Skip to content

Instantly share code, notes, and snippets.

@androchentw

androchentw/ Fun Splunk Queries

Forked from acharlieh/ Fun Splunk Queries
Created July 5, 2021 15:18
Show Gist options
  • Save androchentw/a5f9c59e7a41725544959f539d3ea8fc to your computer and use it in GitHub Desktop.
Save androchentw/a5f9c59e7a41725544959f539d3ea8fc to your computer and use it in GitHub Desktop.
Download ZIP

Revisions

  1. @acharlieh acharlieh revised this gist Jun 20, 2014. 1 changed file with 19 additions and 0 deletions.
    19 changes: 19 additions & 0 deletions Average Splunk Web requests by hour
    View file
    Original file line number Diff line number Diff line change
    @@ -0,0 +1,19 @@
    index=_internal sourcetype=splunk_web_access
    [
    rest / splunk_server=local
    | fields splunk_server
    | rename splunk_server as host
    ]
    | bin _time span=1d
    | stats count by date_hour _time
    | appendpipe
    [
    fields _time
    | dedup _time
    | eval date_hour=mvrange(0,24,1)
    | eval count=0
    | mvexpand date_hour
    ]
    | stats sum(count) as count by date_hour _time
    | stats avg(count) as avg by date_hour
    | sort date_hour
  2. @acharlieh acharlieh revised this gist Jun 15, 2014. 1 changed file with 45 additions and 39 deletions.
    84 changes: 45 additions & 39 deletions ...to get all indexes, or those available to a particular role, or named with a certain name
    View file
    Original file line number Diff line number Diff line change
    @@ -1,40 +1,46 @@
    | rest /servicesNS/-/-/data/indexes count=0
    | rename title as index
    | search index=$indexName$ AND
    [
    rest /servicesNS/-/-/authorization/roles/$roleName$ splunk_server=local
    | appendpipe
    [
    stats count
    | eval srchIndexesAllowed="*"
    | where count=0
    ]
    | fields *srchIndexesAllowed
    | eval index=mvappend(imported_srchIndexesAllowed,srchIndexesAllowed)
    | fields index
    | mvexpand index
    | dedup index
    ]
    | fillnull isReadOnly
    | where disabled=0 AND isReadOnly=0 AND index!="_blocksignature" AND index!="_thefishbucket" AND NOT
    [
    rest / splunk_server=local
    | head 1
    | fields splunk_server
    ]
    | rename index as indexserver
    | eval indexcombined=indexserver
    | stats
    sum(totalEventCount) as eventCountcombined,
    list(totalEventCount) as eventCountserver,
    sum(currentDBSizeMB) as sizeMBcombined,
    list(currentDBSizeMB) as sizeMBserver,
    max(maxTime) as maxTimecombined,
    list(maxTime) as maxTimeserver,
    min(minTime) as minTimecombined,
    list(minTime) as minTimeserver,
    list(splunk_server) as indexerserver
    by indexcombined,indexserver
    | fields *$serverResults$
    | rename *$serverResults$ as *
    | table index, eventCount, sizeMB, maxTime, minTime, *
    | rename title as index
    | search index=$indexName$ [
    rest /servicesNS/-/-/authorization/roles/ splunk_server=local
    | search [
    rest / splunk_server=local
    | head 1
    | fields - *
    | eval title=split("$roleName$",";")
    | mvexpand title
    ]
    | where "$roleName$"!="*"
    | append [
    rest / splunk_server=local
    | head 1
    | fields - *
    | eval srchIndexesAllowed=split("*;_*",";")
    | where "$roleName$"="*"
    ]
    | eval index=mvappend(imported_srchIndexesAllowed,srchIndexesAllowed)
    | fields index
    | mvexpand index
    | dedup index
    | eval isInternal=case(index="*",0)
    ]
    | fillnull isReadOnly
    | where disabled=0 AND isReadOnly=0 AND index!="_blocksignature" AND index!="_thefishbucket" AND NOT [
    rest / splunk_server=local
    | head 1
    | fields splunk_server
    ]
    | stats
    sum(totalEventCount) as eventCountcombined,
    list(totalEventCount) as eventCountserver,
    sum(currentDBSizeMB) as sizeMBcombined,
    list(currentDBSizeMB) as sizeMBserver,
    max(maxTime) as maxTimecombined,
    list(maxTime) as maxTimeserver,
    min(minTime) as minTimecombined,
    list(minTime) as minTimeserver,
    list(splunk_server) as indexerserver
    by index
    | rename index as index$serverResults$
    | fields *$serverResults$
    | rename *$serverResults$ as *
    | table index, eventCount,sizeMB,maxTime,minTime,*
  3. @acharlieh acharlieh revised this gist Jun 15, 2014. 1 changed file with 40 additions and 0 deletions.
    40 changes: 40 additions & 0 deletions ...to get all indexes, or those available to a particular role, or named with a certain name
    View file
    Original file line number Diff line number Diff line change
    @@ -0,0 +1,40 @@
    | rest /servicesNS/-/-/data/indexes count=0
    | rename title as index
    | search index=$indexName$ AND
    [
    rest /servicesNS/-/-/authorization/roles/$roleName$ splunk_server=local
    | appendpipe
    [
    stats count
    | eval srchIndexesAllowed="*"
    | where count=0
    ]
    | fields *srchIndexesAllowed
    | eval index=mvappend(imported_srchIndexesAllowed,srchIndexesAllowed)
    | fields index
