About ntaylorsplunk

ntaylorsplunk · ‎09-28-2016

Forgot to mention, there is no timezone or offset information in the timestamp... The timestamp format from the incoming event is %b %d %T

ntaylorsplunk · ‎09-28-2016

I have a one host that has a time offset of +5 hours and would rewrite the timestamp to represent the local time zone before the event is indexed. What's the best way to do this?

ntaylorsplunk · ‎08-25-2016

That really depends on what type of router/switch you're using and what you're looking for in the traffic. If you just want tcp and udp connection data it would be much different than if you're looking for full packet captures.

ntaylorsplunk · ‎08-25-2016

Try this instead sourcetype=access_combined | lookup TestIPs.csv src_ip OUTPUT CustName | eval CustName=if(len(CustName) > 2, CustName, src_ip) | chart count over CustName| sort -count limit=10

ntaylorsplunk · ‎08-24-2016

The maxspan argument to the transaction command may be part of the reason you're getting incorrect results. The documentation for the transaction command doesn't show months as being a valid time specifier for the maxspan argument. http://docs.splunk.com/Documentation/Splunk/6.4.2/SearchReference/Transaction

Posts	5
Solutions	2
Karma Given	0
Karma Received	3
Member Since	‎08-24-2016

Online Status	Offline
Date Last Visited	‎06-05-2020 02:04 AM

What is the best way to adjust the time value for ...

Re: What is the best way to adjust the time value ...

What is the best way to adjust the time value for ...

Re: How to configure a Splunk forwarder for a netw...

Re: If a value is not in a lookup table, can I ret...

Re: Why is transaction maxspan=1mon span=1mon show...