About khojas02

khojas02 · ‎07-17-2020

Hi, This has worked for me. Error message I was getting - Invalid character entity

khojas02 · ‎07-16-2020

Hello all, I would like to add 3 links of 3 different dashboards in a separate dashboard panel. My current code is as below <row> <panel> <title></title> <html> <p> <b style="font-size:12pt">Link to other relevant Dashboards</b></p> <a href="https://******/en-US/app/******/****">Click here for Dashboard 1</a> <a href="https://******/en-US/app/*****/dlp_unstructured_data_discovery_dim?form.timePolicyDivision.earliest=-30d%40d&form.timePolicyDivision.latest=now&form.policyType=*">Click here for Dashboard 2</a> <a href="https://*****/en-US/app/********/symantec_dim__blocked_detail?form.blockedTime.earliest=-7d%40h&form.blockedTime.latest=now&form.businessUnitSearch=*&form.emplidSearch=*&form.policyCategorySearch=*&form.lanidSearch=*">Click here for Dashboard 3</a> </html> </panel> </row> Now, the URL for Dashboard 1 is working fine that includes the combination of characters, dot, and underscore. But, it's giving me an error for Dashboard 2 and 3 as I have various characters in the URL. So, how can I resolve this issue? I don't have search element in my XML so I can't solve it at UI or search level. Any help would be appreciated!!

khojas02 · ‎07-13-2020

Hi All, I have a table something like this MetricID Count Percent AA 1404 4% BB 256 13% CC 749 31% Now, for each MetricID, I have some condition and based on that condition I would like the background color of Count and Percent columns to be changed to Green, Yellow and Red. Is it possible to do with Splunk? Essentially I don't want to change the color of entire Count of Percent column, rather based on the condition for each MetricID, I would like to change the color for respective Count and Percent values. Thanks in advance!!

khojas02 · ‎05-13-2020

This has worked for me. Thank you for your help!!

khojas02 · ‎05-13-2020

Hello Everyone, I need help with two questions. Please consider below scenario: index=foo source="A" OR source="B" OR source="C" OR source="D" OR source="E" OR source="F" OR source="G" OR source="H" OR source="I" earliest=-14d | bin _time span=1d | fields - index - splunk_server - punct - linecount - splunk_server_group - tag - tag::eventtype - unix_category - unix_group - _raw - eventtype - host - source - sourcetype | table * | untable _time FieldName FieldValue | stats count as Event_count, dc(FieldValue) as distinctCount, mean(FieldValue) as mean by _time FieldName | sort - _time The output of above search is table as below _time FieldName Event_count distinctCount mean 05/13/2020 Field1 520 520 05/13/2020 Field2 77 56 05/13/2020 Field3 1183 1177 450 05/13/2020 Field4 1785 1785 3164.5299719887953 I have similar values for last 14 days and these field values in the FieldName column are coming from various sources as mentioned in the search. Now, is it possible to add the respective source column for each of those field values? Here some fields are coming from multiple sources so is it possible to divide the count values based on the source it is coming from? (For instance - Field 1 could be coming from source E and F with counts 260 from E and 260 from F) I have another search as below: index=foo source=* earliest=-14d | bin _time span=1d | stats count as totalCount by _time source | sort - _time The output of above search is table as below _time source totalCount 2020-05-13 A 283 2020-05-13 B 1785 2020-05-13 C 252 2020-05-13 D 507 2020-05-13 E 336 2020-05-13 F 10527 2020-05-13 G 1183 2020-05-13 H 2586 Now, my another question is that I would like to join both of these tables using the columns _time and source to get count of the source from 2nd table to be added in the first table for each field values based on the source it is coming from. Any help would be appreciated!!

khojas02 · ‎05-06-2020

I have a report scheduled which runs every day and it has earliest=-30d for general scenario and I have a separate alert which uses this report to collect the data and it provides the outlier. Now, my question is if for some reason I need to see the historical data which is older than 30 days then I need to hardcode that time range (for example - earliest=-125d latest=-95d) in the search of the report. I am also updating the same in the time picker using date range to match with what I have updated in the search. Now when I run the report, it gives me correct results but nothing changes in the Alert. It gives me the same data as it was giving me previously for last 30 days. So, basically the alert is not getting updated based on the changes I am making in the report. Any help would be appreciated!!

khojas02 · ‎04-08-2020

Thanks a lot, it worked for me. I was trying to implement nested loop but it was giving me an error about malformed function or repeatable action. Thanking again for help!!

