1. uberAgent Support
  2. Community
  3. Feature Requests
New post
0

Wired or Wireless

Avatar
Jonathan Gillman

How can we get the adapter information for "uberAgent:Process:NetworkTargetPerformance" to tell if it is on wifi or wireless?

Date Votes

11 comments

  • Avatar
    Dominik Britz Official comment

    Hi Jonathan,

    uberAgent stores that information in the field NetworkConfigFriendlyName which you can find in the source type uberAgent:System:NetworkConfigInformation. More information.

  • 0
    Avatar
    Jonathan Gillman

    Thanks I will look into that source type. One thing I do not understand. On Friday we had created a dashboard with a look up file that would show the locations of the Ipv4Address. But when we logged in this morning it is saying that their is no information. Why is the data not there? Any help would be grateful. 

    This is the code that we are using and I went back as far as 30 days and still nothing. But just a couple of days ago the info was there.

    index=uberagent sourcetype="uberAgent:Process:NetworkTargetPerformance" | lookup Lockstepiplookup computer_ip as Ipv4Address OUTPUT city | dedup city

  • 0
    Avatar
    Dominik Britz

    Is the lookup still set in transforms.conf and does the csv still exist on disk?

  • 0
    Avatar
    Jonathan Gillman

    yes it is under the search app.

     

    the thing is that the Ipv4Address is not showing up like it was never captured

    but it was there just a couple of days ago and seems to have disappeared 

  • 0
    Avatar
    Jonathan Gillman

    So it has been 4 hrs since I logged in to our splunk server and now the Ipv4Address is showing up. Can anyone explain why? Does it take that long to process through the info?

     

  • 0
    Avatar
    Dominik Britz

    How do you fill your lookup? With a saved search?

  • 0
    Avatar
    Jonathan Gillman

    I am sorry I am still a little green to splunk. I just fallowed the tutorial and added a csv file to the lookups. Not sure if that means that it is a saved search or not.

  • 0
    Avatar
    Dominik Britz

    How do you fill the csv file? Do you run a Splunk search manually or is it scheduled via a scheduled search?

  • 0
    Avatar
    Jonathan Gillman

    manually. If there something we need to add to the csv then we manually upload a new file

  • 1
    Avatar
    Dominik Britz

    I'm afraid I have no clue wh you sometimes see data and sometimes don't. I implemented a similar setup in my lab and it went very well.

    Working with lookups and SPL searches is nothing specific to uberAgent, but plain Splunking. While we try to answer every question here, we ask for your understanding that this page has a focus on uberAgent and that we cannot dive as deep as we want to in Splunk, as time is scarce.

    Splunk has an excellent discussion platform where many experts are eager to help with you SPL searches. May I ask you to post your question there?

  • 0
    Avatar
    Jonathan Gillman

    I understand and I thank you for your patience and understanding. I will post it there.

Please sign in to leave a comment.