Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- Find Answers
- :
- About vrmandadi
vrmandadi
Builder
Member since:
08-14-2015
03-06-2023
Community Statistics
| Posts | 624 |
| Solutions | 5 |
| Karma Given | 58 |
| Karma Received | 30 |
| Member Since | 08-14-2015 |
Activity Feed
- Got Karma for Re: "Other" in timechart. 12-05-2023 04:19 AM
- Got Karma for Re: "Other" in timechart. 01-13-2023 05:27 AM
- Posted Re: How to have different color for each bar in column chart? on Dashboards & Visualizations. 12-20-2022 10:21 AM
- Posted Re: Timechart to show only when values change for a particular field on Splunk Search. 12-16-2022 10:30 AM
- Posted How to have different color for each bar in column chart? on Dashboards & Visualizations. 12-16-2022 10:30 AM
- Karma Re: Timechart to show only when values change for a particular field for bowesmana. 12-16-2022 10:30 AM
- Posted How to create a timechart to show only when values change for a particular field? on Splunk Search. 12-12-2022 08:50 PM
- Posted Re: Can we delete the fishbucket for a specific index ? on Splunk Search. 12-08-2022 12:27 PM
- Posted Re: Can we delete the fishbucket for a specific index ? on Splunk Search. 12-08-2022 10:41 AM
- Posted Can we delete the fishbucket for a specific index ? on Splunk Search. 12-08-2022 08:07 AM
- Posted Re: How to compare a column with multiple columns in splunk and highlight the cell not matching with red on Splunk Search. 11-21-2022 08:48 AM
- Posted Re: How do you change the cell color based on partial value? on Dashboards & Visualizations. 11-21-2022 08:23 AM
- Posted How to compare a column with multiple columns in Splunk and highlight the cell not matching with red? on Dashboards & Visualizations. 11-21-2022 07:24 AM
- Posted Re: How to compare a column with multiple columns in splunk and highlight the cell not matching with red on Splunk Search. 11-18-2022 04:24 PM
- Posted How to compare a column with multiple columns in Splunk and highlight the cell not matching with red? on Splunk Search. 11-18-2022 08:27 AM
- Posted Re: How can I optimize my query ? on Splunk Search. 11-10-2022 08:41 AM
- Posted How can I optimize my query ? on Splunk Search. 11-09-2022 12:47 PM
- Posted Re: Compare csv and search and show results which are different from csv on Splunk Search. 11-04-2022 10:13 AM
- Posted Re: Compare csv and search and show results which are different from csv on Splunk Search. 11-04-2022 07:42 AM
- Posted How to compare csv and search and show results which are different from csv? on Splunk Search. 11-03-2022 06:41 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
10-06-2022
09:42 PM
@bowesmana I am using two different indexes and joining using host as common field ..The first index is preos which has events as below for each host .Below preo1 is the host 2022-10-06T06:26:22.075037-07:00 preo1 log-inventory.sh[24540]: Boot timestamp: 2022-10-06 06:15:43 2022-10-06T06:26:22.074872-07:00 preo1 log-inventory.sh[24540]: G driver: version: 55.16, md5sum: B67829A0 2022-10-06T06:26:22.073636-07:00 preo1 log-inventory.sh[24540]: GP: PCISLOT: 000:5:00.0, MODEL: H0 e, PN: 2336-884-A1, SN: 133120196, VBIOS: 6.0.A.00, INFOROM: 520.01.01. I am using the below query using the above index index=preos host=preo1 ("Boot timestamp" OR "GPU driver: version: " OR *0000:45:00*)
| rex field=_raw "sh\[\d*\]\:\s*(?<GPU>[^\:]+)\s*\:\s*PCISLOT\:\s*(?<PCIe_Bus_Id>[^\,]+)\,\s*\w*\:\s.*\PN\:(?<PN>[^\,]+)\,\s*SN\:\s*(?<SN>[^.\,]+)\,\s*VBIOS\:\s*(?<VBIOS>[^\,]+)"
| rex field=_raw "Boot\s*timestamp\:\s*(?<Boot_Time>[^.*]+)"
| rex field=_raw "log\-inventory\.sh\[(?<fru_log_id>[^\]]+)"
| rex field=PCIe_Bus_Id "0000(?<PCIe_Bus_Id>[^\.\0]+)"
| rex field=_raw "GPU\sdriver\:\sversion\:\s(?<NV_Driver>[^\,]+)\,"
