Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
All Topics
Find Answers
Ask questions. Get answers. Find technical product solutions from passionate members of the Splunk community.
×
Are you a member of the Splunk Community?
Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- Find Answers
- :
- All Topics
All Topics
08-17-2021
12:29 PM
Upgrade to Splunk 8.2 from 7.3 we must install 8.1 first before 8.2. So is it okay to run the rpm -U for 8.1 and then 8.2 right after 8.1 finishes or should we wait until the entire 8.1 environment ...
See more...
Upgrade to Splunk 8.2 from 7.3 we must install 8.1 first before 8.2. So is it okay to run the rpm -U for 8.1 and then 8.2 right after 8.1 finishes or should we wait until the entire 8.1 environment has been running for a few days? Any suggestions would be greatly appreciated.
Labels
- Labels:
-
upgrade
08-17-2021
12:25 PM
Hi, I have the following search that works against a datamodel to plot a timechart. How can I use predict command with this output? | tstats summariesonly=true count FROM datamodel="modelname...
See more...
Hi, I have the following search that works against a datamodel to plot a timechart. How can I use predict command with this output? | tstats summariesonly=true count FROM datamodel="modelname.dataset" where dataset.field="xyz" by dataset.field, _time span=1h prestats=t | timechart span=1h count by dataset.field usenull=f useother=f If I try to do following, | predict dataset.field search failed with this error. command="predict", Unknown field: dataset.field What is the correct way to do this? UPDATE: Turns out, | predict "xyz" works, but this would mean it is working just for that one value of the field. Thanks
08-17-2021
11:09 AM
Hello Experts, We need to get the IP Address under the Network tab from all the Servers where AppD MA are running through Dexter. Some of the servers configured with different host name so getting ...
See more...
Hello Experts, We need to get the IP Address under the Network tab from all the Servers where AppD MA are running through Dexter. Some of the servers configured with different host name so getting the IP Address will be helpful to find the misconfiguration and fix the issue. Please share your knowledge! Thanks, Selvaganesh E
- Tags:
- Dexter
- ip address
Labels
- Labels:
-
Infrastructure
08-17-2021
11:04 AM
Is there any splunk supported app/add-on for 8.2.X cloud version, which can be used for maps implementation on splunk dashboards? I need to visualize the data in clusters on the dashboard panel us...
See more...
Is there any splunk supported app/add-on for 8.2.X cloud version, which can be used for maps implementation on splunk dashboards? I need to visualize the data in clusters on the dashboard panel using map.
Labels
- Labels:
-
dashboard
08-17-2021
10:41 AM
I have the following data of red, green, and blue light levels over time that I would like to plot on a scatter plot graph. _time Red_level Green_level Blue_level 2021-06-08 17:53:06 0.20...
See more...
I have the following data of red, green, and blue light levels over time that I would like to plot on a scatter plot graph. _time Red_level Green_level Blue_level 2021-06-08 17:53:06 0.205 -8.315 -14.669 2021-06-02 16:54:59 1.313 -6.571 -13.389 2021-06-04 14:50:49 1.564 -6.006 -13.012 2021-06-07 17:47:38 0.362 -7.853 -13.681 2021-05-28 14:25:15 1.440 -6.460 -12.511 2021-05-27 13:43:02 0.789 -7.264 -12.751 2021-05-26 19:20:34 1.018 -6.511 -12.391 2021-05-31 14:11:25 1.187 -6.226 -13.192 2021-05-30 14:48:10 1.042 -6.254 -12.654 2021-05-29 13:48:41 1.023 -6.355 -12.649 Current search: index=aaa | table _time Red_level Green_level Blue_level
08-17-2021
09:34 AM
Hi all, I have the following dataset: Name Title DaysRemaining Tom West 50 Martin error error Billy Winter 5103 Will Fable 2 I was wondering if there is a way to o...
See more...
Hi all, I have the following dataset: Name Title DaysRemaining Tom West 50 Martin error error Billy Winter 5103 Will Fable 2 I was wondering if there is a way to order the DaysRemaining field by first showing the 'error' value on the top and then ordering in ascending order - i.e. 2,50 and 5103? In addition, is there a way to only highlight the DaysRemaining field, in which 'error' is highlighted red, values between 0-30 are also red, values between 30 - 100 are orange and values above 100 are green? Desired outcome: Appreciate any and all help greatly!
