About sverdhan

sverdhan

Hello , Can anyone please provide me a query which lists out all forwarders that have not send data over the last 30 days? Thank you

sverdhan

Hello, this query seems to be working but the clients field is a multivalue field for some sourcetype ,so it results are spread out ,can you modify it ?

sverdhan

Hello Giuseppe, Thanks much for your suggestion , bit the query is giving an error : Cannot find client in the source field client in the lookup table . Now, we cant add clients in th elookup table becaue that would complex things. CAn yiu please tell m eothe rways to do it maybe through join or something. Much appreciated.

sverdhan · ‎06-17-2025

A4server Beta is the first value so no matter what sourcetype i choose it is on;y giving the values of A4server Beta in sourcetype , newIndex an ddomain

sverdhan · ‎06-17-2025

Hello team , Please help me modify this query such that it is able to loop through all the values of the csv file : Although it is able to give the clients and sensitivity of the selected sourcetype but in the results in the fields- Sourcetype Domain and NewIndex it is only giving the values of the first sourcetype- A4Server Like for example over here the selected sourcetype is A4server but in the sourcetype it is giving A4ServerBeta as it is not looping through the entire csv but only the first value | tstats count WHERE index=* sourcetype=A4Server by index | rex field=index max_match=0 "(?<clients>\w+)(?<sensitivity>_private|_public)" | table index, clients, sensitivity | join type=left client [ | inputlookup appserverdomainmapping.csv | table NewIndex, Domain, Sourcetype ]| eval NewIndex= NewIndex + sensitivity | table clients, sensitivity, Domain, Sourcetype, NewIndex

sverdhan · ‎04-23-2025

Hello guys, I need a splunk query that list out all the alerts that have index=* in their query. Unfortunately, I can't use rest services so kindly suggest me how can i do it without using rest.

sverdhan · ‎10-04-2024

i have a query that will calculate the volume of data ingested in a sourcetype-- index=federated:infosec_apg_share source=InternalLicenseUsage type=Usage idx=*_p* idx!=zscaler* st=<your sourcetype here> | stats sum(b) | eval GB = round('sum(b)'/1073741824,2) | fields GB The issue is I have a list of 1200 sourcetypes . please suggest me how can I adjust the entire list into this query

sverdhan · ‎10-03-2024

sverdhan · ‎09-26-2024

Thank you for your prompt reply .. Actually , I am having this search which lists the sourcetypes that have not been searched , but it is not very accurate so it might contain sourcetypes that are still searchable : index=_audit action=search info=granted | eval _raw=search | eval _raw=mvindex(split(_raw,"|"),0) | table _raw | extract | stats count by sourcetype | eval hasBeenSearched=1 | append [| metadata index=* type="sourcetypes" | eval hasBeenSearched="0"] | stats max(hasBeenSearched) as hasBeenSearched by sourcetype | search hasBeenSearched="0" So, I created a lookup into which I have put the sourcetypes that have been searched...I was thinking to reference this lookup in the above mentioned query so that it could remove the sourcetypes that are searchable .. But the query is not giving me results . Can you please check where should i Adjust those commands related to referencing that lookup .. here is how I have used the query, but the results are not coming: index=_audit action=search info=granted | eval _raw=search | eval _raw=mvindex(split(_raw,"|"),0) | table _raw | extract | stats count by sourcetype | eval hasBeenSearched=1 | append [| metadata index=* type="sourcetypes" | eval hasBeenSearched="0"] | stats max(hasBeenSearched) as hasBeenSearched by sourcetype| search NOT [inputlookup sourcetypes_1.csv | fields sourcetype] | search hasBeenSearched="0"

sverdhan · ‎09-26-2024

Hello All, I am looking for a query that can provide me with a list of sourcetypes that have not been searched .Kindly suggest.

sverdhan · ‎09-23-2024

Thank you , Do you have a general query to calculate the volume ingested for any sourcetype in general?

sverdhan · ‎09-23-2024

thank you for your reply , can you suggest any method apart from the lookup one?

sverdhan · ‎09-23-2024

i have used the below query to get a list of 25 sourcetypes who are not reporting for the last 30 days ...but i need to know the volume of data ingested by them...kindly suggest any ideas or any alternative methods: | metadata type=sourcetypes | eval diff=now()-lastTime | where diff > 3600*24*30 | convert ctime(lastTime) | convert ctime(firstTime) | convert ctime(recentTime) | sort -diff

Posts	13
Solutions	0
Karma Given	0
Karma Received	0
Member Since	‎09-23-2024

Online Status	Offline
Date Last Visited	a month ago

Finding forwarders that have not sent data

SPlunk query

Search for "index=*" in searches

How to get ingest volume for 1200 sourcetypes ?

data ingestion

non searchable sourcetypes

How find amount not ingested?

Finding forwarders that have not sent data

Re: SPlunk query

Re: SPlunk query

Re: SPlunk query

SPlunk query

Search for "index=*" in searches

How to get ingest volume for 1200 sourcetypes ?

data ingestion

Re: non searchable sourcetypes

non searchable sourcetypes

Re: splunk

Re: splunk

How find amount not ingested?

Are you a member of the Splunk Community?