| stats values(Boot_Time) as Last_Boot_Time values(SN) as SN VALUES(PN) AS PN VALUES(VBIOS) AS NV_VBIOS VALUES(NV_Driver) AS NV_DRIVER values(PCIe_Bus_Id) as PCIe_Bus_Id BY fru_log_id host
| fillnull value=clear
| search SN!=clear PN!=clear NV_VBIOS!=clear NV_DRIVER!=clear
| fields host fru_log_id Last_Boot_Time PCIe_Bus_Id NV_VBIOS NV_DRIVER PN SN The second index is index=syslog with for the same host preo1.Below is the sample event 2022-10-03T05:20:41.545640-07:00 preo1 kernel: [24052.421284] NVRM: Xid (PCI:0000:85:00): 74, pid='<unknown>', name=<unknown>, NVLink: fatal error detected on link 6(0x10000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) Below is the query I am using index=syslog "*NVRM: Xid " process=kernel host IN (preo1)
| rex field=_raw "NVRM\:\sXid\s*\(PCI\:(?<PCIe_Bus_Id>[^ ]+)\)\:\s*(?<Error_Code>[^ ]+)\,\spid\=(?<pid>[^ ]+)\,\s*name\=(?<name>[^ ]+)\,\s(?<Log_Message>.*)"
| search Error_Code="***"
| stats count by host _time PCIe_Bus_Id Error_Code pid name Log_Message
| addcoltotals count labelfield=host label=_Total
| rename _time as eror_time
| table eror_time host PCIe_Bus_Id Error_Code pid name Log_Message count
| sort by -log_time
| dedup pid Now from the above two searches .I am trying to join by host using below search index=preos_inventory host=preos0036 ("Boot timestamp" OR "GPU driver: version: " OR *0000:45:00*)
| rex field=_raw "sh\[\d*\]\:\s*(?<GPU>[^\:]+)\s*\:\s*PCISLOT\:\s*(?<PCIe_Bus_Id>[^\,]+)\,\s*\w*\:\s.*\PN\:(?<PN>[^\,]+)\,\s*SN\:\s*(?<SN>[^.\,]+)\,\s*VBIOS\:\s*(?<VBIOS>[^\,]+)"
| rex field=_raw "Boot\s*timestamp\:\s*(?<Boot_Time>[^.*]+)"
| rex field=_raw "log\-inventory\.sh\[(?<fru_log_id>[^\]]+)"
| rex field=PCIe_Bus_Id "0000(?<PCIe_Bus_Id>[^\.\0]+)"
| rex field=_raw "GPU\sdriver\:\sversion\:\s(?<NV_Driver>[^\,]+)\,"
| stats values(Boot_Time) as Last_Boot_Time values(SN) as SN VALUES(PN) AS PN VALUES(VBIOS) AS NV_VBIOS VALUES(NV_Driver) AS NV_DRIVER values(PCIe_Bus_Id) as PCIe_Bus_Id BY fru_log_id host
| fillnull value=clear
| search SN!=clear PN!=clear NV_VBIOS!=clear NV_DRIVER!=clear
| fields host fru_log_id Last_Boot_Time PCIe_Bus_Id NV_VBIOS NV_DRIVER PN SN
| sort Last_Boot_Time
| join host
[search index=syslog "*NVRM: Xid " process=kernel host IN (preos0036)
| rex field=_raw "NVRM\:\sXid\s*\(PCI\:(?<PCIe_Bus_Id>[^ ]+)\)\:\s*(?<Error_Code>[^ ]+)\,\spid\=(?<pid>[^ ]+)\,\s*name\=(?<name>[^ ]+)\,\s(?<Log_Message>.*)"
| search Error_Code="***"
| stats count by host _time PCIe_Bus_Id Error_Code pid name Log_Message
| addcoltotals count labelfield=host label=_Total
| rename _time as eror_time
| table eror_time host PCIe_Bus_Id Error_Code pid name Log_Message count
| sort by -log_time
| dedup pid]
| eval eror_time=strftime(eror_time,"%Y-%m-%d %H:%M:%S")
| eval diff=eror_time-Last_Boot_Time But the issue is when I am trying to join .I see all results..no issues ..but when I am trying to get the difference between Last_Boot_Time and eror_time I dont get any results.I hope this is clear with events
... View more
10-06-2022
09:21 PM
Hello Splunkers ,
I have the below source code and using the base search as index=syslog process!=switchd but its taking a while to load...is there a better way to write the base search to optimize the searches and make the dashboards load faster
<form theme="dark">
<label>basesearch</label>
<search id="base">
<query>index=syslog process!=switchd |</query>
<earliest>-30m@m</earliest>
<latest>now</latest>
</search>
<fieldset submitButton="false">
<input type="multiselect" token="multi_process" searchWhenChanged="true">
<label>Process</label>
<choice value="*">All</choice>
<default>*</default>
<initialValue>*</initialValue>
<fieldForLabel>process</fieldForLabel>
<fieldForValue>process</fieldForValue>
<search base ="base">
