Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About mgrosholz
mgrosholz
Path Finder
Member since:
05-05-2016
06-05-2020
Community Statistics
| Posts | 40 |
| Solutions | 1 |
| Karma Given | 15 |
| Karma Received | 3 |
| Member Since | 05-05-2016 |
Activity Feed
- Got Karma for Why is the eval if statement in my search not producing any results if I add anything more with the AND operation?. 11-02-2020 01:57 AM
- Karma Re: How to combine two different searches? for somesoni2. 06-05-2020 12:48 AM
- Karma Re: If "this AND this" OR "this AND this" then ... for pradeepkumarg. 06-05-2020 12:48 AM
- Karma Re: Why is the eval if statement in my search not producing any results if I add anything more with the AND operation? for s2_splunk. 06-05-2020 12:48 AM
- Karma Re: How to write a search to find values similar to a certain string? for richgalloway. 06-05-2020 12:48 AM
- Karma Re: Is there a way to search and list all attributes from a data model? for sundareshr. 06-05-2020 12:48 AM
- Karma How to create a search that shows a trending value based on the selected time range picker value? for Iranes. 06-05-2020 12:48 AM
- Karma Re: changing the source type in splunk for skoelpin. 06-05-2020 12:48 AM
- Karma Re: setting the time format for timezone offset in props for woodcock. 06-05-2020 12:48 AM
- Got Karma for Splunk Enterprise Security: How to remove a notable event from the "Security Posture" dashboard after investigation?. 06-05-2020 12:48 AM
- Got Karma for Re: Splunk Enterprise Security: How to change the default time range inside the app?. 06-05-2020 12:48 AM
- Karma Re: How to get a specific country,state geoip results and ignore everything else for nishan_perera. 06-05-2020 12:47 AM
- Karma Re: How to prevent the field value count from displaying that is used in the rangemap command? for aweitzman. 06-05-2020 12:47 AM
- Karma Re: Finding all instances of a field greater than the avg of that field during a 15 minute span for sideview. 06-05-2020 12:46 AM
- Karma What is the fastest way to show all sources and sourcetypes in an index? for Jason. 06-05-2020 12:45 AM
- Karma Re: Fastest way to show all sources and sourcetypes in an index? for sideview. 06-05-2020 12:45 AM
- Karma Re: Separate combined log entries at search time for Stephen_Sorkin. 06-05-2020 12:45 AM
- Karma Re: Does Splunk have an equivalent to SQL's IN () construct? for sideview. 06-05-2020 12:45 AM
- Posted Re: How to develop a search to find what is NOT in a lookup table with another lookup comparison? on Splunk Search. 05-14-2017 08:51 AM
- Posted Re: How to develop a search to find what is NOT in a lookup table with another lookup comparison? on Splunk Search. 05-11-2017 01:08 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 1 | |||
| 0 |
05-14-2017
08:51 AM
More clarification:
lookup1 and lookup2 have different fields respectively.
The goal is to:
- Have events from index=foo...
- Show only events that match fieldA in lookup1...
- Output fieldB and fieldC from lookup1...
- Remove events (or not see) that match fieldX, fieldY, and fieldZ in lookup2...
... View more
05-11-2017
01:08 PM
No results with just the subsearch.
... View more
05-11-2017
11:38 AM
There is confusion with the title. The first lookup should not affect the second lookup.
I am looking at lookup1 and getting results. Then I am saying do not look at events that match lookup2.
... View more
05-11-2017
11:10 AM
I have been using the lookup command for lookup1 and it works great. I can read, compare, and pull fields. But I can't figure out how to say ignore lookup2 events.
... View more
05-11-2017
11:09 AM
It doesn't pull anything. Checked the lookup, it was empty. So it should spit out results.
... View more
05-11-2017
08:19 AM
I have two lookup tables and I want to search what is NOT in lookup2 but in lookup1.
I have tried:
... NOT [|inputlookup lookup2 ....]
So overall I have something like:
index=foo NOT [| inputlookup lookup2]
| lookup lookup1 fieldA
|... rest of search ...
But nothing works. Any tips?
... View more
05-09-2017
08:41 AM
Oh, and thanks btw.
... View more
05-09-2017
08:36 AM
Why did you add the not null for fieldB?
... View more
05-09-2017
08:35 AM
I had a typo on my end. It works.
... View more
05-09-2017
08:29 AM
Sweet we are getting somewhere! I got the output of fieldB but results are still showing all results of fieldA not just what populates compared to the lookup table. <--does that make sense?
... View more
05-09-2017
08:21 AM
No. It is not. Should it be?