Labels
- Labels:
-
table
08-17-2021
09:08 AM
Hi Folks, I have two lookup files which contain the user information such as username, email and company. for example: 1. First lookup file. user email ...
See more...
Hi Folks, I have two lookup files which contain the user information such as username, email and company. for example: 1. First lookup file. user email company siva siva11@gmail.com google arun arun11@gmail.com 2. Second lookup file. user email company arun arun11@gmail.com yahoo how to merge the two lookup files and merge the value. the expected output should be like this. user email company siva siva11@gmail.com google arun arun11@gmail.com yahoo Could you please anyone suggest to get the expected results.
08-17-2021
08:22 AM
Hi Experts, I have specific requirement to split the contents of a file and ingest it as a separate events. In that events, a filter to be applied and ingest the filtered data to Splunk indexer. I ...
See more...
Hi Experts, I have specific requirement to split the contents of a file and ingest it as a separate events. In that events, a filter to be applied and ingest the filtered data to Splunk indexer. I have created a REGEX pattern which split the contents of the file and ingesting the data in to separate events as desired. Now, my issue is with the filtering of ingested data. In each event, I need to filter fro AGGREGATED_EXECUTION and ingest only the event which has that content. I set the configuration as below. props.conf: [expensive_statements] TRANSFORMS-set= send_events transforms.conf: [send_events] REGEX = AGGREGATED_EXECUTION DEST_KEY = queue FORMAT = indexQueue Above settings is made on HF. Still the filtering is not happening as expected. Kindly help in resolving the issue with filtering. Regards, Karthikeyan.SV
Labels
- Labels:
-
heavy forwarder
-
indexer
-
scripted input
08-17-2021
08:22 AM
I am trying to create a dashboard that contains a textbox. When a ticket reference is given to the textbox and a user clicks submit, a search is run in the background that appends the ticket informat...
See more...
I am trying to create a dashboard that contains a textbox. When a ticket reference is given to the textbox and a user clicks submit, a search is run in the background that appends the ticket information to a kvstore. This is my dashboard - <form script="run_action.js">
<label>QA Manual Submission</label>
<description>A dashboard that allows for the manual submission of QA Samples.</description>
<fieldset submitButton="false"></fieldset>
<row>
<panel>
<input type="text" token="tokRef" searchWhenChanged="true">
<label>Ticket Reference</label>
<default>[Letter][number]_SOC</default>
<initialValue>[Letter][number]_SOC</initialValue>
</input>
<html>
<p>Click "Add to QA" to manually add the ticket number to the QA App</p>
<button class="btn btn-primary button1">Add to QA</button>
</html>
</panel>
</row>
</form> This is javascript I am using - require([
"jquery",
"splunkjs/mvc",
"splunkjs/mvc/searchmanager",
"splunkjs/mvc/tableview",
"splunkjs/mvc/textinputview",
"splunkjs/mvc/simplexml/ready!"
],function(
mvc,
$,
SearchManager,
TableView,
TextInputView
) {
//debug testing
console.log("I get this far!");
//Add after some research on Splunk Anwsers. Since removed.
