Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About manderson7
manderson7
Contributor
Member since:
02-13-2014
11-16-2023
Community Statistics
| Posts | 110 |
| Solutions | 5 |
| Karma Given | 33 |
| Karma Received | 9 |
| Member Since | 02-13-2014 |
Activity Feed
- Posted Need help with nested json and spath on Splunk Search. 11-16-2023 01:47 PM
- Posted Re: Is there an efficient way to do field summary on a large set of source types? on Splunk Enterprise. 03-24-2023 12:55 PM
- Posted Re: Timechart RAM or CPU usage by Linux process on Splunk Search. 11-18-2022 07:00 AM
- Karma Re: How to get "splunk" user to read "root" user-owned files? for esalesapns2. 11-10-2022 05:40 AM
- Posted Re: How to join REST & search results? on Splunk Search. 10-06-2022 07:54 AM
- Karma Re: How to join REST & search results? for jdunlea. 10-06-2022 07:54 AM
- Posted How to join REST & search results? on Splunk Search. 10-06-2022 06:53 AM
- Tagged How to join REST & search results? on Splunk Search. 10-06-2022 06:53 AM
- Posted Re: How can I change input label color? on Dashboards & Visualizations. 10-05-2022 11:36 AM
- Karma Re: How can I change input label color? for kamlesh_vaghela. 10-05-2022 11:35 AM
- Posted How can I change input label color? on Dashboards & Visualizations. 10-05-2022 09:48 AM
- Karma Re: Why is the "Enable summary indexing" option no longer available in 6.6.0? for cygnetix. 08-02-2022 08:22 AM
- Got Karma for Re: Resource/guide sought for ProofPoint TRAP [ThreatResponse] integration with Splunk. 06-06-2022 01:14 PM
- Posted Re: IT Essentials Work with no create entity button on Security. 05-16-2022 04:52 AM
- Posted Where is the IT Essentials Work create entity button? on Security. 04-28-2022 10:10 AM
- Posted Re: Flag when new value is created in field on Security. 03-25-2022 12:38 PM
- Karma Re: Flag when new value is created in field for somesoni2. 03-25-2022 12:14 PM
- Posted Re: Flag when new value is created in field on Security. 03-25-2022 12:05 PM
- Posted How to flag when new value is created in field on Security. 03-25-2022 11:25 AM
- Tagged How to flag when new value is created in field on Security. 03-25-2022 11:25 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
11-16-2023
01:47 PM
I've seen a few of the spath topics around, but wasn't able to understand enough to make it work for my data. I have the following json: {
"Record": {
"contentId": "429636",
"levelId": "57",
"levelGuid": "3c5b481a-6698-49f5-8111-e43bb7604486",
"moduleId": "83",
"parentId": "0",
"Field": [
{
"id": "22811",
"guid": "6c6bbe96-deab-46ab-b83b-461364a204e0",
"type": "1",
"_value": "Need This with 22811 as the field name"
},
{
"id": "22810",
"guid": "08f66941-8f2f-42ce-87ae-7bec95bb5d3b",
"type": "1",
"p": "need this with 22810 as the field name"
},
{
"id": "478",
"guid": "4e17baea-f624-4d1a-9c8c-83dd18448689",
"type": "1",
"p": [
"Needs to have 478 as field name",
"Needs to have 478 as field name"
]
},
{
"id": "22859",
"guid": "f45d3578-100e-44aa-b3d3-1526aa080742",
"type": "3",
"xmlConvertedValue": "2023-06-16T00:00:00Z",
"_value": "needs 22859 as field name"
},
{
"id": "482",
"guid": "a7ae0730-508b-4545-8cdc-fb68fc2e985a",
"type": "3",
"xmlConvertedValue": "2023-08-22T00:00:00Z",
"_value": "needs 482 as field name"
},
{
"id": "22791",
"guid": "89fb3582-c325-4bc9-812e-0d25e319bc52",
"type": "4",
"ListValues": {
"ListValue": {
"id": "74192",
"displayName": "Exception Closed",
"_value": "needs 22791 as field name"