<query>search error OR ERROR OR fail OR failed OR errors OR faulted OR "*NVRM: Xid (PCI*" NOT NOTIFICATION process!=switchd host=$host_preos$
| search $multi_process$
| rex field=_raw "\d{4}\-\d{2}\-\d*\w\d*\:\d*\:\d*\.\d*(\+|\-)\d*\:\d*\s*(\S*)\s*(\S*\:|\S*)\s*(?<Message>(.*))" | search Message!="*failed=0*" Message!="*level=info*" Message=*$search_text$*
| stats count by host process
| dedup process</query>
</search>
<valuePrefix>process="</valuePrefix>
<valueSuffix>"</valueSuffix>
<delimiter> OR </delimiter>
</input>
<input type="text" token="search_text" searchWhenChanged="true">
<label>Search Text</label>
<default>*</default>
</input>
<input type="multiselect" token="host_preos">
<label>Preos Hosts</label>
<fieldForLabel>host</fieldForLabel>
<fieldForValue>host</fieldForValue>
<search base ="base">
<query>search error OR ERROR OR fail OR FAIL OR failed OR Failed OR errors process!=switchd process=* host="preos*"
| rex field=_raw "\d{4}\-\d{2}\-\d*\w\d*\:\d*\:\d*\.\d*(\+|\-)\d*\:\d*\s*(\S*)\s*(\S*\:|\S*)\s*(?<Message>(.*))" | search Message!="*failed=0*" Message!="*level=info*"
| stats count by host
| dedup host</query>
</search>
<choice value="preos*">All</choice>
<default>preos*</default>
</input>
</fieldset>
<row>
<panel>
<title>Error Message Counts - For Host ($host_preos$)</title>
<chart>
<search base ="base">
<query>search "*NVRM: Xid (PCI*62*" OR error OR ERROR OR fail OR failed OR errors OR faulted OR "NVRM: Xid" NOT NOTIFICATION process!=switchd host IN($host_preos$)
| search $multi_process$
| rex field=_raw "\d{4}\-\d{2}\-\d*\w\d*\:\d*\:\d*\.\d*(\+|\-)\d*\:\d*\s*(\S*)\s*(\S*\:|\S*)\s*(?<Message>(.*))"
| search Message!="*failed=0*" Message!="*level=info*" Message=*$search_text$*
| timechart span=1h count(_time) by host limit=0</query>
</search>
<option name="charting.chart">line</option>
<option name="charting.drilldown">none</option>
<option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
<option name="charting.legend.placement">right</option>
<option name="refresh.display">progressbar</option>
</chart>
</panel>
</row>
<row>
<panel>
<title>Overall Error Message Count - For Host ($host_preos$)</title>
<table>
<search base ="base">
<query>search "*NVRM: Xid (PCI*62*" OR error OR ERROR OR fail OR failed OR errors OR faulted OR "*NVRM: Xid (PCI*" NOT NOTIFICATION process!=switchd host IN($host_preos$)
| search $multi_process$
| rex field=_raw "\d{4}\-\d{2}\-\d*\w\d*\:\d*\:\d*\.\d*(\+|\-)\d*\:\d*\s*(\S*)\s*(\S*\:|\S*)\s*(?<Message>(.*))"
| search Message!="*failed=0*" Message!="*level=info*" Message=*$search_text$*
| stats count by host
| addcoltotals labelfield=host
| sort -count</query>
</search>
<option name="drilldown">none</option>
<option name="refresh.display">progressbar</option>
<format type="color" field="host">
<colorPalette type="sharedList"></colorPalette>
<scale type="sharedCategory"></scale>
</format>
</table>
</panel>
<panel>
<title>Error Message Count per Process - For Host ($host_preos$)</title>
<table>
<search base ="base">
<query>search "*NVRM: Xid (PCI*62*" OR error OR ERROR OR fail OR failed OR errors OR faulted OR "*NVRM: Xid (PCI*" NOT NOTIFICATION process!=switchd host IN($host_preos$)
| search $multi_process$
| rex field=_raw "\d{4}\-\d{2}\-\d*\w\d*\:\d*\:\d*\.\d*(\+|\-)\d*\:\d*\s*(\S*)\s*(\S*\:|\S*)\s*(?<Message>(.*))"
| search Message!="*failed=0*" Message!="*level=info*" Message=*$search_text$*
| stats count by host process
| addcoltotals labelfield=host
| sort -count</query>
</search>
<option name="drilldown">none</option>
<option name="refresh.display">progressbar</option>
<format type="color" field="host">
<colorPalette type="sharedList"></colorPalette>
<scale type="sharedCategory"></scale>
</format>
</table>
</panel>
</row>
<row>
<panel>
