About mmasalas

mmasalas · ‎05-05-2021

In manual search it would be "src_ip != MX_address" where MX_address is the one specified in condition 2. In case of several internal IPs: "src_ip != MX_address1 src_ip != MX_address2 src_ip != MX_address3 ...", but for simplicity we may assume now that there is only one internal IP.

mmasalas · ‎05-05-2021

I have some data about email statistics, where one of relevant fields is source IP address. I'm building a dashboard and wanted to add input field on that source IP. That input field should have three choices: All possible source IPs. That is going to be "*". our own MX addresses. every external IP (i.e., all possible source IPs, except the ones listed in 2) In the case of 1 and 2 I have token and search is going to have expression like "src_ip = X". But I cannot find how to combine it with 3, where I'd have to negate condition, something like "src_ip != MX_IP". Any ideas? Also, at the moment I'm trying to do it via checkbox, but if another type would be more suitable, let me know.

mmasalas · ‎11-15-2019

I've read other answers related to conditional searches, still cannot find an answer to my problem. The situation is following. I have one search (S1, runs on index1) which provides values to search for another search (S2, runs on index2). Something like index=index2 [ search index1 | stats count by src_ip | where count > N | fields src_ip ] | stats count by src_ip, dest_ip Usually S1 has non-empty results. In most cases S2 doesn't have any results and I'm interested in cases when there are results from S2. In that case I'd like to append results from S1. So my final query basically has such a structure: index=index2 [ search index1 | stats count by src_ip | where count > N | fields src_ip ] | stats count by src_ip, dest_ip | append [ search index1 | stats count by src_ip | where count > N | fields src_ip ] The problem is that as I've mentioned, S1 query has results most of the time, therefore append (and my final query) has too. I'd like to run append only when there are non empty results from the first part.

mmasalas · ‎08-22-2018

I updated original post. Your mention of time ranges gave me a hint that I'm looking only at fresh data, but it's old data which was indexed.

mmasalas · ‎08-22-2018

I'm trying to understand how Splunk calculates license. There is particular index "snort" which receives some JSON input and laucher reports this index has increased significantly. If I do this search: index=_internal source=*license_usage.log type=Usage idx=snort | stats sum(b) as bytes | eval MB = round(bytes/1024/1024,1) | fields MB it reports me 9GB for a given period. If I estimate the length of each event and sum these values in such a way index=snort | eval len_raw = len(_raw) | stats sum(len_raw) as bytes | eval MB = round(bytes/1024/1024,1) | fields MB it gives me 18MB. I.e, there is about 500 times difference. I understand there may be issues due to encoding (ASCII vs UTF8), yet it would make 2 times difference, not 500. There are other sources that allow me to estimate the size and number of events from these sources and it seems 18MB should be the right number. Any ideas why numbers reported in _internal log are so much different? Edit: Ok, it seems that what happened is that collection script got stuck and it was continuously re-sending old data. Therefore index=snort query didn't see that data because of time-range restriction, but it was included into license estimation.

mmasalas · ‎08-09-2018

How does your jdbc url look like? Is protocol mentioned in there (tds for Sybase, I assume).

mmasalas · ‎08-08-2018

I've enabled LDAP authentication on my search head not so long ago and I started to get errors claiming that 08-08-2018 10:56:21.732 +0300 INFO AuthenticationManagerLDAP - Could not find user="nobody" with strategy="LDAP_dc01" As far as I understand from reading other answers to similar issues, on some particular activity (e.g., saved search) Splunk takes owner from metadata/local.meta or metadata/default.meta and searches for that user. Since it doesn't find that user in LDAP, it reports this fact in log file. Well, I've searched through my *.meta files and found quite a number of instances where "owner = nobody" has been mentioned. I have the impression that this "owner = nobody" was (or maybe still is) used from time to time at least in earlier versions. So it's not clear for me now if that log message indicates some problem (e.g., saved search cannot be started) or can it safely be ignored. Or maybe I should go through these meta files and change owner to something else? Please advise.

Posts	7
Solutions	0
Karma Given	0
Karma Received	1
Member Since	‎11-21-2017

Online Status	Offline
Date Last Visited	‎05-06-2021 03:45 AM

X and NOT X choice in checkbox

conditional search

How does Splunk calculate license usage (splunk li...

issue with user=nobody with LDAP authentication

Re: X and NOT X choice in checkbox

X and NOT X choice in checkbox

conditional search

Re: splunk license: _internal vs event length

How does Splunk calculate license usage (splunk li...

Re: Why is DBConnect for Sybase giving the followi...

issue with user=nobody with LDAP authentication