About sbarinov

sbarinov · ‎05-05-2021

@ITWhisperer Thank you!

sbarinov · ‎05-05-2021

Hi, I am trying to compare event type count statistics for 2 days using the following search: earliest=-48h latest=-24h | stats count as count1 by eventtype | table eventtype, count1 | join eventtype [search earliest=-24h latest=now() | stats count as count2 by eventtype | table eventtype, count2] | eval diff=(count2-count1) | table eventtype, diff | sort diff Is there any option to do this without using subsearch and join? Thanks.

sbarinov · ‎06-18-2020

As it was found, there was a kernel out of memory error. We are running Version:7.2.5 on 12GB RAM. I am wondering what we can do about that. I will try to limit the amount of records in alert searches since we have them running all the time.

sbarinov · ‎06-18-2020

We had our Splunk server stopping by itself two days in a row. I am trying to find the reason but I cannot find anything related in /opt/splunk/var/log/splunk. Could someone please advise where I should be looking for the related logs?

sbarinov · ‎06-04-2020

We categorize log events using event types and assign them to people to address the issues using tags. Our events are generally exception stacktraces (Java). Our event types are basically a search by two fields (source and message). What we do now is we look for events which don't match to any existing event type and create a new event type for them. What we would like to do is to automate the event type creation process. We have a volume of event types we have already created as a learning material. Is there any type of AI integration for this purpose in Splunk?

sbarinov · ‎08-13-2019

We are going to continuously create new event types when we discover new patterns of received log events. We are linking alerts with event types via tags so the set of tags will be rarely changed but new event types will keep coming so we want to be sure that we assign correct tags to them so we don't miss new hits of the same pattern.

sbarinov · ‎08-12-2019

Is there any way to make the event type form's field "tag" auto-complete tag names based on existing tags? Are there any plans for this feature in upcoming releases? It is very easy for one to make a mistake in tag name when using a single tag in multiple event types. It appears for me that it is a base requirement for setting a field with side-registry values, like multi-select fields in Jira.

sbarinov · ‎07-17-2018

Thanks, looks like this is what I need.

sbarinov · ‎07-16-2018

Hello all, Is it possible in Splunk to restrict user of accessing the "Knowledge" settings? I want to disable certain roles to create event types. Thank you.

sbarinov · ‎06-26-2018

Thank you. It would be nice to have an option to replace the generated 'Event type search' field but I guess there is no way to do that.

sbarinov · ‎06-26-2018

I realized that I can create a drilldown to /manager/search/saved/eventtypes/_new?ns=search&action=edit But I can't transfer any data from my search results to the form fields. This will be my last resort in case if there is no other options.

sbarinov · ‎06-26-2018

Hello all, I have a dashboard that contains a panel with 'Statistics Table' visualization of search results. I use that type of visualization to have a list of 10 single-line records per page. I don't like the 'Events' view due to its size, my events contain large fields so it would result in huge rows which is not very convenient for users to view. I also have a couple of panels with the selected event details. What I want is to have an option to create an event type based on some fields from my search results right in the dashboard or in a separate window opened from the dashboard. I know I can add a panel with the 'Events' view which will have a button with workflow actions under the event row but it will not look suitable there and besides, I think I don't have control over the displayed fields. If only I could have a button which would collect data from input components and create a new event type, or at least a drilldown action for any visual object which would result into opening an event type builder window, then it would be great. Does anyone have any suggestions on this? Thank you.

sbarinov · ‎06-22-2018

Thank you.

sbarinov · ‎06-20-2018

Hello, I have an input module that injects data as _json source type. In each event I have a field named "parameters" that contains a map (key-value entries) like this: "parameters": { "parameter-a": "1", "parameter-b": "2", ... } I don't know the map keys, they may correlate between events but are not consistent. Splunk automatically extracts them as "parameters.parameter-a" and "parameters.parameter-b" fields and this is not what I want. It would rather have a multi-value field named "parameters" with each line containing both key and value like: parameter-a=1 parameter-b=2 When I use: | spath output=parameters path=parameters I get a field that contains a raw JSON value of the "parameters" field (with brackets, quotes and commas). When I use: | spath output=parameters path=parameters{} I get empty field values. Is there a way to do what I want? Thank you.

sbarinov · ‎06-06-2018

Thanks to all for the responses. I've used the following search | rest /services/saved/eventtypes | table title | rename title as eventtype | join type=left eventtype [search index="myindex" | stats count by eventtype] | eval count = if(isnull(count), 0, count) | sort -count and got a list of all event types paired with an amount of corresponding events.

sbarinov · ‎06-05-2018

Hello, Is there a way in Splunk to get a list of event types which don't match any events in the defined period of time? I only know how to do the opposite thing. I need this to clean up irrelevant event types. Thank you.

Posts	16
Solutions	1
Karma Given	8
Karma Received	1
Member Since	‎05-23-2018

Online Status	Offline
Date Last Visited	‎05-05-2021 11:57 AM

Join two statistics tables without subsearch

Splunk server crush

Event type creation and AI

Event Type form tag name completion

How to restrict access to knowledge objects for us...

Dashboard form to create a new event type

How to display JSON map as a single multi-value fi...

How to list missing event types that don't match a...

Re: Join two statistics tables without subsearch

Join two statistics tables without subsearch

Re: Splunk server crush

Splunk server crush

Event type creation and AI

Re: Event Type form tag name completion

Event Type form tag name completion

Re: How to restrict access to knowledge objects fo...

How to restrict access to knowledge objects for us...

Re: Dashboard form to create a new event type

Re: Dashboard form to create a new event type

Dashboard form to create a new event type

Re: How to display JSON map as a single multi-valu...

How to display JSON map as a single multi-value fi...

Re: How to list missing event types that don't mat...

How to list missing event types that don't match a...