Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About john_byun
john_byun
Path Finder
Member since:
10-07-2013
03-08-2021
Community Statistics
| Posts | 38 |
| Solutions | 0 |
| Karma Given | 12 |
| Karma Received | 1 |
| Member Since | 10-07-2013 |
Activity Feed
- Posted Re: Query to find events with more than 2 values for a specific field compared to another field on Splunk Search. 02-01-2021 01:36 PM
- Karma Re: Query to find events with more than 2 values for a specific field compared to another field for scelikok. 02-01-2021 01:36 PM
- Posted Query to find events with more than 2 values for a specific field compared to another field on Splunk Search. 02-01-2021 01:18 PM
- Posted Re: Using fireall logs to find hosts that do not use a specific protocol on Splunk Search. 06-23-2020 10:59 AM
- Posted Using fireall logs to find hosts that do not use a specific protocol on Splunk Search. 06-23-2020 10:15 AM
- Karma Re: Cannot see full field list in Add Auto-Extracted Field window for a dataset in a datamodel for codebuilder. 06-05-2020 12:51 AM
- Karma Re: Constant re-authentication after SSO migration for marycordova. 06-05-2020 12:50 AM
- Karma Re: Palo Alto Networks App for Splunk: Where is the WildFire dashboard? for panguy. 06-05-2020 12:49 AM
- Karma Setting tag permissions for jasongb. 06-05-2020 12:49 AM
- Karma Re: Help with simple timechart query for MuS. 06-05-2020 12:47 AM
- Karma Re: Issue extracting field from host metadata for kristian_kolb. 06-05-2020 12:46 AM
- Karma Re: Combine counts from 2 separate searches using subsearches for _d_. 06-05-2020 12:46 AM
- Karma Re: Combine counts from 2 separate searches using subsearches for _d_. 06-05-2020 12:46 AM
- Karma Re: Universal Forwarder not sending data - timed out for lguinn2. 06-05-2020 12:46 AM
- Karma Re: Universal Forwarder not sending data - timed out for Akili. 06-05-2020 12:46 AM
- Got Karma for Universal Forwarder not sending data - timed out. 06-05-2020 12:46 AM
- Posted Re: Cannot see full field list in Add Auto-Extracted Field window for a dataset in a datamodel on Splunk Search. 03-16-2020 04:29 PM
- Posted Cannot see full field list in Add Auto-Extracted Field window for a dataset in a datamodel on Splunk Search. 03-09-2020 08:55 AM
- Posted Re: Constant re-authentication after SSO migration on Security. 07-31-2019 05:19 PM
- Posted Re: Constant re-authentication after SSO migration on Security. 07-31-2019 04:04 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 0 |
02-01-2021
01:36 PM
Perfect! Thanks for your help.
... View more
02-01-2021
01:18 PM
I'm trying to create a query to show me all users who have purchased more than 1 type of product. Each event has a "user" field and a "product" field. I only want to see the users that have purchased more than 1 type of product. "| stats count by user product" This shows me all user and product combinations, but don't know how to filter all events where a user only purchased one type of product. I feel that it should be a very simple query, but can't seem to figure it out.
... View more
- Tags:
- dc
06-23-2020
10:59 AM
I am looking to list all src's that do not use ssl. Your query basically gives me the same results because all src's use multiple apps. Is there a way to do this without me doing a massive diff of tens of thousands of results?
... View more
06-23-2020
10:15 AM
I have the following query for PAN firewall logs: index=pan app=ssl | stats count by src This would give me a list of all src IPs of devices that use SSL. How would I create a query to give me the opposite results? I want the list of src IPs that never have SSL traffic.
... View more
Labels
- Labels:
-
stats
03-16-2020
04:29 PM
We are in SplunkCloud and do not have access to any of the .conf files.
... View more
03-09-2020
08:55 AM
I'm new to data models and have a very newbie question. We are using SplunkCloud and when I try to add an auto-extracted field to the dataset, I only see a partial lists of fields. How do I scroll down or go to next page when trying to add fields to the "Add Auto-Extracted Field" window?
... View more
07-31-2019
05:19 PM
Correct. To be more specific, I don't have to login again. The window refreshes, I can see the SSO screen flash for a second and then the screen comes back up. It happens over and over and is very annoying when I am trying to change my query and it refreshes while I am typing and I have to type it in again. The only fix is to shut down all the windows or all except for one and open up new windows.
... View more
07-31-2019
04:04 PM
I don't have an issue with the session expiring. The issue is that refreshing the page triggers the issue described by the original poster. Each window tries to auto-refresh every 15 seconds or so. The only way to stop this continuous reauth is to close all the windows except one as the poster above mentioned. If want your exact searches back, you have to go into your browser history and reopen them.
... View more
07-11-2019
08:53 AM
I am seeing the same issue and I also believe your workaround works, but it's annoying. I also think it's a bug and hope Splunk will fix it.