//var SearchManager = require("splunkjs/mvc");
//var SearchManager = require("splunkjs/mvc/searchmanager");
//var TextInputView = require("splunkjs/mvc/textinputview");
//var TableView = require("splunkjs/mvc/tableview");
//var $ = require("jquery");
var mysearch = new SearchManager({
id: "mysearch",
autostart: "false",
search: mvc.tokenSafe("| jira jqlsearch \"project IN projectMatch(\\\".+_SOC.+\\\") AND assignee was in(membersOf(\"GG_JIRA_Filter\")) AND status=Closed AND created >= startOfMonth()\" fields \"project,summary,status,resolution,resolutiondate,updated,created,issuetype,assignee\" \r\n| table Summary, Key, \"Issue Type\", Resolution, Assignee, Resolved, Created, \"QA Commentary\", \"QA By\", \"Perceived Ticket Quality\", \"QA Pass\/Fail\"\r\n| rename Key as Ticket_Ref, \"Issue Type\" As Issue_Type\r\n| rex field=Resolved \"(?<date>\\d{4}\\-\\d{2}\\-\\d{2})T(?<time>\\d{2}:\\d{2}:\\d{2})\" \r\n| eval extracted_time=date+\" \"+time \r\n| eval Resolved=strptime(extracted_time,\"%Y-%m-%d %H:%M:%S\") \r\n| eval Resolved=round(Resolved,0) \r\n| rex field=Created \"(?<created_date>\\d{4}\\-\\d{2}\\-\\d{2})T(?<created_time>\\d{2}:\\d{2}:\\d{2})\" \r\n| eval created_extracted_time=created_date+\" \"+created_time \r\n| eval Created=strptime(created_extracted_time,\"%Y-%m-%d %H:%M:%S\") \r\n| eval Created=round(Created,0)\r\n| table Ticket_Ref, Summary, \"Issue_Type\", Resolution, Assignee, Resolved, Created, \"QA Commentary\", \"QA By\", \"Perceived Ticket Quality\", \"QA Pass\/Fail\", \"Manual QA Add\"\r\n| eval \"Manual QAA dd\"=\"True\"\r\n| search Ticket_Ref=$tokRef$\r\n| outputlookup qa_lookup append=True")
});
$(".button1").on("click", function (){
var ok = confirm("Are you sure?");
if (ok){
mysearch.startSearch();
alert('attempted restart!');
} //else {
// alert('user did not click ok!');
//}
});
}); When I try to run the dashboard I get the following errors on the console - Limited knowledge of JS and I've done my best to follow guidance on splunk anwsers. Would appreciate any insight. Many thanks Christopher
08-17-2021
08:06 AM
My fields have values like, UTR998760071.unot.utrl.accorda.net RANWA80A8881.cnet.utrl.matrixia.net ANNA00A0071.tron.utrl.zimbaw.net BP87DF087071.cnet.trzn.netisha.net I want the fist part ...
See more...
My fields have values like, UTR998760071.unot.utrl.accorda.net RANWA80A8881.cnet.utrl.matrixia.net ANNA00A0071.tron.utrl.zimbaw.net BP87DF087071.cnet.trzn.netisha.net I want the fist part of the string to be extracted. The part before the first .(dot) output be like UTR998760071 RANWA80A8881 ANNA00A0071 BP87DF087071 Not with substr but with a regex preferably. Thank you
08-17-2021
08:05 AM
I have been trying for almost a week to get in touch with someone regarding my trial license. I am unable to use Splunk without it. I have left numerous voicemails and no one has returned my call. An...
See more...
I have been trying for almost a week to get in touch with someone regarding my trial license. I am unable to use Splunk without it. I have left numerous voicemails and no one has returned my call. Any assistance would be appreciated. Thank you.
08-17-2021
07:54 AM
My question is can it be used with IPv6? If so, how? I like the tool kit its simple and simple is great for the guys who walk in the lab and ask questions. Thanks for all your hard work.
- Tags:
- Network Toolkit
Labels
- Labels:
-
installation
08-17-2021
07:36 AM
Hello, Whenever I try to install a new version or uninstall the current version on my system, I get an error message that the install failed, and the account already exists. Any ideas?
Labels
- Labels:
-
universal forwarder
-
Windows
08-17-2021
06:26 AM
Hi all, I was wondering, with the following table would I be able to create a set of tiles that would be color coded based on the status field and also visualise also show the application in large f...
See more...
Hi all, I was wondering, with the following table would I be able to create a set of tiles that would be color coded based on the status field and also visualise also show the application in large font: Environment Application Hostname Status EUAT MC H1 RUNNING EUAT MC H2 DOWN DEV IC H4 ERROR UAT IC HK RUNNING I was hoping that "RUNNING" would be green, "DOWN" be red and "ERROR" be orange. Any assistance would be greatly appreciated!
Labels
- Labels:
-
chart
-
panel
-
single value
08-17-2021
06:15 AM
1 Karma
Hi all, I'm trying to convert the message body of my events into fields. The structure of the event message is in a comma delimeted key-value pair format. An example of the structure is: Time ...
See more...
