Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Are you a member of the Splunk Community?
Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- Find Answers
- :
- About snehalk
snehalk
Communicator
Member since:
12-08-2014
03-04-2022
Community Statistics
| Posts | 83 |
| Solutions | 2 |
| Karma Given | 28 |
| Karma Received | 14 |
| Member Since | 12-08-2014 |
Activity Feed
- Got Karma for How to load a dashboard with a default time range of "month to date" in Splunk?. 09-01-2022 08:06 AM
- Posted Why is SC4S UDP data send not working? on Getting Data In. 03-03-2022 12:15 AM
- Got Karma for How to add dynamic value as default value in check box ?. 10-08-2020 10:17 AM
- Karma Re: find the duplicate files from particular source in splunk search query for inventsekar. 06-05-2020 12:48 AM
- Karma Re: How to import pdf file in Splunk with automated script for s2_splunk. 06-05-2020 12:48 AM
- Karma Re: How to increase performance of the complex searches in dashboard for hettervik. 06-05-2020 12:48 AM
- Karma Re: After upgrading to 6.5.0, JavaScript library methods are not working resulting in HTML/JavaScript dashboards to not work. Is there a fix? for luigeek. 06-05-2020 12:48 AM
- Karma Re: How to execute a Splunk search in a dashboard on click of a button using JavaScript? for lquinn. 06-05-2020 12:48 AM
- Karma Re: Calling Java Script from Dashboard for jeffland. 06-05-2020 12:48 AM
- Karma Calling Java Script from Dashboard for earakam. 06-05-2020 12:48 AM
- Karma Re: search query to get specific date range events from different field for gcusello. 06-05-2020 12:48 AM
- Karma Re: How to add new fields in indexing time depending on condition for hunters_splunk. 06-05-2020 12:48 AM
- Karma Re: find the duplicate files from particular source in splunk search query for woodcock. 06-05-2020 12:48 AM
- Karma Re: find the duplicate files from particular source in splunk search query for haley_swarnapat. 06-05-2020 12:48 AM
- Karma Re: File meta-data app for LukeMurphey. 06-05-2020 12:48 AM
- Karma Re: The edits I made to props.conf and transforms.conf are not working to filter my data. Can anyone check to see where I went wrong? for gcusello. 06-05-2020 12:48 AM
- Got Karma for Re: The edits I made to props.conf and transforms.conf are not working to filter my data. Can anyone check to see where I went wrong?. 06-05-2020 12:48 AM
- Got Karma for find the duplicate files from particular source in splunk search query. 06-05-2020 12:48 AM
- Got Karma for How to parse Apache access logs in Splunk. 06-05-2020 12:48 AM
- Got Karma for How to index duplicate files which has different name. 06-05-2020 12:48 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 2 | |||
| 0 | |||
| 0 | |||
| 2 | |||
| 0 | |||
| 0 |
03-22-2017
04:08 AM
2 Karma
Hello All,
I have requirement where i need to monitor pdf files and import in splunk for searching.
But found that we can not do the import directly because as it binary encode file (pdf) So is there any way to do using our configuration in props.conf or transforms.conf file?
Or any script that will convert the pdf file to text file in splunk?
Thank you
... View more
03-06-2017
05:28 AM
Hello Everyone,
Am creating the dynamic query depending on condition and after that using return command to execute that search query string, below is my search query
[ | search query which gives me dynamic string.... | return $myquery ]
where $myquery contain index=xyz | stats c(eval(eventtype="myeventtype1")) as "myeventtype1", c(eval(eventtype="myeventtype2")) as "myeventtype2"
but its giving me the error (actually its putting the each eventtype value while executing), is there any way where we can execute this query without any error?
Note: when i execute myquery string manually its perfectly working fine.
Can any on help me here?
Thank you
... View more
02-14-2017
05:33 AM
Hello Martin,
When i done the automatic lookup, am not able to see Status field in indexed data.
... View more
02-14-2017
05:06 AM
Hello Martin,
Thanks for reply
For doing automatic lookup we need to have unique field values from both the set (index data and lookup data) but in my case each event is tag to multiple eventtype. so how to do this ? in automatic lookup?
