All Posts

yuanliu · ‎02-15-2024

Use /service/search/jobs REST API. When you set up an alert, you must have a saved search. Assuming that you give it a name "My alarming alert: Everybody panic!", the following search will tell you...

Use /service/search/jobs REST API. When you set up an alert, you must have a saved search. Assuming that you give it a name "My alarming alert: Everybody panic!", the following search will tell you when the last alert happened and when the first clear occurred. (It will display the time of latest clean search if last alert already expired.) | rest /services/search/jobs | where isDone = 1 AND label == "My alarming alert: Everybody panic!" | fields updated resultCount label | eval _time = strptime(updated, "%FT%T.%3N%z") | transaction startswith="resultCount>0" endswith="resultCount=0" keeporphans=1 | fields - _* | where closed_txn == 1 OR resultCount == 0 | eval last_alert_count = max(resultCount) | eval last_alert_time = min(updated) | fields label last_alert_time last_alert_count

edalbanese · ‎02-15-2024

We are rolling out a customer service chatbot. Has anyone needed to collect the data such as input/output and logs between an chatbot and OpenAI to monitor it in Splunk? If so, what did you use to GD...

We are rolling out a customer service chatbot. Has anyone needed to collect the data such as input/output and logs between an chatbot and OpenAI to monitor it in Splunk? If so, what did you use to GDI? One other note; there is the possibility for customers to share images or video with the chatbot; wondering if anyone has tried to collect this type of data in Splunk?

jhuysing · ‎02-15-2024

I have a search from which i produce a trellis of the sum of various error codes from multiple machines I would like to enhance the charts with a short description of text. I could add the tex...

I have a search from which i produce a trellis of the sum of various error codes from multiple machines I would like to enhance the charts with a short description of text. I could add the text to the code value and create a new value name and do the split on the new "codetext". But, then I can't use the drill down feature. Is there another way to add some text to the individual graphs

raghunandan1 · ‎02-15-2024

Hi Team, We have DB alerts for server sitpdb0033 are assigning to windows support team first , it needs to be assign to SQL team, How to change the assignment group from windows support team to SQL...

Hi Team, We have DB alerts for server sitpdb0033 are assigning to windows support team first , it needs to be assign to SQL team, How to change the assignment group from windows support team to SQL team. The index=mssql there are 30+ host's are configured. We want only change the group for this server sitpdb0033 we have using this SPL query: index=mssql sourcetype="mssql:database" OR sourcetype="mssql:databases" state_desc!="ONLINE" | eval assignment_group = case(like(source,"%mssql_mfg%"),"Winows_Support - Operations",1=1, "Sql_Production Support") Can you please help on this requirement. Thank you Nandan

ea-2023 · ‎02-15-2024

I get this error whether I use <<FIELD>> or <<ITEM>>. Error in 'EvalCommand': The arguments to the 'mvappend' function are invalid. | eval type=mvappend(if(isnotnull('<<ITEM>>'), '<<ITEM>>', typ...

I get this error whether I use <<FIELD>> or <<ITEM>>. Error in 'EvalCommand': The arguments to the 'mvappend' function are invalid. | eval type=mvappend(if(isnotnull('<<ITEM>>'), '<<ITEM>>', type)) ]

yuanliu · ‎02-15-2024

Splunk Docs is your friend. See foreach. <<FIELD>> is a symbol in SPL's foreach command, not to be replaced by the user. SPL will iterate this symbol over the field names following the command name.

yuanliu · ‎02-15-2024

When you say "a list of", I assume that this list is in a field that is single-valued in each event. Is this correct? Assuming yes, and assuming a field name of fullname, you can do | eval full...

When you say "a list of", I assume that this list is in a field that is single-valued in each event. Is this correct? Assuming yes, and assuming a field name of fullname, you can do | eval fullname = trim(split(fullname, ","), " ") | eval fullname = mvjoin(mvreverse(fullname), " ") Here is an emulation you can run and compare with real data | makeresults | fields - _* | eval fullname = "Smith, Suzy" ``` data emulation above ``` | eval fullname = trim(split(fullname, ","), " ") | eval fullname = mvjoin(mvreverse(fullname), " ") Output is fullname Suzy Smith Hope this helps

vihshah · ‎02-15-2024

hey @ITWhisperer , I see there is one issue, my number of events are less from my actual query. why it may happened?

hidelarosa · ‎02-15-2024

Hi, I'm getting the same issue. Waiting for web server at http://x.x.x.x to be available ... done The Splunk web interface is at http://localhost:8000 Tried access the Splunk web but cann...

Hi, I'm getting the same issue. Waiting for web server at http://x.x.x.x to be available ... done The Splunk web interface is at http://localhost:8000 Tried access the Splunk web but cannot be reached. netstat -an | grep 8000 tcp 0 0 0.0.0.0:8000 0.0.0.0:* LISTEN firewall is disabled. telnet is results below: Trying 127.0.0.1... Connected to 127.0.0.1. Escape character is '^]'. HTTP/1.1 400 Bad Request Date: Thu, 15 Feb 2024 21:21:05 GMT Content-Type: text/html; charset=UTF-8 X-Content-Type-Options: nosniff Content-Length: 207 Connection: Close X-Frame-Options: SAMEORIGIN Server: Splunkd <!doctype html><html><head><meta http-equiv="content-type" content="text/html; charset=UTF-8"><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>HTTP Request was malformed.</p></body></html> Connection closed by foreign host.