<title>NVRM Xid Error Summary</title>
<table>
<title>NVRM Xid Error</title>
<search base ="base">
<query>searcg "*NVRM: Xid (PCI*" process!=switchd host IN($host_preos$)
| rex field=_raw "NVRM\:\sXid\s\(PCI\:(?<PCI_Address>[^ \)]+)\)\:\s(?<Error_Code>[^ ]+)\,\s*pid\=(?<pid>[^ ]+)\,\s*name\=(?<name>[^ ]+)\,\s(?<Error_Message>(.*))"
| stats count by host Error_Code Error_Message PCI_Address pid name
| addcoltotals count labelfield=host
| sort -count
| fields host Error_Code Error_Message count PCI_Address pid name</query>
</search>
<option name="count">5</option>
<option name="drilldown">none</option>
<option name="refresh.display">progressbar</option>
<format type="color" field="host">
<colorPalette type="sharedList"></colorPalette>
<scale type="sharedCategory"></scale>
</format>
</table>
</panel>
</row>
<row>
<panel>
<title>RmInit Error on Boot Summary</title>
<table>
<search>
<query>index=syslog **RmInit error ==* process!=switchd host IN($host_preos$)
| search process="nhc-boot.sh"
| rex field=_raw "\[\d*\]\:\s*\[(?<Log_Level>[^\] ]+)"
| rex field=_raw "(prolog\:|kernel\:|\[\d*\]\:)(?<Message> *(.+))"
| rex field=_raw "NHC\:\s*(?<Error_Message>[^.*]+)\=\="
| search Message!="*failed=0*" Message!="*level=info*"
| stats count by host
| addcoltotals labelfield=host
| sort -count</query>
<earliest>$search_time.earliest$</earliest>
<latest>$search_time.latest$</latest>
</search>
<option name="count">10</option>
<option name="drilldown">none</option>
<option name="refresh.display">progressbar</option>
<format type="color" field="host">
<colorPalette type="sharedList"></colorPalette>
<scale type="sharedCategory"></scale>
</format>
</table>
</panel>
<panel>
<title>RmInitAdapter Summary</title>
<table>
<search>
<query>index=syslog *RmInitAdapter* host IN($host_preos$)
| search process="kernel"
| rex field=_raw "\[\d*\]\:\s*\[(?<Log_Level>[^\] ]+)"
| rex field=_raw "(prolog\:|kernel\:|\[\d*\]\:)(?<Message> *(.+))"
| rex field=_raw "NVRM\:\sGPU\s*(?<GPU>[^ ]+)\:\s*(?<Error_Message>[^.*]+)"
| search Message!="*failed=0*" Message!="*level=info*" _raw="*RmInitAdapter failed*"
| stats count by host GPU Error_Message
| addcoltotals labelfield=host
| sort - count</query>
<earliest>$search_time.earliest$</earliest>
<latest>$search_time.latest$</latest>
</search>
<option name="count">6</option>
<option name="drilldown">none</option>
<option name="refresh.display">progressbar</option>
<format type="color" field="host">
<colorPalette type="sharedList"></colorPalette>
<scale type="sharedCategory"></scale>
</format>
</table>
</panel>
</row>
<row>
<panel>
<title>Error Message - For Host ($host_preos$)</title>
<table>
<search base ="base">
<query>search "*NVRM: Xid (PCI*62*" OR error OR ERROR OR fail OR failed OR errors OR faulted OR "*NVRM: Xid (PCI*" NOT NOTIFICATION process!=switchd host IN($host_preos$)
| search $multi_process$
| rex field=_raw "\d{4}\-\d{2}\-\d*\w\d*\:\d*\:\d*\.\d*(\+|\-)\d*\:\d*\s*(\S*)(\s*\S*\s\[\s*\S*\s|\s*\S*\s\[\S*\s|(\S*)\s*(\S*\:|\S*)\s*)(?<Message>(.*))"
| search Message!="*failed=0*" Message!="*level=info*" Message=*$search_text$*
| stats count by host process _time Message
| addcoltotals labelfield=host
| sort -count</query>
</search>
<option name="count">15</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">none</option>
<option name="percentagesRow">false</option>
<option name="refresh.display">progressbar</option>
<option name="rowNumbers">false</option>
<option name="totalsRow">false</option>
<option name="wrap">true</option>
<format type="color" field="host">
<colorPalette type="sharedList"></colorPalette>
<scale type="sharedCategory"></scale>
</format>
</table>
</panel>
</row>
</form>
... View more
- Tags:
- syslog
10-06-2022
01:04 PM
