About jip31

jip31 · ‎09-13-2024

hi I try to list the step to interface splunk with service now and to create an incident in servicenow from a splunk alert is it mandatory to use the splunk addon Splunk Add-on for ServiceNow | Splunkbase? and what are the steps after? thanks

jip31 · ‎09-13-2024

now it works... Last question : how to change the rangemap of the colors It iis in the xml or is it automatic?

jip31 · ‎09-13-2024

I dont know why but the fields "Value" displays anything when i execute your search even if the field exists

jip31 · ‎09-13-2024

its what I am doing but it returns no heat map index="main" sourcetype="Perfmon:disk" | eval _time=strptime(time, "%m/%d/%Y %H:%M") | timechart eval(round(avg(Value),0)) by host instead this which returns an heat map | inputlookup sample-data.csv | eval _time=strptime(time, "%m/%d/%Y %H:%M") | timechart eval(round(avg(value),0)) by name

jip31 · ‎09-13-2024

Not sure you understand my needs In the example below you can see thats random numbers are displayed | gentimes start=-10 increment=4h | eval "Server Availability"=random()%100, "Customer Satisfaction"=random()%100,"Server Performance"=random()%100, _time=starttime | table _time, "Server Availability","Customer Satisfaction","Server Performance" Instead random numbers, i would like to have true numbers froms my index, for example from the field "Value" so i dont know how to query on it in the example i gave to you

jip31 · ‎09-13-2024

Not sure you understand my needs In the example below you can see thats random numbers are displayed | gentimes start=-10 increment=4h | eval "Server Availability"=random()%100, "Customer Satisfaction"=random()%100,"Server Performance"=random()%100, _time=starttime | table _time, "Server Availability","Customer Satisfaction","Server Performance" Instead random numbers, i would like to have true numbers froms my index, for example from the field "Value" so i dont know how to query on it in the example i gave to you

jip31 · ‎09-13-2024

could you please give me an example?

jip31 · ‎09-12-2024

hi i need to do an heat map vizualization i have checked the dasbord examples addon and in this example a lookup is used | inputlookup sample-data.csv is it possible to do the same thing without a lookup please? I mean by using an index and an eval command for example if the field "Value" is < 50 th color is green, <30, the color is orange and < 10 the color is red in my heat map Rgds

jip31 · ‎09-04-2024

Hi I need to do observability on different web applications on Windows workstations For example i need to mesure response time or error code of the webapp Is it possible to collect these metrics in splunk? How? With Splunk APM? Website monitoring? Other question : how to collect events from the Windows event viewer? Thanks

jip31 · ‎07-24-2024

not sure to understand when you say "1. Use EventTypes to apply the tags to the events so they end up in the correct data model. E.g. tag "network" and "communicate" to put it in the NetworkTraffic data model." imagine that my searc is index=main uri="*.php*" OR uri="*.py*" Do you meant that i have to onboard this in a tag called "network"? And if i have a field called "ip" in my apps does it mean i have to tag it as "dest_ip" following the Network Traffic datamodel?

jip31 · ‎07-23-2024

Hi I have developped a dashbord relative to firewall metrics. I need to make my dashboard CIM compliant Do i need my searches linked to the firewall datamodel with the firewall tstats datamodel (tstats where datamodel=....) or do i just need to create tags and eventtypes following the firewall datamodel ? I understand anything so is someone can d'escrime clearly all the steps for having my apps CIM compliant ? Thanks

jip31 · ‎07-17-2024

ok is the latency explain in seconds? Imagine the latency is 180 does it mean i have to put -3m@m in earliest and now() in latest?

jip31 · ‎07-16-2024

i just want to calculate the latency between _indextime and _time in order to define a time range in my alert which take into account this latency

jip31 · ‎07-16-2024

hi is anybody could give me a search to calculate the _indextime average for my events once it's done, what i have to do in the cron parameters of my alert to take into account this metric? thanks

jip31 · ‎07-16-2024

i have anything displayed under label... is anybody can help? Here is what i see

jip31 · ‎07-16-2024

Hi <search> <query>index=* EventCode=25753 | stats count(EventCode) as toto | append [| search index=* EventCode=* | stats count(EventCode) as toto2]</query> <earliest>-7d@h</earliest> <latest>now</latest> <done> <condition> <set token="NbHost">$result.toto$</set> <set token="NbHost2">$result.toto2$</set> </condition> </done> </search> <option name="drilldown">none</option> <option name="underLabel">$NbHost$ / $NbHost2$</option> I dont succeed to display the NbHost2 value under my single panel what is wrong please?

jip31 · ‎06-04-2024

is anybody can help please?

jip31 · ‎02-16-2024

index=mem tag=a return results but not tag=a you are right, when I add the tage add the index level tag=a works

jip31 · ‎02-16-2024

hi I can see the tag But when I am doing tag="a", i have no results

jip31 · ‎02-15-2024

hi I have created a tag for the field "counter" called "a" But when I run a search with tag=a or with tag::counter="a", there is no results what is the problem please?

jip31 · ‎02-15-2024

when you say "to match those expected by the DM ("high", "medium", "low", etc. in severity, for example)", where I can see this information in the DM?

jip31 · ‎02-15-2024

Imagine I have an app with Intrusion Detection data If I want to make my app CIM compliant I need to add aliases, tags and calculated fields like in the Intrusion Detection Datamodel ? For example, if I have a field called "Alert level", I need to create an aliases in my app in order to rename it as "severity_id"? Or is it better to create a own datamodel from my app and to query from this datamodel with tstats? | tstats count from datamodel=TEST

jip31 · ‎02-15-2024

Hello I have great difficulties to understand where to begin for using the CIM datamodel Is anybody can clearly summarize the different ways to apply a CIM datamodel in my own apps? Thanks in advance

jip31 · ‎02-13-2024

hi i try to use a table icon viz like below in the static folder i have put the "table_icons_rangemap.js" and the 'table_decorations.css" files I call these file in my xml like this : <dashboard version="1.1" script="table_icons_rangemap.js" stylesheet="table_decorations.css"> when I run the dashboard nothing happens I just have severe, high instead an icon I use 9..1.0.1 Splunk Enterprise version is anybody cant help please?? thanks

jip31 · ‎02-06-2024

thanks

Posts	1728
Solutions	11
Karma Given	9
Karma Received	19
Member Since	‎03-22-2018

Online Status	Offline
Date Last Visited	‎09-16-2024 03:53 AM

help to connect splunk with servicenow

help on heat_map_visualization

How to measure applicative availability

Help to make my apps CIM compliant

help to calculate _indextime

help on under label token

help on tag

How to make data CIM compatible

help on custom_table_icon_set_rangemap viz

help on append command in a line chart

help to connect splunk with servicenow

Re: help on heat_map_visualization

Re: help on heat_map_visualization

Re: help on heat_map_visualization

Re: help on heat_map_visualization

Re: help on heat_map_visualization

Re: help on heat_map_visualization

help on heat_map_visualization

How to measure applicative availability

Re: Help to make my apps CIM compliant

Help to make my apps CIM compliant

Re: help to calculate _indextime

Re: help to calculate _indextime

help to calculate _indextime

Re: help on under label token

help on under label token

Re: help on custom_table_icon_set_rangemap viz

Re: help on tag

Re: help on tag

help on tag

Re: Help on CIM datamodel usage

Re: Help on CIM datamodel usage

How to make data CIM compatible

help on custom_table_icon_set_rangemap viz

Re: help on append command in a line chart