About igschloessl

igschloessl · ‎10-07-2020

I have a search which counts all ids events of the last 12 months by the severity. This search needs really long to run. So I dont want to rerun it every month for the complete time range of 12 months. I would like to just add the last month and search this over 6 monts. My actual search is following: index=ids earliest="-1year@month" latest="@month" | fields severity | timechart count by severity span=1mon Thank you in advance

igschloessl · ‎05-06-2020

How can I insert a table in the e-mail notification message? Can I solve that with normal html codes?

igschloessl · ‎04-30-2020

this only deltes my values() command. But i want the values.. should look like something like this src | src_host | dest | domain 10.0.0.2 | hostxy1 | 8.8.8.8 | google.com 10.0.0.7 | N/A | | 10.0.0.11 |N/A | 8.8.8.8 | example.com 10.0.0.21 | hostxy21 | 9.9.9.9 |

igschloessl · ‎04-30-2020

I have a search where I lookup the hostname for an IP address. I want to set the empty hostname with N/A so I can see in the values which src splunk wasnt able to lookup. My search is the following index=http | stats values(dest) as dest values(src) as src by domain | lookup dnslookup clientip as src OUTPUTNEW clienthost as src_host | fillnull src_host value="N/A" this works if there is just one src and one src_host in the line, but if there are multiple src and src_host and one src_host cant be looked up, it just writes the found src_hosts under themselves and you cannot map the src_host to the related src. now it looks like this: (................. stands for empty src | src_host | dest | domain 10.0.0.2 | hostxy2 | 8.8.8.8 | google.com 10.0.0.7 |..................|..............|................. 10.0.0.11 | hostxy21 | 9..9.9.9 | example.com 10.0.0.21 | ................| ............ |................. should look like this src | src_host | dest | domain 10.0.0.2 | hostxy2 | 8.8.8.8 | google.com 10.0.0.7 | N/A |............. |................. 10.0.0.11 |N/A | 9.9.9.9 | example.com 10.0.0.21 | hostxy21 | ........... |................. Can anyone help?

igschloessl · ‎03-16-2020

I would like to make a scheduled report out of a dashboard.´So it could be a PDF of the complete dashboard that will be sent via Mail. Is that possible in Splunk?

igschloessl · ‎11-18-2019

I have a dashboard with big searches. I generated scheduled reports so the searches wont run again in the dashboard. The schedule of the report is planned for tomorrow. I already embedded the reports as panels in the dashboard but they run when I open the dashboard. Can you please explain how I avoid rerunning the saved reports in the dashboard? Thank you in advance

igschloessl · ‎11-12-2019

I need to compare a list consisting of one field from day1 to day2 and get what values where not listed on day 1 but in day2 Comparing this with day 3 and so on. so for example I have a list with user agents and I want to detect what user agents I have today comparing to the last days. Or comparing one week with another week. Can I do this automated? Thank you in advance

igschloessl · ‎11-06-2019

I had to to the following step Click chart overlay and Click the text box and select Total field. There was the wrong field selected. Thank you very much.

igschloessl · ‎11-06-2019

It doenst make a line. What do I need to modify to get a line?

igschloessl · ‎11-05-2019

I need to show in a column chart the count for the top 5 destination hosts in proxy logs and above it a line of summed counts of all proxy logs. So I need two panels in one. My search for the column chart is the following: index=proxy earliest=-1month@month latest=@month | timechart span=1w count by dest_host usenull=false limit=5 I also need to add the overall count line with the following search: index=proxy earliest=-1month@month latest=@month | timechart count How can I compare these two searches in one panel? I know that this article https://answers.splunk.com/answers/9053/example-of-chart-overlay.html exists but I dont get along with the description. Can anyone help?

igschloessl · ‎10-28-2019

this command does not give any events back how can that be?

igschloessl · ‎10-24-2019

index=proxy earliest=-1month@month latest=@month|fields host month | eval month=strftime(_time, "%m") | stats count by host| rename count as curr_count | table curr_count host |appendcols [search index=proxy earliest=-2month@month latest=-1month@month|fields host month | eval month=strftime(_time, "%m") | stats count by host|rename count as old_count | table old_count host] | fillnull value=1 | eval ratio=curr_count-old_count, "up/down"=if (curr_count > old_count, "down", "up") | table host old_count curr_count ratio "up/down" | rename old_count AS "-2month" curr_count AS "-1month" ratio AS "deviation" It works but it is really really slow How can I make it faster? Best regards and thank you.

