Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About lllidan
lllidan
New Member
Member since:
04-19-2018
06-13-2020
Community Statistics
| Posts | 33 |
| Solutions | 0 |
| Karma Given | 0 |
| Karma Received | 0 |
| Member Since | 04-19-2018 |
Activity Feed
- Posted Re: Migrate Splunk from Windows to Linux question on Splunk Enterprise. 06-11-2020 10:40 PM
- Posted How to Migrate Splunk from Windows to Linux question? on Splunk Enterprise. 06-11-2020 08:35 PM
- Posted Re: question about complicated condition search on Splunk Search. 04-14-2020 02:43 AM
- Posted Re: question about complicated condition search on Splunk Search. 04-12-2020 05:10 AM
- Posted question about complicated condition search on Splunk Search. 04-11-2020 07:24 PM
- Tagged question about complicated condition search on Splunk Search. 04-11-2020 07:24 PM
- Posted How can I extract a value from a field that have many content on Splunk Search. 03-18-2020 08:50 PM
- Tagged How can I extract a value from a field that have many content on Splunk Search. 03-18-2020 08:50 PM
- Posted Re: when a setup a blacklist in input.conf, will it decrease the usage of license? on Getting Data In. 02-17-2020 01:42 AM
- Posted when a setup a blacklist in input.conf, will it decrease the usage of license? on Getting Data In. 02-17-2020 01:31 AM
- Tagged when a setup a blacklist in input.conf, will it decrease the usage of license? on Getting Data In. 02-17-2020 01:31 AM
- Posted How to input data via "TA for Nutanix Prism" add-on? on Getting Data In. 02-12-2020 09:48 PM
- Tagged How to input data via "TA for Nutanix Prism" add-on? on Getting Data In. 02-12-2020 09:48 PM
- Posted how can I analyze logs and extract fields from network device on Getting Data In. 01-20-2020 12:22 AM
- Tagged how can I analyze logs and extract fields from network device on Getting Data In. 01-20-2020 12:22 AM
- Tagged how can I analyze logs and extract fields from network device on Getting Data In. 01-20-2020 12:22 AM
- Posted Re: union search with same field from different sourcetype on Splunk Search. 11-11-2019 07:25 PM
- Posted union search with same field from different sourcetype on Splunk Search. 11-11-2019 12:04 AM
- Tagged union search with same field from different sourcetype on Splunk Search. 11-11-2019 12:04 AM
- Posted Re: How to extract fields with not displayed content ? on Splunk Search. 01-15-2019 07:53 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
06-11-2020
10:40 PM
Thanks for your advice, I knew that I can replace folder to migrate configuration and index data, but I just want to find another way to do migration by once install. Because I found some descriptions in guide as below: (refer to step 3) 1. Stop Splunk Enterprise on the host from which you want to migrate. 2. Copy the entire contents of the $SPLUNK_HOME directory from the old host to the new host. 3. Install the appropriate version of Splunk Enterprise for the target platform. 4. Confirm that index configuration files (indexes.conf) contain the correct location and path specification for any non-default indexes. 5. Start Splunk Enterprise on the new instance. 6. Log into Splunk Enterprise with your existing credentials. 7. After you log in, confirm that your data is intact by searching it.
... View more
06-11-2020
08:35 PM
I am planning a migration from Windows to Linux.
As I found in Splunk guide, I did following steps:
1. remove instance from distributed search peer.
2. copy whole splunk_home folder to new Linux server.
3. change the paths in configuration file to fit Linux format.
now, I want to install splunk via RPM package to finish migration. but I am not sure which command can keep my configuration, alerts, reports, dashboards from old splunk.
does "rpm -i --replacepkgs --prefix=/splunkdirectory/ splunk_package_name.rpm" can cover my requirement?
if anything I did wrong, please help, thanks in advance.
... View more
Labels
- Labels:
-
upgrade
-
using Splunk Enterprise
04-14-2020
02:43 AM
thanks, David. I am really appreciate your help.
It's very close to the requirement, I got a good classification with your search, I also want to modify the different IP between "last hour" and "Last 15 min" that from the same user, list the username, different IP and "last hour" IP as columns in a chart.
thanks so much
... View more
04-12-2020
05:10 AM
yes, it works. thanks.
Furthermore, I also want to compare the 5 minutes' IP address to 1 hour's IP address from same user, do you have some idea?
... View more
04-11-2020
07:24 PM
I am facing a difficult problem about search, the condition is: I want to filter the user who change his/her logon source IP address in ten minutes.
the problem is, there are many users login in the time period, how can I classify the same username, I can't define the username in advance, it's random.
could you give a sample search? thanks in advance.
... View more
- Tags:
- splunk-enterprise
03-18-2020
08:50 PM
I have a field named "Message", the content as below:
*Active Directory Domain Services could not use DNS to resolve the IP address of the source domain controller listed below. To maintain the consistency of Security groups, group policy, users and computers and their passwords, Active Directory Domain Services successfully replicated using the NetBIOS or fully qualified computer name of the source domain controller.
Invalid DNS configuration may be affecting other essential operations on member computers, domain controllers or application servers in this Active Directory Domain Services forest, including logon authentication or access to network resources.
You should immediately resolve this DNS configuration error so that this domain controller can resolve the IP address of the source domain controller using DNS.