... View more
02-14-2017
04:21 AM
Hello Everyone,
I have requirement where i need to search eventtype which are present in my lookup table, say in lookup i have one column name called "eventtype" and other column "Status" value as pass or Fail
eg:
eventtype Status
xyz pass
abc Fail
So in my final result i want the all indexed data with eventtype "xyz"
Below is what i tried but its not working
index=myindex sourcetype=aa [ | inputlookup myfile.csv where Status ="pass"| table eventtype ]
Can any one help me on this?
Thanks,
Snehal Kinekar
... View more
01-02-2017
02:49 AM
Hi All,
I got the answer for this problem. the query is as follow.
search query 1 | stats count by ID,Email,Status1 | appendcols [search query 2 | stats count by ID,Email,Status2 ] | eval finalstatus=if ( Status1= Pass AND Status2= Pass, "Pass", Fail) | stats count by finalstatus
... View more
12-30-2016
03:31 AM
Hello All,
I have the requirement where i need to marge two search query values depending on parameter.
Example:
Result of Query 1:
ID Email Status
1 xyz@abc Pass
2 dd@fd Fail
Result Query 2
ID Email Status
1 xyz@abc Fail
2 dd@fd Fail
What i want as final result
Final Query [ query 1 + query 2 ]
ID Email Status
1 xyz@abc Fail
2 dd@fd Fail
Because the Id with 1 and email id with xyz@abc failed in second result .
I have used append and appendcols but its not working,.
So can any one help me on this?
Thanks!!
... View more
12-27-2016
02:20 AM
1 Karma
Hello Giuseppe,
Thanks for your help, additional to above props.conf file, i have added one more line and its working fine .
my updated props.conf
[regdata]
SHOULD_LINEMERGE = false
TRANSFORMS-regdataparses=set_nullqueue,regdataparse
Transforms.conf
[regdataparse]
REGEX = ABC|AMT|LX|XTP\*573\*
DEST_KEY = queue
FORMAT = indexQueue
[set_nullqueue]
REGEX=.
DEST_KEY=queue
FORMAT=nullQueue
Thank you once again!!
... View more
12-21-2016
11:59 PM
Hello Giuseppe,
Yes, i restarted the splunk, whenever i did change in configuration file, and right know am doing in my local machine, once it get parse will put in our prod indexer.
Configuration file path is follows
C:\Program Files\Splunk\etc\apps\Mycustapp\local
Please help me here!!
... View more
12-21-2016
05:39 AM
Hello Giuseppe,
still the filter is not working, it pulling all raw data, can you please help me here?
... View more
12-21-2016
05:17 AM
Hello cusello,
Am getting "$1" as log entry in splunk. please help me, shall i remove FORMAT = $1 ?
... View more
12-21-2016
03:26 AM
Hello All,
I have written the below props.conf and transforms.conf files, but am not able to filter my data, could anyone please let me know where am wrong?
my sample input file contains
*888*12223322*13~
Gaa7*12*216621~
ABC***1212121*470.01**2121212~
ML*14442126616682872*12~
ML*1442123133552772*12~
ML*1214241161127711722*12~
ML*121221111728182112122*12~
AMT*DD*250~
LL*11001*
XTP*434*D8*20151028~
LX*1~
LL*110016686*
XTP*434*yD8*20151028~
LL*11001*
XTP*573*D8*20161028~
LX*2~
LL*11001*
XTP*4134*D8*20161028~
LL*11001*
XTP*573*D8*20161028~
LX*3~
LL*11001*
XTP*434*D8*20161028~
LL*11001*
XTP*573*D8*20161028~
LX*4~
LL*11001*
XTP*434*D8*20161028~
what i want in output is as follows ( each event need to start with "ABC")
ABC***1212121*470.01**2121212~
AMT*DD*250~
LX*1~
XTP*573*D8*20161028~
LX*2~
XTP*573*D8*20161028~
LX*3~
XTP*573*D8*20161028~
LX*4~
Below are my configuration files
inputs.conf
[monitor://C:\trash\*.txt]
index=xyz
sourcetype=regdata
transforms.conf
[regdataparse]
REGEX = ^(ABC.+|AMT.+|LX.+|XTP\*573\*.+)
FORMAT = $1
DEST_KEY = _raw
props.conf
[regdata]
TRANSFORMS-regdataparses=regdataparse
And all files are in search app local directory (C:\Program Files\Splunk\etc\apps\search\local) and also the above regular expression is working on link text online tool
Please help me here.
