Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Are you a member of the Splunk Community?
Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- Find Answers
- :
- About a212830
a212830
Champion
Member since:
07-29-2011
06-05-2020
Community Statistics
| Posts | 1285 |
| Solutions | 16 |
| Karma Given | 151 |
| Karma Received | 256 |
| Member Since | 07-29-2011 |
Activity Feed
- Got Karma for What is tstats and why is so much faster than stats?. 3 weeks ago
- Got Karma for list all fields within a sourcetype. 12-18-2024 07:23 AM
- Got Karma for For large lookups, should I use the kv store?. 06-01-2024 05:16 AM
- Got Karma for How to remove an indexer from the distributed management console?. 06-15-2023 02:55 PM
- Got Karma for Re: Two serverclass.conf files - now what?. 06-02-2023 07:45 AM
- Got Karma for Two serverclass.conf files - now what?. 06-02-2023 07:44 AM
- Got Karma for How to use the REST API to just run a search and stream the results back?. 10-12-2022 06:38 AM
- Got Karma for How often/quickly does a Splunk universal forwarder read a file?. 05-06-2022 11:39 PM
- Got Karma for Why are we getting message "waiting for queued job to start..." and search job takes 5 minutes to run?. 01-11-2022 01:11 AM
- Got Karma for What is tstats and why is so much faster than stats?. 10-20-2021 12:41 PM
- Got Karma for What is tstats and why is so much faster than stats?. 10-11-2021 06:44 AM
- Got Karma for Why are results from two searches for license data different?. 06-26-2020 08:03 AM
- Got Karma for How to remove headers from a custom app log file?. 06-11-2020 06:01 PM
- Karma Re: Questions about Splunk_TA_windows for kmorris_splunk. 06-05-2020 12:50 AM
- Karma Re: Can you help us with understand how Splunk manages bundles? for DavidHourani. 06-05-2020 12:50 AM
- Karma Re: Can you help me with my license report? for muralikoppula. 06-05-2020 12:50 AM
- Karma Re: How to pass in a variable to dbxquery for niketn. 06-05-2020 12:50 AM
- Karma Re: Can you help me with my field extraction weirdness? for woodcock. 06-05-2020 12:50 AM
- Karma Re: Can Splunk charts display a logrythmic Axis? for skoelpin. 06-05-2020 12:50 AM
- Karma Re: Help with eval and wildcards for gcusello. 06-05-2020 12:50 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
05-02-2012
02:33 PM
Did that - doesn't work.
LOOKUP-hostdb = hostdb_lookup srcIP OUTPUTNEW deviceName
... View more
05-02-2012
01:43 PM
Hi,
I configured a lookup that works fine, if I explicitly use the lookup statement in my search, but I want the field to auto-populate, based upon the sourcetype. Is there a way to do this?
... View more
05-02-2012
01:41 PM
1 Karma
Ditto. Searches should be multi-threaded...
... View more
05-02-2012
07:19 AM
One last question? I'm looking at the doc, but it doesn't specify if the lookup should exist on the forwarder, or the indexer - any idea? I'm assuming indexer...
... View more
05-02-2012
06:51 AM
Thanks. In theory, that would work. I guess my next question is how would I "call" that static lookup?
... View more
05-02-2012
06:42 AM
Hi,
I want to create a lookup table that will load my /etc/hosts data, so that I can associate snmp traps with actual hostnames. From what I've read, the best way(?) to do this is to call an external script, but my concern is that this script will be firing quite often, as the feed coming into splunk is quite active. Is there an alternative way of doing this? The /etc/hosts file will update at least daily, and sometimes more, so I also need a way of updating the lookup table. The size is about 3000 rows of data.
Any advise is appreciated...
... View more
04-27-2012
12:27 PM
Awesome. Thanks. Just took the second reporting class and things are slowly clicking...
... View more
04-27-2012
12:15 PM
lost me on that - what is it doing?
My search is:
source="/var/opt/trapx/log/traps-all.log" | fields eventtype, host |chart count by eventtype, host |addcoltotals | addtotals fieldname=Totals
Which works fine, but ignores "non-eventtypes". I want to include totals for these in my chart.
