-
1 month, 2 weeks ago
Azeemering wrote a new post, DNS search for encoded data
Description:
Use this Splunk search to find Base64 encoded content in DNS queries. The goal is to examine the DNS query field of the dns events to find subdomain streams that contain only Base64 valid […] -
2 months, 3 weeks ago
Azeemering wrote a new post, Show cron frequency and scheduling of all scheduled searches
This search shows you all scheduled searches and their respective cron frequency and cron schedule. This also helps finding frequently running saved searches.
| rest splunk_server=local […] -
2 months, 4 weeks ago
Azeemering wrote a new post, Data model Acceleration Details
This Splunk Search shows you a lot of good information about your data model acceleration and performance.
| rest /services/admin/summarization by_tstats=t splunk_server=local count=0 | eval […] -
6 months, 3 weeks ago
Azeemering wrote a new post, Remove mulitple values from a multivalue field
This Splunk search is an example on how to remove unwanted values from multivalue fields using mvfilter.
| gentimes start=-1 | eval field1=”pink,fluffy,unicorns” | table field1 | makemv field1 delim=”,” | eval […] -
6 months, 3 weeks ago
Azeemering wrote a new post, List all your existing indexes or check if index exists
With this spl you can check what indexes exist or if you want to search for a specific index.
List all indexes:
|rest /services/data/indexes | fields title | rename title AS index
Or check if a specific index […]
-
1 year, 7 months ago
Azeemering wrote a new post, Datamodel Search Performance
See how well your DM searches are running.
Run this search using the Line Chart visualization:
index=_internal sourcetype=scheduler component=SavedSplunker ACCELERATE NOT skipped run_time=*
| rex […] -
1 year, 9 months ago
Azeemering wrote a new post, Breathing Fire Dragon when Starting dbx_task_server
index=_internal sourcetype=dbx_server Starting dbx_task_server
Will return events that display a little dragon ascii art:|___/|
(, /,)
/ /
(@_^_@)/ […] -
2 years, 3 months ago
Azeemering wrote a new post, Show your triggered alerts
This search shows all the alerts that where triggered in your splunk environment:
index=_audit action=alert_fired ss_app=* | eval ttl=expiration-now() | search ttl>0 | convert ctime(trigger_time) | table […]-
This only measures triggered alerts though, no? If you do not have an action set to trigger a “Triggered Alert”, this won’t give back correct stats.
-
I re-read the title and got the right context for it now. Ty.
-
-
-
2 years, 4 months ago
Azeemering wrote a new post, Evaluate Fahrenheit to Celsius
Quick snippet to evaluate temperature Fahrentheit to Celsius:
| eval Temperature_Fahrenheit=Temperature_Celsius*1.8+32 -
2 years, 6 months ago
Azeemering wrote a new post, Find unused dashboards
Use this search to find unused dashboards:
| rest /servicesNS/-/-/data/ui/views splunk_server=*
| search isDashboard=1
| rename eai:acl.app as app
| fields title app
| join type=left title
[| search […] -
2 years, 7 months ago
Azeemering wrote a new post, Check your strftime is correct in the props.conf
A simple method on checking if your strftime (TIME_FORMAT=) in the props.conf matches your log file timestamp format.
strftime(X,Y)
This function takes a UNIX time value, X, as the first argument and renders the […] -
3 years, 2 months ago
Azeemering wrote a new post, Saved Search Scheduler Activity
I use this query a lot to tune and adjust scheduling, find out what searches need attention:
index=_internal sourcetype=scheduler result_count | extract pairdelim=”,”, kvdelim=”=”, auto=f | stats avg(result_count) […] -
3 years, 2 months ago
Azeemering wrote a new post, Show indexing queue sizes
Use a linechart with this search to show you the indexing queue sizes:
index=_internal source=*metrics.log group=queue (name=parsingqueue OR name=indexqueue OR name=typingqueue OR name=aggqueue) | timechart […]
-
3 years, 2 months ago
Azeemering wrote a new post, Percentage of skipped searches
This query will give you a table with a percentage of skipped searches and an evaluation with 3 ranges
index=_internal sourcetype=scheduler | stats count as total, count(eval(status=”skipped”)) as skipped | eval […] -
3 years, 2 months ago
Azeemering wrote a new post, Retention Period in days per index
This query will give you a table of all indexes and their respective retention period in days:
| rest splunk_server=* /services/data/indexes | join type=outer title [
| rest splunk_server=* […] -
3 years, 2 months ago
Azeemering wrote a new post, Bucket Count by indexer/index
This search displays the amount of buckets per indexer/index
To learn more about the | dbinspect command go to:
|dbinspect index=* | search index!=_* | chart dc(bucketId) over splunk_server by index
-
3 years, 2 months ago
Azeemering wrote a new post, Bucket Count by State over Index
This search counts the amount of buckets per state for each index.
To learn more about | dbinspect go to:
|dbinspect index=* | eval state=case(state==”warm” OR state==”hot”,”hot/warm”,1=1, state) | chart […]
-
3 years, 2 months ago
Azeemering wrote a new post, Memory Usage (MB) per Splunk Process Class
Use the following search with a column chart visualisation. It will give you a good overview of what Splunk processes use the most memory:
index=_introspection sourcetype=splunk_resource_usage […]-
I modified this to fit my environment by specifying a host specifically (where you have host=*).
Thanks for sharing, I’ve added it to an internal admin dashboard!
-
-
3 years, 2 months ago
Azeemering wrote a new post, Universal Forwarder Throughput Limit Hit Count
This search counts the amount of times the UF’s throughput limit is hit. I also threw in a sparkline:
index=_internal sourcetype=splunkd “current data throughput” | rex “Current data throughput ((?S+)” | eval […] -
3 years, 2 months ago
Azeemering wrote a new post, Top 10 Accessed Dashboards
Where “host=”your_sh_host”” you could specify a host, or put a wildcard * in place.
index=”_internal” source=*access.log user!=”-” */app/* (host=”your_sh_host”)
| rex field=referer […] - Load More
There’s a really GREAT app called “Proper Alerts” on splunkbase that does this and more. Helped me to balance out all of the alerts/reports running on my search heads so that I could spread out the scheduling. Plus it looks at how well formed the alerts/reports are too.