Notes

Daily Volume

(host=*.*splunk*.* NOT host=sh*.*splunk*.* index=_telemetry source=*license_usage_summary.log* type="RolloverSummary")

| bin _time span=1d

| stats latest(b) AS b by slave, pool, _time

| timechart span=1d sum(b) AS "volume" fixedrange=true

| eval GB=round((((volume / 1024) / 1024) / 1024),3), "Daily Volume"=GB

| fields - GB, volume

Notable Comparison

index=notable search_name=*gcp*| eval user=Country."/".user | timechart count values(user) by search_name



Timestamp Comparison

index=* host IN (USAWSVRS05) _index_earliest=-5m@m _index_latest=now

| eval time_index=_indextime

| eval time = _time

| eval time_s=strftime(time,"%Y-%m-%d %H:%M:%S")

| eval time_index_s=strftime(time_index,"%Y-%m-%d %H:%M:%S")

| eval delta_minutes = round((time - time_index)/600)*10

| stats count by host sourcetype delta_minutes



Troubleshoot Queues



index=_internal source=*metrics.log sourcetype=splunkd group=queue

| eval name=case(name=="aggqueue","2 - Aggregation Queue",

name=="indexqueue", "4 - Indexing Queue",

name=="parsingqueue", "1 - Parsing Queue",

name=="typingqueue", "3 - Typing Queue",

name=="splunktcpin", "0 - TCP In Queue",

name=="tcpin_cooked_pqueue", "0 - TCP In Queue")

| eval max=if(isnotnull(max_size_kb),max_size_kb,max_size)

| eval curr=if(isnotnull(current_size_kb),current_size_kb,current_size)

| eval fill_perc=round((curr/max)*100,2)

| bin _time span=1m

| stats Median(fill_perc) AS "fill_percentage" max(max) AS max max(curr) AS curr by host, _time, name

| where (fill_percentage>70 AND name!="4 - Indexing Queue") OR (fill_percentage>70 AND name="4 - Indexing Queue")

| sort -_time





TIME_FORMAT = %Y-%m-%dT%H:%M:%S



MAX_TIMESTAMP_LOOKAHEAD = 50



KV_MODE = json



INDEXED_EXTRACTIONS = JSON



Findings by Finding Class



`googlescc_index` sourcetype="google:scc:findings" organization_id=$org$ finding.findingClass=* | dedup finding.name,organization_id | stats count by finding.findingClass



Threats Over Time



| search finding.severity=* | timechart count(finding.name) as Count by finding.severity | rename finding.severity as Severity



Vulnerabilities Over Time



| search finding.severity=* | timechart count(finding.name) as Count by finding.severity | rename finding.severity as Severity



index="gcp_all_prod" sourcetype IN (google:gcp:security:alerts, httpevent)



| rex field=_raw ""parent":"organizations/(?<organization_id>w+)" | search



index="gcp_all_prod" sourcetype IN (google:gcp:security:alerts, httpevent) finding.findingClass=* | rex field=_raw ""parent":"organizations/(?<organization_id>w+)" | search organization_id=* | dedup finding.name,organization_id | stats count by finding.findingClass



The index and the log frequency examined. The

Last event time currently: 8/10/23 10:36



DDAA



index=summary source="splunk-ddaa-detail"

| `sim_filter_stack(solvaysa)`

| fillnull archiveUsage

| append

[ search index=summary source="splunk-storage-summary"

| `sim_filter_stack(solvaysa)`

| fields activeArchiveLicenseGB

| fillnull]

| bin _time span=1d

| stats sum(archiveUsage) as archiveUsage latest(activeArchiveLicenseGB) as license by _time

| timechart minspan=1d latest(license) as "archive license" max(archiveUsage) as "archive usage"





DDAS



index=summary source="splunk-storage-summary"

| `sim_filter_stack(solvaysa)`

| eval activeStorageLicenseGB=if(activeArchiveLicenseGB>0,activeStorageLicenseGB,activeStorageLicenseGB)

| timechart minspan=1d latest(activeStorageLicenseGB) as "storage license GB" max(rawSizeGBCustomer) as "utilized storage GB"