Kat456 · ‎02-15-2024

I have a list of comma separated names (lastname, firstname) that I need to reverse. So "Smith, Suzy" becomes "Suzy Smith". What's the easiest way to do this?

raghunandan1 · ‎02-15-2024

Log ingesting intermittently We could not find the path referenced . We have Univerasal forwarder is Windows server and Heavy forwarder is *nix server. How to get the diag files with debug enable of ...

Log ingesting intermittently We could not find the path referenced . We have Univerasal forwarder is Windows server and Heavy forwarder is *nix server. How to get the diag files with debug enable of the UF and the HF? Can you please provide the detailed explanation with commands

richgalloway · ‎02-15-2024

Have you edited the data model to create a new calculated field using your eval command? That should do it. Be warned, however, that once you modify a DM you own it. Your copy will override any ch...

Have you edited the data model to create a new calculated field using your eval command? That should do it. Be warned, however, that once you modify a DM you own it. Your copy will override any changes delivered by Splunk.

ea-2023 · ‎02-15-2024

@bowesmana just wanted to tag you for awareness, not sure how this community notifies on comment replies.

jeradb · ‎02-15-2024

I can run the below command in a search successfully - | eval message=replace(Message, "^Installation Successful: Windows successfully installed the following update: ", "") How can I conv...

I can run the below command in a search successfully - | eval message=replace(Message, "^Installation Successful: Windows successfully installed the following update: ", "") How can I convert this to work in a data model? Below is my base search sample result. Message=Installation Successful: Windows successfully installed the following update: Security Intelligence Update for Microsoft Defender Antivirus - KB2267602 (Version 1.405.28.0) - Current Channel (Broad) In my data model I would like to use eval expression on the field message and take off - Installation Successful: Windows successfully installed the following update: Desired results - Message= Security Intelligence Update for Microsoft Defender Antivirus - KB2267602 (Version 1.405.28.0) - Current Channel (Broad)

ea-2023 · ‎02-15-2024

What is expected for <<FIELD>>? What value would I add here to get it to cycle through all 3 (or more) values extracted from the spath object?

bowesmana · ‎02-15-2024

@ea-2023 If your JSON field 3 has one or more of those field attributes, then after the spath you can do | foreach "Attribute Name", "Resource Name", and "ID" [ | eval type=mvappend(if(isnotnull(...

@ea-2023 If your JSON field 3 has one or more of those field attributes, then after the spath you can do | foreach "Attribute Name", "Resource Name", and "ID" [ | eval type=mvappend(if(isnotnull('<<FIELD>>'), '<<FIELD>>', type) ] which will cycle through the 3 desired fields and for any of the 3 that exist, will make a multi-value field called type with any that do exist.

iamryan · ‎02-15-2024

Hi @Gregory.Burkhead, I'm going to dig into this for you, but I wanted to make sure this was the documentation you were looking at. https://docs.appdynamics.com/appd/onprem/latest/en/analytics/ad...

Hi @Gregory.Burkhead, I'm going to dig into this for you, but I wanted to make sure this was the documentation you were looking at. https://docs.appdynamics.com/appd/onprem/latest/en/analytics/adql-reference/adql-queries/analytics-functions This explanation does not tell you enough? This query first selects all error transactions for the "ECommerce" application. It then calculates, for each unique transaction name, the ratio of instances of that transaction name to the total number of error transactions. (The assumption is that any given transaction name can appear in multiple error transactions.) SELECT transactionName, count ( * ) / totalResultCount() FROM transactions WHERE application = 'ECommerce' AND userExperience = 'ERROR'

iamryan · ‎02-15-2024

Hi @Abdulrahman.Kazamel, Thanks for sharing this in-depth work-around. Let's see if the community can jump in to offer a more robust solution for you.

ITWhisperer · ‎02-15-2024

Please can you share some sample events and a mockup of what your expect output would look like

ITWhisperer · ‎02-15-2024

Click on the Add New link?

All Posts

All Posts

Re: Search to check if request duration search has recovered

Monitoring OpenAI usage in Splunk

Enhance Trellis chart with text from a lookup

Change the alert action SNOW group from windows to sql team.

Re: How to populate a single column with dynamic field values?

Re: How to populate a single column with dynamic field values?

Re: Change order of comma separated names

Re: Nested query

Re: Can't access splunk web server

Change order of comma separated names

How to get the diag files with debug files of the UF and the HF?

Re: Data model - eval expression

Re: How to populate a single column with dynamic field values?

Data model - eval expression

Re: How to populate a single column with dynamic field values?

Re: How to populate a single column with dynamic field values?

Re: Analytics - totalResultCount()

Re: Event Service with elasticsearch 8 Intallation

Re: How to populate a single column with dynamic field values?

Re: Lookup

All Posts

Are you a member of the Splunk Community?

All Posts