Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About Gawker
Gawker
Path Finder
Member since:
03-08-2018
06-05-2020
Community Statistics
| Posts | 19 |
| Solutions | 1 |
| Karma Given | 0 |
| Karma Received | 6 |
| Member Since | 03-08-2018 |
Activity Feed
- Got Karma for Why does an extension used in the example dashboard app not work outside of that dashboard (Ex: Table Icon Set (Rangemap))?. 06-05-2020 12:49 AM
- Got Karma for Re: Why does an extension used in the example dashboard app not work outside of that dashboard (Ex: Table Icon Set (Rangemap))?. 06-05-2020 12:49 AM
- Got Karma for Re: Why does an extension used in the example dashboard app not work outside of that dashboard (Ex: Table Icon Set (Rangemap))?. 06-05-2020 12:49 AM
- Got Karma for Re: Why does an extension used in the example dashboard app not work outside of that dashboard (Ex: Table Icon Set (Rangemap))?. 06-05-2020 12:49 AM
- Got Karma for Re: IPLocation: how to use with both src-ip and dest-ip?. 06-05-2020 12:46 AM
- Got Karma for Re: IPLocation: how to use with both src-ip and dest-ip?. 06-05-2020 12:46 AM
- Posted Re: How do I list data rows starting at a certain point if a field contains a particular value on Splunk Dev. 05-18-2018 01:35 PM
- Posted Re: How do I list data rows starting at a certain point if a field contains a particular value on Splunk Dev. 05-14-2018 01:23 PM
- Posted Re: How do I list data rows starting at a certain point if a field contains a particular value on Splunk Dev. 05-14-2018 12:52 PM
- Posted How do I list data rows starting at a certain point if a field contains a particular value on Splunk Dev. 05-14-2018 11:55 AM
- Tagged How do I list data rows starting at a certain point if a field contains a particular value on Splunk Dev. 05-14-2018 11:55 AM
- Posted Re: Is it possible to hide, suppress or remove the column header row in a report? on Splunk Search. 05-04-2018 09:38 AM
- Posted Is it possible to hide, suppress or remove the column header row in a report? on Splunk Search. 05-03-2018 02:04 PM
- Tagged Is it possible to hide, suppress or remove the column header row in a report? on Splunk Search. 05-03-2018 02:04 PM
- Tagged Is it possible to hide, suppress or remove the column header row in a report? on Splunk Search. 05-03-2018 02:04 PM
- Posted Re: Why does an extension used in the example dashboard app not work outside of that dashboard (Ex: Table Icon Set (Rangemap))? on Dashboards & Visualizations. 05-03-2018 09:57 AM
- Posted Re: Why does an extension used in the example dashboard app not work outside of that dashboard (Ex: Table Icon Set (Rangemap))? on Dashboards & Visualizations. 05-02-2018 09:33 AM
- Posted Re: Why does an extension used in the example dashboard app not work outside of that dashboard (Ex: Table Icon Set (Rangemap))? on Dashboards & Visualizations. 05-01-2018 01:42 PM
- Posted Why does an extension used in the example dashboard app not work outside of that dashboard (Ex: Table Icon Set (Rangemap))? on Dashboards & Visualizations. 05-01-2018 10:40 AM
- Tagged Why does an extension used in the example dashboard app not work outside of that dashboard (Ex: Table Icon Set (Rangemap))? on Dashboards & Visualizations. 05-01-2018 10:40 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
05-18-2018
01:35 PM
I took a small data source where verification of my search criteria and results would be easy.
(01) Here's the data from a specific time picker range that was convenient to use as there were only 12 events.
"12 events (5/15/18 12:00:00.000 AM to 5/16/18 12:00:00.000 AM)"
grep "2018-05-15 15:32:" ../log/server.log
xxxxxxxx75
xxxxxxxx78
grep exception ../log/server.log
xxxxxxxx66
tail -f ../log/server.log
xxxxxxxx66
cd /usr/local/jboss/server/default/deploy
2018-05-15 11:34:16
xxxxxxxx99
nslookup eudc2.eu.ei3.local
xxxxxxxx94
nslookup xxxxx.xxxxxx.xxxxxx.xx
xxxxxxxx44
cat inputs.conf
xxxxxxxx43
ls
xxxxxxxx41
cd /opt/splunkforwarder/etc/system/local/
2018-05-15 09:32:12
(02) I set up this query, using the date/time from the first event (see above) as my key for streamstats:
source="/root/.bash_history" | rex "(grep \"(?.)\" ..\/log\/server.log)" | streamstats count reset_after="Search_It=\"2018-05-15 15:32:*\"" | where count<=3
(03) The results from the aforementioned query and the time range picker yielded what was expected, the "key" entry and three rows:
grep "2018-05-15 15:32:" ../log/server.log
xxxxxxxx75
xxxxxxxx78
grep exception ../log/server.log
xxxxxxxx66
tail -f ../log/server.log
(04) I set the time range picker to "All", which then yielded an extra row in addition to the 4 expected as in (03):
2018-05-17 16:49:01
Any idea as to why the extra row shows up?
