Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About bangalorep
bangalorep
Communicator
Member since:
11-08-2017
06-05-2020
Community Statistics
| Posts | 58 |
| Solutions | 4 |
| Karma Given | 6 |
| Karma Received | 4 |
| Member Since | 11-08-2017 |
Activity Feed
- Got Karma for Re: sum specific field value. 06-05-2020 12:50 AM
- Got Karma for Splunk Machine Learning Toolkit: Error in Loading custom algorithm. 06-05-2020 12:50 AM
- Got Karma for Re: How to use "webhooks" alert action and post the alert info to Trello?. 06-05-2020 12:50 AM
- Karma Re: using bin command and span for mayurr98. 06-05-2020 12:49 AM
- Karma Re: Splunk says it has "received event for unconfigured/disabled/deleted index=", except it does exist and ends up working. What gives? for mayurr98. 06-05-2020 12:49 AM
- Karma Re: Alert to show if a Users data level goves over 1GB for mayurr98. 06-05-2020 12:49 AM
- Karma Re: joining multiple select statements in dbxquery for sandyIscream. 06-05-2020 12:49 AM
- Karma Re: Search for total browsing time by user for mayurr98. 06-05-2020 12:49 AM
- Got Karma for Re: How to Load 100 GB data with 5 GB license/day. 06-05-2020 12:49 AM
- Karma Re: tstat and timechart for Lamar. 06-05-2020 12:46 AM
- Posted Re: Getting out of the Machine Learning add-on basic on All Apps and Add-ons. 01-31-2020 03:40 AM
- Posted Re: Setting up indexes.conf on Getting Data In. 01-31-2020 02:12 AM
- Posted Re: sum specific field value on Splunk Search. 08-02-2019 05:30 AM
- Posted Unable to save correlation search in ITSI getting error "Invalid search string: This search cannot be parsed when parse_only is set to true." on Splunk ITSI. 05-14-2019 03:29 AM
- Tagged Unable to save correlation search in ITSI getting error "Invalid search string: This search cannot be parsed when parse_only is set to true." on Splunk ITSI. 05-14-2019 03:29 AM
- Posted Re: Why does my real-time alert continue to send emails/sms? on Splunk Search. 02-20-2019 03:44 AM
- Posted Re: How do you Join two searches based on lookup values? on Splunk Search. 02-18-2019 08:42 PM
- Posted Re: How to use "webhooks" alert action and post the alert info to Trello? on All Apps and Add-ons. 02-04-2019 02:07 AM
- Posted Re: Log4j2 configuration for splunk HEC on Splunk Cloud Platform. 01-31-2019 11:09 PM
- Posted Re: Can you help me with a lookup table behavior question? on Splunk Search. 01-25-2019 01:45 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 1 | |||
| 0 |
01-31-2020
03:40 AM
Hello,
Have you also installed the Python for Scientific Learning App as well? You can add your custom algorithms there.
If you want to make any changes in teh algorithm, you can copy it and make the changes in the new file.
... View more
01-31-2020
02:12 AM
Hi,
You have to specify maxTotalDataSizeMB as this parameter dictates the freezing of your data.
thawedPath cannot contain a volume reference. It says so in the documentation as well. https://docs.splunk.com/Documentation/Splunk/8.0.1/Admin/Indexesconf
... View more
08-02-2019
05:30 AM
1 Karma
You can try this,
| makeresults
| eval value="1,3,5,0,4,5,6,0,1"
| makemv delim="," value
| mvexpand value
| fields - _time
| streamstats current=f window=1 last(value) as break
| append
[| makeresults
| eval value="1,3,5,0,4,5,6,0,1"
| makemv delim="," value
| mvexpand value
| fields - _time
| stats last(value) as final]
| fillnull value=0
| search value=0
| eval sum=break+final
| stats sum(sum) as sum
In your case, it will be
`your query`
| streamstats current=f window=1 last(value) as break
| append
[| `your query`
| stats last(value) as final]
| fillnull value=0
| search value=0
| eval sum=break+final
| stats sum(sum) as sum
... View more
05-14-2019
03:29 AM
Hello,
Using ITSI on Splunk Cloud.
