About Gabriel_CCI

Gabriel_CCI · ‎11-24-2023

Hi, Isn´t possible with join of chart?

Gabriel_CCI · ‎11-24-2023

Hi. Colleagues. Somebody help me? I have this query by current day (figure 1) index=xxxx sourcetype=xxx earliest=-d@d latest=now |table control indicador cumplimiento| sort control |chart values(cumplimiento) over control by indicador the fields are: Empleo, Huérfanas, Uso, Control _time and Month My problem is, I need also show data as showing in figure 2 (by month), but I don´t find the way to show as the figure (with month on top) Somebody were a similar problem?

Gabriel_CCI · ‎09-06-2022

This is part of the query <panel id="cantidad"> <single> <title>Cantidad Alertas Gatilladas Durante el día</title> <search> <query>index=_audit earliest=@d|search ss_name="DKT - Alerta de brecha critica - Gran cantidad de brechas Usuario" OR ss_name="DKT - Alerta de brecha critica - SSH hacia destino externo extraño" OR ss_name="Endpoint - Servidores Windows Vulnerables a EternalBlue (OpenVas) - Rule" OR ss_name="Endpoint - Servidores Windows Vulnerables a EternalBlue (Tenable) - Rule" OR ss_name="Endpoint - Tareas programadas mal configuradas - Rule" |table _time ss_name</query> <earliest>@d</earliest> <latest>now</latest> </search> <option name="colorMode">block</option> <option name="drilldown">none</option> <option name="rangeColors">["0x53a051","0xf8be34","0xdc4e41"]</option> <option name="rangeValues">[10,19]</option> <option name="refresh.display">progressbar</option> <option name="useColors">1</option> </single>

Gabriel_CCI · ‎09-06-2022

Hi community! I have a dashboard that shows the alerts on table and in the graph, the questions is How I can link each fired alert to respective saved search? I paste one image

Gabriel_CCI · ‎08-16-2022

Hi. I need upgrade my Splunk Cluster, my current versión is 7.3.2 and I need upgrade to 8.0.10, but we have Enterprise Security App version 6.0.0 installed, in the Compatibility Matrix it says ES 6.0. 0 is compatible with Splunk Enterprise 8.0.10, but the installs of 8.0.10 aren't on the website, the same matrix says that ES 6.2.0 is compatible with Splunk version 8.1.0, my questions are. could be ES 6.0.0 compatible with Splunk Enterprise 8.1.0? And, where I can obtained the 8.0.10 version of Splunk? thank so much!

Gabriel_CCI · ‎04-29-2022

How I can count the number of open files per minute by query in Splunk? thanks

Gabriel_CCI · ‎04-12-2022

Yes, the parameter 999999 was set for the splunk user, but it still crashes and another symptom that I have detected is that when many files are opened in the SH port 8089 is queued.

Gabriel_CCI · ‎04-11-2022

Dear All. I have a problem with the number of files opened by Linux, I have set the ulimit parameter to 999999 but I still have Splunk service crashes due to file descriptors, this happens in the Search heads, is there a way to tell Splunk not to open more files ?, I have tried with [inputproc] max_fd = 120000 but it keeps opening many more files The Linux version is Oracle Linux Server release 7.8

Gabriel_CCI · ‎07-28-2021

Hi. I have a problem with strptime I try converter a date with datee1=strptime('datee', "%d-%b-%y") but with some dates don´t work example datee datee1 31-ago-16 13-feb-19 1550026800.000000 When I overwrite 31-ago-16 with 13-fe-19 it works! I don´t understand My source is a Lookup file

Posts	9
Solutions	0
Karma Given	1
Karma Received	0
Member Since	‎07-28-2021

Online Status	Offline
Date Last Visited	‎11-28-2023 07:50 AM

Format to show data

How to link each fired alert to respective saved s...

Can I Upgrade Splunk Enterprise 8.1.0 with ES 6.0....

When Linux opens files, splunk crashes due to file...

Problem converting some dates to epoch

Re: Format to show data