... View more
11-29-2016
04:07 AM
Thank you so much !! for your help, 🙂 just last question, can we used standard format instate of day calculation? because the month may contains 30 days or 31 days or some time 28 days , so can we use something like 1y for year and 2 months for months?
index=yourindex sourcetype="xyz" | eval mydate1=mydate | join id_num [ search index=yourindex sourcetype="abc" | eval mydate2=mydate ] | eval mydate1=strptime(mydate1,"your_format"), mydate2=strptime(mydate2,"your_format") | eval diff=mydate1-mydate2 | where diff<1y??
... View more
11-29-2016
02:55 AM
Thank you so much !! for your help. just last question 🙂 is there any way instated of days wise calculation can we use like as below because the month may have 30 days or 31 or 28, so can we use 1y for year and for months 2m something like ?
index=yourindex sourcetype="xyz" | eval mydate1=mydate | join id_num [ search index=yourindex sourcetype="abc" | eval mydate2=mydate ] | eval mydate1=strptime(mydate1,"your_format"), mydate2=strptime(mydate2,"your_format") | eval diff=mydate1-mydate2 | where diff< 9m?
... View more
11-28-2016
03:50 AM
Hello Giuseppe,
thank you so much, when i search the query am getting in "diff" column some date with 1970 year value so how to identify the value am getting is correct? because there are many events? is there any ways for that?
... View more
11-28-2016
02:55 AM
Hello Giuseppe,
Thank you for search query. Could you please explain what is mean by 36720000? and why we are using here?
... View more
11-24-2016
01:18 AM
Hello Giuseppe,
ya, its has the id_num which can use for join
... View more
11-23-2016
06:08 AM
that would be comparing each event (date) with other event. eg: sourcetype="xyz" mydate (2013) sourcetype="abc" mydate (2016) then take the "abc" event
if sourcetype="xyz" mydate (2010) sourcetype="abc" mydate (2016) then dont take "abc" event
... View more
11-23-2016
04:33 AM
Hello Giuseppe,
Thank you for response, below are my answers for each doubt you have.
you have events from two sourcetypes,
Ans: Yes, i have two different sourcetype
field mydate is present in all events of both sourcetypes,
Ans: Yes. Its present in both the sourcetypes
when you say where the date field "mydate" is different, do you mean different by what?
Ans: different by date
when you say that date should be within one year and two months from "xyz" sourcetype date field "mydate", do you mean from the first, the last or what date of "xyz" sourcetype?
Ans: it means the events(result) from "abc" should be within range of (ie one year two months) from "xyz" sourcetype field "mydate".
... View more
11-23-2016
01:49 AM
Hello All,
I have requirement where need to compare the two different date's and condition is that date would be one year and two months from respective field.
eg: consider two sourcetype followed by sourcetype="xyz" and sourcetype="abc" and each sourcetype contain date field called "mydate". So requirement is need to fetch the events from "abc" where the date field "mydate" is different and that date should be within one year and two months from "xyz" sourcetype date field "mydate".
Can any one guide me on this?
Thanks
... View more
11-10-2016
05:19 AM
No problem Hunters, Thank you for your inputs.
... View more
11-10-2016
12:22 AM
Hello Hunter,
Thanks for reply, is it possible to use like condition mynum>5 because the number can change instate of using regular expression? can we use any arithmetic operator?
... View more
11-09-2016
03:41 AM
Hello All,
Is this possible in Splunk where we can add new fields and there value will depends on condition? in transforms.conf file? or in fields.conf
eg: while indexing we have field called mynum=6 when this found then splunk need to add new field (at end of each event) called "check" and the value is pass/fail depending on condition and the condition for pass is mynum>5?
something like when i indexed the data in splunk
....my sample log....,check=pass
Can any one help me on this?
Thank you
... View more
09-23-2016
07:42 AM
Thank you, its working for me. and good explanation as well. once again thank you so much!!
... View more
09-22-2016
03:41 AM
Hello Haley,
Its not displaying any result.. but i remove the eval command then events are coming
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
03-04-2022
04:48 AM
|
Karma given to
