Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About dritjon
dritjon
Path Finder
Member since:
07-19-2022
08-01-2023
Community Statistics
| Posts | 18 |
| Solutions | 0 |
| Karma Given | 7 |
| Karma Received | 0 |
| Member Since | 07-19-2022 |
Activity Feed
- Posted Re: Timestamp of events is wrong after indexer reboot on Getting Data In. 02-20-2023 07:32 AM
- Posted Timestamp of events is wrong after indexer reboot? on Getting Data In. 02-20-2023 06:24 AM
- Tagged Timestamp of events is wrong after indexer reboot? on Getting Data In. 02-20-2023 06:24 AM
- Tagged Timestamp of events is wrong after indexer reboot? on Getting Data In. 02-20-2023 06:24 AM
- Tagged Timestamp of events is wrong after indexer reboot? on Getting Data In. 02-20-2023 06:24 AM
- Karma Re: Help with a simple search: How do I count how many days match a certain criteria? (example below) for gcusello. 10-27-2022 02:17 AM
- Posted Help with a simple search: How do I count how many days match a certain criteria? (example below) on Splunk Search. 10-27-2022 01:49 AM
- Tagged Help with a simple search: How do I count how many days match a certain criteria? (example below) on Splunk Search. 10-27-2022 01:49 AM
- Tagged Help with a simple search: How do I count how many days match a certain criteria? (example below) on Splunk Search. 10-27-2022 01:49 AM
- Tagged Help with a simple search: How do I count how many days match a certain criteria? (example below) on Splunk Search. 10-27-2022 01:49 AM
- Tagged Help with a simple search: How do I count how many days match a certain criteria? (example below) on Splunk Search. 10-27-2022 01:49 AM
- Karma Re: Is there a way I can input data into splunk manually for offline events? for gcusello. 10-26-2022 01:10 AM
- Posted Is there a way I can input data into splunk manually for offline events? on Getting Data In. 10-25-2022 11:19 PM
- Tagged Is there a way I can input data into splunk manually for offline events? on Getting Data In. 10-25-2022 11:19 PM
- Tagged Is there a way I can input data into splunk manually for offline events? on Getting Data In. 10-25-2022 11:19 PM
- Karma Re: How to replace values outputted from a stats with lookup table values? for ITWhisperer. 10-17-2022 04:24 AM
- Posted How to replace values outputted from a stats with lookup table values? on Splunk Search. 10-17-2022 03:48 AM
- Tagged How to replace values outputted from a stats with lookup table values? on Splunk Search. 10-17-2022 03:48 AM
- Tagged How to replace values outputted from a stats with lookup table values? on Splunk Search. 10-17-2022 03:48 AM
- Posted Re: How to use the same lookup file for different fields? on Splunk Search. 10-17-2022 03:36 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
02-20-2023
07:32 AM
> The timestamp _time is being picked up from the same place in the event before and after the reboot. But the path is the same. I did not change anything, only rebooted the server
... View more
02-20-2023
06:24 AM
Hello, I'm having a problem where the _time field of events does not match the actual events. This happened after I rebooted the splunk server.
As you can see from the pics, before the reboot the Time stamp, _time matches the time field
After the reboot the _time stamp is 2 hours before the time field
I checked the local linux server time, the user's Splunk time, they're all OK. Where does Splunk change the time of the events?
... View more
Labels
- Labels:
-
time
10-27-2022
01:49 AM
I have this search which builds a table my_search | timechart span=1d sum(eval(b/1024/1024/1024)) AS volume_b it will build a table like this: 24 October 18 25 October 10 26 October 25 27 October 30 Now, from this search I want to do a simple count: how many days have a volume>15 for the table above it would just show count: 3
... View more
10-25-2022
11:19 PM
I want to input into splunk the "events" of my fire alarms of all the branch offices. Is there a way I can manually create an index=firealarm and periodically fill fields I will create such as: date: 26 october branch: 01 alarmid: 125 reason: smoking etc... I will add new events everytime an alarm is triggered. I know I can do this in excel, but I want to store these data on Splunk and build dashboards too
... View more
Labels
- Labels:
-
index
10-17-2022
03:48 AM
I've done a simple search like this: index=fw_cisco | stats dc(dest_ip) as NrDestIp by src_ip I have defined a lookup file (ip_lookup) which has two colums: IPHost and DNShost. How do I replace the values of src_ip with the corresponding values of the lookup table? I tried this index=fw_cisco | lookup ip_lookup IPHost as src_ip OUTPUT DNSHost as resolved_src | stats dc(dest_ip) as NrDestIp by src_ip, resolved_src But it creates two columns, and also misses the values of src_ip that dont have a matching IPHost in the lookup table.
