About cmeinco

cmeinco · ‎06-23-2015

Extract: ... | rex field=_raw "Search time taken[^\d]+(?[\d,]+)ms.*?Search count returned[^\d]+(?[\d+,]+)" | convert rmcomma(srch_time) rmcomma(srch_count) Convert time to seconds: ... | eval srch_time_seconds=(srch_time/1000) I love using case as it allows me to define my buckets as I want them. The previous answer had the quickest way to your solution looking for the log10 ranges (bin span=log10 srch_time), but if you need custom bucket sizes or ranges and labels, use case For your second example: (<=5,5-10,10+); you said >0, but i assume you mean >=, the default 1=1 would catch any negative numbers or error cases. ... | eval srch_time_buckets=case(srch_time_seconds>10,"10+",srch_time>5,"5-10",srch_time>=0,"<5",1=1,"<0") And for both you can use the same stats: ... | stats count AS total avg(srch_time) AS averageTime min(srch_time) AS minTime max(srch_time) AS maxTime by srch_time_buckets Good Luck!

cmeinco · ‎06-15-2015

use the last function: stats last(version) by user http://docs.splunk.com/Documentation/Splunk/6.2.2/SearchReference/CommonStatsFunctions

cmeinco · ‎02-22-2014

I'm not sure which is more efficient, but since my brain works in regex, this would also work: source="base_bds_adsl.csv" | regex COD_SC_CSO="^\d{2}68\d$" | table N_BD,data_ini,data_fim,cd_enc,ESCRITORIO,AREA, NUMERO_TERMINAL,CNL,id_atlz,COD_SC_CSO, DDD,Sigla

cmeinco · ‎02-20-2014

Is this a splunk search question? Or are you asking how to only index the filtered data ?

cmeinco · ‎02-16-2014

Note the issue with your raw data, "src-xlated ip" and "dst-xlated ip" are being extracted as "ip" because of the space. I used rex to pull them together. It would be better to change the log format. The next step would be to take this regex and add it to an extract and transform. assuming sent/received is in bytes, here is a good start for you: NetScreen | rex field=_raw "src-xlated ip=(?<src_ip>[\d+\.]+)" | rename src_ip AS "Source IP" | stats sum(sent) AS sentBytes sum(rcvd) AS rcvdBytes sum(eval(sent+rcvd)) AS total by "Source IP"

cmeinco · ‎11-20-2013

post login, you can use messages to be displayed to users. I do this to inform users of outages, planned changes, etc. http://docs.splunk.com/Documentation/Splunk/5.0.4/RESTAPI/RESTsystem#messages Use something like: curl -k -u adminuserid https://splunk.com:8089/services/messages \ -d name=message \ -d value="[$(date)] Notice Servers being rebooted at 3PM. Contact cmeinco with any questions or concerns." Note: curl will prompt for the user password, instead of running with your pwd on the command line Then after the change, i clear the message from the search head, since only admins can do this. Good luck.

cmeinco · ‎10-09-2013

I decided this wouldn't recurse more than 99 times, so I wrote a quick shell script to generate a macro (parent_part_lookup): join partid [|inputlookup parts.csv | join type=left parentpartid overwrite=f [|inputlookup parts.csv|rename parentpartid as parentpartid_lvl1|rename partid as parentpartid] | join type=left parentpartid_lvl1 overwrite=f [|inputlookup parts.csv|rename parentpartid as parentpartid_lvl2|rename partid as parentpartid_lvl1] | join type=left parentpartid_lvl2 overwrite=f [|inputlookup parts.csv|rename parentpartid as parentpartid_lvl3|rename partid as parentpartid_lvl2] | join type=left parentpartid_lvl3 overwrite=f [|inputlookup parts.csv|rename parentpartid as parentpartid_lvl4|rename partid as parentpartid_lvl3] ... | join type=left parentpartid_lvl98 overwrite=f [|inputlookup parts.csv|rename parentpartid as parentpartid_lvl99|rename partid as parentpartid_lvl98] | join type=left parentpartid_lvl99 overwrite=f [|inputlookup parts.csv|rename parentpartid as parentpartid_lvl100|rename partid as parentpartid_lvl99] ] | where parentpartid=tmp_partid OR parentpartid_lvl1=tmp_partid OR parentpartid_lvl2=tmp_partid OR parentpartid_lvl3=tmp_partid OR ... OR parentpartid_lvl98=tmp_partid OR parentpartid_lvl99=tmp_partid There has to be a better way; likely starting with some macro cleanup and parameterization. Note: I first had everything formatted and easy to read, but the macro had an error and I had to remove the line breaks (bug?)

