About Kk

Kk · ‎06-04-2023

Hello, The first query that you answered isn't working. Can you please on your side? I have added index, source and modified Exception field name that's it and set the time to present day. In this case it should fetch 3 to 4am exception stats with 7to8am stats.

Kk · ‎06-04-2023

I don't know why gentimes used here. I have clearly mentioned the time ranges and also you don't have to list the Exceptions in eval command. As I said it will real time data and can be extracted through field name. And also how do I mention index and source here?

Kk · ‎06-04-2023

Let's say you have one field extraction that extracts Exception from real time events. Example null pointer exception, Illegal argument exception, socket time out exception etc.. If i search set the time for the whole day, i need to search compare exception stats of 7to8am stats with 3to4am stats.

Kk · ‎06-04-2023

Yes, I do have one Exception field. But when i ran this query with that modification and set the time range for whole day. I need to compare stats of only 7to 8am stats with 3 to 4am stats.

Kk · ‎06-04-2023

You understood it wrong. The data will be real time data. For the example sake i have mentioned those 3 to4am stats like that. But in real, i need to calculate those too. You should not define eval field and assign exceptions

Kk · ‎06-04-2023

How do we mention time here?. I think the mvmap('7to8am',if), doesn't work. Can you help me with full query here?

Kk · ‎06-03-2023

Hello splunk, I'm trying to compare the exceptions between time ranges and get the new exceptions list. Suppose consider I'm searching for 3to4am stats of exceptions and 7to 8am stats of exceptions. I should compare these two stats and list out what are the new exceptions occurred at 7to8am. Example: 3to4am stats: 7to8am Ex1 Ex3 Ex2 Ex1 Ex3 Ex5 Ex4 Ex6 Result: Ex5 Ex6 Thanks in advance

Kk · ‎12-16-2022

Sry, my bad. It is working now..

Kk · ‎12-16-2022

This doesn't work @FelixLeh

Kk · ‎12-16-2022

Hi All, I'm to trying to set an email alert notification by using splunk. In the alert Description, I just want to mention only particular field values that search returns. I thought of using $result.fieldname$ but, As splunk says it only returns field first row value in the description. For Example: Field name: values numbers 1,2,3,4,5 search: index=""|table numbers alert Description: The number values are: $result.numbers$ O/P: The number values are: 1 O/p Expected: The number values are: 1,2,3,4,5

Kk · ‎11-09-2022

Suppose think my query is in this way. index=temp "error" earliest=-3d@d latest=now|timechart count|timewrap d Result: I will be showing the count in line chart. Where it list down the peaks of error count with respect to 24hrs of time and in the right side it will show options to select the 1dayago data,2dataago,3 days ago.. So my question is, there is any way to show the date rather than showing date like this 1dayago data,2dataago,3 days ago. I was expecting date like this, Example today is 09-11-2022, so the data on right side of line chart will be 08-11-2022, 07-11-2022, 06-11-2022.. That's it.

Kk · ‎11-08-2022

Hi All, Is there any way to display the date in visualization by using timewrap. Ex: 22/09/10,22/09/09,22/09/08..etc.-->Expecting 1day ago, 2days ago, 3days ago ---> Actual o/p Please help me out, If you got any idea on this Thanks, kk

Kk · ‎10-26-2022

Exceptions Day1 Day2 Day3 Abc 5 4 3 Start 3 4 4 xyz 3 2 5

Kk · ‎06-20-2022

Hi All, I was trying to find the unencrypted passwords in my logs by using one anchor pattern. After getting the password value by anchor pattern, I have to check whether it is encrypted or not. In my logs the encyption is done by using asterisk(*) symbol. So, It has been difficult for me to differentiate between user entered password and encrypted password as user password can also have the asterisk(*) symbol. There are no prior requirements for the passwords like atleast 1Uppercase, 1 lowercase etc.. The Password will have no min length. Passwords can be like: 1. 1234556687 2. RonnieAlex 3. Tyler@123 4. #%@cosmic123 5. A***B*V*****U**Y***(Encrypted password in my log) Help me with the regex that matches all the above cases. Thx in advance

Kk · ‎06-10-2022

Ok thanks. Can you provide the Xml for linking the search string when we click on result?