... View more
04-27-2012
11:27 AM
Hi,
I am doing a search to report on some eventtypes. The eventtypes report fine, but I also want to put anything that isn't categorized as an eventtype into "other" in the table. Is there a way to do this? s
... View more
- Tags:
- eventtypes
- report
04-27-2012
08:12 AM
Hi,
I'm having issues with extracting a field from multi-line events. Two samples are below. I want to grab the value of "Enterprise:". In most events, the Enterprise line is followed by "Object:", but in other events, it is the last line of the event. I am unable to extract the field properly in both scenarios. I tried the IFX, which tested ok, but when I actually ran a search against it, didn't work - it grabs everything after Enterprise, including all the "Object" stuff.
Any ideas? Also, keep in mind that the length of Enterprise will vary.
Trap Type: Authentication Failure
Specific Type: 0
Enterprise: 1.3.6.1.4.1.564.101.1
Trap Type: Vendor Specific
Specific Type: 1085
Enterprise: 1.3.6.1.4.1.3167.1.2.8
Object:1.3.6.1.4.1.3167.1.1.1 Value:3
... View more
04-26-2012
01:25 PM
OK. Did that, and it returns other eventtypes as well, which I didn't create (possibly system eventtypes?). It also returns "nix-all-logs" eventtypes.
... View more
04-26-2012
01:10 PM
Hi,
I want to query on eventtype, and my query is returning items that I don't want. My search is:
source="/var/opt/trapx/log/traps-all.log" tag::eventtype="SNMP" | fields eventtype, host |chart count by eventtype, host
The search is returning eventypes that aren't tagged with SNMP. I also tried running it with a match on eventtype directly (eventtype="*_Trap"), and it did the same thing. Any suggestions?
... View more
- Tags:
- eventtypes
- search
- snmp
04-25-2012
11:46 AM
I tried doing this, and it worked for the Summary view, but once I picked on a specific source or sourcetype, it went back to "All Time". Is there a way to change the default so that when I go from Summary to an individual source/sourctype, it won't be "All Time"?
... View more
- Tags:
- search
- search-help
04-25-2012
07:24 AM
Hi,
I recently added a udp input, and the data looks correct, but the hostname is appearing as an ip address. I tried configuring the input to use dns, but nothing changed. How would I handle this?
... View more
- Tags:
- hostname
02-09-2012
04:32 PM
Not sure what a pastebin is, but I did a copy/paste of some of the log data.
Trap: 24910058
Thu Feb 9 02:01:11 2012
Src IP: 12.3.4.5
Agent IP: 1.2.3.4
Trap Type: Vendor Specific
Specific Type: 1
Enterprise: 1.3.6.1.4.1.9.9.43.2
Object:1.3.6.1.4.1.9.9.43.1.1.6.1.3.3997 Value:1
Object:1.3.6.1.4.1.9.9.43.1.1.6.1.4.3997 Value:4
Object:1.3.6.1.4.1.9.9.43.1.1.6.1.5.3997 Value:6
Trap: 24910059
Thu Feb 9 02:01:11 2012
Src IP: 1.2.3.4
Agent IP: 1.2.3.4
Trap Type: Vendor Specific
Specific Type: 1
Enterprise: 1.3.6.1.4.1.9.9.41.2
Object:1.3.6.1.4.1.9.9.41.1.2.3.1.2.0 Value:PAGP
Object:1.3.6.1.4.1.9.9.41.1.2.3.1.3.0 Value:6
Object:1.3.6.1.4.1.9.9.41.1.2.3.1.4.0 Value:PAGP
Object:1.3.6.1.4.1.9.9.41.1.2.3.1.5.0 Value:2012 Feb 09 02:01:11 eastern -05:00 %PAGP-5-PORTTOSTP:Port 2/17 joined bridge port 2/17
Object:1.3.6.1.4.1.9.9.41.1.2.3.1.6.0 Value:279122402
Trap: 24910060
Thu Feb 9 02:01:12 2012
Src IP: 1.2.3.4
Agent IP: 1.2.3.4
Trap Type: Vendor Specific
Specific Type: 1
Enterprise: 1.3.6.1.4.1.9.9.41.2
Object:1.3.6.1.4.1.9.9.41.1.2.3.1.2.61328708 Value:PIM
Object:1.3.6.1.4.1.9.9.41.1.2.3.1.3.61328708 Value:5
Object:1.3.6.1.4.1.9.9.41.1.2.3.1.4.61328708 Value:INVALID_SRC_REG
Object:1.3.6.1.4.1.9.9.41.1.2.3.1.5.61328708 Value:Received Register from 1.2.3.4 for (1.2.3.4, 2.3.4.5), not willing to be RP
Object:1.3.6.1.4.1.9.9.41.1.2.3.1.6.61328708 Value:468d 06:45:54
... View more
02-09-2012
02:22 PM
I tried the latest change and I'm still getting the same thing (bounced the app). I keep trying to upload the image, but it doesn't get added. Here's the text from the "pull-out" window for the trapType field. It's taking the information after the Trap Type: value, but it should stop at the end of that line, and it's not.