}
}
},
{
"id": "22818",
"guid": "e2388e72-cace-42e6-9364-4f936df1b7f4",
"type": "4",
"ListValues": {
"ListValue": {
"id": "74414",
"displayName": "Yes",
"_value": "needs 22818 as field name"
}
}
},
{
"id": "22981",
"guid": "8f8df6e3-8fb8-478b-8aa0-0be02bec24e3",
"type": "4",
"ListValues": {
"ListValue": {
"id": "74550",
"displayName": "Critical",
"_value": "needs 22981 as field name"
}
}
},
{
"id": "22876",
"guid": "4cc725ad-d78d-4fc0-a3b2-c2805da8f29a",
"type": "9",
"Reference": {
"id": "256681",
"_value": "needs 22876 as field name"
}
},
{
"id": "23445",
"guid": "f4f262f7-290a-4ffc-af2b-dcccde673dba",
"type": "9",
"Reference": {
"id": "255761",
"_value": "needs 23445 as field name"
}
},
{
"id": "1675",
"guid": "ea8f9a24-3d35-49f9-b74e-e3b9e48f8b3b",
"type": "2"
},
{
"id": "22812",
"guid": "e563eb9e-6390-406a-ac79-386e1c3006a3",
"type": "2",
"_value": "needs 22812 as field name"
},
{
"id": "22863",
"guid": "a9fe7505-5877-4bdf-aa28-9f6c86af90ae",
"type": "8",
"Users": {
"User": {
"id": "5117",
"firstName": "data",
"middleName": "data",
"lastName": "data",
"_value": "needs 22863 as field name"
}
}
},
{
"id": "22784",
"guid": "4466fd31-3ab3-4117-8aa0-40f765d20c10",
"type": "3",
"xmlConvertedValue": "2023-07-18T00:00:00Z",
"_value": "7/18/2023"
},
{
"id": "22786",
"guid": "d1c7af3e-a350-4e59-9353-132a04a73641",
"type": "1"
},
{
"id": "2808",
"guid": "4392ae76-9ee1-45bf-ac31-9e323a518622",
"type": "1",
"p": "needs 2808 as field name"
},
{
"id": "22802",
"guid": "ad7d4268-e386-441d-90b1-2da2fba0d002",
"type": "1",
"table": {
"style": "width: 954px",
"border": "1",
"cellspacing": "0",
"cellpadding": "0",
"tbody": {
"tr": {
"style": "height: 73.05pt",
"td": {
"style": "width: 715.5pt",
"valign": "top",
"p": "needs 22802 as field name"
}
}
}
}
},
{
"id": "8031",
"guid": "fbcfdf2c-2990-41d1-9139-8a1d255688b0",
"type": "1",
"table": {
"style": "width: 954px",
"border": "1",
"cellspacing": "0",
"cellpadding": "0",
"tbody": {
"tr": {
"style": "height: 71.1pt",
"td": {
"style": "width: 715.5pt",
"valign": "top",
"p": [
"needs 8031 as field name",
"needs 8031 as field name"
]
}
}
}
}
},
{
"id": "22820",
"guid": "0f98830d-48b3-497c-b965-55be276037f2",
"type": "1",
"p": "needs 22820 as field name"
},
{
"id": "22807",
"guid": "8aa0d0fa-632d-4dfa-9867-b0cc407fa96b",
"type": "3"
},
{
"id": "22855",
"guid": "e55cbc59-ad8d-4831-8e6f-d350046026e9",
"type": "1"
},
{
"id": "8032",
"guid": "f916365b-e6eb-4ab9-a4ff-c7812a404854",
"type": "1",
"p": "needs 8032 as field name"
},
{
"id": "22792",
"guid": "8e70c28a-2eec-4e38-b78b-5495c2854b3e",
"type": "1",
"_value": "needs 22792 as field name "
},
{
"id": 22793,
"guid": "ffeaa385-643a-4f04-8a00-c28ddd026b7f",
"type": "4",
"ListValues": ""
},
{
"id": "22795",
"guid": "c46eac60-d86e-4af4-9292-d194a601f8b6",
"type": "1"
},
{
"id": "22797",
"guid": "8cd6e398-e565-4034-8db8-2e2ecb2f0b31",
"type": "4",
"ListValues": {
"ListValue": {
"id": "73060",
"displayName": "data",
"_value": "needs 22797 as field name"
}
}
},
{
"id": "22799",
"guid": "20823b18-cb9b-47a3-854d-58f874164b27",
"type": "4",
"ListValues": {
"ListValue": {
"id": "74410",
"displayName": "Other",
"_value": "needs 22799 as field name"
}
}
},
{
"id": "22798",
"guid": "5b32be4c-bc40-45b3-add4-1b22162fd882",
"type": "4",
"ListValues": {
"ListValue": {
"id": "74405",
"displayName": "N/A",
"_value": "needs 22798 as field name"
}
}
},
{
"id": "22800",
"guid": "6b020db0-780f-4eaf-8381-c122425b71ed",
"type": "1",
"p": "needs 22800 as field name"
