About syloee

syloee · ‎11-01-2022

EX> search_id search count [ID1] index=_internal sourcetype=splunkd 10 ( count of index=_internal sourcetype=splunkd) [ID2] index=_internal sourcetype=splunk* 100( count of index=_internal sourcetype=splunk*) NOT _audit log result_count, by re-search I'd appreciate it if you could help me.

syloee · ‎10-31-2022

hello index=_audit user=admin action=search info=granted search=* | table search_id search | replace "'search *" WITH "*" IN search | replace "*'" WITH "*" IN search I extracted the following result with this command. search_id search [ID1] [SPL1] [ID2] [SPL2] [ID3] [SPL3] I want to extract count of search field by re-search. search_id search count [ID1] [SPL1] [SPL1-count] [ID2] [SPL2] [SPL2-count] [ID3] [SPL3] [SPL3-count] I'd appreciate it if you could help me.

syloee · ‎07-08-2021

thank you

syloee · ‎07-07-2021

thank you very much!

syloee · ‎07-07-2021

thank you very much

syloee · ‎07-07-2021

hi everyone i installed splunk after delete splunk i go /splunk/bin and ./splunk start i see error message "ERROR: Couldn't determine $SPLUNK_HOME or $SPLUNK_ETC; perhaps one should be set in environment" how i can do? thank you very much!

syloee · ‎07-05-2021

hi everyone i want to install splunk db connect 1.2.2 in splunk 7.3.9 i want to know this is ok thank you if version web page have a nice day

syloee · ‎06-27-2021

to. kamlesh_vaghela, venkatasri thankyou

syloee · ‎06-27-2021

to. kamlesh_vaghela, venkatasri thankyou

syloee · ‎06-27-2021

thank you very much

syloee · ‎06-27-2021

This is data file(<Interceptor>~~~</Interceptor><Interceptor>~~~</Interceptor>) <?xml version="1.0" encoding="UTF-8" ?><dataroot><Interceptor><AttackCoords>-80.33100097073213,25.10742916222947</AttackCoords><Outcome>Interdiction</Outcome><Infiltrators>23</Infiltrators><Enforcer>Ironwood</Enforcer><ActionDate>2013-04-24</ActionDate><ActionTime>00:07:00</ActionTime><RecordNotes></RecordNotes><NumEscaped>0</NumEscaped><LaunchCoords>-80.23429525620114,24.08680387475695</LaunchCoords><AttackVessel>Rustic</AttackVessel></Interceptor> -> i want to this ↓ <Interceptor>~~~</Interceptor> <Interceptor>~~~</Interceptor> <Interceptor>~~~</Interceptor> i use LINE_BREAKER = <Interceptor> MUST_BREAK_AFTER = \</Interceptor\> but i can't do. What can I do?

syloee · ‎06-27-2021

This is data file( ip -- [time] text &&& ip -- [time] text &&& ip -- [time] text &&&) 41.146.8.66 - - [13/Jan/2016 21:03:09:200] "POST /category.screen?category_id=SURPRISE&JSESSIONID=SD1SL2FF5ADFF3 HTTP 1.1" 200 3496 "http://www.myflowershop.com/cart.do?action=view&itemId=EST-16&product_id=RP-SN-01" "Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_6_3; en-US) AppleWebKit/533.4 (KHTML, like Gecko) Chrome/5.0.375.38 Safari/533.4" 294&&&130.253.37.97 - - [13/Jan/2016 21:03:09:185] "GET /category.screen?category_id=BOUQUETS&JSESSIONID=SD7SL2FF1ADFF8 HTTP 1.1" 200 2320 "http://www.myflowershop.com/cart.do?action=changequantity&itemId=EST-12&product_id=AV-CB-01" "Opera/9.20 (Windows NT 6.0; U; en)" 361&&&141.146.8.66 - - -> i want to this ↓ ip -- [time] text ip -- [time] text ip -- [time] text What can I do? (use LINE_BREAKER, etc)

Posts	12
Solutions	0
Karma Given	0
Karma Received	0
Member Since	‎06-27-2021

Online Status	Offline
Date Last Visited	‎12-19-2023 08:40 AM

Extract count of search field(SPL) by re-search?

Couldn't determine $SPLUNK_HOME or $SPLUNK_ETC;

db connect version

spunk data input - xml

splunk data input

Re: extract count of search field(SPL) by re-searc...

Extract count of search field(SPL) by re-search?

Re: Couldn't determine $SPLUNK_HOME or $SPLUNK_ETC...

Re: Couldn't determine $SPLUNK_HOME or $SPLUNK_ETC...

Re: Couldn't determine $SPLUNK_HOME or $SPLUNK_ETC...

Couldn't determine $SPLUNK_HOME or $SPLUNK_ETC;

db connect version

Re: splunk data input

Re: splunk data input

Re: spunk data input - xml

spunk data input - xml

splunk data input