hd]),\s?(?\d{4})/\1, \3/g" | table dt yr _raw

inventsekar · ‎08-10-2016

rex field=_raw "(?<month>\w+)\s\d+\w\w,(?<year>\d\d\d\d)" | eval MON=case(month == "Nov", "11", month == "July", "7", month == "June", "6", month == "Aug", "8") | eval date=year."-".MON | table date MON, year _raw it gives this output - date MON year _raw 2014-11 11 2014 the format Nov 10th,2014 and extract out the month_year in the format 2014-06. 2014-8 8 2014 the format Aug 6th,2014 and extract out the month_year in the format 2014-06. 2014-7 7 2014 the format July 1st,2014 and extract out the month_year in the format 2014-06. 2014-6 6 2014 the format June 16th,2014 and extract out the month_year in the format 2014-06.

inventsekar · ‎08-10-2016

oh ok.. thanks.

inventsekar · ‎08-10-2016

http://docs.splunk.com/Documentation/SplunkLight/6.4.2/References/Listofsearchcommands there is no lookup command on the list of available commands on Splunk Light.

inventsekar · ‎08-10-2016

i hope, with enterprise trial license you can configure SHC and index cluster. Summary of key requirements for search head clusters These are the main issues to note regarding provisioning of cluster members: Each member must run on its own machine or virtual machine, and all machines must run the same operating system. All members must run on the same version of Splunk Enterprise. All members must be connected over a high-speed network. You must deploy at least as many members as either the replication factor or three, whichever is greater. In addition to the cluster members, you need a deployer to distribute updates to the members. The deployer must run on a non-member instance. In some cases, it can run on the same instance as a deployment server or an indexer cluster master node. There is no special type of license specifically for search heads, that is to say, there is no "Search head license". However, you must have an Enterprise license to configure a search head. http://docs.splunk.com/Documentation/Splunk/6.4.2/Admin/TypesofSplunklicenses http://docs.splunk.com/Documentation/Splunk/6.4.2/DistSearch/SHCsystemrequirements maybe, you should check "Sales trial license" If you are working with Splunk Sales, you can request trial Enterprise licenses of varying size and duration. The Enterprise trial license expires 60 days after you start using Splunk. If you are preparing a pilot for a large deployment and have requirements for a longer duration or higher indexing volumes during your trial, contact Splunk Sales or your sales rep directly with your request.

inventsekar · ‎08-10-2016

"(?i)response=(?.+)$" ----- - you should use < and > around the variable - (?<i>) - (?<i>) needs to come where it will appear on the event (ie, after the "response=") and i created few sample events ending with "response=digits" event 1 - Extract "from" and "to" fields using regular expressions. response=101 event 2 - If a raw event contains "From: Susan To: Bob", then from=Susan and to=Bob, response=404 event 3 - source="tutorialdata.zip:./www1/access.log" response=500 and this query picks up the response codes fine. sourcetype=responseREX | rex field=_raw "response=(?<i>.*)" | table _raw, i regarding the end of line $, these below two works same - response=(?.) and response=(?.)$

inventsekar · ‎08-09-2016

looks like source and sourcetype are audittrail. i hope this is same for LDAP and local users as well. please check it and update us(for those who uses LDAP only) index=_audit source = audittrail sourcetype = audittrail

inventsekar · ‎08-09-2016

index=_audit tag=authentication | stats count by user, info | sort - info this works fine, but it includes LDAP as well. let me check how to get only local accounts. one more question - do you have both Local accounts and LDAP authentication together ah?!?!

