Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Are you a member of the Splunk Community?
Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- Find Answers
- :
- About Shashank_87
Shashank_87
Explorer
Member since:
04-24-2018
06-05-2020
Community Statistics
| Posts | 107 |
| Solutions | 0 |
| Karma Given | 2 |
| Karma Received | 2 |
| Member Since | 04-24-2018 |
Activity Feed
- Got Karma for What is pctIdle in splunk index os?. 02-19-2021 01:27 PM
- Karma Re: How to create an alert for events that are not logged? for richgalloway. 06-05-2020 12:51 AM
- Karma Re: How to monitor Garbage Collector using Splunk? for Sukisen1981. 06-05-2020 12:50 AM
- Got Karma for Re: Set time frame of Splunk Dashboard report. 06-05-2020 12:50 AM
- Posted Re: How to create an alert for events that are not logged? on Splunk Search. 05-29-2020 08:52 AM
- Posted How to create an alert for events that are not logged? on Splunk Search. 05-29-2020 06:24 AM
- Tagged How to create an alert for events that are not logged? on Splunk Search. 05-29-2020 06:24 AM
- Posted Splunk with Jira on Splunk Dev. 05-28-2020 05:36 AM
- Posted How to calculate Average and Peak day for last 3 months on Splunk Search. 05-18-2020 07:01 AM
- Posted How to create an alert for increase in traffic? on Alerting. 05-13-2020 09:35 AM
- Posted Re: How to do the addition of content loaded from a Page on Splunk Search. 05-06-2020 08:28 AM
- Posted How to do the addition of content loaded from a Page on Splunk Search. 05-06-2020 08:09 AM
- Posted Re: Ingesting a Json format data in Splunk on Getting Data In. 05-01-2020 03:40 AM
- Posted Re: Ingesting a Json format data in Splunk on Getting Data In. 04-30-2020 09:11 AM
- Posted Re: Ingesting a Json format data in Splunk on Getting Data In. 04-30-2020 09:02 AM
- Posted Re: Ingesting a Json format data in Splunk on Getting Data In. 04-30-2020 08:21 AM
- Posted Ingesting a Json format data in Splunk on Getting Data In. 04-30-2020 08:03 AM
- Posted Combine 2 values of multi value fields on Splunk Search. 04-22-2020 07:59 AM
- Posted How to remove everything after a specific character from a field on Getting Data In. 04-20-2020 07:11 AM
- Posted Re: count the specific items from the list in Splunk on Splunk Search. 04-06-2020 03:08 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
02-25-2020
09:23 AM
@to4kawa Hi, it is still not working. So the issue is when sending this file to server using SFTP, it's not in the proper format. There are extra commas coming in multiple rows don't know for what reason.
Even if i export that from Splunk and open the file in Notepad++, it shows incorrectly. Attached are the 2 files - one from server and one directly from Splunk.
The data in both of these attached file should be coming as one row but they are going to next line and the server file have extra commas for no reason.
Please help.
... View more
02-13-2020
10:07 AM
@vikramyadav There is nothing much in the search. There are few fields which I am extracting are multi valued like deviceDescription. I am trying to combine it's values by using mv command but not sure if it's working. Not sure what is causing that issue on csv
index=temp_prd serviceName source=tomcat.txt
| rex field=_raw "deviceDescription>(? [^<\/]+)" max_match=20
| rex field=_raw "requestTimestamp>(? [^<\/]+)"
| eval requestTimestam=strptime('requestTimestamp',"%Y-%m-%dT%H:%M:%S")
| eval requestTimestamp=strftime('requestTimestam',"%Y-%m-%d %H:%M:%S")
| dedup requestID
| table originatorURI, activityname requestTimestamp,responseTimestamp,AccountNumber,ref,Channel,Code,accountDiagnosticsSummary,diagnosticIdentifier,deviceDescription
| makemv delim="|" deviceDescription
... View more
02-13-2020
09:05 AM
alt textHi, I have a daily scheduled report which goes to sftp server in a csv format. I am getting complaints that the data is not coming properly. I investigated and suspect that it may be because of the multi valued fields in the table but I am not sure. In Splunk it shows something like I have attached and in the CSV which is delivered on the server it is seen something like this very weird with column name deviceDescription
app,"serviceName","2020-02-12 23:34:01","2020-02-12 23:34:01",34567,ANA,C,,51228586,"HD BOX (CISCO),,,,,,,,,,,,
TIVO 500GB BOX (CISCO),,,,,,,,,,,,,,,,,,,,,,
TIVO 1TB BOX (ARRIS),,,,,,,,,,,,,,,,,,,,,,
TIVO 1TB BOX (ARRIS)",456,Agent,,,,5678997,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
Total columns in the table is 23 but it seems in CSV they are more than 23 commas coming.