},
{
"id": "22801",
"guid": "06334da8-5392-4a9d-a3eb-d4075ee30787",
"type": "1",
"p": "needs 22801 as field name"
},
{
"id": "22794",
"guid": "25da1de8-8e81-4281-8ef3-d82d1dc005ad",
"type": "4",
"ListValues": {
"ListValue": {
"id": "74398",
"displayName": "Yes",
"_value": "needs 22794 as field name"
}
}
},
{
"id": "22813",
"guid": "89760b4f-49be-40ad-8429-89c247e3e95a",
"type": "1",
"p": "needs 22813 as field name"
},
{
"id": "22803",
"guid": "03b6c826-e15c-4356-89e8-b0bd509aaeb5",
"type": "3",
"xmlConvertedValue": "2023-06-15T00:00:00Z",
"_value": "needs 22803 as field name"
},
{
"id": "22804",
"guid": "d7683f9c-97bb-461a-97df-36ec6596b4fc",
"type": "1",
"p": "needs 22804 as field name"
},
{
"id": "22805",
"guid": "33386a3a-c331-4d8c-9825-166c0a5235c2",
"type": "3",
"xmlConvertedValue": "2023-06-15T00:00:00Z",
"_value": "needs 22805 as field name"
},
{
"id": "22806",
"guid": "cd486293-9857-475c-9da3-a06f836edb59",
"type": "1",
"p": "needs 22806 as field name"
}
]
}
} and have been able to extract id, (some) p data and _value data from Record.Field{} using: | spath path=Record.Field{} output=Field
| mvexpand Field
| spath input=Field
| rename id AS Field_id, value AS Field_value, p AS Field_p , but have been unable get any other data out. The p values that I can get out are single value only. In particular, I need to get the multi-value fields for ListValues{}.ListValue out. In addition, I need to map the values in _value and p to the top ID field in that array. I think the code sample provided above explains what's needed. I know I can do a |eval {id}=value but it's complicated when there are so many more fields other than value, or complicated when the fields are nested. Can someone help with this?
... View more
03-24-2023
12:55 PM
I was about to start writing a post trying to figure out what you seem to have figured out. I think I get the gist of your original search, though it seems like you have to repeat it per index? If that's the case, it wouldn't work, as you've got quite a few indexes to search over I'd imagine. I guess my question is, what is <base search> that you have referenced up there?
... View more
11-18-2022
07:00 AM
Back from the dead! Big ask I realize, but did you get any further with this? We're stuck trying to get a better handle on mem utilization of processes, and this is a big step in the right direction.
... View more
10-06-2022
07:54 AM
That helped quite a bit, thanks. The somewhat final search came out to be: | rest /servicesNS/-/-/admin/directory count=0 splunk_server=<splunkserver>
| rename eai:* as *, acl.* as *
| eval updated=strptime(updated,"%Y-%m-%dT%H:%M:%S%Z"), updated=if(isnull(updated),"Never",strftime(updated,"%d %b %Y"))
| sort type
| eval sAMAccountName=lower(owner)
| stats count by title orphaned sAMAccountName sharing type owner updated app disabled
| search orphaned=1
| join sAMAccountName
[| search index=metrics_summary source="LDAP*" source IN("LDAP GROUP USER DIVISION Summary Index Search" "LDAP_GROUP_USER_DIVISION_Summary_Index_Search" lookup_ldap_group_user_division) sAMAccountName=e* OR sAMAccountName=v* NOT sAMAccountName=e-mail* userAccountControl=*ACCOUNTDISABLE*
| eval sAMAccountName=lower(sAMAccountName)
| stats latest(_time) AS latest values(displayName) values(mail) values(distinguishedName) values(department) values(division) latest(userAccountControl) values(manager) by sAMAccountName] I needed to limit the results more in the subsearch. Thanks so much.