... View more
05-29-2019
03:13 PM
Let me ask a slightly different question. In general, is it going to be faster using a string search compared to a field search?
... View more
05-24-2019
01:37 PM
In most cases, I don't notice a huge difference when I specify a fieldname or do a free text search, but for some fields it is literally 260 times slower.
Are searches using fieldnames supposed to be slower than free text?
What is it about these particular fields that make it unbearably slow?
For instance:
index=main myusername
This search has completed and has returned 1,774 results by scanning 1,774 events in 2.65 seconds
index=main user=myusername
This search has completed and has returned 1,774 results by scanning 40,885,115 events in 689.411 seconds
... View more
01-16-2019
10:21 AM
Can Splunk build in an option to enable Duo on an account basis instead of globally?
... View more
01-16-2019
10:17 AM
Is this really not possible with Splunk Cloud? Is there a workaround to get MFA working?
... View more
12-04-2017
04:42 PM
After entering all of the Duo Admin API info (integration key, secret key, host) I get the following error message when I hit Next and cannot proceed.
Encountered the following error while trying to save: Splunkd daemon is not responding: ("Error connecting to /servicesNS/admin/search/data/inputs/duo_input: ('The read operation timed out',)",)
If I navigate to splunk:8089/servicesNS in a web browser, I see the following:
This XML file does not appear to have any style information associated with it. The document tree is shown below.
Not Found
Does anyone know what the problem might be and how I can fix it?
... View more
11-30-2017
07:45 PM
Where is the WildFire Dashboard supposed to be located? The only WildFire dashboard that I see is the WildFire Submissions dashboard and it has data. Where is the link to view the WildFire Dashboard?
... View more
03-17-2017
05:05 PM
We have the same issue, but only from one type of device. If I apply this setting, will it affect all other syslogs coming into Splunk?
... View more
11-22-2015
11:37 AM
rich7177, thanks so much for your help.
I was able to get the query working by moving my eval commands to go after my stats.
eventtype=A | timechart count span=1d | append [search eventtype=B | transaction host maxspan=3m | timechart count as B_Count span=1d] | append [search eventtype=C | timechart count as C_Count span=1d] | stats first() as by _time | eval B_Rate=(B_Count/count)100 | fieldformat B_Rate=tostring(round(B_Rate,2))+"%" | eval C_Rate=(C_Count/count)100 | fieldformat C_Rate=tostring(round(C_Rate,2))+"%"
... View more
11-21-2015
08:41 PM
I've corrected the typo, replaced join with append, replaced stats with timechart, and replaced table with stats first(*) as * by _time.
My results are much closer now, but the 2 Rate calculations are coming up as Null%. Any idea what else I would need to add to make this work?
eventtype=A | timechart count span=1d | append [search eventtype=B | transaction host maxspan=3m | timechart count as B_Count span=1d] | append [search eventtype=C | timechart count as C_Count span=1d] | eval B_Rate=(B_Count/count)100 | fieldformat B_Rate=tostring(round(B_Rate,2))+"%" | eval C_Rate=(C_Count/count)*100 | fieldformat C_Rate=tostring(round(C_Rate,2))+"%" | stats first() as * by _time
... View more
11-21-2015
07:24 PM
The following query works for a specific time period.
eventtype=A | stats count |join type=outer [search eventtype=B | transaction host maxspan=3m | stats count as B_Count] | join type=outer [search eventtype=C | stats count as B_Count] | sort -count | eval B_Rate=(B_Count/count)*100 | fieldformat B_Rate=tostring(round(B_Rate,2))+"%" | eval C_Rate=(C_Count/count)*100 | fieldformat C_Rate=tostring(round(C_Rate,2))+"%" | table count, B_Count, B_Rate, C_Count, C_Rate
Results:
Total number of A events
Total number of B events
B divided by A%
Total number of C events
C divided by A%
How can I make this into a timechart that will provide results over time? For example, I would like the above results for every day for the last 7 days in a single table. I can do this manually by running the above search 7 times for each day, but I would like to do this in single search.
... View more
06-23-2014
11:44 AM
Here is what my data looks like below. I want to create a line chart with time on the x-axis and the fieldvalue on the y-axis.
Time Field Value
12:15 90
12:25 85
1:00 70
1:30 65
2:30 95
4:00 90
... View more
06-23-2014
11:25 AM
My current search is simply "timechart avg(fieldvalue)", but this does not give me the results that I want.
I do not want an average of the values.
I want each event to be a datapoint rather than giving me a single datapoint every 30 minutes.
... View more
06-23-2014
10:55 AM
I have a list of events that have a specific value associated with each event. I want to create a line graph of those values. How do I do this?
The elapsed time between each event is not consistent, so I want each event to be logged as a data point on my graph to be able to see the trend over time.
... View more
- Tags:
- timechart
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
03-08-2021
06:51 PM
|