Using the following search to create a correlation search
search pattern
| eval MatchPattern =
[| inputlookup test.csv
| eval PatternToSearch="\"%".Error."%\""
| eval commandToExecute="message LIKE ".PatternToSearch.",\"".Message."\""
| fields commandToExecute
| stats delim="," values(commandToExecute) as commandToExecute
| mvcombine commandToExecute
| eval commandToExecute="case(".commandToExecute.",1=1,\"UnMatched\")"
| return $commandToExecute]
| fillnull MatchPattern value="Null"
| search MatchPattern!= "UnMatched"
The search runs fine but when I try to save the correlation search, I get the error "Invalid search string: This search cannot be parsed when parse_only is set to true." which I found is a Javascript limitation. Any workaround for this?
... View more
02-20-2019
03:44 AM
The alert is getting triggered repeatedly as the event will be populated multiple times in the 10 minute duration. If you run this search every 10 minutes you should get a single mail only.
... View more
02-18-2019
08:42 PM
Does using |join EmailAddress not provide the search you want?
... View more
02-04-2019
02:07 AM
1 Karma
You could create a custom alert that sends data to trello using the Add-On Builder
... View more
01-31-2019
11:09 PM
Hello,
Before these configurations, we usually add a section with the IP for the splunk instance and splunk token. Could you maybe check this section to see if its all good?
... View more
01-25-2019
01:45 AM
You can not use fillnull with automatic lookups. Use |inputlookup and then try the fillnull method.
... View more
01-22-2019
07:46 PM
Hello,
You could usee the inputcsv command. The syntax would be sourcetype="device_assets" | inputcsv current_assets.csv
Documentation on this command https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Inputcsv
... View more
01-22-2019
12:27 AM
Hello,
You can use the rex command to field during search time. https://docs.splunk.com/Documentation/Splunk/7.2.3/SearchReference/Rex
Conversely, you can extract fields by clicking on an event event actions >> extract fields . You can get more information from the following documentation
https://docs.splunk.com/Documentation/Splunk/7.2.3/Knowledge/ExtractfieldsinteractivelywithIFX
You can also use regex101.com to test your regex code
... View more
01-21-2019
10:52 PM
Hello,
- You could use tokens for the latest time if you want to add this in a dashboard
- You could refer to this documentation for snapping the time https://docs.splunk.com/Documentation/Splunk/7.2.3/SearchReference/SearchTimeModifiers
- Could you please elaborate a bit more on this problem?
... View more
01-21-2019
10:46 PM
You can create a role with only read access. You can go to settings >> access control >> roles
You can know more from the following link
https://docs.splunk.com/Documentation/Splunk/7.2.3/Admin/Aboutusersandroles
... View more
01-21-2019
10:26 PM
Hello,
You can only send a single value from the text box input. You can however use the multi select option to send multiple tokens
... View more
01-21-2019
04:00 AM
You can check out the final answer from here:
https://answers.splunk.com/answers/584253/isit-possible-to-display-multiple-panels-in-a-spli.html
... View more
01-17-2019
08:32 PM
Are you facing any performance issues?
Also, what is the data volume?
... View more
01-16-2019
11:07 PM
This is what I tried.
| makeresults | eval a = "AML_PK1, AML_PK2, AML_PK3;AML_PK2" | makemv delim=";" a | mvexpand a | makemv delim=", " a | mvexpand a | stats count by a
... View more
01-15-2019
11:36 PM
In your search what is this part for? |search closed_txn=0 AND evicted>=0
You could instead run a search like NOT duration = * and the calculate the duration of the remaining events.
... View more
01-15-2019
04:17 AM
Hello,
If you use the transaction command the duration is automatically calculated. You could search for duration and add it as an interesting field on the list of fields to the left side
... View more
01-15-2019
12:15 AM
Hello,
You could use the transaction command with the endswith and startwisth options
here's the documentation on transaction with other options you could use to optimize your search
https://docs.splunk.com/Documentation/Splunk/7.2.0/SearchReference/Transaction
... View more
01-15-2019
12:13 AM
You could go to props.conf and copy the settings of access combined to your sourcetype.
Here's the documentation on props.conf
https://docs.splunk.com/Documentation/Splunk/7.2.3/Admin/Propsconf
... View more
01-14-2019
12:11 AM
Have you tried coping the /etc/users folder?
... View more
01-10-2019
08:59 PM
You can use the startswith and endswith option as well.
So your transaction command should look something like |transaction maxspan=5s startswith="some str 1" endswith = "some str 2"
... View more
01-10-2019
02:04 AM
Hello,
You could try this https://answers.splunk.com/answers/294682/the-splunk-homevarspoolsplunk-directory-is-filling.html
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:03 AM
|
