Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About somesoni2
somesoni2
Revered Legend
Member since:
07-26-2011
3 weeks ago
Community Statistics
| Posts | 11790 |
| Solutions | 2732 |
| Karma Given | 1141 |
| Karma Received | 6140 |
| Member Since | 07-26-2011 |
Activity Feed
- Got Karma for Re: Announcing Our Splunk MVPs. 2 weeks ago
- Got Karma for Re: Proper use of join vs. append - correlating events by a common field. 03-06-2024 11:46 PM
- Got Karma for Re: How to use different time ranges in sub-queries in savedsearches.conf. 03-06-2024 12:23 PM
- Got Karma for Re: condition match set tokens on input. 03-05-2024 09:15 AM
- Got Karma for Re: Is there a way to group by multiple fields in a timechart?. 03-04-2024 12:31 PM
- Got Karma for Re: foreach command. 02-28-2024 12:56 AM
- Got Karma for Re: How split up a string into multiple fields. 02-27-2024 04:23 PM
- Got Karma for Re: sourcetype question and confusion. 02-20-2024 10:13 AM
- Got Karma for Re: How to get a total count and count by specific field displayed in the same stats table?. 02-17-2024 10:52 AM
- Got Karma for Re: How is data handled with indexes.conf when the index is removed?. 02-15-2024 04:49 PM
- Got Karma for Re: how to get count of events for each 30 min. 02-08-2024 12:09 PM
- Got Karma for Re: Where are alerts stored in Linux directory structure?. 02-07-2024 01:52 AM
- Got Karma for Re: On dashboard, how do I trim the whitespace in a text input field. 01-17-2024 08:33 AM
- Got Karma for Re: Timechart, last value is always 0. 01-15-2024 03:28 AM
- Got Karma for Re: How to exclude specific time ranges in search results. 01-10-2024 01:45 AM
- Got Karma for Re: License usage for one index broken down by sourcetype. 12-06-2023 05:56 AM
- Got Karma for Re: How can I generate a list of users and assigned roles?. 12-04-2023 03:00 AM
- Got Karma for Re: What are the differences between append, appendpipe, and appendcols search commands?. 11-30-2023 07:53 AM
- Got Karma for Re: What are the differences between append, appendpipe, and appendcols search commands?. 11-30-2023 07:53 AM
- Got Karma for Re: How to get a list of Schedules searches , reports , alerts , dashboards that use DBX query from my search head?. 11-29-2023 02:35 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 1 | |||
| 2 | |||
| 3 | |||
| 1 | |||
| 6 | |||
| 0 | |||
| 3 | |||
| 2 | |||
| 0 | |||
| 2 |
Give this a try index=_internal source=*var/log/splunk/search_messages.log
... View more
10-19-2023
12:42 PM
1 Karma
The timechart generates time series for selected time range, so you get data for full time window, even when there are no results for certain buckets. The chart command, like stats command, generates statistics for available _time buckets only, so if a time bucket has 0 events, it'll will not show it (can't generate if it's not present). There are workaround to get full time series with chart as well but it's not that pretty. If timechart is an option, use that. Here is the workaround query: index = _internal ``` simulate zero-count buckets ```
| bucket _time span=5m
| chart count over _time
| append [| makeresults | addinfo
| eval time=mvrange(info_min_time, info_max_time+1,300)
| rename comment as "third argument should in seconds and same as the span you selected for chart"
| table time | mvexpand time
| rename time as _time | eval count=0]
| chart sum(count) as count by _time
... View more
10-19-2023
12:19 PM
1 Karma
