- Splunk Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Not getting any data
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Not getting any data
index="Server" (CategoryString="Account Management" OR TaskCategory="Security Group Management" ) (Message="Security Enabled*" OR Message="A member was added to a*") ( EventCode=632 OR EventCode=636 OR EventCode=4728 OR EventCode=4732) | top member, group, caller, name, host, Security_ID | fields member, group, caller, name, host, Security_ID| eval caller = if(isnull(Account_Name), Caller_User_Name, mvindex(Account_Name,0)) | eval member = if(isnull(Account_Name), Member_Name, mvindex(Account_Name,1)) | eval group = if(isnull(Target_Account_Name), Group_Name, Target_Account_Name) | search group="*Domain Admins" OR “*Administrators” OR “*ACCOUNT OPERATORS” OR “*Enterprise Admins” OR “*Schema Admins”| rename _time AS Time member AS Username group AS Group caller AS "Action by" name AS "Description" host AS "DC" Security_ID AS "Initiator Details" | convert timeformat="%m/%d/%Y %H:%M:%S %p" ctime(Time)
I am having a hard time figuring out why no information is being displayed through the top and fields command.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
at the top command
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
top is a command that transforms the search results, so if it gets raw input, it will not pass on that raw input to the commands coming after it in the search pipeline. So, once you've run top field1 for instance, the information available to the rest of the commands will only be the results produced by top (values for field1, count and percent). So, when you run rename _time AS Time for instance, that doesn't make sense because at that stage in the search pipeline the _time field doesn't exist anymore.
Perhaps you could explain a bit more what you want to accomplish with your search?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
What chart? What kind of output are you expecting? I don't see any charting commands in your search (besides top that I guess could count as a charting command)
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I did lol but i still dont see the fields displaying in my chart below the search
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Well perhaps remove it? 😛
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
because i was going to add it in eventually, but i cant even get the feilds to display
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Then why are you using it?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I just want to display all of the feilds, i do not even need the top function yet.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
| fields member, group, caller, name, host, Security_ID|
Try putting a space after Security_ID and the |
Does that do anything?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Have you tried doing the search bit by bit? Where does it fail for you?
Updated Team Landing Page in Splunk Observability
New! Splunk Observability Search Enhancements for Splunk APM Services/Traces and ...
Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...