Kk · ‎06-10-2022

Hey all, I'm trying to build a clickable dashboard. For that, I had choosen line chart visualization. So in the below pic you can see the line chart resulting count of events with respective some random id. So my idea is to make that id or count clickable so that we redirect to see the original events i.e for below shown id we should able to see all 6,630 event logs in new tab.. Is that possible by any chance? Thanks in advance @ITWhisperer

Kk · ‎06-03-2022

According to luhn algo, we take even digits from front in a number. But we fail if this case in case of odd digits. So basically if we come from reverse end whether it may be odd or even the results will be perfect. Anyway, I have figured out the solution and thx for the response👍.

Kk · ‎06-03-2022

Hi All, I have been working on the luhn algorithm to validate the credit card. For that, I have used the below link query. The query is correct, but it is cannot validate the correct credit card numbers.Sometimes it will result the not valid cards too. Pls refer to this below link and help out to find the valid cards. https://gosplunk.com/detect-credit-card-numbers-using-luhn-algorithm/ @ITWhisperer @aasabatini

Kk · ‎06-01-2022

Yeah we can do in that way but in anchor tag we can't expect only card details. We have some other data too. Example: card>xxxxxxxxxx9787<card card> this is so and so info xxxxxxxx9797<card. So how can we search card details in these cases.

Kk · ‎06-01-2022

Hi @ITWhisperer , actually we are having many anchor patterns to recognise the card details. Example like card>xxxx, text:xxx. So is their any way to find by using generic query?

Kk · ‎05-31-2022

Hi All, I'm trying to find the credit card details in the logs with all in one regex expression. But I was also getting some other data too like timestamp data as it has more than 12digits and some random data. Just bit exhausted with this thing here. Is there any possible solution to find the credit card numbers directly that will not contains random numbers or time stamps. Help me with the query if possible. Thanks in advance.

Kk · ‎03-31-2022

Hi All, I'm trying to extract the card details in my logs. Just confused how to extract the two or more card details or thier respective fields using rex command. Example : Visa card numbers regex is ^4[0-9]{12}(?:[0-9]{3})?$ JCB card numbers regex is ^(?:2131|1800|35\d{3})\d{11}$ I just want to extract the Visa and JCB fileds to check my card details. Is thier a way to create named grouped fields for the above cards using rex command in a single search? Help me with the query guys. Thanks in advance.

Kk · ‎03-29-2022

Hi All, Any idea on how to generate an alert when the password does not contain any special characters? Like when ever in my data the password is of only in plain text format, I should generate an alert. I'm a newbie,Please help out with the query. Thanks in advance.

Kk · ‎03-23-2022

Hi All, I was trying to generate the results from my search more than 10,000 results. It displayed a message like results are being truncated. Is there any way to change the limit for my column chart in the XML file. Here, I don't have permission to change visualization.conf file. So asking anyway to change through in XML source?

Kk · ‎03-17-2022

No just assume I gave you already known Exceptions like I mentioned above there. So for that how can we show the count of each and every Exception in table. Here we have only strings i.e Exception names which are not extracted to field in common. With that, I have to generate a table row as an exception name and col as count. Pls make sure there is no common field extraction.

Posts	28
Solutions	0
Karma Given	22
Karma Received	0
Member Since	‎03-16-2022

Online Status	Offline
Date Last Visited	‎07-12-2023 06:45 AM

How to get new exceptions stats by comparing two t...

How to set an email alert in Splunk?

Displaying date with timewrap command?

How to get the count over exceptions for the past ...

How to find unencrypted passwords in my logs by us...

Is it possible to create this Clickable Dashboard?

How to create an algo for finding card numbers?

How do I create a Regex that doesn't contain rando...

How to write this field extraction using rex?

How to generate an alert when the password does no...

Re: Get new exceptions stats by comparing two time...

Re: Get new exceptions stats by comparing two time...

Re: Get new exceptions stats by comparing two time...

Re: Get new exceptions stats by comparing two time...

Re: Get new exceptions stats by comparing two time...

Re: Get new exceptions stats by comparing two time...

How to get new exceptions stats by comparing two t...

Re: Email Alert in Splunk

Re: Email Alert in Splunk

How to set an email alert in Splunk?

Re: Displaying date with timewrap command

Displaying date with timewrap command?

How to get the count over exceptions for the past ...

How to find unencrypted passwords in my logs by us...

Re: Clickable Dashboard

Is it possible to create this Clickable Dashboard?

Re: Algo for finding card numbers

How to create an algo for finding card numbers?

Re: Regex

Re: Regex

How do I create a Regex that doesn't contain rando...

How to write this field extraction using rex?

How to generate an alert when the password does no...

Is there any way to change the limit for my column...

Re: Count Exceptions without any field usage.