For your requirement, left join may not be ideal. Try this alternate implementation (replace make results query with your lookup/data query): | makeresults | eval DatabaseName=split("A B C"," ") | mvexpand DatabaseName | table DatabaseName | eval from="Lookup" | append [| makeresults | eval DatabaseName=split("A A1 10#A A2 20#C C1 40#C C2 50#D D 60","#") | mvexpand DatabaseName | table DatabaseName | rex field=DatabaseName "^(?<DatabaseName>\S+)\s+(?<Instance>\S+)\s+(?<CPUUtilization>\S+)$" | eval from="search"] | eventstats values(from) as from by DatabaseName | where isnotnull(mvfilter(match(from,"Lookup"))) | foreach CPUUtilization Instance [| eval "<<FIELD>>"=coalesce('<<FIELD>>',if(mvcount(from)=1 AND from="Lookup","NULL",null()))] | stats count by DatabaseName CPUUtilization Instance | table DatabaseName CPUUtilization Instance
... View more
10-18-2023
12:56 PM
Try adding following at the end of your search If your current search result contains _time and one field say "count" | eventstats sum(count) as TotalCount If your search result contains _time and several dynamic column names, | addtotals fieldname="Totalcount"
... View more
10-17-2023
09:08 AM
1 Karma
Gi <input type="dropdown" token="tok_usecase" searchWhenChanged="true">
<label>Use Case</label>
<choice value=""01"">Use Case 01</choice>
<choice value=""02"">Use Case 02</choice>
<choice value=""03"">Use Case 03</choice>
<choice value=""04"">Use Case 04</choice>
<choice value=""05"">Use Case 05</choice>
<choice value=""06"">Use Case 06</choice>
<default>"01"</default>
<initialValue>"01"</initialValue>
<change>
<condition label="Use Case 05">
<set token="ShowPanel">true</set>
<unset token="tok_audit"></unset>
<unset token="tok_taskID"></unset>
<unset token="tok_sessID"></unset>
</condition>
<condition match="true()">
<unset token="ShowPanel"></unset>
<unset token="tok_audit"></unset>
<unset token="tok_taskID"></unset>
<unset token="tok_sessID"></unset>
</condition>
</change>
</input> ve this a try
... View more
10-17-2023
08:53 AM
Did you deploy any props.conf for this sourcetype on your search head? Since you're doing index time field extraction (with INDEXED_EXTRACTIONS = json), there is no need to search time field extraction. I've seen props.conf with search time field extraction (KV_MODE = json) along with index time field extraction causing double extraction. You need to use one. If you just want index time field extraction, explicitly set KV_MODE = none on search head.
... View more
10-16-2023
11:44 AM
I missed a colon in the regex. Added just now. Try the updated version.
... View more
10-16-2023
09:59 AM
1 Karma
Try like this (UPDATED) | rex "http(s)*:\/\/([^\/]+\/)+customer\/(?<customerId>[^\/]+)\/product\/(?<productId>[^\/]+)"
... View more
10-16-2023
08:42 AM
1 Karma
Your filter to include weekends is "day_of_week="*"". The asterisk as wildcard doesn't work with "where" command. So either change your search to replace "where" with "search" OR change your include weekend filter. Either Change search to: `compliance("`console`", now(), -15d@d, mcafee,*, virus_, *, *, *)`
| eval day_of_week = lower(strftime(_time,"%A"))
| search NOT (day_of_week="saturday" OR day_of_week="sunday")
| chart count by virus_global
| sort virus_global OR change radio button to: <input type="radio" token="weekends" searchWhenChanged="true">
<label>Weekends</label>
<choice value="NOT (day_of_week="saturday" OR day_of_week="sunday")">Exclude Weekends</choice>
<choice value="true()">Include Weekends</choice>
<default>NOT (day_of_week="saturday" OR day_of_week="sunday")</default>
<initialValue>NOT (day_of_week="saturday" OR day_of_week="sunday").