Authenticatio....6.1.4.1.3224 4,629 9.719%
Authenticatio....4.1.2021.251 1,440 3.023%
Authenticatio...e:10.47.89.25 1,060 2.226%
Authentication...e:10.93.65.11 788 1.654%
Authentication...4.1.564.101.1 500 1.05%
Authentication...10.165.27.145 480 1.008%
Authentication...e:10.47.89.25 444 0.932%
Authenticatio...1.8072.3.2.255 392 0.823%
Vendor Specif...1.4.1.3375.2.4 382 0.802%
Vendor Specif...1.4.1.3375.2.4
... View more
02-09-2012
10:28 AM
Yes, it's a multiline event. I've attached a screenshot of what happens.
... View more
02-09-2012
08:00 AM
Hi,
I'm trying to extract a field from a source, and when I test it, it appears to work, but in practice, it's grabbing too much.
Two examples are below. I want to create a "trapType" field, and report on it. It should contain "Vendor Specific" or "Authentication Failure". When I test it, everything looks ok, but then when I run a search, it's including everything after the values.
The field extract is: (?i) Type: (?P .+)
10:43:20.000 AM
10:43:20.000 AM
Trap: 25311425
Thu Feb 9 10:43:20 2012
Src IP: 6.7.8.9
Agent IP: 6.7.8.9
Trap Type: Authentication Failure
Specific Type: 0
Enterprise: 1.3.6.1.6.3.1.1.5
Object:1.3.6.1.4.1.9.2.1.5.0 Value:6.7.8.9
Trap: 25311426
Thu Feb 9 10:43:20 2012
Src IP: 1.2.3.4
Agent IP: 1.2.3.4
Trap Type: Vendor Specific
Specific Type: 1
Enterprise: 1.3.6.1.4.1.9.9.41.2
Object:1.3.6.1.4.1.9.9.41.1.2.3.1.2.3175321 Value:PIM
Object:1.3.6.1.4.1.9.9.41.1.2.3.1.3.3175321 Value:5
Object:1.3.6.1.4.1.9.9.41.1.2.3.1.4.3175321 Value:INVALID_SRC_REG
Object:1.3.6.1.4.1.9.9.41.1.2.3.1.5.3175321 Value:Received Register from 1.2.3.4 for (1.2.3.4, 1.2.3.4), not willing to be RP
Object:1.3.6.1.4.1.9.9.41.1.2.3.1.6.3175321 Value:264d 04:40:27
... View more
- Tags:
- regex
02-08-2012
08:18 PM
I'm using the universal forwarder. So, the props.conf needs to go on the index server?
... View more
02-08-2012
08:12 PM
Yeah, restarted the forwarder, and the results are below.
Wed Feb 8 23:10:18 2012
Src IP: 1.2.3.4
Agent IP: 1.2.3.4
Trap Type: Authentication Failure
Specific Type: 0
Enterprise: 1.3.6.1.6.3.1.1.5
Object:1.3.6.1.4.1.9.2.1.5.0 Value:1.2.3.4
Trap: 24780942
... View more
02-08-2012
05:35 PM
Thanks. That almost works. It's putting the "Trap:" from the next event at the bottom of the previous event. The "Trap:" is the start of the event, and I want to include it. Any way to do that?
... View more
- « Previous
- Next »
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:03 AM
|
Karma given to