    | mvexpand index
    | dedup index
    ]
    | fillnull isReadOnly
    | where disabled=0 AND isReadOnly=0 AND index!="_blocksignature" AND index!="_thefishbucket" AND NOT
    [
    rest / splunk_server=local
    | head 1
    | fields splunk_server
    ]
    | rename index as indexserver
    | eval indexcombined=indexserver
    | stats
    sum(totalEventCount) as eventCountcombined,
    list(totalEventCount) as eventCountserver,
    sum(currentDBSizeMB) as sizeMBcombined,
    list(currentDBSizeMB) as sizeMBserver,
    max(maxTime) as maxTimecombined,
    list(maxTime) as maxTimeserver,
    min(minTime) as minTimecombined,
    list(minTime) as minTimeserver,
    list(splunk_server) as indexerserver
    by indexcombined,indexserver
    | fields *$serverResults$
    | rename *$serverResults$ as *
    | table index, eventCount, sizeMB, maxTime, minTime, *
  4. @acharlieh acharlieh revised this gist Jun 10, 2014. 1 changed file with 2 additions and 1 deletion.
    3 changes: 2 additions & 1 deletion All indexes not explicitly granted to a role
    View file
    Original file line number Diff line number Diff line change
    @@ -11,4 +11,5 @@
    | mvexpand index
    | where NOT match(index,".*\*.*")
    ]
    | search NOT role=*
    | search NOT role=*
    | fields index
  5. @acharlieh acharlieh revised this gist Jun 10, 2014. 1 changed file with 14 additions and 5 deletions.
    19 changes: 14 additions & 5 deletions All indexes not explicitly granted to a role
    View file
    Original file line number Diff line number Diff line change
    @@ -1,5 +1,14 @@
    | rest /servicesNS/-/-/data/indexes count=0 | stats max(isInternal) as internal, max(disabled) as disabled, max(isReadOnly) as readonly by title | fillnull | where internal=0 AND disabled=0 AND readonly=0 | fields title | rename title as index | join index type=left [rest /servicesNS/-/-/authorization/roles count=0 splunk_server=local
    | fields title,srchIndexesAllowed
    | rename srchIndexesAllowed as index title as role
    | mvexpand index
    | where NOT match(index,".*\*.*")] | search NOT role=*
    | rest /servicesNS/-/-/data/indexes count=0
    | stats max(isInternal) as internal, max(disabled) as disabled, max(isReadOnly) as readonly by title
    | fillnull
    | where internal=0 AND disabled=0 AND readonly=0
    | fields title
    | rename title as index
    | join index type=left
    [ rest /servicesNS/-/-/authorization/roles count=0 splunk_server=local
    | fields title,srchIndexesAllowed
    | rename srchIndexesAllowed as index title as role
    | mvexpand index
    | where NOT match(index,".*\*.*")
    ]
    | search NOT role=*
  6. @acharlieh acharlieh revised this gist Jun 10, 2014. 1 changed file with 5 additions and 0 deletions.
    5 changes: 5 additions & 0 deletions All indexes not explicitly granted to a role
    View file
    Original file line number Diff line number Diff line change
    @@ -0,0 +1,5 @@
    | rest /servicesNS/-/-/data/indexes count=0 | stats max(isInternal) as internal, max(disabled) as disabled, max(isReadOnly) as readonly by title | fillnull | where internal=0 AND disabled=0 AND readonly=0 | fields title | rename title as index | join index type=left [rest /servicesNS/-/-/authorization/roles count=0 splunk_server=local
    | fields title,srchIndexesAllowed
    | rename srchIndexesAllowed as index title as role
    | mvexpand index
    | where NOT match(index,".*\*.*")] | search NOT role=*
  7. @acharlieh acharlieh revised this gist Jun 10, 2014. 1 changed file with 1 addition and 0 deletions.
    1 change: 1 addition & 0 deletions Fun Splunk Queries
    View file
    Original file line number Diff line number Diff line change
    @@ -0,0 +1 @@
    This is a Gist of useful Splunk Queries.
  8. @acharlieh acharlieh revised this gist Jun 10, 2014. 1 changed file with 5 additions and 0 deletions.
    5 changes: 5 additions & 0 deletions Every index explicitly granted to a role
    View file
    Original file line number Diff line number Diff line change
    @@ -0,0 +1,5 @@
    | rest /servicesNS/-/-/authorization/roles count=0 splunk_server=local
    | fields title,srchIndexesAllowed
    | rename srchIndexesAllowed as index title as role
    | mvexpand index
    | where NOT match(index,".*\*.*")
  9. @acharlieh acharlieh created this gist Jun 10, 2014.
    11 changes: 11 additions & 0 deletions Splunk Objects With Perms granted to non-existent roles
    View file
    Original file line number Diff line number Diff line change
    @@ -0,0 +1,11 @@
    | rest /servicesNS/-/-/admin/directory count=0 splunk_server=local
    | fields eai:acl.app, eai:acl.owner, eai:acl.perms.*, eai:acl.sharing, eai:location, title
    | eval perms=mvappend('eai:acl.perms.read','eai:acl.perms.write')
    | fields - eai:acl.perms.*
    | mvexpand perms
    | where perms!="*" AND NOT
    [
    | rest /servicesNS/-/-/authorization/roles count=0 splunk_server=local
    | fields title
    | rename title as perms
    ]