Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About majilan1
majilan1
Path Finder
Member since:
06-08-2022
yesterday
Community Statistics
| Posts | 49 |
| Solutions | 0 |
| Karma Given | 7 |
| Karma Received | 0 |
| Member Since | 06-08-2022 |
Activity Feed
- Posted Re: SIEM Dashboard on Alerting. yesterday
- Posted SIEM Dashboard on Alerting. Wednesday
- Posted How to troubleshoot splunk data feed has been detected down: on Alerting. Wednesday
- Posted Why was the false alert triggered? on Alerting. 11-09-2022 08:53 AM
- Karma Re: Remove user email for richgalloway. 10-18-2022 02:53 PM
- Posted Re: Remove user email on Getting Data In. 10-18-2022 09:14 AM
- Posted Re: Remove user email on Getting Data In. 10-18-2022 08:51 AM
- Posted How do I remove user email? on Getting Data In. 10-18-2022 08:22 AM
- Posted Re: Additional alerts for Oracle for file system Approching Maximum Capacity? on Alerting. 10-14-2022 05:45 AM
- Posted Additional alerts for Oracle for file system Approching Maximum Capacity? on Alerting. 10-13-2022 01:59 PM
- Posted How to create a Splunk alert for when storage on host reaches 75%? on Alerting. 09-08-2022 06:40 AM
- Karma Re: How do I trigger alert if there are extracts where TOTAL_PIECES >0 and RETRIEVAL_ATTEMPT= 10? for gcusello. 08-20-2022 08:19 AM
- Posted Blackouts alert error- How can I fix? on Splunk Cloud Platform. 08-20-2022 08:12 AM
- Karma Re: Modifying CSV for bowesmana. 08-18-2022 05:32 AM
- Posted Re: Modifying CSV on Splunk Search. 08-17-2022 06:35 PM
- Posted Re: Modifying CSV on Splunk Search. 08-17-2022 05:42 PM
- Posted Is it possible to modify a portion of CSV file in inputlookup? on Splunk Search. 08-17-2022 02:37 PM
- Posted How to add a column to an alert? on Alerting. 08-02-2022 05:34 PM
- Posted Re: How do I trigger alert if there are extracts where TOTAL_PIECES >0 and RETRIEVAL_ATTEMPT= 10? on Splunk Search. 08-02-2022 06:56 AM
- Posted Re: How do I trigger alert if there are extracts where TOTAL_PIECES >0 and RETRIEVAL_ATTEMPT= 10? on Splunk Search. 08-02-2022 06:48 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
yesterday
gcusello, what I meant to do is using: index=xta then I want to pull fma_id, Org_unify, description, AH tag and the ISO name. Using fma_id that is pulled from xta example index=*OS-001* and report all index that have that fma_id as part of the string then run a count on all hosts/systems that have the UF installed and register to that fma_id by type (windows vs Linux) then I have to check the available data sets to look for the host in by checking the hosts under fma ID exist in AD, Defender, Big Fix, and Tenable and when they were last detected. Thanks a lot for your help on this matter.
... View more
Wednesday
Hi All, I'm working hard to create a SIEM dashboard that has the AH list: higher priority :1)ab 2)CD 3)if 4)GH rest of the AH: 5)IJ 6)kl 7)MN for each of these systems, I need a list of hosts associated with the AH and what is currently being ingested from the AH.
... View more
Labels
- Labels:
-
email
Wednesday
I'm working on splunk data feed outage alert: The following data feed has been detected down: Index=a sourcetype=splunkd host=b. Is there someone can point me to the right direction of troubleshooting this issue. Thanks a lot.
... View more
Labels
- Labels:
-
alert action
11-09-2022
08:53 AM
Hi Folks,
I can't see what would have caused the false alert to triggered: when I checked this directory I can see plenty of space :
Size: 500g Used: 9.6g Avail: 491g use%: 2%
the query looks like this:
index=a sourcetype=b MountedON="d" PercentUsedSpace > 90
| stats latest(PercentUsedSpace) as PercentUsedSpace latest(Avail) as Avail latest(Used) as Used latest(UsePct) as UsePct by MountedON
| fields MountedON UsePct Used Avail
| rename MountedON as "Mount" UsePct as "Percent Used" Used as "Used Space" Avail as "Available Space"
... View more
Labels
- Labels:
-
alert action
10-18-2022
09:14 AM
I'm getting Error in the 'SearchOperator':Missing required REST url. | rest splunk_server=local /servicesNS/-/-/saved/searches
| search alert_type!="always"
| where action.email.to="A@gmail.com"
... View more
10-18-2022
08:51 AM
What privilege required to perform this action? Is user able to do so or need an admin role? Thanks!
... View more
10-18-2022
08:22 AM
Hi Guys,
Is there anybody here knows how to remove user email from any Splunk alert and add new user email in his place!
I used this search to find any Splunk alerts related to the person I want to remove, but I'm getting 0 events.
| `a_searches`
| fields report_name email_recipients cc_email_recipients
| search email_recipients="* A@gmail.com*"
Any help will be appreciated!
... View more
Labels
- Labels:
-
other
10-14-2022
05:45 AM
My query does run, but it generates 0 events, I tried yours and is the samething.
... View more
10-13-2022
01:59 PM
Hi Everyone,
I run into an issue today in SIT where TIV0 was inaccessible because a similar directory was full.