khojas02 · ‎04-08-2020

I have set of events as below: EmployeeID Company C123 ABC C456 DEF C789 2598 3648 Here, all the EmployeeID starting with C are Contractors and some of them have Company values. Now I want to achieve 2 things 1. I want to Populate "Unknown" where the EmployeeID starts with C but there is no Company value. 2. And for all the other EmployeeID (not starting with C), I want to populate Fulltime. Thanks in advance!!

khojas02 · ‎04-02-2020

The events are in the question. I am just hiding the IPs due to privacy issues. Hope I understood your comment correctly!!

khojas02 · ‎04-02-2020

Thank you for your response. These events are not fetched as extracted fields. Those are just words present in the events so for ease of use I would like to give them field name "EventType". Can we fetch those values (Session disconnected, assigned to session, Rejected ) using regular expression and store it in the new field EventType? If so, can you please help me with regular expression? Also, I am not able to change anything with Cisco app. That is out of my authorization. Thanks again!!

khojas02 · ‎04-02-2020

I have 3 types of events as below: Apr 2 11:35:28 vg1 : %ASA-4-113019: Group = EMPLOYEE, Username = karrc03, IP = ..., Session disconnected. Session Type: SSL, Duration: 2h:15m:12s, Bytes xmt: 59389646, Bytes rcv: 14229526, Reason: Idle Timeout Apr 2 11:35:23 vg1 : %ASA-4-722051: Group User IP <...> IPv4 Address <...> IPv6 address <::> assigned to session Apr 2 11:03:47 vg2 : %ASA-4-113005: AAA user authentication Rejected : reason = Invalid password : server = ... : user = SHAFED61 : user IP = ... Now, I would like to fetch the events based on the words: Session disconnected, assigned to session, and Rejected in the separate column "EventType" by user Your help would be appreciated. Thanks in advance

khojas02 · ‎04-02-2020

Thank you for your response. This has worked for me. My requirement has changed now. I have 3 types of events as below: Apr 2 11:35:28 vg1 : %ASA-4-113019: Group = EMPLOYEE, Username = karrc03, IP = ..., **Session disconnected. Session Type: SSL, Duration: 2h:15m:12s, Bytes xmt: 59389646, Bytes rcv: 14229526, Reason: Idle Timeout Apr 2 11:35:23 vg1 : %ASA-4-722051: Group User IP <...> IPv4 Address <...> IPv6 address <::> **assigned to session* Apr 2 11:03:47 vg2 : %ASA-4-113005: AAA user authentication Rejected : reason = Invalid password : server = ...* : user = SHAFED61 : user IP = .*..* Now, I would like to fetch the events based on the values: Session disconnected, assigned to session, and Rejected in the separate column "EventType" by user Your help would be appreciated. Thanks in advance

khojas02 · ‎03-31-2020

I have the event as below: Mar 31 13:21:29 vg1 : %ASA-4-113019: Group = EMPLOYEE, Username = VAZQUD68, IP = ...*, Session disconnected. Session Type: SSL, Duration: 1h:06m:28s, Bytes xmt: 17586992, Bytes rcv: 6595282, Reason: Idle Timeout Now, I would like to fetch the value "vg1" in the column named "Host" and apart from that I would like to fetch the values for Group, Username, IP, Session Type, Duration, Bytes xmt, Bytes rcv, Reason. Any help would be appreciated. Thanks in advance!!

khojas02 · ‎03-31-2020

Thank you for your response. This has worked for me, however my events got changed now as below: Mar 31 13:21:29 vg1 : %ASA-4-113019: Group = EMPLOYEE, Username = VAZQUD68, IP = 162.228.72.102, Session disconnected. Session Type: SSL, Duration: 1h:06m:28s, Bytes xmt: 17586992, Bytes rcv: 6595282, Reason: Idle Timeout Can you help me fetch the valules for Group, Username, IP, Session Type, Duration, Bytes xmt, Bytes rcv, Reason? Also, I would like to fetch "vg1" value that can go into the column name "Host". Thanks in advance!!

khojas02 · ‎03-30-2020

I have an event as below: Mar 30 16:59:08 vg1 : %ASA-4-113019: Group = EMPLOYEE, Username = roys86, IP = ...**, Session disconnected. Session Type: SSL, Duration: 7h:18m:21s, Bytes xmt: 408659006, Bytes rcv: 162000348, Reason: User Requested Now, I would like to fetch the values for the fields Session Type, Duration, Bytes xmt, Bytes rcv, Reason I would also like to rename some the fields after fetching the data. Thanks in advance!!