inventsekar · ‎08-09-2016

when you create the alert, you can enable "Add to Triggered Alerts" action, so that, you can review all recently triggered alerts on the Triggered Alerts page. http://docs.splunk.com/Documentation/Splunk/6.4.2/Alert/Triggeredalertaction http://docs.splunk.com/Documentation/Splunk/6.4.2/Alert/Reviewtriggeredalerts Details of triggered alerts are available for 24 hours by default. updated - this query will give us a list of alerts fired in last 1day - index=_audit action=alert_fired earliest=-1d@d

inventsekar · ‎08-09-2016

Please check this add-on... File/Directory Information Input Add-on The File Info add-on provides an input for indexing file meta-data (size, last modified dates, etc.) and indexing it in your Splunk instance to make it searchable. https://splunkbase.splunk.com/app/2776/ Or, you might need to do scripted input. Or, maybe, check this idea - - finding the size of all events from the log and adding it. on that Splunk Tutorial data, we have a file tutorialdata.zip:./www1/access.log and its size is 4.06 MB (4,262,086 bytes). thru this query, splunk shows its size as "4248458" (very close value, i think ;). approximately, i hope, its a good process) source="tutorialdata.zip:./www1/access.log" | eval esize=len(_raw) | stats sum(esize) by sourcetype

inventsekar · ‎08-09-2016

$SPLUNK_HOME/etc/system/default/alert_actions.conf OR $SPLUNK_HOME/etc/system/local/alert_actions.conf in this file, do you have any value for "ttl"?!? $SPLUNK_HOME/etc/system/default/savedsearches.conf OR $SPLUNK_HOME/etc/system/local/savedsearches.conf got any values for dispatch.ttl?

inventsekar · ‎08-09-2016

the question is bit not clear. may we know, some more info please.. 1. from this above sample log msg, do you want to query this event ah? Start of the event CPF1124 00 INFO Job 252582/QTMHHTTP/QIWIRELESS started on 07/04/16 at 00:00:21 in subsystem QHTTPSVR in QHTTPSVR. Job ent QIWIRELESS QTMHHTTP 252582 QWTPIIPP 0000 07/04/16 00:00:22.002029 QTMHHTTP <<<< End of the Event 2. the above sample log is a single event or multiple events? 3. from this sample log, can you tell us, how to find out the "start of the event" and "end of the event"..

inventsekar · ‎08-07-2016

for this task, i hope using metadata would be efficient. This one will find the hosts that have not sent any events for more than one day. | metadata type=hosts index=windows host=one (or .....)| where relative_time(now(), "-1d") > lastTime | convert ctime(lastTime) as Latest_Time | sort -lastTime | table host,Latest_Time A general query | metadata type=hosts | sort recentTime desc | convert ctime(recentTime) as Recent_Time

inventsekar · ‎08-05-2016

splunk document link for rex learning http://docs.splunk.com/Documentation/Splunk/6.4.2/Knowledge/AboutSplunkregularexpressions http://docs.splunk.com/Documentation/Splunk/6.4.2/SearchReference/Rex

inventsekar · ‎08-05-2016

edit - tried this and its working good. sourcetype=rexmemtotal | rex field=_raw "(MemTotal:\s+(?P<rexmemtotal>\d+))" | table rexmemtotal _raw

inventsekar · ‎08-04-2016

check this one.. index=main sourcetype=jmslogs | rex field=_raw "(?ms)^\s+(?P\d+\-\d+\-\d+\s+\d+:\d+:\d+,\d+) INFO \[(?P[^\]]+)" | table jmsContainer date _raw jmsContainer date _raw jmsContainer-2 2016-08-03 23:32:07,551 2016-08-03 23:32:07,551 INFO [jmsContainer-2] ... jmsContainer-15 2016-08-03 23:43:06,660 2016-08-03 23:43:06,660 INFO [jmsContainer-15] ... jmsContainer-1 2016-08-03 23:20:06,581 2016-08-03 23:20:06,581 INFO [jmsContainer-1] ... jmsContainer-10 2016-08-03 23:39:06,123 2016-08-03 23:39:06,123 INFO [jmsContainer-10] ... jmsContainer-1 2016-08-03 23:31:06,453 2016-08-03 23:31:06,453 INFO [jmsContainer-1] ... jmsContainer-5 2016-08-03 23:51:00,607 2016-08-03 23:51:00,607 INFO [jmsContainer-5] ...

