Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- Find Answers
- :
- About fdi01
fdi01
Motivator
Member since:
12-11-2014
06-05-2020
Community Statistics
| Posts | 304 |
| Solutions | 36 |
| Karma Given | 58 |
| Karma Received | 116 |
| Member Since | 12-11-2014 |
Activity Feed
- Got Karma for Re: Restart a splunk app via script. 09-22-2022 04:28 AM
- Got Karma for Re: splunk queries to insert special characters in field values. 09-19-2021 06:33 AM
- Got Karma for How to change a specific value of a field in my events to another value in a search?. 08-16-2021 09:12 AM
- Got Karma for Re: How to change chart count to a percent value?. 01-26-2021 06:31 PM
- Got Karma for Re: How to join two searches for stats command. 08-03-2020 11:11 PM
- Karma Re: rename EventCodes for smudge797. 06-05-2020 12:48 AM
- Karma Re: How to use Eval to find all matching errors and display result count by error for somesoni2. 06-05-2020 12:48 AM
- Karma Re: tstats with stats eval condition not displaying any results for maciep. 06-05-2020 12:48 AM
- Karma Re: Where is the Splunk Forwarder older versions page? for ohoppe. 06-05-2020 12:48 AM
- Got Karma for Re: Why am I getting permission denied errors running "enable boot-start" in a Splunk 6.0.3 search head pool attached to an NFS mount?. 06-05-2020 12:48 AM
- Got Karma for Re: How to write a search to calculate percentages for success and failure rates from my user log data?. 06-05-2020 12:48 AM
- Got Karma for Re: How to configure Splunk to extract fields from XML tags?. 06-05-2020 12:48 AM
- Got Karma for Re: Field mapping from number to names. 06-05-2020 12:48 AM
- Got Karma for Re: How to group results by name. 06-05-2020 12:48 AM
- Got Karma for Re: Using Geostats to display count on Map. 06-05-2020 12:48 AM
- Got Karma for Re: How to identify reports/Dashboard owned by user?. 06-05-2020 12:48 AM
- Got Karma for Re: impact of fields command on performance. 06-05-2020 12:48 AM
- Got Karma for Re: rename EventCodes. 06-05-2020 12:48 AM
- Got Karma for Re: Is there a way to list all the available REST endpoints via search query ?. 06-05-2020 12:48 AM
- Got Karma for Re: How to join two searches for stats command. 06-05-2020 12:48 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 5 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 2 | |||
| 1 | |||
| 0 |
03-03-2016
01:49 AM
1 Karma
see this answer; it can help you
https://answers.splunk.com/answers/133533/xml-extraction.html?utm_source=typeahead&utm_medium=newquestion&utm_campaign=no_votes_sort_relev
... View more
03-03-2016
01:36 AM
if you are looking to estimate your daily indexing throughput (whether the data counted against your license quota or not), I would recommend to leverage the events of group=thruput name=index_thruput in metrics.log, like so:
index=_internal group=thruput name=index_thruput | timechart span=1d sum(kb) AS daily_GB|eval daily_GB =daily_GB/(1024*1024)."GB"
Do not attempt to use events of group=per_*_thruput to accurately determine license usage or indexing thruput as those represent a sampled measurement.
... View more
03-03-2016
01:02 AM
see this link it can help you Mr michael_peters
http://wiki.splunk.com/Community:DeployHardenedSplunk
... View more
03-02-2016
04:18 AM
1 Karma
your_base_search |stats count AS "T",count(eval(Type=="ERROR")) AS Failure|eval pF=round((Failure/T)*100), "Success Rate"=100-pF|table T,"Success Rate",pF|rename pF as "Failure Rates", T as "Total User"
... View more
03-02-2016
02:52 AM
1 Karma
run it as root user
to do it, run sudo command.
you can try like
$sudo ./splunk/bin/splunk enable boot-start
password:
or
$sudo su
password:
./splunk/bin/splunk enable boot-start
... View more
02-28-2016
11:54 PM
Hi,
OTHER values show up due to global limits for geostats command. You can get rid of it setting globallimit=0. Then it will show up all values found.