khojas02 · ‎03-16-2020

Hello Everyone!! I have a sample data as below Analyst Span A 1049d 00h 00m B 430d 01h 00m C 225d 05h 00m I would like to add one more column which basically convert the span column into number of years. Here d suggests number of days, h suggests an hour and m suggests minute in the Span column. Thanks in advance!!

khojas02 · ‎03-16-2020

Your search has created the output shown below. Now, if I want to add the column that shows the span in number of years. AssignedAnalyst FirstAssigned LastAssigned span B_Davis 2018-03-09 00:00:00 2020-02-28 00:00:00 721d 00h 00m C_Ramos 2017-03-22 00:00:00 2019-06-24 00:00:00 824d 00h 00m L_Allen 2018-09-19 00:00:00 2019-01-14 00:00:00 17d 01h 00m Is is possible to do that? Thanks!!

khojas02 · ‎03-16-2020

Hi, For some reason, this solution is not producing any output for me. I just added required index and source on top of it.

khojas02 · ‎03-13-2020

This worked for me, thanks!! How can we show the the days in years?

khojas02 · ‎03-13-2020

I have a sample data as below Assigned Analyst Assigned Date John 2018-03-09 00:00:00.0 2018-03-23 00:00:00.0 2018-03-30 00:00:00.0 2018-04-16 00:00:00.0 2018-04-24 00:00:00.0 2018-04-26 00:00:00.0 2018-05-03 00:00:00.0 Joe 2017-03-22 00:00:00.0 2017-03-23 00:00:00.0 2017-05-01 00:00:00.0 2017-05-02 00:00:00.0 2017-05-18 00:00:00.0 2017-05-23 00:00:00.0 Now, I would like to find the time span for each Analyst based on the earliest and latest values of Assigned Date in Years and Days. Assigned Date is simply the date on which the ticket was assigned. Ticket Number is the unique identifier which I didn't add in the sample data. Thanks in advance

khojas02 · ‎01-15-2020

I am trying to reference the data from the saved search in my dashboard. In the saved search the span is specified as 1 day so when I source the data from it, it gives me correct results for the first time I run the search with yesterday selected on time picker. However every time after that, the numbers are getting increased in the dashboard. Even if I select yesterday on the time picker, the numbers are increasing and the same applies for other time ranges as well such as previous month or last 3 months. I have attached 2 screenshots. In the Scenario 1, the numbers are increasing when I run the search second time with the same time range specified in the saved search i.e 1 day In the scenario 2, I changed the time picker to previous month and again the numbers are increasing and not matching with the save search result Any help would be appreciated!!

khojas02 · ‎12-19-2019

I have panel which performs the look up on the csv file and have the additional code as below. | eval _time=strptime(date,"%m/%d/%Y") | where _time>=relative_time(now(),"-1q") Now currently I have hard coded the the time range for last quarter data. When I tried to connect this panel to the Shared Time Picker, the values weren't getting updated as per the collection. You advice would be appreciated!!

Posts	22
Solutions	0
Karma Given	0
Karma Received	0
Member Since	‎12-19-2019

Online Status	Offline
Date Last Visited	‎07-17-2020 04:50 PM

How to add a link to other dashboard using SimpleX...

Change the color of cell based on the condition in...

Using untable function and perform the join with t...

Splunk report and alert problem

Run the condition on multiple fields of each event...

Fetch data based on the words in the event

Fetch the data from the fields which has multiple ...

Fetch the data from the fields which has 2 words i...

Convert Number of days into years

Difference between 2 dates based on another field ...

Re: Adding a link to other dashboard using SimpleX...

How to add a link to other dashboard using SimpleX...

Change the color of cell based on the condition in...

Re: Using untable function and perform the join wi...

Using untable function and perform the join with t...

Splunk report and alert problem

Re: Run the condition on multiple fields of each e...

Run the condition on multiple fields of each event...

Re: Fetch data based on the words in the event

Re: Fetch data based on the words in the event

Fetch data based on the words in the event

Re: Fetch the data from the fields which has multi...

Fetch the data from the fields which has multiple ...

Re: Fetch the data from the fields which has 2 wor...

Fetch the data from the fields which has 2 words i...

Convert Number of days into years

Re: Difference between 2 dates based on another fi...

Re: Difference between 2 dates based on another fi...

Re: Difference between 2 dates based on another fi...

Difference between 2 dates based on another field ...

Why are the numbers are increasing when connecting...

One of the panels in dashboard is not getting conn...