Thank you.
... View more
05-14-2018
01:23 PM
For clarification, I updated my question.
The 50 rows after the field1="alert" that I am interested in are not entries with "alert".
What I am looking for would be something akin to a head/tail combination of the data based on the actual time of the entry which contains field1="alert". I want to capture the "alert" row and 50 data rows following it, regardless of the contents of the 50 rows.
Hope that clarifies things.
... View more
05-14-2018
11:55 AM
I've a need to search through some data for a field that has a particular value. If the value is found, then I want to list out that line and the 50 lines that precedes it.
For example:
01) Search sourcetype=abc for field1="alert".
02) Field1="alert" is first found at 2018-05-10 18:10:01
03) List out entry for 2018-05-10 18:10:01 and the 50 data entries prior/earlier then 18:10:01. The 50 data entries may not be related to or contain field1="alert". They are needed for review of activity leading to the "alert".
04) Field1="alert" is next found at 2018-04-27 13:57:55
05) List out entry for 2018-05-10 13:10:00 and the 50 data entries prior/earlier then 13:57:55. The 50 data entries may not be related to or contain field1="alert". They are needed for review of activity leading to the "alert".
...
I've tried several things unsuccessfully. I could really use some guidance.
Thank you
... View more
- Tags:
- splunk-cloud
05-04-2018
09:38 AM
Thank you for the info. I already tried that, but it looks a little odd having the blank row at the top when it's embedded in a web page. I was hoping that Splunk had some easy option to hide/unhide the column names (ex: table hideheader=y Location, Data_Age
Maybe they'll consider it an enhancement : )
... View more
05-03-2018
02:04 PM
I have a report that looks similar to this:
Is it possible to hide, suppress or remove the column header row in the report so that it looks like this:
I want to do this in the actual report, not in a dashboard.
BYA, this is not the solution: https://answers.splunk.com/answers/76860/is-it-possible-to-remove-coulumn-names.html
Thank you.
... View more
05-03-2018
09:57 AM
2 Karma
The solution...
This is the dashboard tag I was using and not getting results in the primary dashboard, but which worked in the Examples Dashboard app:
<dashboard script="table_icons_rangemap.js" stylesheet="table_decorations.css">
This is the corrected tag as provided by support:
<dashboard script="simple_xml_examples:table_icons_rangemap.js" stylesheet="simple_xml_examples:table_decorations.css">
It was what it looked like, a path issue. Unsure as to how one would know to add "simple_xml_examples:" to the js and css file names.
... View more
05-02-2018
09:33 AM
1 Karma
I tried to use the bold text feature here and it didn't translate it in the code, so there are a few sets of "**".
I don't know where the files are as they were installed by support. We are cloud based and therefore unable to see where things are.
... View more
05-01-2018
01:42 PM
I tested Table Cell Highlighting and found the same functional issue.
... View more
05-01-2018
10:40 AM
1 Karma
I am trying to use the Table Icon Set (Rangemap) extension as seen in the Examples Dashboard app. I successfully created and tested a new dashboard in the Examples Dashboard app.
I then created a new dashboard in the default environment, copying in the code from the test dashboard in the Examples Dashboard app.
The dashboard in the default environment does not replace the range value with the icon:
Examples Dashboard:
Default dashboard:
The code:
<dashboard **stylesheet="table_decorations.css" script="table_icons_rangemap.js"**>
<label># ECK ICONs Copy Copy</label>
<description>Use Javascript and CSS in tables to convert rangemap results into icons.</description>
<row>
<table **id="table1"**>
<title>Render Icons based on rangemap result</title>
<search>
<query>
| metadata index=* type=hosts
...
| table Location, host, Data_Age_Secs, UTC_Status
| sort Location, host
| **rangemap field=Data_Age_Secs low=0-100 elevated=101-500 severe=501-999999999 default=severe**
</query>
<earliest>-1h</earliest>
</search>
<option name="drilldown">none</option>
</table>
</row>
</dashboard>
I thought that perhaps the extension files had to be propagated (or something configured), but support said that no changes were necessary, indicating it was my code.
Anybody know what I am doing wrong?
Thank you.
... View more
04-13-2018
01:36 PM
I can generate an incident report by server that looks like this:
Host_Name Event_Count
myhost-01 11
myhost-02 2
If there isn't any data for the observation period, I want to generate something like this:
Host_Name Event_Count
n/a 0
I've tried using several eval and fillnull statements to get past this. Example:
...| stats sum(linecount) as Total_Events BY host | fillnull host value="N/A"
Thank you.