... View more
Labels
- Labels:
-
lookup
10-17-2022
03:36 AM
thanks that worked is there a way to do it with one lookup command?
... View more
10-17-2022
02:12 AM
Let me be more clear: I have defined a lookup file (ip_lookup) which has two colums: IPHost and DNShost Now I have a search which has two fields, src_ip and dest_ip. I successfully created a new field by using lookup like this: index=fw_cisco | lookup ip_lookup IPHost as src_ip OUTPUT DNShost as resolved_source_ip But I want to do the same for the field dest_ip too. Doing lookup like this: | lookup ip_lookup IPHost as src_ip, dest_ip ... throws an error How do I create two new fields that match the src_ip and dest_ip of my events, from the same lookup command
... View more
10-14-2022
02:25 AM
Bear with me as this is the first time im doing this. I configured a vmware host to send its events via syslog to splunk. It is working. Raw logs are stored in /opt/syslog/192.168.x.x in four different types (local, daemon logs etc) Now, how do I index these logs? How do I create a new index=vmware which will start index raw logs and I can start searching? Googled a bit but I cant find a step-by-step tutorial
... View more
Labels
- Labels:
-
indexer
-
search head
09-22-2022
11:52 PM
Is that the only way? Splunk support takes more than 10 days to answer us
... View more
09-22-2022
11:47 PM
Splunk search was disabled because we exceeded the quote for 45 days. So we bought another license to add 10GB to our license. Applied the license fine. Yet still I cant search due to violation. I restarted the license manager server, the indexers but nothing. I'm under the license limit now, what do I have to do to enable searching again?
... View more
Labels
- Labels:
-
license
08-19-2022
01:11 AM
Thanks, it worked. Just for visualization, any way I can make that chart as Bubble Chart? Because as is it works only as a Column Chart
... View more
08-19-2022
12:36 AM
the y-axis value would always be 1 for example. I just want a chart where I can see (in the last year for example) when's the last event of a users
... View more
08-19-2022
12:18 AM
I have a search whish results in these events: user last_event user1 2021-12-30 08:57:36.77 user2 2022-03-12 22:29:52.333 user 3 2022-03-13 08:02:48.253 I want to plot a chart where on the X axis there's the dates and on the Y there's the user
... View more
07-19-2022
07:31 AM
Thanks. One last question. The official doc says to modify the file in this path $SPLUNK_HOME/etc/system/local/props.conf But my local path doesnt have a props.conf file. Instead the path $SPLUNK_HOME/etc/system/default/ has a props.conf file Which to update?
... View more
07-19-2022
07:12 AM
The source is /opt/syslog/10.101.132.1/ The sourcetype is cisco:asa My architecture has 2 indexers in a cluster. Do i have to edit the files on both indexers
... View more
07-19-2022
07:06 AM
@richgalloway wrote: There can be many props.conf and transforms.conf files in a Splunk instance. You'll find them in $SPLUNK_HOME/etc/system/default, $SPLUNK_HOME/etc/system/local, $SPLUNK_HOME/etc/apps/<appname>/default, and $SPLUNK_HOME/etc/apps/<appname>/local (ignoring user-specific files). Splunk combines them all, using precedence rules, to produce a run-time configuration. Never modify a .conf file in a default directory. Any such changes will be lost the next time Splunk or the app is upgraded. Where do you make your changes? In the app that defines the sourcetype being modified. That may be a Cisco add-on or a custom app. Your architecture seems unusual. A search head cluster is supposed to have at least 3 search heads and you don't mention indexers at all. The settings to send unwanted events to the null queue must be installed on each indexer. If you don't have separate indexers then the settings go on the SHs. Sorry as I'm new to splunk. I have 1 search head and 2 indexers. Do I need to change the files on the search head or indexer? My /opt path on both machines has these folders splunkforwarder, splunk_indexer, syslog
... View more
07-19-2022
06:30 AM
Because of licensing reasons, I want to stop indexing these events (as they make up almost 50% of the index)
index=cisco dest_port=53
So basically DNS requests. Is it possible for this specific index=cisco to stop indexing these logs where dest_port=53? I cant do it from the cisco firewall itself.
I googled a bit and the consensus seems to be sending the logs to NULLQUEUE, and modify props.conf & transform.conf. But what I'm struggling with is where are these files?
My Splunk architecture is 2 Search Heads in a cluster and 1 License Manager server. Where to modify these files? On both Search heads?
... View more
- Tags:
- indexing
Labels
- Labels:
-
blacklist
-
props.conf
-
transforms.conf
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
08-01-2023
06:30 AM
|
Karma given to