igschloessl · ‎09-05-2019

Thank you. I tried to do a summary with appendcols index=_internal sourcetype=scheduler earliest=-7d@d latest=-0d@d | eval period="-7d" | stats count min(result_count) as min_result_count max(result_count) as max_result_count avg(result_count) as avg_result_count by savedsearch_name app period | eval avg_result_count= round(avg_result_count,2) | table savedsearch_name app period min_result_count max_result_count avg_result_count count | appendcols [search index=_internal sourcetype=scheduler earliest=-14d@d latest=-7@d | eval period= "-14d" | stats count min(result_count) as min_result_count max(result_count) as max_result_count avg(result_count) as avg_result_count by savedsearch_name app period | eval avg_result_count= round(avg_result_count,2) | table savedsearch_name app period min_result_count max_result_count avg_result_count count ] | appendcols [search index=_internal sourcetype=scheduler earliest=-21d@d latest=-14@d | eval period= "-21d" | stats count min(result_count) as min_result_count max(result_count) as max_result_count avg(result_count) as avg_result_count by savedsearch_name app period | eval avg_result_count= round(avg_result_count,2) | table savedsearch_name app period min_result_count max_result_count avg_result_count count ] But this does not work. And I dont know how to alarm if the counts are highly different from the weeks before.

igschloessl · ‎09-04-2019

Hello together, i want to monitor existing alerts in splunk. For the case that an alarm doesn't work proper and doesn't find anything I want to get a notice or an alarm for that. I do not know how to do this far. Is there something in the internal index where splunk logs its alarms? Any suggestions? Thanks in advance.

igschloessl · ‎08-19-2019

My case is that I have got a dashboard with panels where I have a global time picker $global_pckr$ I need to calculate the latest timespan for a specific panel, when the user picks a too wide timespan. index=proxy src=$ip$ [|gentimes start=-1 | addinfo | eval earliest=$global_pckr.earliest$, latest=relative_time($global_pckr.earliest$, "+7d"] | stats count min(_time) as end max(_time as start by action src url I get the Error: Unable to parse 156616... with format: %m/%d/%>:%H:%M:%S How can I get this work? Thank you in advance

igschloessl · ‎03-27-2019

I have different count searches that I want to show in one report so I can send it to me as a csv file. index=proxy host=server1 | stats count as output1 | append [search index=mail host=server2 | stats count as output2] | append [search index=fw host=server3 | stats count as output3] | table output1 output2 output3 This output generates 3 columns and three rows. How can I put the count values in one row? I couldnt update a picture so I tried to make a table: output1 | output2 | output3 123---------------------------- -------------576--------------- ---------------------------38

igschloessl · ‎03-11-2019

I've got proxy logs and I want to show the top 5 urls and for that the count of distinct users who tried to access it. I tried the following search command index=proxy | eval dc_user=[search* stats dc(user) by url| return $dc_user] | top dest_host limit=5 | table dest_host dc_user How can I get this work? I also wanted to add the count of the url and the percentage. Thank you in advance.

igschloessl · ‎09-18-2018

I have a pie chart where I show the income types of people. (|eval income_type= if(income=<4000, "middle class","high class") | stats count by income_type When I click on the "high class" I want to show in the drilldown which person earns how much money. So I don't want the income_type, I need the income value itself. How can I get the income to the drilldown? Now I just get "high class" string. I already tried $row.income$ but it doesnt work. Thank you in advance.

igschloessl · ‎07-30-2018

I have a search which returns 150 Events but when I use the loadjob command I can only work with 100 Events of the original search. Can I configure this anywhere in the splunk settings? Because it makes less sense to search through just a part of the Events. Does anyone know how to fix this? Thx in advance.

Posts	19
Solutions	0
Karma Given	3
Karma Received	1
Member Since	‎07-30-2018

Online Status	Offline
Date Last Visited	‎10-09-2020 12:49 AM

Searching for period of months without rerunning s...

E-Mail notification with table

Set empty values of dnslookup with "N/A" in multiv...

Report of Dashboard

Report in Dashboard - but search reruns

Comparing lists from day1 with the list of day2 an...

How to compare Column Chart with Line Chart?

How to calculate two months of deviation with coun...

Monitor alerts (alarm if alerts do not work)

Calculate earliest, latest with timepicker

Searching for period of months without rerunning s...

E-Mail notification with table

Re: Set empty values of dnslookup with "N/A" in mu...

Set empty values of dnslookup with "N/A" in multiv...

Report of Dashboard

Report in Dashboard - but search reruns

Comparing lists from day1 with the list of day2 an...

Re: How to compare Column Chart with Line Chart?

Re: How to compare Column Chart with Line Chart?

How to compare Column Chart with Line Chart?

Re: How to calculate two months of deviation with ...

How to calculate two months of deviation with coun...

Re: Monitor alerts (alarm if alerts do not work)

Monitor alerts (alarm if alerts do not work)

Calculate earliest, latest with timepicker

Combine multiple searches with no relation in one ...

How to show the top command with distinct value?

How do I use drilldown with a piechart to get a di...

loadjob returns only 100 of 150 events