... View more
- Tags:
- splunk-cloud
03-30-2018
12:03 PM
I have fortigate logs for which I have a high level of confidence that the srccountry values are correct.
I selected data from a particular day so that I could do my first cluster map using:
| iplocation srcip | geostats latfield=lat longfield=lon count
I was seeing some data that looked on the surface to be invalid. iplocation was saying that one of the IPs was in Seychelles off of the coast of Africa while srccountry was correctly indicating that the IP was in the Netherlands.
I then determined the number of entries where iplocation Country did not match srccountry and removed the "where" clause to get the full count:
| iplocation srcip | where NOT Country=srccountry | stats count
8,470 of the 29,233 data points (29%) had iplocation Country values that did not match srccountry.
561 of the 8,470 mismatches (7%) had null iplocation Country values.
Are my queries incorrect or...?
Thank you.
... View more
03-29-2018
12:36 PM
2 Karma
You can also accomplish the same thing by doing this:
sourcetype="IPS" | iplocation prefix=CC1_ src_ip | iplocation prefix=CC2_ dest_ip | table src_ip CC1_Country dest_ip CC2_Country
To access other data iplocation and that isn't part of the default values (ex: timezone) , you would add the allfields=true parameter to each iplocation command:
sourcetype="IPS" | iplocation prefix=CC1_ allfields=true src_ip | iplocation prefix=CC2_ allfields=true dest_ip | table src_ip CC1_Country CC1_Timezone dest_ip CC2_Country CC2_Timezone
http://docs.splunk.com/Documentation/Splunk/6.0.1/SearchReference/Iplocation
... View more
03-26-2018
10:34 AM
I have a report with the following search:
sourcetype="xxxxxxxx:xxxxxxxx" "GET /xxxxx" apiKey= | rex "(GET (?.))" | eval Page_Name=(mvindex(split(Page_String,"?"),0)) | bin _time span=1m | stats count AS Page_Requests BY _time | sort -_time | head 30
01) When I run the report, it shows a fully loaded graph in just a few seconds which includes a total of 30 1-minute span bars.
02) I added the report to the dashboard via the "+Add Panel" option on the dashboard. The dashboard chart starts loading slowly, displaying the most current minute as the first bar. The graph continues loading in this fashion, one bar/minute at a time, until all 30 bars (minutes) are populated from the data as it is generated instead of fetching the data for the prior 29 minutes.
03) If I am in the report and I add it via "Save As", then "Dashboard Panel" , "Existing", "Inline Search", the dashboard chart loads as fast as the report search does (01).
04) If I am in the report and I add it via "Save As", then "Dashboard Panel", "Existing", "Report", the dashboard chart loads slowly, behaving like (02).
Why is there a difference in behavior of the chart based on how it is added to the dashboard?
Should I always add a component from the actual report search instead of selecting the report via the dashboard option to add a panel?
Thank you.
... View more
03-16-2018
11:52 AM
Thank you for the excellent insight!
I tried the NOT search as you suggested and the count was the exact delta of the linecount and apiKey numbers.
... View more
03-16-2018
10:25 AM
I have a report that provides a summary of key activity by IP.
I wanted to cross check that information against the results using a simple search that would return all the rows for a particular IP on a particular day.
I ran this search:
host="xxxxxx.xxx.xxxxx.local" "xxx.xxx.xxx.xxx"
Instead of getting 804,471 results (as in my report), the query yielded:
819,542 events (3/14/18 12:00:00.000 AM to 3/15/18 12:00:00.000 AM)
So, I then decided to add stats to the query, which is also used in the report:
I ran:
host="xxxxxx.xxx.xxxxx.local" "xxx.xxx.xxx.xxx" | stats count(*)
This search gave me something interesting:
819,542 events (3/14/18 12:00:00.000 AM to 3/15/18 12:00:00.000 AM)
count(apiKey)..........804471 << Correct and matches my report
count(date_hour).....819542 << Matches the total from the non-stats search
count(linecount)......819542 << Matches the total from the non-stats search
As a Splunk neophyte, this looks like I am getting phantom rows.
Why do I see different counts?
Thank you.
... View more
03-09-2018
01:04 PM
Thank you for the reply, damiensurat.
I've used your valuable input to modify my query and now have an alert in place.
... View more
03-08-2018
01:09 PM
Greetings.
I've a search to determine the number of events per IP. The resulting output looks like the following, where the first column is the IP and the 2nd column being the number (count) of events:
123.456.789.1 35
123.456.789.2 0
123.456.789.3 257
123.456.789.4 153
...
I would like to set up an alert that checks for any IP with an even count that exceeds 200. Ideally the alert would only include information for that particular entry.
Thank you.
... View more
- Tags:
- splunk-cloud