... View more
05-09-2017
08:00 AM
I have an index=foo and a lookup table defined as foo2. How can I compare my index to the table to show only results matching fieldA in foo2 and pulling fieldB from foo2?
I have tried below and many variations of it but I get no results.
index=foo
[| inputlookup foo2 | fields fieldA]
index=foo
| lookup foo2 fieldA OUTPUT fieldB
... View more
- Tags:
- lookups
04-27-2017
01:56 PM
Does anyone recall the app that can be obtained after x licensing and turns plain language inputs into drill down search strings?
... View more
- Tags:
- splunk-enterprise
03-14-2017
06:23 AM
So your search might be cumbersome because you are not using metadata. Metadata is perfect for this instance and does not require Splunk to search all indexes at search time.
You should use something like this...
| metadata type=sourcetypes index=*
Much like others above have mentioned.
... View more
03-14-2017
06:19 AM
Try
| metadata type=sources sourcetype=*
... View more
01-30-2017
01:21 PM
1 Karma
I reached out to Splunk Support and got the problem resolved. It was fairly simple. To fix via the UI follow the steps below.
Navigate to Settings -> Service Settings -> Search Preferences
Change Default search time range to "Last 4 hours" and save.
Navigate to ES App -> click on search -> select Search
... View more
01-19-2017
06:13 AM
I didn't think ES had its own .conf file. I did change the default time in the location you mentioned and followed the instructions and formatting stated in the documentation.
To clarify, the search head with the ES app was changed. Within the same search head, the "Search & Reporting app does reflect the changes made. However, when you go into the ES app, and click on the "Search" tab, then the "Search" option, the setting is still set to "All Time".
... View more
01-17-2017
10:51 AM
I know how to change the default time range in the search head but it only applies to the Search & Reporting app.
Does anyone know how to change the default time within the Splunk Enterprise Security app?
I cannot find any documentation on it.
... View more
01-06-2017
01:08 PM
What is the time spent on the search? i.e. is it already a fairly long search to complete?
I was able to do something similar by utilizing a subsearch. But subsearches slow the search-time results.
You can try...
index=akamai src_ip!=xxx.xx.xx.xx AND src_ip!=xxx.xx.xx.xx [search index=akamai src_ip!=xxx.xx.xx.xx AND src_ip!=xxx.xx.xx.xx | lookup whitelistip.csv src_ip OUTPUTNEW src_ip as Whitelist | where isnull(Whitelist) | eval useragent=urldecode(useragent) | dedup useragent | top limit=x useragents | table http_user_agent, useragent] | stats dc(http_user_agent) AS Number_of_userAgents, list(useragent) as useragent_list, count(eval(uri_path="/search/stuff/v2")) as "SearchV2", count(eval(uri_path="shape/search/stuff/v2")) as "ShapeV2", count(eval(uri_path="/search/stuff/v1")) as "SearchV1", count as EventCount by src_ip | eval TotalCount=SearchV2+ShapeV2+SearchV1 | eval hitPercentage=(TotalCount/EventCount) * 100 | fields src_ip, Number_of_userAgents,useragent_list, hitPercentage, EventCount, SearchV2, ShapeV2, SearchV1, TotalCount
If you are unsure about your subsearch just put "| format" behind it and you will see what it pipes to your search.
... View more
12-16-2016
11:03 AM
I am looking to grab the data that fall under two completely different searches.
I have these two searches.
index="A"
| iplocation src
| search Country!="country1" status=200
| bucket _time span=1m
| stats count by _time, usr1
| where count > 25
AND
sourcetype="B"
| bucket _time span=1m
| stats count by _time, usr2
| where count > 25
I want to combine them. Here is what I have so far but it doesn't pull up the data.
index="A" OR sourcetype="B"
| eval id=case(index="A", "usr1", sourcetype="B", "usr2")
| iplocation src
| search Country!="country1" status=200
| bucket _time span=1m
| stats count by _time, id
| where count > 25
sourcetype="B" does not contain iplocation or country information. This, I believe, is the issue.
I have tried subsearches, join, append, etc...
Any advise is appreciated.
... View more
10-28-2016
05:06 AM
Have you tried...
My search | timechart span=1h limit=0 count by student | anomalies by student
... View more
10-28-2016
04:50 AM
By mean activity, I am assuming you mean the average.
| stats avg(count) by date_hour, user
For standard deviation you can try something like below. Replace "n" with your amount.
| eventstats stdev(count) as deviation | eval outlier=deviation*"n" | where count > outlier
... View more
10-14-2016
07:51 AM
The question is a little convoluted. Could you clarify if you are looking to eval between the two searches or search the "| fields..." for the entire search string? If it's the latter you can just pull it out of the subsearch.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:04 AM
|
Karma given to