inventsekar · ‎08-04-2016

please check this sourcetype events - f5:bigip:syslog if you have any sample events, we can create the splunk query.

inventsekar · ‎08-04-2016

hi, 10billion seems a very huge number. are you sure?.. also did you check the set diff configurations on the limits.conf file ah..please update us..

inventsekar · ‎08-04-2016

oh ok. i thought cisco:asa logs may have same format. seems your environment is different. ok, thanks.

inventsekar · ‎08-03-2016

as i checked, "sourcetype=cisco:asa" events are not having a field "dev" tried it without "dev" and its working fine.. src=122.15.158.173 sourcetype=cisco:asa "Deny*"|stats max(_time) as last_time by host,sourcetype,action,dest,dest_ip,dest_port,index,msg,src,src_ip,src_port,vendor_action |dedup last_time,host,sourcetype,action,dest,dest_ip,dest_port,index,msg,src,src_ip,src_port,vendor_action

inventsekar · ‎08-03-2016

10 billion !!!... i think, you may need to edit the query timelines and do multiple queries. with default values for set command, it wont return 10 billion. http://docs.splunk.com/Documentation/Splunk/6.4.2/SearchReference/Set Output limitations There is a limit on the quantity of results that come out of the invoked subsearches that the set command receives to operate on. If this limit is exceeded, the input result set to the diff command is silently truncated. If you have Splunk Enterprise, you can adjust this limit by editing the limits.conf file and changing the maxout value in the subsearch stanza. If this value is altered, the default quantity of results coming from a variety of subsearch scenarios are altered. Note that very large values might cause extensive stalls during the 'parsing' phase of a search, which is when subsearches run. The default value for this limit is 10000. Result rows limitations By default the set command attempts to traverse a maximum of 50000 items from each subsearch. If the number of input results from either search exceeds this limit, the set command silently ignores the remaining events. By default, the maxout setting for subsearches prevents the number of results from exceeding this limit. If you have Splunk Enterprise, you can change this limit by editing the maxresultrows setting in the set stanza in the limits.conf file.

Posts	1971
Solutions	190
Karma Given	2341
Karma Received	504
Member Since	‎06-19-2015

Online Status	Offline
Date Last Visited	4 hours ago

Regarding rex in SPL2 supports raw string literals...

fresh splunk installation, acccept license gives w...

Problems when submitting an app / add-on to splunk...

The Slack Community User Metrics

Splunk workload pricing vs ingest pricing

Splunk Slack to Splunk Community Q and A posts mig...

the karma points system... logically broken?

About Splunk Command options

conf25 Unpacked in Bangalore edition - This Friday

Bangalore Splunk Usergroup meeting(Dec 2025)

Re: how to extract 2 different values from a strin...

Re: how to extract 2 different values from a strin...

Re: Schedule automatic summary backfill?

Re: Regex match till end of event?

Re: Splunk date time format

Re: Splunk date time format

Re: How to add a CSV lookup table - Splunk Light F...

Re: How to add a CSV lookup table - Splunk Light F...

Re: Will be able to use enterprise trail license t...

Re: Regex match till end of event?

Re: Splunk success & fail Logins

Re: Splunk success & fail Logins

Re: Action log of emails sent as trigger from ale...

Re: how can i monitor a file size

Re: Saving alert artifacts for longer periods of t...

Re: Confuguring events for AS400 logs

Re: How to write a search to alert when a source s...

Re: What is a regular expression that ignores whit...

Re: What is a regular expression that ignores whit...

Re: Filter logs by thread name and display in tabl...

Re: F5 Audit Logs

Re: set diff is very slow when match 10 billion

Re: Why is my current stats search not producing a...

Re: Why is my current stats search not producing a...

Re: set diff is very slow when match 10 billion

Join the Conversation