Alternate server name: AAABB0001 Failing DNS host name:*
I want to extract value "AAABB0001", I tried to use eval n=mvfind(Message,"\w{5}\d{4}"), but it only return a value "0".
Could you please give some better solution for me? thanks
... View more
- Tags:
- splunk-enterprise
Labels
- Labels:
-
field extraction
02-17-2020
01:31 AM
As I asked, if I setup a blacklist to deny some logs, does the dropped logs still occupy the license quota?
... View more
- Tags:
- splunk-enterprise
02-12-2020
09:48 PM
As I read the guide from "TA for Nutanix Prism" on Splunk Base.
There's some description of data input as below:
"On you Splunk Enterprise instance, navigate over to Settings —> Data Inputs —> and select the Nutanix Prism API endpoints you want to ingest into Splunk. For each input you want to add, select the endpoint then select new —> and fill out the required form."
But I can't find the right option to match "select the Nutanix Prism API endpoints you want to ingest into Splunk. For each input you want to add, select the endpoint", there are some options like : Local Event Logs, Remote Event Logs, File&Directories, Http Event Collector, TCP/UDP...
Could you give some advice? thanks in advance.
... View more
01-20-2020
12:22 AM
Even though I collected some logs from network device, like Cisco switch and firewall. but how can I analyze them and extract fields?
Splunk only supply a source "Cisco:asa", but it can only identify less fields from network device logs. Shall I extract them manually or there's another plugins to solve this problem?
... View more
11-11-2019
07:25 PM
it seems doesn't work, the query values(fields) can only extract the value of fields, but can't show the relationship between two sourcetype, when the field ChangeUser is "2" , it must mapping to sourceB and find ID equal 2, and got the UserName=Jack=ChangeUser=2
... View more
11-11-2019
12:04 AM
I have two sources as below:
source x:
CreateTime, CreateUser,ChangeTime,ChangeUser,.......
2019/01/01 | 1 | 2019/02/02 | 2 |
source y:
ID,UserName,.......
1 | Tom
2 | Jack
my expected output:
CreateTime, CreateUser,ChangeTime,ChangeUser,.......
2019/01/01| Tom |2019/02/02 | Jack |
do you have any idea? Thanks in advance.
... View more
01-15-2019
07:53 PM
Hi Giuseppe,
thanks for you kindly help, do follow that operation, but nothing change.
Actually, I need display more log contents in "file extractor" page to extract hided field.
I share two pictures to you to explain this situation, hope you can browse that.
https://pan.baidu.com/s/1g2rD1eSqtwgtziCTE_u3ow
https://pan.baidu.com/s/1LsKmOpYvGn8jEZvYqVTMkA
I really appreciate your help .
... View more
01-15-2019
01:51 AM
Hi Giuseppe,
do you meant I should copy "$Splunk_Home\etc\system*default**props.conf" file to "$Splunk _Home\etc\system**local**props.conf*" ? and modify the parameter "truncate = 0".
Does this method will influence "Search" App?
And how to create an empty APP in Splunk ?
thanks for your patience and time as well. to be honest, I'm a layman on this field.
Kr.,
Lllidan
... View more
01-15-2019
12:26 AM
Hi Giuseppe,
A good suggestion! I would like to try it, but which one is the correct path of "props.conf" file? I found many files use the same name in Splunk installation folder.
... View more
01-14-2019
11:25 PM
if I have a short event log, I can easy extract the field that displayed in the "Extraction fields Wizard". ( use mouse to select the target field. and then follow the wizard )
but for a long event log, the event content may not displayed completely, in this situation, how can I select the field that in the hide content? or I can only use REX formula?
... View more
08-22-2018
02:32 AM
I have to say I'm a layman on Splunk. but i got a requirement from my boss , i need to search the same user login via different IP addresses during five minutes.
i admire the man who can help me .
... View more
08-22-2018
02:23 AM
when i try to input some excel files named xx.xlsx , and then i got some messy codes from search result like: "Pk\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00......." . that's unreadable !
how i can correctly input the kind of .xlsx files ? which source / sourcetype / index should i select ? or maybe i should use some plugins ?
... View more
08-14-2018
11:46 PM
I want to monitor the connection status of some network device, and I want to trigger an alert which the same source IP address access the device greater than 1000 per hour. How can I achieve this requirement?
... View more
07-10-2018
03:21 AM
your answer solved my problem , except one mistake , "| where date_hourmin>=2200 OR date_hourmin<=400"
... View more
07-10-2018
02:41 AM
"@d-2h @d+4h" like this ?
... View more
07-09-2018
07:00 PM
this search can only display one day's logs, if I select the time range option with "month to date", it just display today's logs, not everyday's specific time range.
... View more
07-09-2018
02:28 AM
i want to collect logs that from 10 p.m to next day 4 a.m everyday in per month , how can i define the time range ? it seems "date_hour" field doesn't work.
... View more
- Tags:
- collection
- time-range
07-04-2018
12:09 AM
thanks for your kindly answer , but as I try the sentence you given , the field "date_hour" do not work , it's not exist in the splunk , that's you manually extract ? or a default field ?
... View more
06-28-2018
10:27 PM
i defined an alert to send email to me , but i found the attachment ( .csv file ) in the alert mail is incomplete, it miss some importance column,
i wonder how to alter the content in the csv file ?
... View more
- Tags:
- content
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-13-2020
01:47 AM
|