Any help is appreciated.
... View more
02-08-2020
05:50 AM
I dont think that matters. The problem is I want to compare the results from 12:00 PM to 10:00 PM.
Right now it's coming for full day which i don't want.
I think this is what needs to be modified : earliest=-8d@d+3h latest=@d
... View more
02-08-2020
05:03 AM
@jkat54 This is the query -
index=tp_test sourcetype=access_combined_wcookie earliest=-8d@d+3h latest=@d
| timechart span=15m avg(response_time_sec) as AvgResponseTime
| timewrap d
| fields _time,AvgResponseTime_latest_day,AvgResponseTime_1day_before,AvgResponseTime_7days_before
... View more
02-08-2020
04:48 AM
Hi, I am trying to plat a graph of response time over a period of time. I am using timewrap command to plot it for yesterday, day before yesterday and last week.
The problem is I only want it for a certain period of time on the day. For Example between 12:00 PM to 10:00 PM (peak hours).
I am snapping the time in the search itself like this earliest=-7d@d+3h latest=@d but is not working. Please see the graph - on the x-axis it is still plotting from 12:00 AM but what i want is from 12:00 PM.
earliest=-7d@d+3h latest=@d
Any help is appreciated.
... View more
01-07-2020
07:07 AM
Hi, I want to calculate max TPS on a particular day for last 3 months for some specific URL's. I just have 5 URL's so I can run the query separately for separate URL's. Looking for a Table something like below -
URL maxTPS(count) date
add-to-cart 400 07-01-2019
add-to-cart 600 06-01-2019
Let me know if anyone can help here please.
... View more
12-04-2019
03:56 AM
@woodcock Hi, Thanks for your quick response. This really works fine. But I have to first output my query results to a CSV and then use the above command to append the results in one csv.
Actually what i was thinking of if we can create 3 separate csv's and attach them together in same mail. Not sure if that is possible?
... View more
12-04-2019
02:53 AM
Hi, I am stuck into a weird problem. I have 3 queries from 3 different source producing a table with a service name and it's error count. Is it possible that I generate 3 reports, attach it in the same email and trigger it as a scheduled report. I know we can use append command but i think that will make the output a bit messy.
Is there any other way?
... View more
11-19-2019
05:27 AM
@Vebloud @allanw_splunk - Are you able to figure it out how to add the minute in the table. I am also facing the same problem and wanting to know if you have figured out any solution for this
... View more
11-19-2019
04:26 AM
@to4kawa thanks for the response but this is not what I am looking for and moreover this query is a bit complex and not very optimized if i have to run for a longer period.
I have shared the working query but it's just that it is not showing the peak hour along with the day. I need something like this in atabular format -
Day PeakhourofTheDay PeakHourCount
... View more
11-19-2019
03:07 AM
Hi, I am trying to find the busiest time of the day for last 30 days. What i need is a table like this -
Day PeakhourofTheDay count
I have this query but it's not showing the peak hour in the table. Also i am not sure if it's correct. Please any help is appreciated.
index=web_env sourcetype=ssl_access_combined
| timechart span=1h count
| timechart span=1d max(count)
... View more
11-14-2019
09:07 AM
Hi, I am trying to show a comparison of traffic on my website for today, yesterday and last week. I am using below query for getting the results. My query is if i put that into a chart then on x-axis, i get time field which shows time for last 24 hours. So what does it mean exactly?
I mean does it show the 7 days before on this time, this was the traffic? I am not able to get the _time field understanding here.
