About mukeshb

mukeshb · ‎01-22-2015

Try using subsearches. Something like this should work sourcetype=server_a "New connection to server A" NOT [search sourcetype=server_b "New connection to server B" | dedup user| fields user] | table user The above does the following: Performs a search to give the users logged into server B (this is the sub search assuming the field name is user and that the field name is same for both the sourcetypes) For performance issues, the sub search is made to give only the field user The outer search searches for users which are NOT in the list of the inner search and lists them as a table. Make changes accordingly and look for sub searches in splunkdocs.

mukeshb · ‎01-21-2015

We have logs coming in from an authentication system and we would like to chart out the number of authentications by Hour of the day (or Hours of the day) for the last x number of days just to check the peak authentication times. The query we have at the moment is sourcetype=abc action=success | chart count(user) by date_hour but the result is: Hour...... Count 0............... 2 1...............12 2...............13 3...............8 ...... 23.............. 6 How can I get a result like: Hour ....................Count 00:00- 00:59............2 1 :00- 1:59..............12 2:00- 2:59 ............. 13 3:00- 3:59............8 ...... 23:00- 23:59............ 6 Would it be possible to get a table or chart like above?

mukeshb · ‎07-21-2013

As per splunk, they support Linux kernel versions, not distributions. So if you have a Linux kernel 2.6 and up, any distribution should be fine.

mukeshb · ‎04-03-2013

What ive been told by a splunk engineer (and I have no idea on how true this is) is that if you build your app/dashboards in firefox/chrome it uses html5 to render the graphs which might not work on older versions of IE and show the black background

mukeshb · ‎04-03-2013

Have you tried a different browser? I faced the same issue with another app. But the black background appeared only on IE and not on Firefox or Chrome.

Posts	5
Solutions	1
Karma Given	0
Karma Received	2
Member Since	‎10-14-2012

Online Status	Offline
Date Last Visited	‎06-05-2020 02:03 AM

Find out Number of Authentications per hour

Re: Which users have done this but have not done t...

Find out Number of Authentications per hour

Re: version of linux

Re: Splunk_CiscoSecuritySuite V2 Showing all dashb...

Re: Splunk_CiscoSecuritySuite V2 Showing all dashb...