Hi all, I'm trying to convert the message body of my events into fields. The structure of the event message is in a comma delimeted key-value pair format. An example of the structure is: Time Event 10/08/2021 15:09:49.000 Timestamp,10/08/2021 15:09:49,Environment,EUAT,Artefact,ICE,Application,ICE,Domain,ws,Status,RUNNING 10/08/2021 15:09:49.000 Timestamp,10/08/2021 15:09:49,Environment,EUAT,Artefact,ICE,Application,Radiating Whitespaced App,Domain,dc,Status,ERROR 10/08/2021 15:09:49.000 Timestamp,10/08/2021 15:09:49,Environment,DEV,Artefact,MC,Application,MCIO,AppID,4,Hostname,4569erg,Domain,wsdc,Status,STOPPED Is there a way, through a search query to make every odd value a 'field' and every even value a corresponding 'value' for that field. Therefore, 'Timestamp' would be a field, with it's corresponding value, then 'Environment' would be the next field. The tricky part is that there can be varying lengths of key-value pair strings in the events. For instance, the first row has 6 pairs of key-value pairs, whereas the third row has 8. Any help would be greatly appreciated!
Labels
- Labels:
-
eval
-
field extraction
-
fields
08-17-2021
06:09 AM
Hi All, I'm using the default windows addon and fetching the %idletime for physicaldisk, but except for C: drives it shows 0% for all others but when I login to the server and check the graphs it's ...
See more...
Hi All, I'm using the default windows addon and fetching the %idletime for physicaldisk, but except for C: drives it shows 0% for all others but when I login to the server and check the graphs it's always around 100% and until the performance monitor is open Splunk will also show me the same data (100 % idle time ). Kindly help me out with this. Stanza I'm using in inputs.conf [perfmon://PhysicalDisk] object = PhysicalDisk counters = Disk Transfers/sec; % Disk Time; % Idle Time; Avg. Disk sec/Write; Avg. Disk sec/Read disabled = 0 index=perfmon instances = * interval = 300 mode = multikv useEnglishOnly=true
Labels
- Labels:
-
configuration
-
search
-
troubleshooting
I have a few lookups created by users they left the organization. We need to remove this lookups since it take large amount of space. Before we remove is there any query we can find out how many sea...
See more...
I have a few lookups created by users they left the organization. We need to remove this lookups since it take large amount of space. Before we remove is there any query we can find out how many searches using this lookup.
08-17-2021
05:51 AM
Hello, I would like to enter the info from a lookup table into my dashboard search. lookup table name: FIP.csv content: field1;field2 160;43 180;50 I tried this: | inputlookup FIP.csv ...
See more...
Hello, I would like to enter the info from a lookup table into my dashboard search. lookup table name: FIP.csv content: field1;field2 160;43 180;50 I tried this: | inputlookup FIP.csv and then several add-ons like | lookup FIP field1 OUTPUTNEW field2 but nothing works. What is the correct syntax?
Labels
- Labels:
-
lookup
08-17-2021
04:07 AM
Hi all, I have created a lookup in HF ( taking batch inputs from dbconnect into a lookup) But i am unable to access the lookup on the Search Head. Please help.
- Tags:
- dbconnect lookup
Labels
- Labels:
-
using Splunk Enterprise
08-17-2021
03:38 AM
Hello I have this query: sourcetype="billinglog" "Reported to MonitorProcessing successfully"| spath "AdditionalData.EventData.MetricName" | search "AdditionalData.EventData.MetricName"=Depos...
See more...
Hello I have this query: sourcetype="billinglog" "Reported to MonitorProcessing successfully"| spath "AdditionalData.EventData.MetricName" | search "AdditionalData.EventData.MetricName"=DepositV2 | rename AdditionalData.EventData.monitorProcessingDto.Country as Country | search AdditionalData.EventData.monitorProcessingDto.FTD="*"
| stats count(AdditionalData.EventData.monitorProcessingDto.FTD=Yes) AS FTDyes | table FTDyes FTDyes returns as 0 while if im changing AdditionalData.EventData.monitorProcessingDto.FTD="*" to: AdditionalData.EventData.monitorProcessingDto.FTD="yes" i'm getting result 12 what am i missing ? thanks
Labels
- Labels:
-
development