... View more
10-06-2022
06:53 AM
I'm really bad when it comes to join searches, though I've been doing this for years.
I'm able to find the list of orphaned searches using:
| rest /servicesNS/-/-/admin/directory count=0 splunk_server=<splunkserver>
| rename eai:* as *, acl.* as *
| eval updated=strptime(updated,"%Y-%m-%dT%H:%M:%S%Z"), updated=if(isnull(updated),"Never",strftime(updated,"%d %b %Y"))
| sort type
| eval sAMAccountName=owner
| stats count by title orphaned sAMAccountName sharing type owner updated app disabled
| search orphaned=1
and we have a summary index containing our LDAP users & managers for those users. Using the following search returns users and their managers:
index=metrics_summary source="LDAP*" source IN("LDAP GROUP USER DIVISION Summary Index Search" "LDAP_GROUP_USER_DIVISION_Summary_Index_Search" lookup_ldap_group_user_division) sAMAccountName=e* OR sAMAccountName=v* |table sAMAccountName displayName mail department division manager
But I haven't been able to join the two searches together to give me the manager name of the user w/ the orphan search. I've tried variations of the following:
| rest /servicesNS/-/-/admin/directory count=0 splunk_server=<splunkserver>
| rename eai:* as *, acl.* as *
| eval updated=strptime(updated,"%Y-%m-%dT%H:%M:%S%Z"), updated=if(isnull(updated),"Never",strftime(updated,"%d %b %Y"))
| sort type
| eval sAMAccountName=owner
| stats count by title orphaned sAMAccountName sharing type owner updated app disabled
| search orphaned=1
| join sAMAccountName type=outer max=0
[|search index=metrics_summary source="LDAP*" source IN("LDAP GROUP USER DIVISION Summary Index Search" "LDAP_GROUP_USER_DIVISION_Summary_Index_Search" lookup_ldap_group_user_division)
| stats latest(_time) AS latest values(displayName) values(mail) values(distinguishedName) values(department) values(division) latest(userAccountControl) values(manager) by sAMAccountName
| rename values(*) AS *, latest(*) AS *]
but this only comes back w/ results from the rest call.
I know I get results using the summary index search. How do I merge these?
Thanks
... View more
- Tags:
- rest
Labels
- Labels:
-
join
10-05-2022
11:36 AM
That did the trick. Thank you.
... View more
10-05-2022
09:48 AM
I know I can change the color of a .panel-title, but I haven't found the code to change the .input-label color.
This works:
<panel id="panel2">
<title>title</title>
<input type="text" token="commentpicker">
<label>Add any additional comments below</label>
<default></default>
</input>
<html>
<style>
#panel2 .dashboard-panel .panel-title {
color: #EC102B;
}
</style>
But this won't
<input type="multiselect" token="newenabledpicker" searchWhenChanged="false" id="input1">
<label>Modify or Disable (REQUIRED)?</label>
<choice value="modify">Modify</choice>
<choice value="disable">Disable</choice>
<delimiter> </delimiter>
</input>
<html>
<style>
#input1 .dashboard-panel .input-label {
color: #EC102B;
}
</style>
</html>
... View more
Labels
- Labels:
-
panel
05-16-2022
04:52 AM
Unfortunately not. I moved on to other work, and this was dropped. It's a shame, because otherwise it's a solid product, but this stopped us moving forward.
... View more
04-28-2022
10:10 AM
We've done a new install of IT Essentials work, and was trying to add entities, but don't have the create entity button. My account has itoa_admin, itoa_analyst, itoa_user roles assigned. I do have a create entity type button, but there are no configured entity types. I have installed the AWS & nix content packs. What am I missing?
