-
7 years agomasdeeper wrote a new post
|tstats count WHERE index=* OR index=_ BY index
Don’t forget time modifier is required
-
7 years ago
masdeeper wrote a new post
index=_internal sourcetype=scheduler savedsearch_name=* status=skipped | stats count by savedsearch_name reason
Look at the reason to know how to TB.
-
7 years ago
masdeeper wrote a new post
There is a bug that make a search being executed 2 times or more.
index=_internal sourcetype=scheduler scheduled_time=* savedsearch_name=* |stats count by scheduled_time, savedsearch_name | where count > 1 -
7 years ago
masdeeper wrote a new post
Sorry but a query would not be elegant.
TIME_FORMAT=%Y-%m-%dT%H:%M:%S.%3N%Z
TZ_ALIAS = A=GMT+1:00, B=GMT+2:00, C=GMT+3:00, D=GMT+4:00, E=GMT+5:00, F=GMT+6:00, G=GMT+7:00, H=GMT+8:00, I=GMT+9:00, K=GMT+10:00, […]
-
7 years ago
masdeeper wrote a new post
Impact: since there is no timezone, the logs will have the same timezone as the local user. Therefore in another timezone, the logs won’t have the same order. If no TZ is specified, perhaps we could hard code […]
-
7 years ago
masdeeper wrote a new post
Given an IP network address and it’s netmask represented under integer format, the bellow search will create a CIDR representation from the lookup without using built-in tools.
|inputlookup geoip | head […] -
7 years ago
masdeeper changed their profile picture
-
7 years ago
masdeeper commented on the post, RFQ (Request For Query) – Port Scan
In reply to: rashid47010 wrote a new post I am looking for the query[timechartl] for example 50 port scan attempts with in a second against list of organization public facing IP address. ViewProvide log example.
-
7 years ago
masdeeper commented on the post, List of Indexes
In reply to: ItsJohnLocke wrote a new post This simple Splunk query will return results for indexes that the current user (typically you) have access to: *NOTE* depending on settings this may or may not return internal […] ViewThis is resource consumming. REST or tstats would be a better choice.
-
7 years ago
masdeeper became a registered member
-
7 years ago
masdeeper became a registered member
