Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About somesoni2
somesoni2
Revered Legend
Member since:
07-26-2011
08-09-2024
Community Statistics
| Posts | 11790 |
| Solutions | 2732 |
| Karma Given | 1141 |
| Karma Received | 6182 |
| Member Since | 07-26-2011 |
Activity Feed
- Got Karma for Re: How to group by host, then severity, and include a count for each severity?. 2 weeks ago
- Got Karma for Re: What is the impact of deployment server failure?. 11-12-2024 12:57 PM
- Got Karma for Re: When adding "KV_MODE=none" to props.conf, how come unwanted field extractions are not being stopped?. 11-10-2024 06:53 PM
- Got Karma for Re: Timecharting delta by multiple fields. 11-04-2024 01:36 AM
- Got Karma for Re: How to chart values over time. 10-31-2024 01:17 PM
- Got Karma for Re: How to use split to extract a delimited value?. 10-15-2024 12:38 PM
- Got Karma for Re: tstats and using timechart not displaying any results. 10-10-2024 11:57 AM
- Got Karma for Re: How to I exclude a field value that contains numbers?. 10-10-2024 04:17 AM
- Got Karma for Re: Clarification on eventtypes when using the Splunk App for Windows Infrastructure. 10-08-2024 01:11 AM
- Got Karma for Re: How to extract multiple key value pairs from the logs. 10-07-2024 07:10 PM
- Got Karma for Re: How do I create a stacked bar graph with 2 fields?. 10-03-2024 08:26 AM
- Got Karma for Re: Can I fill null results of a field with results from another field?. 10-03-2024 03:06 AM
- Got Karma for Re: how to get the month dropdown?. 09-20-2024 05:44 AM
- Got Karma for Re: How to reference the search time range. 09-13-2024 08:14 AM
- Got Karma for Re: inputlookup - How to search through all lookup fields. 09-05-2024 08:50 AM
- Got Karma for Re: Is it safe to remove excess buckets?. 09-05-2024 08:20 AM
- Got Karma for Re: Get last login time based upon a list of accounts in a CSV lookup file. 09-04-2024 09:07 AM
- Got Karma for Re: How to return more than 10 columns in a table search result?. 09-01-2024 04:47 PM
- Got Karma for Re: Blacklist a host (hosts is sending logs to Splunk via TCP). 08-30-2024 02:19 PM
- Got Karma for Re: Understanding the LOOKUP command. 08-28-2024 10:57 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 1 | |||
| 2 | |||
| 3 | |||
| 1 | |||
| 6 | |||
| 0 | |||
| 3 | |||
| 2 | |||
| 0 | |||
| 2 |
Give this a try index=_internal source=*var/log/splunk/search_messages.log
... View more
10-19-2023
12:42 PM
1 Karma
The timechart generates time series for selected time range, so you get data for full time window, even when there are no results for certain buckets. The chart command, like stats command, generates statistics for available _time buckets only, so if a time bucket has 0 events, it'll will not show it (can't generate if it's not present). There are workaround to get full time series with chart as well but it's not that pretty. If timechart is an option, use that. Here is the workaround query: index = _internal ``` simulate zero-count buckets ```
| bucket _time span=5m
| chart count over _time
| append [| makeresults | addinfo
| eval time=mvrange(info_min_time, info_max_time+1,300)
| rename comment as "third argument should in seconds and same as the span you selected for chart"
| table time | mvexpand time
| rename time as _time | eval count=0]
| chart sum(count) as count by _time
... View more
10-19-2023
12:19 PM
1 Karma