... View more
Labels
- Labels:
-
other
03-25-2022
12:38 PM
Thanks for the help so far, this is what I have |relevant rest call
| eval from="rest"
| eval added_on_date=now()
| fields title, search, updated SplunkApp dataSource actions search added_on_date
| rename title AS Title
| append
[| inputlookup append=true correlation_searches_history.csv
| eval from="lookup"
| eval added_on_date=coalesce(added_on_date,0)
]
| stats max(added_on_date) AS added_on_date values(from) as from values(updated) by Title and the search keeps updating the added_on_date in the lookup (when I run outputlookup) to when the search runs. How do I avoid that?
... View more
03-25-2022
12:05 PM
Yep, overthinking. Thank you. In addition, how would I go about creating a "add on date" field to the lookup once the new search is added to it. Basically, I'd like to get the dates added for new correlation searches from this time forward in said lookup.
... View more
03-25-2022
11:25 AM
I'm really overthinking this, but am lost.
I need to show when new correlation searches are introduced into the environment. I have a lookup with the current correlation searches, along w/ relevant data, and last time updated. How do I compare current rest call results with the lookup and show the most recently created searches?
Any help would be appreciated.
... View more
Labels
- Labels:
-
audit
01-11-2022
06:12 AM
We have a heavy forwarder running some Add-ons, and one of them (SNow) is eating up all the memory. We have workload management enabled on our search head clusters for cpu/memory management, but wanted to see if it's possible to restrict mem/cpu usage for ingest on the HF using WM. If that's a possibility, where would I edit settings to update the configurations accordingly?
... View more
- Tags:
- Workload Management
Labels
- Labels:
-
heavy forwarder
-
modular input
12-28-2021
06:49 AM
We've gotten a search to work that shows the delta between the number of messages in an inbox for a period of time: <basesearch>
| bin _time span=5m
| stats max(Items) AS Max by _time
| delta Max as Delta
| fields _time Delta
| where Delta>=10 But I want to do this based on multiple inboxes, and delta is merging the inboxes together, so the values of each inbox are interfering with each other. <basesearch multiple mailboxes>
| bin _time span=5m
| stats max(Items) AS Max by _time User
| delta Max as Delta
| fields _time Delta User returns: _time User Max Delta 09:15 user1 103 09:15 user2 251 148 09:15 user3 17 -234 and I want the users to be treated as individual accounts, not merged with each other. I assume I need to use streamstats for this, but so far I've been unable to work out how.
... View more
08-20-2021
10:18 AM
Thanks Rich. Sounds like I need to create a lookup table w/ a list of known hosts , and search against that?
... View more
08-20-2021
08:52 AM
We're trying to gather a list of servers, both linux and windows that are missing specific software packages. It's easy enough to get the list of servers that has the software installed. search software IN ("CrowdStrike") I was hoping I could search against the software package, like search NOT software in ("CrowdStrike") but that still displays hosts with Crowdstrike installed, just not that particular event showing that Crowdstrike is indeed installed. I thought of making an eval |eval cs_win_installed=if(match(software, "CrowdStrike"),1,0) and then searching for 0 or 1 depending on what I care about, but can I do that with all the software that I'm searching on? Running that eval for multiple pieces of software | eval cs_lin_is_installed=if(match(software, "falcon-sensor"),1,0)
| eval cs_win_is_installed=if(match(software, "CrowdStrike Windows Sensor"),1,0)
| eval q_is_installed=if(match(software, "Qualys*"),1,0)
| eval f_is_installed=if(match(software, "SecureConnector*"),1,0) only returns with the event showing that 1 piece of software on the machine. Am I overthinking this? How should I go about displaying hosts with missing software? Thanks much.
... View more
Labels
- Labels:
-
search
06-29-2020
07:22 AM
Working a bunch with the Trackme app and it's showing a lot of promise. I finally got the right MLTK and Python applications installed, hopefully that will help some of the issues I'm having. When I modify a data source, choosing "auto lagging" comes back with unexpected results. In particular, I have a data source that only ingests M-F, between 9am and 5pm. The auto percentile lag of this data source for 7-30 days at 1-3 seconds. How would I go about getting a longer average lag time for this source? In addition, how can I tell trackme to not show an alert state on the same sourcetype on a monday morning, since it hasn't gotten any events since the friday before? I don't want to set the lag time as too high as that will interfere w/ monitoring during weekdays. Thanks for your help.
