Splunk Cheat Sheet - Revision history

Admin: /* Server Commands */

2024-05-19T16:52:44Z

Server Commands

← Older revision		Revision as of 16:52, 19 May 2024
Line 62:		Line 62:
	*Or monitor		*Or monitor
	./splunk btool inputs list monitor		./splunk btool inputs list monitor
			==DBInspect==
			./splunk dispatch "\| dbinspect index=myindex" -uri https://127.0.0.1:8089
			==Curl Search ==
			curl -u admin:changeit -k https://localhost:8089/services/search/jobs/export -d output_mode=csv -d search="search index=_internal \|head 10"

	==Server Commands==		==Server Commands==
	*Show running server.conf		*Show running server.conf

2024-01-04T09:54:36Z

@@ Line 351: / Line 351: @@
 =Mail=
 | makeresults 1 | eval Message="This is a test"  | sendemail to="mail@domain.com" sendresults=true inline=true subject="search result test"
 =Stats=

2023-12-19T09:25:32Z

Stats

← Older revision		Revision as of 09:25, 19 December 2023
Line 345:		Line 345:
	*Use appendcols		*Use appendcols
	M=FAPI FT=1 STAT=0 USR=USR.PROD \| stats count(CMD) as XXX \| '''appendcols''' [search M=FAPI FT=1 STAT=0 USR NOT XXXX.PROD \| stats count(CMD) as OTHER]		M=FAPI FT=1 STAT=0 USR=USR.PROD \| stats count(CMD) as XXX \| '''appendcols''' [search M=FAPI FT=1 STAT=0 USR NOT XXXX.PROD \| stats count(CMD) as OTHER]

			=HEC=
			[splunk@splunk splunk]$ curl -k http://127.0.0.1:8088/services/collector/event -H 'Authorization: Splunk <token>' \
			-d"{\"event\": \"test message\", \"index\":\"main\", \"host\":\"$HOSTNAME\"}"
			=Mail=
			\| makeresults 1 \| eval Message="This is a test" \| sendemail to="mail@domain.com" sendresults=true inline=true subject="search result test"

	=Stats=		=Stats=
Line 367:		Line 373:
	*Amount of searches per day		*Amount of searches per day
	index=_audit action="search" search="" NOT user="splunk-system-user" savedsearch_name="" NOT search="\'\|history" NOT search="\'typeahead*" \| timechart count		index=_audit action="search" search="" NOT user="splunk-system-user" savedsearch_name="" NOT search="\'\|history" NOT search="\'typeahead*" \| timechart count





	=Links=		=Links=

2023-12-17T18:50:05Z

Regex Samples

← Older revision		Revision as of 18:50, 17 December 2023
Line 318:		Line 318:
	Regex to get a table of SRC,DST and Port		Regex to get a table of SRC,DST and Port
	host="192.168.100.1" Built inbound TCP connection * \| rex field=_raw "for outside:(?<SRC>[^\/]+)" \| rex field=_raw "to inside:(?<DST>[^\/]+)\/(?<PORT>[^\s+]+)" \| top 500 SRC,DST,PORT		host="192.168.100.1" Built inbound TCP connection * \| rex field=_raw "for outside:(?<SRC>[^\/]+)" \| rex field=_raw "to inside:(?<DST>[^\/]+)\/(?<PORT>[^\s+]+)" \| top 500 SRC,DST,PORT


			Regex to get date
			2023-12-17 18:00:00
			*
			\| rex "^(?<Year>[^\-]+)\-(?<Month>[^\-]+)\-(?<Day>[^ ]+)\s+(?<Hour>[^\:]+):(?<Minute>[^\:]+):(?<Second>[^ ]+)"
			\| eval dateref=Year + "-" + Month + "-" + Day + " " + Hour + ":" + Minute + ":" + Second
			\| sort - dateref

	===Lookahead Sample===		===Lookahead Sample===

2023-10-06T18:45:18Z

Links

← Older revision		Revision as of 18:45, 6 October 2023
Line 367:		Line 367:
	*http://docs.splunk.com/Documentation/Splunk/6.0/SearchReference/CommonEvalFunctions		*http://docs.splunk.com/Documentation/Splunk/6.0/SearchReference/CommonEvalFunctions

	*KV Store ~~renew~~ cert		*KV Store Renew cert
	*http://wiki.intern/index.php/Renew_internal_Splunk_License		*http://wiki.intern/index.php/Renew_internal_Splunk_License

2023-10-06T18:33:22Z

2023-09-05T14:24:02Z

Paths

← Older revision		Revision as of 14:24, 5 September 2023
Line 8:		Line 8:
	*Local conf		*Local conf
	ls /opt/splunk/etc/system/local		ls /opt/splunk/etc/system/local
			*Merged and running config
			var/run/merged/server.conf

	==Splunk Configuration==		==Splunk Configuration==
	===server.conf===		===server.conf===

2023-07-25T16:33:29Z

HEC

← Older revision		Revision as of 16:33, 25 July 2023
Line 165:		Line 165:
	==HEC==		==HEC==
	*Sening a test message		*Sening a test message
	curl "https://localhost:8088/services/collector~~?channel=00872DC6-AC83-4EDE-8AFE-8413C3825C4C~~" \		curl "https://localhost:8088/services/collector" \
	-H "Authorization: Splunk <~~AuthToken~~>" \		-H "Authorization: Splunk <Auth Token>" \
	-d '{"event": "Hello, world ~~123~~", "sourcetype": "manual"}' -k		-d '{"event": "Hello, world!", "sourcetype": "manual"}' -k

	==Debugging Searches==		==Debugging Searches==

2023-07-25T16:31:20Z

Rolling restart

← Older revision		Revision as of 16:31, 25 July 2023
Line 162:		Line 162:

	splunk rolling-restart shcluster-peers		splunk rolling-restart shcluster-peers

			==HEC==
			*Sening a test message
			curl "https://localhost:8088/services/collector?channel=00872DC6-AC83-4EDE-8AFE-8413C3825C4C" \
			-H "Authorization: Splunk <AuthToken>" \
			-d '{"event": "Hello, world 123", "sourcetype": "manual"}' -k

	==Debugging Searches==		==Debugging Searches==

2023-07-25T16:13:09Z

SH Bundles

← Older revision		Revision as of 16:13, 25 July 2023
Line 151:		Line 151:
	[splunk@dep1 splunk]$ bin/splunk list shcluster-bundle -member_uri https://sh3:8089		[splunk@dep1 splunk]$ bin/splunk list shcluster-bundle -member_uri https://sh3:8089
	[splunk@dep1 splunk]$ bin/splunk show bundle-replication-status		[splunk@dep1 splunk]$ bin/splunk show bundle-replication-status
			[splunk@sh1 splunk]$ bin/splunk show bundle-replication-status -auth admin:$(</mnt/splunk-secrets/password)

	==Smart Store==		==Smart Store==