For your requirement, left join may not be ideal. Try this alternate implementation (replace make results query with your lookup/data query): | makeresults | eval DatabaseName=split("A B C"," ") | mvexpand DatabaseName | table DatabaseName | eval from="Lookup" | append [| makeresults | eval DatabaseName=split("A A1 10#A A2 20#C C1 40#C C2 50#D D 60","#") | mvexpand DatabaseName | table DatabaseName | rex field=DatabaseName "^(?<DatabaseName>\S+)\s+(?<Instance>\S+)\s+(?<CPUUtilization>\S+)$" | eval from="search"] | eventstats values(from) as from by DatabaseName | where isnotnull(mvfilter(match(from,"Lookup"))) | foreach CPUUtilization Instance [| eval "<<FIELD>>"=coalesce('<<FIELD>>',if(mvcount(from)=1 AND from="Lookup","NULL",null()))] | stats count by DatabaseName CPUUtilization Instance | table DatabaseName CPUUtilization Instance
... View more
10-18-2023
12:56 PM
Try adding following at the end of your search If your current search result contains _time and one field say "count" | eventstats sum(count) as TotalCount If your search result contains _time and several dynamic column names, | addtotals fieldname="Totalcount"
... View more
10-17-2023
09:08 AM
1 Karma
Gi <input type="dropdown" token="tok_usecase" searchWhenChanged="true">
<label>Use Case</label>
<choice value=""01"">Use Case 01</choice>
<choice value=""02"">Use Case 02</choice>
<choice value=""03"">Use Case 03</choice>
<choice value=""04"">Use Case 04</choice>
<choice value=""05"">Use Case 05</choice>
<choice value=""06"">Use Case 06</choice>
<default>"01"</default>
<initialValue>"01"</initialValue>
<change>
<condition label="Use Case 05">
<set token="ShowPanel">true</set>
<unset token="tok_audit"></unset>
<unset token="tok_taskID"></unset>
<unset token="tok_sessID"></unset>
</condition>
<condition match="true()">
<unset token="ShowPanel"></unset>
<unset token="tok_audit"></unset>
<unset token="tok_taskID"></unset>
<unset token="tok_sessID"></unset>
</condition>
</change>
</input> ve this a try
... View more
10-17-2023
08:53 AM
Did you deploy any props.conf for this sourcetype on your search head? Since you're doing index time field extraction (with INDEXED_EXTRACTIONS = json), there is no need to search time field extraction. I've seen props.conf with search time field extraction (KV_MODE = json) along with index time field extraction causing double extraction. You need to use one. If you just want index time field extraction, explicitly set KV_MODE = none on search head.
... View more
10-16-2023
11:44 AM
I missed a colon in the regex. Added just now. Try the updated version.
... View more
10-16-2023
09:59 AM
1 Karma
Try like this (UPDATED) | rex "http(s)*:\/\/([^\/]+\/)+customer\/(?<customerId>[^\/]+)\/product\/(?<productId>[^\/]+)"
... View more
10-16-2023
08:42 AM
1 Karma
Your filter to include weekends is "day_of_week="*"". The asterisk as wildcard doesn't work with "where" command. So either change your search to replace "where" with "search" OR change your include weekend filter. Either Change search to: `compliance("`console`", now(), -15d@d, mcafee,*, virus_, *, *, *)`
| eval day_of_week = lower(strftime(_time,"%A"))
| search NOT (day_of_week="saturday" OR day_of_week="sunday")
| chart count by virus_global
| sort virus_global OR change radio button to: <input type="radio" token="weekends" searchWhenChanged="true">
<label>Weekends</label>
<choice value="NOT (day_of_week="saturday" OR day_of_week="sunday")">Exclude Weekends</choice>
<choice value="true()">Include Weekends</choice>
<default>NOT (day_of_week="saturday" OR day_of_week="sunday")</default>
<initialValue>NOT (day_of_week="saturday" OR day_of_week="sunday").
