Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- Find Answers
- :
- About stephanefotso
stephanefotso
Motivator
Member since:
12-11-2014
2 weeks ago
Community Statistics
| Posts | 395 |
| Solutions | 56 |
| Karma Given | 0 |
| Karma Received | 148 |
| Member Since | 12-11-2014 |
Activity Feed
- Got Karma for Re: "bucket _time span=..." has no affect on search results. 09-27-2023 08:57 AM
- Got Karma for Re: Why am I getting this error? - "Error in 'outputlookup' command: The lookup table 'Permission denied for collection 'mycollection'' is invalid.". 09-21-2023 01:07 AM
- Got Karma for Re: How do I access my local Splunk enterprise instance from another local computer on my network?. 02-04-2023 10:55 PM
- Got Karma for Re: Making a chart and I want to change columns header names from Windows eventlog EventCodes to something readable. 01-19-2022 02:53 PM
- Got Karma for Re: how to sort() version values.. 12-17-2020 06:03 AM
- Posted Re: How do I access my local Splunk enterprise instance from another local computer on my network? on Security. 12-13-2020 12:42 PM
- Posted Re: how to sort() version values. on Splunk Search. 12-13-2020 11:55 AM
- Got Karma for Re: Is it possible to create an alert that depends on another alert to be triggered?. 09-18-2020 08:16 AM
- Got Karma for Re: How to combine two values from separate searches to get an average?. 06-05-2020 12:47 AM
- Got Karma for Re: Starting Splunk Enterprise. 06-05-2020 12:47 AM
- Got Karma for Re: I have created an alert and setup email for it but its not working. 06-05-2020 12:47 AM
- Got Karma for Re: No Visualisation although enough values. 06-05-2020 12:47 AM
- Got Karma for Re: Making a chart and I want to change columns header names from Windows eventlog EventCodes to something readable. 06-05-2020 12:47 AM
- Got Karma for Re: Making a chart and I want to change columns header names from Windows eventlog EventCodes to something readable. 06-05-2020 12:47 AM
- Got Karma for Re: How to display the average of the week as a straight line overlay in a timechart?. 06-05-2020 12:47 AM
- Got Karma for Re: How to display the average of the week as a straight line overlay in a timechart?. 06-05-2020 12:47 AM
- Got Karma for Re: How to display the average of the week as a straight line overlay in a timechart?. 06-05-2020 12:47 AM
- Got Karma for Re: How to calculate percentage and display this on a timechart?. 06-05-2020 12:47 AM
- Got Karma for Re: How to edit my search to output results to separate rows based on multiple values?. 06-05-2020 12:47 AM
- Got Karma for Re: how to generate error count report. 06-05-2020 12:47 AM
Topics I've Started
No posts to display.
06-12-2015
02:41 PM
2 Karma
Hello/
The top command Finds the most frequent tuple of values of all fields in the field list, along with a count and percentage. Means search something | top host_ip, username , will find the most frenquent values of the field host_ip , and the most frequent values of the field username
If the optional by-clause is provided, top will find the most frequent values for each distinct tuple of values of the group-by fields. http://docs.splunk.com/Documentation/Splunk/6.2.3/SearchReference/Top
Thanks
... View more
06-12-2015
10:29 AM
1 Karma
Hello! Try a search like this:
index=_internal sourcetype=scheduler thread_id=AlertNotifier* NOT (alert_actions="summary_index" OR alert_actions="")|table run_time alert_actions app status
Youa can add more fields as you need in your table
Thanks
... View more
06-12-2015
10:01 AM
wo wo wo. Thanks. That is verry clear now. Sorry
Thanks again!
... View more
06-12-2015
09:45 AM
Sorry, but i don't understand when you say, you want the total number of days for each day of the week and that is why i'v said you don't need the by date_wday clause here. I'm really sorry.
Thanks
... View more
06-12-2015
08:22 AM
Lets get your search query please.
... View more
06-12-2015
08:12 AM
1 Karma
Hello! Bucket/bins does not means number of rows, but it means number of rows if possible. When you say: index= _internal | bucket size bins=3 |stats count(_raw) by size it just means: Bucket search results into 3bins, and return the count of raw events for each bucket. Depending of your time range,and the number of events, you could get 0,1, 2, or 3 rows max, not 4.
Thanks
... View more
06-12-2015
08:00 AM
Hello! As woodcock is saying, you are not using the time you have extracted. Also, i think you don't need the by clause herere. I propose that you opdate your query like this:
base search | rex field=_raw "(?P<paymentAmount>\w+) date_wday: (?P<time>\d+)ms" | eval date_wday=strftime(time,"%w-%A")| stats sum(paymentAmount), count(date_wday) | eval date_wday=replace(date_wday,"(\d+-)(\w+)","\2")
Thanks
... View more
06-12-2015
07:29 AM
1 Karma
Hello! Here is one option: Just say donot display null events where field=blank. ...|where field!=" "
index=_internal sourcetype=*|stats count by sourcetype|where sourcetype!= " "
Thanks
... View more
06-12-2015
07:18 AM
That is what you have to know. If you want to reuse the initial value of a field in your search query, do not assign to that field a value, before the use of the field. For example:
Let suppose that you have a field named field1, and that, initially field1=10.