Can someone help?
index=web_prod sourcetype=access_combined req_content="/" earliest=-8d@d latest=now
| timechart count span=1h
| timewrap d
| table _time 1day_before 7days_before latest_day
... View more
11-07-2019
06:25 AM
Hi @renjith.nair , yes that's perfect. That's what i used and now displaying it fine but I don't know why the double quotes are coming when i am checking the file on the server. And those double quotes are coming only on the _time column -
test@server1$ head -5 Daily_Report-_2019-11-07.csv
"_time",siteReference,address,number,status
"Thu Nov 07 14:10:56 2019",20,6922311,,working
This is the query i used -
| eval _time=strftime(_time, "%a %b %d %H:%M:%S %Y")
| table _time siteReference address number status
... View more
11-07-2019
04:26 AM
Hi, I have generated a report which contains _time column in a tabular format but it is displaying differently with different actions.
For example,
1. if i schedule that report as an email, I get _time displayed like this in the csv report - Wed Nov 6 23:59:57 2019
_time,siteReference,addressIdentifier,UPRN,serviceabilityOutcome
Sun Sep 15 23:59:58 2019,,,100050529544,UnServiceable
If i schedule that report to configure as SFTP and send it on one of the ETL server it is displayed like this - I don't know how double quotes came into picture. I want this to be same as above format.
"_time",siteReference,addressIdentifier,UPRN,serviceabilityOutcome
"1573127879.336",20,6985807,,UnServiceable
Can someone help me with changing the proper format of _time field for the 2nd scenario?
... View more
10-17-2019
04:50 AM
1 Karma
@wmyersas Thanks for your response. This logic also works but a bit messy. I would just go with creation of 2 reports and schedule it on monday and thursday respectively. But Thanks for the response. I am saving this query. Might be helpful in future. 🙂
... View more
10-15-2019
06:10 AM
Hi, I am working on a dashboard report which i need to schedule bi-weekly i.e. Monday and Thursday morning. I have the Cron expression ready (30 08 * * 1,4) but how do i change the time dynamically?
For example When report runs on Monday morning, it should fetch the data of Thursday, Friday, Saturday and Sunday. And when it runs on Thursday it should fetch the data from Monday, Tuesday and Wednesday.
Now if i set the time as "Last 4 days", Monday report works fine but Thursday report fetches the data of Sunday as well which is not required.
Can someone help? Any suggestion or hint is appreciated.
... View more
10-14-2019
03:35 AM
Hi, I have an out of the box query in Splunk. I am trying to find out a way using which we can stand out or highlight a value in a table. For example if i use this command | top useragent and suppose the toppest useragent is standing out like more than 90% then can i highlight that with a shade or something? Is this possible?
UserAgent count percent
Useragent1 986734 90.2
Let me know if anyone can help. Much appreciated
... View more
10-08-2019
02:04 AM
Hello, I am trying to make a comparison between dynatrace and splunk. In my project we are already using Splunk and we will have dynatrace very soon.
But i want to understand is it really worth having both of them as licensing of these tools is quite expensive. What i want to understand is -
Why we need dynatrace and what is the factor which differentiate?
What does it do which cannot be done from Splunk?
What does splunk do which cannot be done from dynatrace?
I have heavily read about it online but i am not able to make any conclusions. If anyone can help that would be much appreciated.
... View more
10-03-2019
07:28 AM
Thanks @skoelpin for your response. I have just got it working with the query commented by somesoni. But thanks anyways for looking.
... View more
10-03-2019
07:23 AM
@somesoni2 This is brilliant stuff. Thank you very much. This is exactly what i was looking for. Only disappointed that i couldn't think of this.
Thanks again 🙂
... View more
10-03-2019
06:42 AM
Hi, I am working on a query to get the peak hour count of of the top 100 visited pages on my website and i want this together in a single table.
In simple terms what i want is a table with three columns -
1. req_content (visited page)
2. Total count of this visited page (suppose in last 7 days)
3. Peak hour count of this visited page (suppose in last 7 days).
Mainly the 1st and 3rd column and even if we don't get total count that's okay. I have this below query which gives the top 100 visited pages but I also want the peak hour count alongside it in a separate column
index=test sourcetype=access_combined requested_content="/*" NOT (images OR js OR css OR png OR gif OR json OR jpg OR woff OR eot OR ico OR ttf OR svg OR pdf OR php OR jpeg OR txt) status=200
| stats count by req_content
| sort - count limit=100
Any help is appreciated.
@David @to4kawa @Sukisen1981 @gcusello
... View more
10-03-2019
05:24 AM
@Keysofsandiego Hey, let me know if you can help me with the query please.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:04 AM
|
