Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About BITSIntern
BITSIntern
Path Finder
Member since:
06-30-2015
06-05-2020
Community Statistics
| Posts | 17 |
| Solutions | 0 |
| Karma Given | 4 |
| Karma Received | 2 |
| Member Since | 06-30-2015 |
Activity Feed
- Karma Re: How to do multiple searches at once? for sk314. 06-05-2020 12:47 AM
- Karma Re: How to do multiple searches at once? for sk314. 06-05-2020 12:47 AM
- Karma Re: Is it possible to search 2 different IP fields' rare limits to graph them both and see if any IP addresses overlap? for woodcock. 06-05-2020 12:47 AM
- Karma Re: How to search if a value from FieldA equals a value from FieldB, add the two values if true, and display both values with their sum? for woodcock. 06-05-2020 12:47 AM
- Got Karma for How to search if a value from FieldA equals a value from FieldB, add the two values if true, and display both values with their sum?. 06-05-2020 12:47 AM
- Got Karma for How to search if a value from FieldA equals a value from FieldB, add the two values if true, and display both values with their sum?. 06-05-2020 12:47 AM
- Posted Re: How to do multiple searches at once? on Splunk Search. 07-14-2015 12:05 PM
- Posted Re: How to do multiple searches at once? on Splunk Search. 07-14-2015 11:59 AM
- Posted Re: How to do multiple searches at once? on Splunk Search. 07-14-2015 11:56 AM
- Posted Re: How to do multiple searches at once? on Splunk Search. 07-14-2015 11:50 AM
- Posted Re: How to do multiple searches at once? on Splunk Search. 07-14-2015 11:46 AM
- Posted How to do multiple searches at once? on Splunk Search. 07-14-2015 11:26 AM
- Tagged How to do multiple searches at once? on Splunk Search. 07-14-2015 11:26 AM
- Tagged How to do multiple searches at once? on Splunk Search. 07-14-2015 11:26 AM
- Tagged How to do multiple searches at once? on Splunk Search. 07-14-2015 11:26 AM
- Tagged How to do multiple searches at once? on Splunk Search. 07-14-2015 11:26 AM
- Posted Re: How do I make splunk read one word as another? on Splunk Search. 07-14-2015 08:29 AM
- Posted How do I make splunk read one word as another? on Splunk Search. 07-14-2015 07:58 AM
- Tagged How do I make splunk read one word as another? on Splunk Search. 07-14-2015 07:58 AM
- Tagged How do I make splunk read one word as another? on Splunk Search. 07-14-2015 07:58 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 2 | |||
| 0 |
07-14-2015
11:59 AM
the count of govern is 1078 and government is 16 so it should be 1094 together and the count of racist is 314 and race is 91 so it should be 405 together... I guess it did not include the amount of the originial word in the count
... View more
07-14-2015
11:56 AM
well I know that the count of the word govern plus the count of the word government equals 1094 (1078 + 16 = 1094) and the count of the word racist plus the count of the word race equals 405 (314 + 91 = 405)... I guess it just is not adding the actual word's count to the renamed word
... View more
07-14-2015
11:50 AM
hmm its weird, it worked but it forgot a few of the events...
so it gave me 1078 for government instead of 1094 and 314 for race instead of 405
... View more
07-14-2015
11:46 AM
wait where do I put the lookup table? Do I create a transforms.conf file and upload it to splunk?
... View more
07-14-2015
11:26 AM
Hi guys,
I need to have multiple searches running that pull up a word from the same field and replace it with another (doing this:** | eval word = if (word="racist","race",word) | stats count by word** ). My problem is I want to do this multiple times with different words but when I tried append, appendcols, join, or saving the searches, they never work out quite right. The closest I have gotten is this in my search bar:
sourcetype="socialist action" "government" OR "govern" | eval word = if (word="govern","government",word) | stats count by word | appendcols[search sourcetype="socialist action" "government" OR "govern" OR "race" OR "racist" | eval word = if (word="racist","race",word) | stats count by word]
But it still leaves another government:
word count
government 1094
government 16
race 405
Do any of you have a suggestion on how to fix this? Please let me know!
... View more
07-14-2015
08:29 AM
That helped a lot but because the count for the words is in the actual document that I uploaded I need to use pivot so I can control the y-axis, but I don't think I can anymore since it created a statistical report. Do you have any other suggestions?
Thanks!
... View more
07-14-2015
07:58 AM
Hi guys,
I am inputting wordlists into splunk and in some of the wordlists there are certain words like "racist" and then "race" where they are similar.
My wordlists look like this:
race, 23
racist, 2
test, 12
testing, 22
Where "race" is in the field "word" and "23" is in the field "count".
I need to figure out a way to tell splunk to read "racist" and "race" as the same word such that when I create a dashboard in pivot where the x-axis is "word" and the y-axis is "count", the first 2 lines of my example are "race, 25" (making the x-axis say "race" and have the column reach to 25 on the y-axis).
I had done this before with ip addresses having splunk read the source and destination and make them add the count if they were the same but I can't figure this out.
If you know how to create a search such that this works please let me know! Also, if you do not fully understand what I am saying please feel free to ask for clarification.
Thanks!
... View more
07-01-2015
07:41 AM
Thank you this really helped!!
... View more
07-01-2015
06:26 AM
Sorry I did not know there was a search manual.
... View more
07-01-2015
06:00 AM
Hi guys,
I am having some trouble trying to do a search. I want to do a search that involves the tools count and if but it keeps giving me an error like: Unknown search command 'count'. When I wanted to delete a few things from my index, I had to go to my access controls and turn on the delete command but when I went back I did not see anything about other command functions.
Am I doing something wrong or do I need to turn the tools on?
Please let me know!
... View more
06-30-2015
09:37 AM
uhh ok.... So for my ip_source there are many different ip addresses that have been repeated and the same goes for ip_destination. I would like to create a search that counts the total of each ip address which a top/rare limit search already does but I would like it to also match up the ip_source if it is identical (the ip address not the amount of times it has been repeated) to the ip_destination. If they are equal, it will count the total of the 2 different fields ( the ip_source and ip_destination) such that the one ip address will have three values: the ip_source count, the ip_destination count, the total count.
For mine, I don't have to specify the source/sourcetype, only the host.
Sorry if I was unclear, I am extremely new to splunk.
... View more
06-30-2015
09:11 AM
It's weird, so far, none have resulted in any output besides woodcock's and his only returned a total for all of the addresses (only one thing returned)
... View more
06-30-2015
08:35 AM
2 Karma
Hi guys,
So I need to figure out how to see if the thing from field ip_source equals the thing from field ip_destination and if it does, add the values of the two fields if the fields equal each other. Basically, I want the statistics to match up the items from each field and show their separate value and the values added together so that when I graph it in the visualization section there will be 3 different values (one for each field and one of the total of the 2 fields) for each ip address.
The 2 fields are: ip_source, ip_destination
They are in the same host and I am using all sources/sourcetypes (no specification)
Please let me know if you can help!
... View more
06-30-2015
07:31 AM
Thanks for the help! This didn't really get me the result I wanted but it helped!
... View more
06-30-2015
07:14 AM
Hi
I was wondering if it was possible to search 2 different field's limits. I have tried using join, append, set diff and none have gotten me what I want. What I need is to be able to compare the rare limits of the field ip_source and the field ip_destination such that I can graph them both and see if any ip addresses overlap.
This is my most recent search:
set diff [search host="intern-Studio-1737" | rare limit=20 ip_destination] [search host="intern-Studio-1737" | rare limit=20 ip_source ]
Please let me know if you can help!
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:04 AM
|
