Notes![what is notes.io? What is notes.io?](/theme/images/whatisnotesio.png)
![]() ![]() Notes - notes.io |
(host=*.*splunk*.* NOT host=sh*.*splunk*.* index=_telemetry source=*license_usage_summary.log* type="RolloverSummary")
| bin _time span=1d
| stats latest(b) AS b by slave, pool, _time
| timechart span=1d sum(b) AS "volume" fixedrange=true
| eval GB=round((((volume / 1024) / 1024) / 1024),3), "Daily Volume"=GB
| fields - GB, volume
Notable Comparison
index=notable search_name=*gcp*| eval user=Country."/".user | timechart count values(user) by search_name
Timestamp Comparison
index=* host IN (USAWSVRS05) _index_earliest=-5m@m _index_latest=now
| eval time_index=_indextime
| eval time = _time
| eval time_s=strftime(time,"%Y-%m-%d %H:%M:%S")
| eval time_index_s=strftime(time_index,"%Y-%m-%d %H:%M:%S")
| eval delta_minutes = round((time - time_index)/600)*10
| stats count by host sourcetype delta_minutes
Troubleshoot Queues
index=_internal source=*metrics.log sourcetype=splunkd group=queue
| eval name=case(name=="aggqueue","2 - Aggregation Queue",
name=="indexqueue", "4 - Indexing Queue",
name=="parsingqueue", "1 - Parsing Queue",
name=="typingqueue", "3 - Typing Queue",
name=="splunktcpin", "0 - TCP In Queue",
name=="tcpin_cooked_pqueue", "0 - TCP In Queue")
| eval max=if(isnotnull(max_size_kb),max_size_kb,max_size)
| eval curr=if(isnotnull(current_size_kb),current_size_kb,current_size)
| eval fill_perc=round((curr/max)*100,2)
| bin _time span=1m
| stats Median(fill_perc) AS "fill_percentage" max(max) AS max max(curr) AS curr by host, _time, name
| where (fill_percentage>70 AND name!="4 - Indexing Queue") OR (fill_percentage>70 AND name="4 - Indexing Queue")
| sort -_time
TIME_FORMAT = %Y-%m-%dT%H:%M:%S
MAX_TIMESTAMP_LOOKAHEAD = 50
KV_MODE = json
INDEXED_EXTRACTIONS = JSON
Findings by Finding Class
`googlescc_index` sourcetype="google:scc:findings" organization_id=$org$ finding.findingClass=* | dedup finding.name,organization_id | stats count by finding.findingClass
Threats Over Time
| search finding.severity=* | timechart count(finding.name) as Count by finding.severity | rename finding.severity as Severity
Vulnerabilities Over Time
| search finding.severity=* | timechart count(finding.name) as Count by finding.severity | rename finding.severity as Severity
index="gcp_all_prod" sourcetype IN (google:gcp:security:alerts, httpevent)
| rex field=_raw ""parent":"organizations/(?<organization_id>w+)" | search
index="gcp_all_prod" sourcetype IN (google:gcp:security:alerts, httpevent) finding.findingClass=* | rex field=_raw ""parent":"organizations/(?<organization_id>w+)" | search organization_id=* | dedup finding.name,organization_id | stats count by finding.findingClass
The index and the log frequency examined. The
Last event time currently: 8/10/23 10:36
DDAA
index=summary source="splunk-ddaa-detail"
| `sim_filter_stack(solvaysa)`
| fillnull archiveUsage
| append
[ search index=summary source="splunk-storage-summary"
| `sim_filter_stack(solvaysa)`
| fields activeArchiveLicenseGB
| fillnull]
| bin _time span=1d
| stats sum(archiveUsage) as archiveUsage latest(activeArchiveLicenseGB) as license by _time
| timechart minspan=1d latest(license) as "archive license" max(archiveUsage) as "archive usage"
DDAS
index=summary source="splunk-storage-summary"
| `sim_filter_stack(solvaysa)`
| eval activeStorageLicenseGB=if(activeArchiveLicenseGB>0,activeStorageLicenseGB,activeStorageLicenseGB)
| timechart minspan=1d latest(activeStorageLicenseGB) as "storage license GB" max(rawSizeGBCustomer) as "utilized storage GB"
![]() |
Notes.io is a web-based application for taking notes. You can take your notes and share with others people. If you like taking long notes, notes.io is designed for you. To date, over 8,000,000,000 notes created and continuing...
With notes.io;
- * You can take a note from anywhere and any device with internet connection.
- * You can share the notes in social platforms (YouTube, Facebook, Twitter, instagram etc.).
- * You can quickly share your contents without website, blog and e-mail.
- * You don't need to create any Account to share a note. As you wish you can use quick, easy and best shortened notes with sms, websites, e-mail, or messaging services (WhatsApp, iMessage, Telegram, Signal).
- * Notes.io has fabulous infrastructure design for a short link and allows you to share the note as an easy and understandable link.
Fast: Notes.io is built for speed and performance. You can take a notes quickly and browse your archive.
Easy: Notes.io doesn’t require installation. Just write and share note!
Short: Notes.io’s url just 8 character. You’ll get shorten link of your note when you want to share. (Ex: notes.io/q )
Free: Notes.io works for 12 years and has been free since the day it was started.
You immediately create your first note and start sharing with the ones you wish. If you want to contact us, you can use the following communication channels;
Email: [email protected]
Twitter: http://twitter.com/notesio
Instagram: http://instagram.com/notes.io
Facebook: http://facebook.com/notesio
Regards;
Notes.io Team