</initialValue>
</input>
... View more
10-16-2023
08:33 AM
The equal sign might be causing issues, escape them with backward slash. Also, the OR keyword between two stats fields is invalid, remove it. index=abcd | stats count(eval(searchmatch("https://drive.google.com/uc?export\=download&id\=1HGFF5ziAFGn8161CKQC$Xyuhni9PNK_X"))) as "https://drive.google.com/uc?export=download&id=1HGFF5ziAFGn8161CKQC$Xyuhni9PNK_X" count(eval(searchmatch("value2"))) as "value2"
... View more
10-16-2023
08:14 AM
You'll want to backup your index data as well. https://docs.splunk.com/Documentation/Splunk/9.1.1/Indexer/Backupindexeddata
... View more
10-16-2023
08:07 AM
1 Karma
Assuming your value always starts with ESC, give this a try: | rex "value\":\"(?<ESC>ESC[^\"]+)"
... View more
10-16-2023
07:21 AM
Give this a try Your base search to get all workstation names e.g. | tstats count WHERE index=windows by host
| searc NOT ([| inputlookup code_countries.csv | table alpha-2 | eval host='aplha-2'."*" | table host])
| where match(host,"^\w{3}\d+")
... View more
10-02-2023
06:52 AM
Make sure you've SSL configured correctly on appropriate Splunk server. Use this link as reference: https://docs.splunk.com/Documentation/Splunk/9.1.1/Security/ConfigureSplunkforwardingtousesignedcertificates
... View more
09-22-2023
07:27 AM
Change the timerange of both panel to some historical time for which your summary index will have data. E.g. earliest=-24h latest=-2m@m. This way your summary will have some data summarized and your drilldown search will only look at raw data for summarized data time-range only.
... View more
09-22-2023
07:20 AM
Give this a try Find count of events by userAgent Your base search
| rex "\]\s+(\"+[^\"]+){3}\"+\s+\"+(?<userAgent>[^\"]+)"
| stats count by userAgent Trend of distinct count of userAgents over time Your base search
| rex "\]\s+(\"+[^\"]+){3}\"+\s+\"+(?<userAgent>[^\"]+)"
| timechart dc(userAgent) as distinct_userAgents
... View more
05-02-2023
07:39 AM
Since the mvfind function only support one field reference, it would be difficult to do filter based on dynamic latest Date value. Try this alternate implementation my base search
| eventstats latest(Date) as latestDate
| eval shouldInclude=if(Date=latestDate,1,0)
| transaction ID
| stats count values(Date) as Date value(field1) as field1 max(shouldInclude) as shouldInclude by ID
| where shouldInclude=1
... View more
05-01-2023
09:46 AM
1 Karma
Give this a try (run it without delete command first to validate result) index=threatintel
| eventstats latest(last_updated_date) as latest_update_date by indicator
| where NOT last_updated_date=latest_update_date
| delete
... View more
05-01-2023
09:42 AM
1 Karma
Give this a try base search |transaction ID | table date field1 field2 ID
| eventstats latest(date) as latestDate
| where date=latestDate | fields - latestDate
... View more
05-01-2023
09:32 AM
This link should help: https://docs.splunk.com/Documentation/SplunkCloud/9.0.2303/DashStudio/searchTokens
... View more
05-01-2023
07:44 AM
1 Karma
Give this a try my base search
| transaction ID
| stats count values(Date) as Date value(field1) as field1 by ID
| where isnull(mvfind(Date,"02\/20\/23"))
... View more
05-01-2023
07:38 AM
Give this a try index="va_tools_oit-salesforce" source="sfdc_event_log://EventLog_va_my_salesforce_com_eventlog_va" sourcetype="sfdc:logfile" URL=""https://case.mibams.ba.com/api/ms*
| rex field=_raw "\"\"https:\/\/case.mibams.ba.com\/api\/(?<API>[^\/]+\/[^\?\/]+)"
| stats count by API | table API
... View more
04-27-2023
07:28 AM
Does running the alert search manually fetches proper results? Start with this base search and slowly add portions of your search, one at a time, to troubleshoot in which steps extraction/calculations are failing index="content" source="catalina.out" "org.apache.catalina.startup.Catalina.start Server startup" NOT Caesium
| table _time _raw host
... View more
04-27-2023
07:14 AM
1 Karma
If you've your "exception" field extracted already, try something like this index=yourIndex sourcetype=yourSourcetype NOT [| inputlookup yourExceptionLookup.csv | table exception ] If field is not already extracted, consider doing so and use above query. If field extraction is not possible, and you want to do a less efficient text search, try something like this index=yourIndex sourcetype=yourSourcetype NOT [| inputlookup yourExceptionLookup.csv | table exception | rename exception as search ]
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
3 weeks ago
|
Karma given to