@bowesmana I am sorry its a typo ... I guess the issue is Boot_Time is we are using stats values(Boot_Time) so it has two or three values which is difficult to get the difference..is there way to get the difference
... View more
10-04-2022
02:10 PM
@bowesmana Thank you for your reply and sorry for the late reply... I did the change and made both the timestamps to epoch time . but when doing a difference I dont see the value Last_Boot_Time - 1663311600.000000 eror_time - 1663782065.763202 Following are two Raw events from join: 2022-10-02T22:50:39.841330-07:00 abc log-inventory.sh[24384]: Boot timestamp: 2022-10-02 22:39:53 2022-10-03T05:20:41.545640-07:00 abc kernel: [24052.421284] NVRM: Xid (x): 74, pid='<unknown>', name=<unknown>, nk: link 6(0x10000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0)
... View more
10-04-2022
02:00 PM
Thank you this worked
... View more
09-30-2022
09:38 AM
@johnhuang Thank you for you reply.How do I make it work to only look at the latest events for a host(GPU0-GPU5) .Currently it is showing all the results when there is a change but I only want to see the latest and if there is change show only that. Below is the query I used index=preos_inventory sourcetype = preos_inventory host IN(*)
| rex field=_raw "log-inventory.sh\[(?<id>[^\]]+)\]\:\s*(?<gpu>[^\:]+)\:\s*(?<ios>.*)"
| search gpu=*VBIOS* host=preos
| eval gpu_ios=gpu." : ".ios
| bucket _time span=1m
| appendpipe [| top 1 ios BY _time host | rename ios AS common_ios | table _time common_ios host]
| eventstats max(common_ios) AS common_ios values(gpu_ios) AS gpu_ios BY _time host
| table _time host gpu ios common_ios gpu_ios
| where LEN(gpu)>1 AND ios!=common_ios
... View more
09-29-2022
08:50 PM
I have the following sample event 2022-09-29T19:29:22.260916-07:00 abc log-inventory.sh[24349]: GPU5 IOS: 96 2022-09-29T19:29:22.260916-07:00 abc log-inventory.sh[24349]: GPU4 IOS: 96 2022-09-29T19:29:22.260916-07:00 abc log-inventory.sh[24349]: GPU3 IOS: 96 2022-09-29T19:29:22.260916-07:00 abc log-inventory.sh[24349]: GPU2 IOS: 96 2022-09-29T19:29:22.260916-07:00 abc log-inventory.sh[24349]: GPU1 IOS: 76 2022-09-29T19:29:22.260916-07:00 abc log-inventory.sh[24349]: GPU0 IOS: 96 I want to compare the IOS value for each host and if any one is showing a different value then I want to output the result .In the above events for host=abc all GPU's has IOS value as 96 except for GPU1 which is 76.I want to output the GPU1 and the value of IOS...I tried doing diff but its not working. Thanks in Advance
... View more
Labels
- Labels:
-
development
09-29-2022
08:41 PM
@bowesmana if I remove | eval log_time=strftime(_time,"%Y-%m-%d %H:%M:%S.%3N") and just use in search in the join I dont see the _time field being shown. I get all other table columns but not _time .I am using the below search index=pre host=abc | eval epoch = strptime('Boot_Time', "%Y-%m-%d %H:%S") | stats values(epoch) as Last_Boot_Time values(SN) as SN VALUES(PN) AS PN by id host | fillnull value=clear | fields host id Last_Boot_Time PN SN | join [ search index=syslog host=abc | stats count by host _time PCIe_Bus_Id Error_Code pid name Log_Message | dedup pid]
... View more
09-27-2022
02:13 PM
The issue is not with the two time fields displaying.. the join or working and I see those two time fields are showing up but when I do a difference it's not working... if I do a difference between id and pid I am able to get the result but not with these two time fields
... View more
09-27-2022
12:21 PM
Yes no luck with that...I am assuming its something do with the date/time format . Sample logs: index=preos 022-09-22T13:20:38.713211-07:00 preos log-inventory.sh[24193]: Boot timestamp: 2022-09-22 13:09:59 index=syslog 2022-09-22T11:51:34.272862-07:00 preos kernel: [74400.062429] NVRM: Xid (PCI:0000:45:00): 119, pid=17993, name=cache_mgr_event, Timeout waiting for RPC from GSP! Expected function 76 (GSP_RM_CONTROL) (0x20800a4c 0x4).