... View more
02-26-2016
05:03 AM
see this link it can help you
https://answers.splunk.com/answers/1673/hostname-rename-using-transforms.html#answer-1686
... View more
02-26-2016
03:47 AM
try like
(c) index=… sourcetype=… | perSITEinfo_with_args(specific-file-name-source-within…zip-file) by source
or
definition: search index=… sourcetype=… $in_source$ | series of search | stats perc50(X) dc(Y) values(Z) by source
after run with source=specific-file-name-source args like this :
perSITEinfo_with_args(source=specific-file-name-within…zip-file)
... View more
02-26-2016
01:58 AM
1 Karma
try like :
index=*
| fields eventDateTime,computerName,name,agentGuid,ID
| eval _timeepoch = strptime(eventDateTime,"%Y-%m-%d %H:%M")
| eval myDay = strftime(_timeepoch,"%A")
| eval myYear = strftime(_timeepoch,"%Y")
| eval myMonth = strftime(_timeepoch,"%m")
| where (myDay != "Saturday" AND myDay != "Sunday")
| lookup Workdays myYear myMonth OUTPUT Days
| chart count over computerName by name | eventstats sum(count) as Total by Days
| eval Percent=round(count*100/Total,4)
| eval count=if(Servicetime>100,100.0000,Servicetime)
or
your base search | stats count by computerName name | eventstats sum(count) as Total by Days | eval Percent=round(count*100/Total,4) | ....
... View more
02-24-2016
03:39 AM
see this link it can help you Mr ahmedhassanean
https://answers.splunk.com/answers/320978/how-to-extract-the-timestamp-from-a-filename-at-in.html
... View more
02-23-2016
06:28 AM
try this link :
https://login.splunk.com/index.php?module=roles&func=showloginform&redirecturl=https%3A%2F%2Flogin.splunk.com%2Fpage%2Fsso_redirect%3Ftype%3Dportal
after put your
Username:...
Password:...
lunch to go on this link https://splunkcommunities.force.com/customers/home/home.jsp
... View more
02-23-2016
06:14 AM
try :
sourcetype=DCM_MEAS_XML | rename Measurement.lcp0_shp as lcp0_shp | eval num=if(isnum(lcp0_shp),"yes","no") | eval str=if(isstr(lcp0_shp),"yes","no") | Convert auto(lcp0_shp) as number | eval converted=if(isnum(number),"yes","no") | stats values(num) values(str) values(converted) values(number) by _time
... View more
02-23-2016
04:47 AM
in CLI; go to splunk_home/bin/ use splunk clean command to do it
you can first run splunk help clean command to understand how clean command is it work
... View more
02-23-2016
01:21 AM
you can send your query ?
... View more
02-22-2016
05:11 AM
try like :
[you_index_name]
CHARSET = UTF-8
NO_BINARY_CHECK = 1
TIME_FORMAT = %a %b %d %H:%M:%S %z %Y
TIME_PREFIX = "__time":"
MAX_TIMESTAMP_LOOKAHEAD = 150
SHOULD_LINEMERGE = false
TZ = UTC
KV_MODE = json
... View more
02-22-2016
05:00 AM
1 Karma
try like:
...|bucket _time span=1months| top Type by _time
... View more
02-22-2016
03:22 AM
1 Karma
to chart of the percentage of these three values , try like :
...| top Type
or
try thi :
...| stats count by Type | eventstats sum(count) as total | eval percent = round(count/total) . " %" | fields - total
... View more
02-19-2016
02:05 AM
try like:
...| spath input=json|rename FIELDNAME as "your_FIELDNAME" |...|fields your_FIELDNAME
... View more
02-16-2016
04:57 AM
use clean command in splunk to do it.
from splunk_home/splunk/bin/ repertory in CLI,
run ./splunk help clean to understans how clean command work.
like this :
./splunk clean eventdata -index your_index_name -f
... View more
02-16-2016
02:49 AM
try like this :
index="wineventlog" source="wineventlog:security" EventCode="4624" (user=userID) |eval AD_Time=strftime(_time, "%Y/%m/%d %H:%M:%S")|rename user AS Account| appendcols [search index=xyz sourcetype="xyz" act="Action" (duser=userID) |eval CA_Time=strftime(_time, "%Y/%m/%d %H:%M:%S")| rename duser AS Account, act AS Action] | eval Timediff=AD_Time-CA_Time | eval Timediff=strftime(_time,"%H:%M:%S") | table AD_Time Account CA_Time Action Timediff
... View more
02-09-2016
05:38 AM
use 'chmod' command linux to do it.
like this: chmod -R repertoire
in your case : chmod -R 444 SPLUNK_HOME/etc/apps/sample_app
this link can help you : https://doc.ubuntu-fr.org/permissions
... View more
02-09-2016
04:00 AM
you use ' head ' command like that :
index=* app=""
| chart sum(sentbyte) as sum_send, sum(rcvdbyte) as sum_rcv by app
| addtotals fieldname=total_byte sum_
| sort - total_byte
| head 3
... View more
02-05-2016
01:03 AM
1 Karma
You can tag your indexe with your tag_name, and view them with tag::index.
... View more
