Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About arikanter
arikanter
Observer
Member since:
11-01-2018
01-25-2024
Community Statistics
| Posts | 5 |
| Solutions | 0 |
| Karma Given | 0 |
| Karma Received | 0 |
| Member Since | 11-01-2018 |
Activity Feed
- Posted Re: Create an alert based on comparison of two lookup tables on Alerting. 05-03-2021 09:37 AM
- Posted Create an alert based on comparison of two lookup tables on Alerting. 04-30-2021 05:59 PM
- Tagged Create an alert based on comparison of two lookup tables on Alerting. 04-30-2021 05:59 PM
- Posted Re: ignore timestamp greater than 2 days on Splunk Enterprise Security. 04-24-2020 01:48 PM
- Posted ignore timestamp greater than 2 days on Splunk Enterprise Security. 04-23-2020 10:12 PM
- Tagged ignore timestamp greater than 2 days on Splunk Enterprise Security. 04-23-2020 10:12 PM
- Tagged ignore timestamp greater than 2 days on Splunk Enterprise Security. 04-23-2020 10:12 PM
- Posted How to make second token value be based on choice made for first token on Splunk Enterprise Security. 09-23-2019 02:31 PM
- Tagged How to make second token value be based on choice made for first token on Splunk Enterprise Security. 09-23-2019 02:31 PM
- Tagged How to make second token value be based on choice made for first token on Splunk Enterprise Security. 09-23-2019 02:31 PM
- Tagged How to make second token value be based on choice made for first token on Splunk Enterprise Security. 09-23-2019 02:31 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 |
05-03-2021
09:37 AM
Hi! Sorry, I wasn't clear enough in my ask. In my use case, my search will never return events because I'm not searching events, I'm searching lookuptables. Results from lookuptables are returned as statistics, not events. Problem: Splunk alerts (by design?) appear to trigger only when searches return events. I want my Splunk alert to trigger on statistics.
... View more
04-30-2021
05:59 PM
I have two lookup tables that get updated 1/day from time/CPU intensive searches. I want to create an alert to let me know when there are deltas between these two lookup tables. I can schedule as a report, and this works, but then I get empty reports if not deltas are found. I think the reason my alert is not triggering is because the results from my search are not showing as events, but as statistics. |inputlookup main.csv |lookup secondary.csv eventSource as eventSource output Name|where isNull(Name) "Trigger Number of Results" = greater than 0 the search returns results, but no alert is triggered.
... View more
- Tags:
- statistics
Labels
- Labels:
-
alert condition
04-24-2020
01:48 PM
Rich-- thank you so much -- I did not know about "relative_time" . That was so helpful, and what you provided was exactly what I needed. 🙂
... View more
04-23-2020
10:12 PM
two time fields per event:
_time (default eventfield for Splunk)
occurtime (timestamp within body of event)
I only want to show events where the field in the body of the event: "occurtime" is not more than two days older than "_time".
I have done the following to convert occurtime to epoch time:
eval occur=strptime(occurtime,"%Y-%m-%dT%H:%M:%S")
example current output:
_time: 2020-04-23 05:07:03.151
occurtime: 2020-02-24T17:42:38.572Z
occur: 1582594958.000000
I just need to figure out how the < funcitons with time.
Thank you!
... View more
09-23-2019
02:31 PM
Token 1:
<label>OS</label>
<choice value="Windows">Windows</choice>
<choice value="RedHat">RedHat</choice>
Token 2:
I want to set Token 2 to be based on whatever was selected for Token1.
For example:
If RedHat was selected for token1, make Token2: "OS01"
If Windows, was selected for token1, make Token2: "OS02"
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
01-25-2024
10:29 PM
|