... View more
09-27-2022
11:33 AM
I do get the output if I dot use join by host .But as you suggested I did use host but when I am calculating |eval diff=log_time - Last_Boot_Time it is not showing the result
... View more
09-27-2022
09:59 AM
Below is the search I am using.I am joining two indexes and then doing a differences between two timefields Last_Boot_Time ,log_time .But I am unable to get the difference .
index=preos host=*
| stats values(Boot_Time) as Last_Boot_Time values(SN) as SN VALUES(PN) AS PN VALUES(VBIS) AS NV_VBIS VALUES(NV) AS NV values(PCI) as PCI BY id host
| fillnull value=clear
| search SN!=clear PN!=clear NV_VBIS!=clear NV!=clear
| fields host id Last_Boot_Time PCI NV_VBIS NV_DRIVER PN SN
| sort Last_Boot_Time
| join
[search index=syslog
| search Error_Code="***"
| stats count by host _time PC Error_Code pid name Log_Message
| eval log_time=strftime(_time,"%Y-%m-%d %H:%M:%S")
| table log_time host PC Error_Code pid name Log_Message count
| sort by -log_time
| dedup pid]|eval diff=log_time-Last_Boot_Time
. Following are sample events for index=preos (here Boot time is considered as timestamp) 2022-09-22T13:20:38.713211-07:00 preo log-inventory.sh[24193]: Boot timestamp: 2022-09-22 13:09:59
Index=syslog 2022-09-22T11:51:34.272862-07:00 preo kernel: [74400.062429] NVRM: Xid (PCI:xxx): 119, pid=17993, name=che_mr_ent, Timeout waiting for on 76 (P_RM_CONTROL) (0x20800a4c 0x4). Thanks in Advance
... View more
Labels
- Labels:
-
development
09-26-2022
06:44 AM
Thank You..this worked
... View more
09-24-2022
09:00 AM
@bowesmana @isoutamo @richgalloway @@I am sorry if I have not explained it correctly...But I am looking to find difference between all the events with boot time for each host..it might be two or three or ten depending on time range selected..So for instance if a host A has 10 events and host B has 6 events and host C has 5 events I want to find firstly the time difference between each event for a particular host and then do the average of it ..I get correct value if I do this for single host but when I do same by selecting all hosts then it doesn't shows wrong value
... View more
09-23-2022
05:06 AM
@richgalloway I dont want to look at just 2 events..I want to look at all the events in that selected time range and then do the difference and average for each host
... View more
09-23-2022
04:33 AM
@isoutamo I did try your search but it is working if there are only two events of Boot time...if there are more than two then its showing wrong value .I am not sure how streamstats work...can you let me know how it works. Thanks
... View more
- Tags:
- @
09-22-2022
05:07 PM
I am using the below search to first get the difference in time everytime I see an event which has boot timestamp in it and using it first get the difference and then get the average of it by host.I am able to get the result correctly if I do one host per search like host=abc but if I use a wildcharacter for all hosts then I see the results are different (host=*) .I am assuming someother hosts having the events at same time is causing the issue .How to get the correct results for all hosts at a time . I get the time value as 11:50:58.59 if I use only host=abc but when I want to list all hosts (host=*.)for host abc I see value 00:18:18.67
index=abc "Boot timestamp" host=abc | eval _time=strptime(Boot_Time,"%Y-%m-%d %H:%M:%S") | reverse | delta _time as difference_secs | table _time difference_secs host | stats avg(difference_secs) as average by host | eval average=round(average,2) | eval time=tostring(average, "duration") is it possible to get all hosts average or it can be only individual .