... View more
- Tags:
- TrackMe
Labels
- Labels:
-
administration
05-19-2020
06:29 AM
Thanks very much Chris. Accepted!
... View more
05-15-2020
12:57 PM
Loving this viz and the Number Display viz. However, I'm having a problem getting drilldowns to work.
If I set the drilldown to Link to Search, on clicking a value, it runs the basic search and selects the value clicked on. I haven't been able to create a working token to send to a search on the same dashboard.
There's a setting in General / Click action : set tokens to $sunburst_viz_{field}$ and I've assigned that to a form.field_name , but on clicking the field value in the Sunburst, the search will search on the literal variable set in the token.
How is the drilldown supposed to work with Sunburst and Number Display?
Thank you!
... View more
03-04-2020
07:13 AM
This is the final props & transforms that finally worked, thanks again for all your help
Transforms:
[version1_fields]
REGEX = \<Attribute name=\"([^\"]+)\"\>(.*?)\<\/Attribute\>
FORMAT=$1::$2
[v1_ownername]
SOURCE_KEY = Owners_Name
REGEX = \<Value\>(?<Owner>.*?)\<\/Value\>
MV_ADD = true
... View more
03-02-2020
08:46 AM
Thanks for your help. Unfortunately, I'm still getting
< Value>name one< /Value>< Value>name two< /Value>
minus the spaces.
Transforms.conf is :
[version1_fields]
REGEX = <Attribute name=\"([^\"]+)\">(.*?)<\/Attribute>
FORMAT=$1::$2
[v1_ownername]
SOURCE_KEY = "Owners.Name"
REGEX = \<Value\>(.*?)\<\/Value\>
FORMAT = Owners.Name::$1
MV_ADD = true
I make the Value uppercase in the regex, and adjusted Format from Owners_name to Owners.Name, but no help. Props looks like:
[version1_xml]
REPORT-v1 = version1_fields
REPORT-v12 = v1_ownername
Update:
I changed props to
[version1_xml]
REPORT-v1 = version1_fields,v1_ownername
and restarted, but nothing useful happened unfortunately, still seeing the multiple values in the same value surrounded by the < Value>< \Value>
... View more
03-02-2020
05:37 AM
That works in regex101, to an extent.
The Owners.Name field keeps the closed/open tags between the names, like
owner one< /value> <value>owner two
Is there any way around this, or is this the best that can happen?
and this is search time field extractions, so I need to put it on the search head, not the ingest host. thanks for that.
Also, thank you for your help, and for explaining the transforms.
... View more
02-28-2020
03:17 PM
Data example:
<Asset href="/company/rest-1.v1/Data/Story/2530981/6709286" id="Story:2530981:6709286"><Attribute name="Status.Name">Ready</Attribute><Attribute name="Number">B-107445</Attribute><Attribute name="Name">Upgrade Splunk Windows TA</Attribute><Attribute name="ChangeDate">2020-01-29T13:49:44.337</Attribute><Attribute name="CreateDate">2019-03-12T12:49:22.703</Attribute><Attribute name="Owners.Name"><Value>owner one</Value><Value>owner two</Value></Attribute></Asset>
&
<Asset href="/company/rest-1.v1/Data/Story/3644941/6720976" id="Story:3644941:6720976"><Attribute name="Status.Name">Ready</Attribute><Attribute name="Number">B-143465</Attribute><Attribute name="Name">Review/Upgrade Splunk_TA_Nix to v7</Attribute><Attribute name="ChangeDate">2020-01-30T12:54:07.103</Attribute><Attribute name="CreateDate">2020-01-15T10:40:49.307</Attribute><Attribute name="Owners.Name"><Value>owner one</Value></Attribute></Asset>
I've gotten my XML to seperate into events finally, but I'm being thrown by trying to get the fields to work. I'd like to have
Status.Name = Ready
Number = B-143465
ChangeDate = 2020-01-30T12:54:07.103
and so on
I created this regex using the field extractor and regex101:
^(?:[^>\n]*>){2}(?P<Status_Name>\w+\s+\w+|\w+)(?:[^>\n]*>){2}(?P<Number>\w+\-\d+)[^ \n]* \w+="\w+">(?P<Name>[^<]+)[^ \n]* \w+="\w+">(?P<ChangeDate>[^<]+)(?:[^"\n]*"){2}>(?<CreateDate>[^<]+)(?:[^"\n]*"){2}><\w+>(?P<Owners_Name>\w+\s+\w+)
which gets me most of the way there, but it won't work for the multiple owner values.