</initialValue>
</input>
... View more
10-16-2023
08:33 AM
The equal sign might be causing issues, escape them with backward slash. Also, the OR keyword between two stats fields is invalid, remove it. index=abcd | stats count(eval(searchmatch("https://drive.google.com/uc?export\=download&id\=1HGFF5ziAFGn8161CKQC$Xyuhni9PNK_X"))) as "https://drive.google.com/uc?export=download&id=1HGFF5ziAFGn8161CKQC$Xyuhni9PNK_X" count(eval(searchmatch("value2"))) as "value2"
... View more
10-16-2023
08:14 AM
You'll want to backup your index data as well. https://docs.splunk.com/Documentation/Splunk/9.1.1/Indexer/Backupindexeddata
... View more
10-16-2023
08:07 AM
1 Karma
Assuming your value always starts with ESC, give this a try: | rex "value\":\"(?<ESC>ESC[^\"]+)"
... View more
10-16-2023
07:21 AM
Give this a try Your base search to get all workstation names e.g. | tstats count WHERE index=windows by host
| searc NOT ([| inputlookup code_countries.csv | table alpha-2 | eval host='aplha-2'."*" | table host])
| where match(host,"^\w{3}\d+")
... View more
10-02-2023
06:52 AM
Make sure you've SSL configured correctly on appropriate Splunk server. Use this link as reference: https://docs.splunk.com/Documentation/Splunk/9.1.1/Security/ConfigureSplunkforwardingtousesignedcertificates
... View more
09-22-2023
07:27 AM
Change the timerange of both panel to some historical time for which your summary index will have data. E.g. earliest=-24h latest=-2m@m. This way your summary will have some data summarized and your drilldown search will only look at raw data for summarized data time-range only.
... View more
09-22-2023
07:20 AM
Give this a try Find count of events by userAgent Your base search
| rex "\]\s+(\"+[^\"]+){3}\"+\s+\"+(?<userAgent>[^\"]+)"
| stats count by userAgent Trend of distinct count of userAgents over time Your base search
| rex "\]\s+(\"+[^\"]+){3}\"+\s+\"+(?<userAgent>[^\"]+)"
| timechart dc(userAgent) as distinct_userAgents
... View more
05-02-2023
07:39 AM
Since the mvfind function only support one field reference, it would be difficult to do filter based on dynamic latest Date value. Try this alternate implementation my base search
| eventstats latest(Date) as latestDate
| eval shouldInclude=if(Date=latestDate,1,0)
| transaction ID
| stats count values(Date) as Date value(field1) as field1 max(shouldInclude) as shouldInclude by ID
| where shouldInclude=1
... View more
05-01-2023
09:46 AM
1 Karma
Give this a try (run it without delete command first to validate result) index=threatintel
| eventstats latest(last_updated_date) as latest_update_date by indicator
| where NOT last_updated_date=latest_update_date
| delete
... View more
05-01-2023
09:42 AM
1 Karma
Give this a try base search |transaction ID | table date field1 field2 ID
| eventstats latest(date) as latestDate
| where date=latestDate | fields - latestDate
... View more
05-01-2023
09:32 AM
This link should help: https://docs.splunk.com/Documentation/SplunkCloud/9.0.2303/DashStudio/searchTokens
... View more
05-01-2023
07:44 AM
1 Karma
Give this a try my base search
| transaction ID
| stats count values(Date) as Date value(field1) as field1 by ID
| where isnull(mvfind(Date,"02\/20\/23"))
... View more
05-01-2023
07:38 AM
Give this a try index="va_tools_oit-salesforce" source="sfdc_event_log://EventLog_va_my_salesforce_com_eventlog_va" sourcetype="sfdc:logfile" URL=""https://case.mibams.ba.com/api/ms*
| rex field=_raw "\"\"https:\/\/case.mibams.ba.com\/api\/(?<API>[^\/]+\/[^\?\/]+)"
| stats count by API | table API
... View more
04-27-2023
07:28 AM
Does running the alert search manually fetches proper results? Start with this base search and slowly add portions of your search, one at a time, to troubleshoot in which steps extraction/calculations are failing index="content" source="catalina.out" "org.apache.catalina.startup.Catalina.start Server startup" NOT Caesium
| table _time _raw host
... View more
04-27-2023
07:14 AM
1 Karma
If you've your "exception" field extracted already, try something like this index=yourIndex sourcetype=yourSourcetype NOT [| inputlookup yourExceptionLookup.csv | table exception ] If field is not already extracted, consider doing so and use above query. If field extraction is not possible, and you want to do a less efficient text search, try something like this index=yourIndex sourcetype=yourSourcetype NOT [| inputlookup yourExceptionLookup.csv | table exception | rename exception as search ]
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
08-09-2024
10:23 AM
|
Karma given to