I'm trying to set one alert for DEV and one for SIT and the folder path for each environment is :
DEV:/mms/ora1200/u00/oracle.
SIT:/mms/ora1201/u00/oracle.
this is what i have so far :
index=A "/mms/ora1200/u00/oracle" source= B
| stats latest(storage_used*) as storage_used* latest(storage_free*) as storage_free* by host mount
| where storage_used_percent>90
| eval storage_used=if(storage_used>1000,(storage_used/1000). " GB" ,storage_used+" MB"), storage_free=if(storage_free>1000, (storage_free/1000, (storage_free/1000). " GB", storage_free+" MB")
Any feedback will be appreciated.
... View more
Labels
- Labels:
-
alert action
09-08-2022
06:40 AM
I need to create a Splunk alert that will trigger when storage on /vi/vip_pdh/00d for a host reaches at least 90% capacity.
index=A sourcetype=B /vi/vip_pdh OR /var/log earliest=-2h
| eval UsePct=rtrim(UsePct,"%")
| stats latest(UsePct) as UsePct by MountedOn host.
Just a Slight correction, I want to monitor both /vi/vip_pdh and /var/log.
Thanks!
... View more
Labels
- Labels:
-
alert action
08-20-2022
08:12 AM
Hi Folks,
I'm looking into a blackouts alert that weren't working properly, and the alerts fire for jobs that should be blacked out(ERROR: While inserting Into spm_Delta at line 590 /ERROR DESCRIPTION: ORA-0001 deadlock detected while waiting for resources).
Is there anybody can help point me where I should start to fix this problem please.
Thanks!
... View more
Labels
- Labels:
-
Analytics Workspace
08-17-2022
06:35 PM
I get error in 'EvalCommand': the expression is malformed. Expected).
... View more
08-17-2022
02:37 PM
Hi Every one,
Is it possible to modify a portion of CSV file in inputlookup?
Cheers.
... View more
Labels
- Labels:
-
lookup
08-02-2022
05:34 PM
Hi Guys, my question is Can priority (the regular P1/P2/P3 column) and job alias from the pw_map lookup be added to this alert as additional columns? I’ve recently started seeing some ingest issues with a few queues, and these columns would help with escalation and determining downstream impacts.
... View more
Labels
- Labels:
-
alert action
08-02-2022
06:56 AM
Thanks, you guys have been a great helping solve these problems.
... View more
08-02-2022
06:48 AM
Thanks! It works, I forgot to add the second part of the condition: TOTAL_PIECES > 0.
... View more
08-02-2022
05:09 AM
Alert should trigger if: There are any extracts where TOTAL_PIECES is >0 and the RETRIEVAL_ATTEMPT is = 10. I added AND TOTAL_PIECES > 0, but I'm not getting no result. The thing is when I move that TOTAL_PIECES is >0 I get some data, but I need to trigger based on the condition above. Thanks
... View more
08-01-2022
01:03 PM
Hi,
I want the alert to trigger if there are extracts where TOTAL_PIECES >0 and RETRIEVAL_ATTEMPT= 10
Is there anybody can help with this please?
My search is,
index=A source=B sourcetype=c
| fillnull value=0 TOTAL_PIECES RETRIEVAL_ATTEMPT
| where RETRIEVAL_ATTEMPT= 10
| rename "SASP_CTRL_SEQ_NBR" as "Extract_Seq_ID" ,"IV_STS" as "IV_Status", "RETRIEVAL_ATTEMPT" as "Retrieval_Attempt","PSTG_STMT_N" as "Pos_St","TOTAL_PIECES" as "Piece_Count"
| table "Extract_Seq_ID","IV_Status","Retrieval_Attempt","Pos_St","Piece_Count"
... View more
Labels
- Labels:
-
stats
07-20-2022
07:28 AM
Thanks gcusello, What I want to do first is to filter based on : If there are any extracts where TOTAL_PIECES is >0 and RETRIVAL_ATTEMPT is = 99, I know that I have to add | fillnull for this field, but not working for me. Any advice please!
... View more
07-19-2022
12:38 PM
07-14-2022
08:26 AM
The subsearch actually finds the IP addresses that I'm looking for and everything looks great until the last line where I have : | fields host_name count earliest_error latest_error at this point the IP address changed to host_name with no output on the host_name field. Thanks
... View more
07-14-2022
07:48 AM
Thanks again for your quick response, please take a look at this: index=X sourcetype=Y "Failed handshake due to exhausted 10 seconds timeout on channel" earliest=06/16/2022:00:00:00 | rex field=_raw "(R:\/)(?<ip>[\d.]*)(:8609)" | stats earliest(_time) as earliest_error latest(_time) as latest_error count by ip | join type=left ip [| search earliest=-24h index=A sourcetype=B dv_u_eir=4311.00 | stats latest(dv_name) as host by dv_ip_address | rename dv_ip_address as ip] | eval earliest_error=strftime(earliest_error,"%m/%d/%Y %H:%M:%S"), latest_error=strftime(latest_error,"%m/%d/%Y %H:%M:%S") | fields host count earliest_error latest_error
... View more
07-14-2022
06:42 AM
Thanks ITWhisperer, Just as an update, the field that I need to join on need to have the same exact name. Thanks
... View more
07-13-2022
09:49 AM
The host name will not be available in the web logs, that's why I join to a different search using the ip_address to get the host name, even doing all of that still no luck!
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
yesterday
|