Can someone suggest a fix here? Also, if you could also suggest some help in implementing the regex in a transforms, I'd appreciate it. I think I can call it using
PROPS
...
REPORT-V1 = v1_fields
TRANSFORMS
[v1_fields]
REGEX = ^(?:[^>\n]*>){2}(?P<Status_Name>\w+\s+\w+|\w+)(?:[^>\n]*>){2}(?P<Number>\w+\-\d+)[^ \n]* \w+="\w+">(?P<Name>[^<]+)[^ \n]* \w+="\w+">(?P<ChangeDate>[^<]+)(?:[^"\n]*"){2}>(?<CreateDate>[^<]+)(?:[^"\n]*"){2}><\w+>(?P<Owners_Name>\w+\s+\w+)
But I don't know if I need to add a FORMAT = $1::$2 line (nor do I know what that line does ... )
Any help you can provide here would be great.
I've also tried KV_MODE=xml on the search head, but that doesn't give me the field names I want, just values for
Asset.Attribute
Asset.Attribute.Value
etc
Thanks
... View more
12-03-2019
05:00 AM
If it helps, this is the code I used for my panel
<panel>
<viz type="performance-analysis.performance_analysis">
<title>Use a short time window (4hr), otherwise will not show all values</title>
<search>
<query>index=sitescope eventtype=all_sitescope_monitors
| stats count by _time sis_monitor_status sis_monitor_name eventtype
| search eventtype=*sitescope*
| sort - sis_monitor_status
| stats values(eventtype) as application by sis_monitor_status sis_monitor_name _time
| eval value=case(sis_monitor_status=="good", "01", sis_monitor_status=="warning", "66", sis_monitor_status=="error", "99")
| eval status=case(sis_monitor_status=="good", "GREEN", sis_monitor_status=="warning", "AMBER", sis_monitor_status=="error", "RED")
| search $apppicker$
| rename sis_monitor_name AS name
| table _time name value status</query>
<earliest>$field1.earliest$</earliest>
<latest>$field1.latest$</latest>
</search>
<option name="drilldown">none</option>
<option name="performance-analysis.performance_analysis.OKIsLowOrHigh">low</option>
<option name="performance-analysis.performance_analysis.criticalColour">#DD0000</option>
<option name="performance-analysis.performance_analysis.criticalThreshold">18</option>
<option name="performance-analysis.performance_analysis.downTimeEnd">0</option>
<option name="performance-analysis.performance_analysis.downTimeStart">0</option>
<option name="performance-analysis.performance_analysis.granularity">10</option>
<option name="performance-analysis.performance_analysis.noDataColour">#999999</option>
<option name="performance-analysis.performance_analysis.okColour">#78B24A</option>
<option name="performance-analysis.performance_analysis.showLegend">true</option>
<option name="performance-analysis.performance_analysis.showStatusAsText">true</option>
<option name="performance-analysis.performance_analysis.sortOrder">true</option>
<option name="performance-analysis.performance_analysis.timeFormat">h:mm A</option>
<option name="performance-analysis.performance_analysis.tokenEarliest">pa_earliest</option>
<option name="performance-analysis.performance_analysis.tokenLatest">pa_latest</option>
<option name="performance-analysis.performance_analysis.tokenName">pa_name</option>
<option name="performance-analysis.performance_analysis.warningColour">#E0C135</option>
<option name="performance-analysis.performance_analysis.warningThreshold">12</option>
<option name="refresh.display">progressbar</option>
</viz>
</panel>
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
11-16-2023
06:44 PM
|
Karma from
Karma given to