cmeinco · ‎09-30-2013

Example of output: (tmp_partid="part01") part02,23 part04,30 If there were multiple part02 entries, these would be sum'd with stats.

cmeinco · ‎09-30-2013

answers appears to be broken, can't add edit right now; Here is more about my search: (my search)= sourcetype=part_events | eval tmp_partid="part02" (output)= | stats sum(count) as hits by partid | sort - hits I want all the events where partid is a child of part2; no matter how deep into the hierarchy. So if I passed in part01 as tmp_partid, I would expect to get everything. Should I be looking at macros to do this recursion for me?

cmeinco · ‎09-30-2013

I think you mean lookup, not inputlookup. This does not appear to be working; as with the other comment; this is not recursively including all children of the tmp_partid (root search element).

cmeinco · ‎09-30-2013

this isn't working; it's limited to a first level lookup; whereas I'm looking to grab a full tree from the root partid and find all parts under that root partid for inclusion in my output.

cmeinco · ‎09-30-2013

I have an lookup file: (parts.csv) partid, parentpartid part01, part02,part01 part03,part01 part04,part02 I need to join this data with this data: (mysearch) day, partid, partevent, count 9/30/2013,part02,creation,23 9/30/2013,part04,update,30 Selfjoin does not appear to work as described (what little description exists). Here is my first hack attempt: (my search) | join type=left parentpartid overwrite=f [|inputlookup parts.csv|rename parentpartid as parentpartid_lvl1|rename partid as parentpartid] | join type=left parentpartid_lvl1 overwrite=f [|inputlookup parts.csv|rename parentpartid as parentpartid_lvl2|rename partid as parentpartid_lvl1] | join type=left parentpartid_lvl2 overwrite=f [|inputlookup parts.csv|rename parentpartid as parentpartid_lvl3|rename partid as parentpartid_lvl2] | join type=left parentpartid_lvl3 overwrite=f [|inputlookup parts.csv|rename parentpartid as parentpartid_lvl4|rename partid as parentpartid_lvl3] I can then filter the results by using this statement: | where parentpartid=tmp_partid OR parentpartid_lvl1=tmp_partid OR parentpartid_lvl2=tmp_partid OR parentpartid_lvl3=tmp_partid OR parentpartid_lvl4=tmp_partid Note: I put my initial part id into my search by doing this as part of (mysearch): "| eval tmp_partid=part02" I need to be able to do this up to around 40 times (maybe more), but I'm happy to put a cap on it. Any guidance or recommendation on creating a custom join or inputlookup.

Posts	12
Solutions	3
Karma Given	8
Karma Received	3
Member Since	‎08-30-2011

Online Status	Offline
Date Last Visited	‎06-05-2020 02:03 AM

How do I make a inputlookup recursive?

Re: How to extract more complex statistics from my...

Re: How do i filter out all but the most recent re...

Re: how will i filter rows with specific column sp...

Re: how will i filter rows with specific column sp...

Re: Juniper SSG (screenos)Traffic report

Re: Add text to login page (web.conf), restart nee...

Re: How do I make a inputlookup recursive?

Re: How do I make a inputlookup recursive?

Re: How do I make a inputlookup recursive?

Re: How do I make a inputlookup recursive?

Re: How do I make a inputlookup recursive?

How do I make a inputlookup recursive?