-
6 months, 1 week agoSplunkNinja wrote a new post, Fishies! Fun Query and Easter Egg
Here is a fun query that you may have seen as an Easter egg in an app. I stumbled on this while cleaning up old saved searches. If you know the app comment below!
FYI make sure you run this in real time […]
-
6 months, 1 week ago
SplunkNinja commented on the post, License Usage by Sourcetypes
In reply to: SplunkNinja wrote a new post, License Usage by Sourcetypes The following Splunk query will return results for license usage by sourcetype: index=_internal source=”*license_usage.lo*” type=Usage | stats sum(b) as […] Viewindex=_internal source=”*license_usage.lo*” type=Usage
| stats sum(b) as bytes by st
| eval Megabytes=bytes/1048576
| eval Megabytes=round(Megabytes,2)
| rename st as sourcetype
| fields – bytes
| sort – Megabytes
| eventstats sum(Megabytes) as totalMB
| eval percent=100*(Megabytes/totalMB) -
1 year, 4 months ago
SplunkNinja wrote a new post, List All Hosts Associated with All Indexes
Using the Splunk Tstats command you can quickly list all hosts associated with all indexes:
|tstats values(host) where index=* group by index -
1 year, 4 months ago
SplunkNinja wrote a new post, Track Remediation Progress by OS – Qualys
The following Splunk Search Queries within the Qualys Sourcetype track the remediation progress for a variety of operating systems. The queries are separated by Operating System or Device Type:
OS & Device […]
-
1 year, 4 months ago
SplunkNinja wrote a new post, Top 25 Most Vulnerable Systems by OS – Qualys
The following Splunk Search Queries within the Qualys Sourcetype list the top 25 most vulnerable systems. The queries are separated by Operating System or Device Type:
Linux
eventtype=qualys_vm_detection_event […] -
1 year, 4 months ago
SplunkNinja wrote a new post, Top 25 Most Prevailing Vulnerabilities with Patches Available (Multiple OSs)- Qualys
The following Splunk Search Queries within the Qualys Sourcetype list the top 25 most prevailing vulnerabilities that have patches available. The queries are separated by Operating System or Device […]
-
1 year, 4 months ago
SplunkNinja wrote a new post, Remediation Tracking Trend – Qualys
The following Splunk query will help determine remediation tracking trends within the Qualys Sourcetype:
eventtype=”qualys_vm_detection_event” | stats count as eachCount |eval STATUS=”Total” | table STATUS […] -
1 year, 4 months ago
SplunkNinja wrote a new post, High Severity Vulnerabilities – Qualys
The following Splunk query will show the percentage of high severity vulnerabilities within the Qualys Sourcetype:
eventtype=”qualys_vm_detection_event” |eval Success= if(SEVERITY >3,1,0)|stats count as total […] -
1 year, 4 months ago
SplunkNinja wrote a new post, New Vulnerabilities Detected Since Last Scan – Qualys
As the title suggests this Splunk Search will dedup results so you can better see changes in Vulnerability detection scan to scan within the Qualys Sourcetype:
eventtype=”qualys_vm_detection_event” | dedup QID […] -
1 year, 4 months ago
SplunkNinja wrote a new post, Hosts Taking a Long Time to Scan – Qualys
The following Splunk query will show the hosts taking an abnormally lengthy time to scan (helps find that needle in a haystack) within the Qualys Sourcetype:
sourcetype=”qualys:hostDetection” […] -
1 year, 4 months ago
SplunkNinja wrote a new post, Number of Vulnerabilities Detected – Qualys
The following Splunk query will show the number of vulnerabilities detected all severities and all types within the Qualys Sourcetype:
eventtype=”qualys_vm_detection_event” STATUS=”NEW” | dedup QID |stats count […] -
1 year, 4 months ago
SplunkNinja wrote a new post, Qualys – Number of Hosts Scanned
The following Splunk query will show the number of hosts scanned within the Qualys Sourcetype:
eventtype=”qualys_vm_detection_event” |eval Success= if(SEVERITY >3,1,0)|stats count as total sum(Success) as […] -
1 year, 5 months ago
SplunkNinja wrote a new post, REST Call for Memory & CPU usage on Splunk Servers
This Splunk search will show you use and available CPU and Memory statistics. Depending on your environment you may see multiple Splunk servers:
| rest /services/server/status/resource-usage/hostwide | eval […] -
1 year, 5 months ago
SplunkNinja posted a new activity comment
In reply to: kharris posted an update @hagjos43 How can you convert the available memory into a percentage, like we see it in task manager, 50% used 50% free ? ViewAre you getting the output without the percent? Essentially the number but juts looking for the % sign? From the looks of the query that is what I’m seeing (without running it lol)
-
1 year, 7 months ago
SplunkNinja wrote a new post, Linux Free Disk Space
The following Splunk query shows a percentage of free disk space over a period of time using timechart:
index=os sourcetype=df PercentFreeSpace=* mount=”/” | timechart latest(PercentFreeSpace) by host -
1 year, 7 months ago
SplunkNinja wrote a new post, Linux Memory Usage
The following Splunk Search will show memory usage on a linux machine over a period of time using timechart:
index=os sourcetype=top pctMEM=*| transaction host _time | streamstats window=1 global=f sum(pctMEM) as […] -
1 year, 7 months ago
SplunkNinja wrote a new post, Linux CPU Usage
The following query will output CPU usage per host over a period of time using timechart:
index=os sourcetype=top pctCPU=* | transaction host _time | streamstats window=1 global=f sum(pctCPU) as CPU | timechart […] -
1 year, 9 months ago
SplunkNinja wrote a new post, Convert Seconds to Hours Minutes Seconds HHMMSS
Take any field in splunk that outputs a value in seconds and change it to report in HH:MM:SS format:
your.search.here | eval HHMMSS=tostring(Field_In_Seconds, “duration”) | table HHMMSS -
1 year, 10 months ago
SplunkNinja wrote a new post, Forwarder Diagnostics – Last time Data Was Received by Index and Sourcetype
The following Splunk query was modified from the Splunk Health Overview app on Splunkbase. This particular Splunk search returns a list of hosts with their indexes and sourcetypes and determines when each last […]
-
1 year, 10 months ago
SplunkNinja answered to the question “[RESOLVED] Question Template (CISCO PIX SAMPLE LOG)“
SAMPLE ANSWER: search.goes.here | rex ”d+SsBuilt(?w{3})s” | search Protocol=UDP | stats count by Protocol
- Load More
it is giving me the results in Gbs , below is an example of the results. If splunk would give me the max memory of each server, I could use the results below, but since it does not, I rather see the results in percentages if possible.
Host Trend Average Peak Current Last Updated
myHost TrendGraph 0.31 0.32 0.30…[Read more]