Then in your search query, if you do something like this: ...|eval field1=50|eval field2=field1+5|table field1 field2
result:
field1 field2
50 55
As you can see, the initial value of field1 has change, and that is why field2=55.
But if you do like this: ...|eval field2=field1|eval field3=field1+5|table field1 field2 field3
result:
field1 field2 field3
10 10 15
Here the initial value of field1 did not change, and t that is why you have field3=15
Thanks
... View more
06-12-2015
04:46 AM
You can set it both via splunk web or the configuration file.
Via splunk web:
First, create the index: Settings -->Indexes -->New and create your index
Second, index your log: From splunk home, Add data--> Monitor . Select the source, ......... At the Next screen, select the index, ........ ....
... View more
06-12-2015
04:05 AM
I do not know if I've understood very well your problem. field1 is not the field you want to reuse? Because |eval newfield=field1 will not change de value of field1, But the value of newfield will be the value of field1.
... View more
06-12-2015
03:57 AM
Hello! You can first create your index. During indexing your logs, you will be prompted to select the index. Just select your index, and everything will be ok.
Thanks
... View more
06-12-2015
03:49 AM
Hello! The only way to use the initial value of field1 it is to use the eval or a subsearch.
And if you use eval, do something like this: |eval newfield=field1 , and not |aval field1=newfield , because it will change the initial value of field1.
Thanks
... View more
06-12-2015
02:04 AM
2 Karma
Hello! That is simple.
Just add the search view to your django app, by addind this to your app nav menu.
Now you can launch any search from your application, and then save it as an alert.
Thanks
... View more
06-12-2015
01:07 AM
2 Karma
Hello!
In your Django app, you can integrate both xml, html, and Django's views
To integrate your django's views, just put your html files in $SPLUNK_HOME/etc/apps/your_app_name/django/your_app_name/templates
To integrate xml views, just put your xml files on $SPLUNK_HOME/etc/apps/your_app_name/default/data/ui/views
To integrate simple html files (for example when you convert a xml dashboard to html view ), put your html files in $Splunk/etc/apps/your_app_name/appserver/static/html/
You can create and access your xml views via splunk web: settings -->user interface--> views ,
The nav menu on settings -->user interface--> Navigation Menu let you manage all your pages. Here is an example
<nav>
<view name="my_xml_view" default="true"/>
<a href="/dj/redirector/Steph_Django/my_django_page">my first django page</a>
...
</nav>
Conclusion: With your django app, you can develop features in UI and Django
Thanks
... View more
06-11-2015
11:13 AM
On settings --> User Interface --> Views, first select your application in the App context drop down menu. After the selection, you will see the name of your html page . Under acctions , Click on open to launch the dashboard, and let me know if it is working as you need.
Thanks
... View more
06-11-2015
07:28 AM
Please let me understand. In your table above which value do you want to remove?
... View more
06-11-2015
07:09 AM
View your comment, you must first extract IP and URL to detect that clientIP1 visit an order - "URL1, URL2, URL3"
Here you go.
.... |rex field=_raw "^(?:[^ \n]* ){2}(?P<IP>\w+)\s+[^\)\n]*\)\"\s+\"(?P<url>\w+)"|transaction IP startswith=(url=URL1) endswith=(url=URL3)|table IP url
You can also count .......
.... |rex field=_raw "^(?:[^ \n]* ){2}(?P<IP>\w+)\s+[^\)\n]*\)\"\s+\"(?P<url>\w+)"|transaction IP startswith=(url=URL1) endswith=(url=URL3)|stats count
Thanks
... View more
06-11-2015
01:59 AM
Hello! Can we get a sample data of your log, and also please can you explain how one IP visits one Visit Order? Maybe something which can help write the query?
Thanks
... View more
06-11-2015
12:10 AM
. My regex just means, after ] extract the informations field, and after that field, take all caracters, except the - , and create a ID field with that values.
This means that, if INFO, ERROR or WARN are not followed by ID, the informations field will still be extracted, but the ID field will be populated with wrong values
Thanks
Do not forget to accept the answer, if are satisfy .
... View more
06-10-2015
05:29 PM
2 Karma
Hello! You will find all you need here: http://docs.splunk.com/Documentation/Splunk/6.2.0/Knowledge/Aboutdatamodels
Thanks
... View more
06-10-2015
05:20 PM
2 Karma
ok copy your html file here: $Splunk/etc/apps/your_app_name/appserver/static/html/ . On settings -->user interface--> views , in your app context, you will see your dashboard, run it again and let me know.
Please if a folder does not exist, create it.
Thanks
... View more
06-10-2015
04:57 PM
I want to say, when you click the Philippines link in the results to view events, change the time range of the search in the search bar to all time and let me know.
If still not working, make sure that, your lookup table and lookup definition are shared globally.
... View more
06-10-2015
04:41 PM
Hello! Did your verify the time range? Set it to all time and let me know
Thanks
... View more
06-10-2015
04:28 PM
Hello. Please let me know. Is the conversion was from xml to HTML dashboard?
Thanks
... View more