Thanks in Advance
... View more
08-12-2022
10:00 AM
@ITWhisperer raw data coming in but no statistical data for that search
... View more
08-09-2022
06:12 PM
Hello SPLUNKERS, I have a field called GPU which has values GPU0,GPU1,GPU2,GPU3. etc ..Some might have 7 values some might have 4 and some might have 3 for each host... I want to compare the current GPU and with the previous event for that host and if there is a difference I want to show what is the difference and if its same then show no difference .For example Current Event : GPU0,GPU1,GPU2,GPU3,GPU4,GPU5,GPU6,GPU7 Previous Event : GPU0,GPU2,GPU6,GPU7 Thanks in Advance I want to output the difference :GPU1,GPU3,GPU4,GPU5
... View more
Labels
- Labels:
-
timechart
08-09-2022
01:43 PM
@ITWhisperer I tried your search but It did not result in any results...I am not sure how your search shows the difference if you only have latest in it | streamstats window=1 current=f global=f latest(id) as pid latest(SN) as pSN latest(PN) as pPN latest(_time) as ptime by GPU
... View more
08-09-2022
01:00 PM
hello @inventsekar .Sorry if my question is bit confusing...I am basically trying to compare events and show the difference if any but I dont know how to do it...so I dont have any comparison operators ..Your search gives earliest and latest data for a particular time range..but it doesnt exactly compare the successive events . I am trying to the search by using a by clause on field "GU" which has 8 values ..I am not sure how to compare | stats latest(id) as id, earliest(id) as eid, latest(SN) as SN, earliest(SN) as eSN, latest(PN) as PN, earliest(PN) as ePN, earliest(_time) as etime, latest(_time) as time by GU
... View more
08-09-2022
09:35 AM
I am trying to write a search that will compare data for the latest event with its previous event and show the difference if any for each host .I am trying to use earliest and latest event but I earliest doesnt take the immediate preceding event
Following is the search I have tried but I dont think its right
index=abc host=xyz | stats latest(id) as id latest(SN) as SN latest(PN) as PN latest(_time) as time by host |stats earliest(id) as eid earliest(SN) as eSN earliest(PN) as ePN earliest(_time) as etime by host
Thanks in Advance Splunkers
... View more
06-01-2022
10:00 AM
Thank you it worked.I never know that we can add + in earliest and latest.Thank you I learned something new
... View more
06-01-2022
09:20 AM
I tried to run line by line. I ran the below search but I only got 8AM events. index=test (earliest=@d+8h latest=@d+9h) OR (earliest=@d+16h latest=@d+17h) | rename "results{}.id" as "id" | bin _time span=1h | stats count(id) as total by _time vrmandadi_0-1654100438141.png
... View more
05-31-2022
01:47 PM
I am trying to get the total count of a field called ID for earliest and latest time for a particular time range. Assume I am looking for a time range of Mor 8AM to 5PM . I want the count of total for a field called "ID" for 8AM TO 9AM and also count from 4PM TO 5PM for field called 'ID" and show what is different if there is a difference in values of ID for hours 8AM TO 9AM and 4PM TO 5PM .
Following is the query I am using
index=test | rename "results{}.id" as "id" | bin _time span=1h | stats count(id) as total by _time | delta total as difference | fillnull value=0 |eval status=case(difference=0, "No change", difference<0, "Device(s) Removed" , difference>0 ,"Device(s) Added") | search status!="No change" | rename _time as time | eval time=strftime(time,"%m/%d/%y %H:%M:%S")
... View more
Labels
- Labels:
-
timechart
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
03-06-2023
02:14 PM
|
