Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- Find Answers
- :
- About vrmandadi
vrmandadi
Builder
Member since:
08-14-2015
03-06-2023
Community Statistics
| Posts | 624 |
| Solutions | 5 |
| Karma Given | 58 |
| Karma Received | 30 |
| Member Since | 08-14-2015 |
Activity Feed
- Got Karma for Re: "Other" in timechart. 12-05-2023 04:19 AM
- Got Karma for Re: "Other" in timechart. 01-13-2023 05:27 AM
- Posted Re: How to have different color for each bar in column chart? on Dashboards & Visualizations. 12-20-2022 10:21 AM
- Posted Re: Timechart to show only when values change for a particular field on Splunk Search. 12-16-2022 10:30 AM
- Posted How to have different color for each bar in column chart? on Dashboards & Visualizations. 12-16-2022 10:30 AM
- Karma Re: Timechart to show only when values change for a particular field for bowesmana. 12-16-2022 10:30 AM
- Posted How to create a timechart to show only when values change for a particular field? on Splunk Search. 12-12-2022 08:50 PM
- Posted Re: Can we delete the fishbucket for a specific index ? on Splunk Search. 12-08-2022 12:27 PM
- Posted Re: Can we delete the fishbucket for a specific index ? on Splunk Search. 12-08-2022 10:41 AM
- Posted Can we delete the fishbucket for a specific index ? on Splunk Search. 12-08-2022 08:07 AM
- Posted Re: How to compare a column with multiple columns in splunk and highlight the cell not matching with red on Splunk Search. 11-21-2022 08:48 AM
- Posted Re: How do you change the cell color based on partial value? on Dashboards & Visualizations. 11-21-2022 08:23 AM
- Posted How to compare a column with multiple columns in Splunk and highlight the cell not matching with red? on Dashboards & Visualizations. 11-21-2022 07:24 AM
- Posted Re: How to compare a column with multiple columns in splunk and highlight the cell not matching with red on Splunk Search. 11-18-2022 04:24 PM
- Posted How to compare a column with multiple columns in Splunk and highlight the cell not matching with red? on Splunk Search. 11-18-2022 08:27 AM
- Posted Re: How can I optimize my query ? on Splunk Search. 11-10-2022 08:41 AM
- Posted How can I optimize my query ? on Splunk Search. 11-09-2022 12:47 PM
- Posted Re: Compare csv and search and show results which are different from csv on Splunk Search. 11-04-2022 10:13 AM
- Posted Re: Compare csv and search and show results which are different from csv on Splunk Search. 11-04-2022 07:42 AM
- Posted How to compare csv and search and show results which are different from csv? on Splunk Search. 11-03-2022 06:41 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
02-05-2016
01:00 PM
I am trying to calculate the average response time for the below field
ENDPOINT_LOG{}.EML_RESPONSE_TIME: 2016-01-19 15:44:08.127 +00:00
Since the above field has date along with time, it is not able to calculate the avg response time by using the simple stats command.
index="main" source="dcd_sample_data_for_splunk_dashboard.txt" sourcetype="dcd" |stats avg (ENDPOINT_LOG{}.EML_RESPONSE_TIME)
I would like to know from you experts, how the regex is written for this and calculate the avg response time
... View more
02-01-2016
09:00 PM
Thank You for your reply,I will let you know for any specific one.
... View more
02-01-2016
08:55 PM
I have used the following when indexing the data
Sourcetype=system Defaults
breaktype as regex
Pattern: Request Message Qualifier
timestamp : Current time
The data look like this in splunk for each event
The above image shows how data looks in splunk ,but i want request message qualifier,inquiry type,bank,account etc in interesting fields
... View more
02-01-2016
08:43 PM
I have used the following when indexing the data
Sourcetype=system Defaults
breaktype as regex
Pattern: Request Message Qualifier
timestamp : Current time
The data look like this in splunk for each event
I want request message qualifier,inquiry type,bank,account etc in interesting fields ..Is that possible
... View more
02-01-2016
05:25 PM
I have the below sample data and I want to break the events at the request message qualifier field
Request Message Qualifier: CMO_REQ Inquiry Type : DEP Bank: PB_ABA1 Amount: 12500 # $125.00 which is less than $500.00. Response Message Qualifier: CMO_RES Instrument Type: CHK Payment Guarantee: G Request Message Qualifier: CMO_REQ
Inquiry Type : DEP Bank: PB_ABA1 Amount: 150000 # $1500.00 is more than $500 Response Message Qualifier: CMO_RES
Instrument Type: CHK Payment Guarantee: G.................................
I want to break the above event at Request Message Qualifier i.e. the events starts with Request Message Qualifier and end at Payment Guarantee .
I have also attached the sample file.
Please help on this.Thanks in advance
... View more
09-22-2015
09:12 AM
who is a splunk analyst what are his roles and how is he different from a developer
... View more
- Tags:
- splunk
09-09-2015
12:42 PM
thank you so much guys
... View more
09-09-2015
11:31 AM
Hi somesh if you dont mind can i have your email id..i have seen you have almost 3 yrs exp in splunk as a dev and admin
... View more
09-09-2015
11:27 AM
ya so is there anything to do with that
... View more
09-09-2015
11:16 AM
if the avg of three fields calgary+leatherhead+Melbourne/3 is greater than 300 then the avg value should be displayed and it should fall in good category for example
_time calgary houston
2015-09-08 10 20
melbourne average status
30 20 good
the average of 10+20+30/3=20
since its avg is greater than 10 it is good or else it should be bad
... View more
09-09-2015
10:56 AM
can you see the pic now
... View more
09-09-2015
07:34 AM
1) In the picture attached, I want to display the values >300 as good and less than 300 as bad
2) The other part is to calculate the avg of each row (i.e. (calgary+leatherhead+Melbourne)/3) and display a new column with the avg of those, and if the value is >350 it is good and less than 350 as bad
... View more
09-08-2015
07:15 AM
I tried -1w@w5 but itstill it has the weekend and 0w@w5 is not parsing
... View more
09-04-2015
11:10 AM
I tried your answer but it is showing an error saying cannot parse time argument
... View more
09-04-2015
11:04 AM
so using the above finish time give me the report for 1yr till last week ignoring the last weekend right?
... View more
09-04-2015
10:27 AM
I am creating an alert for which I need the time range for the last one year till last week, but it should ignore the weekend of the last week?
the start time is : -1y@s
finish time: -1week@week ...this is for last one yr and ignoring the last week
thanks in advance
... View more
09-03-2015
12:04 PM
it should be random
... View more
09-03-2015
10:54 AM
How can I add a drop-down box where we can select hours, day. Can anybody please help?
... View more
09-02-2015
12:10 PM
2015-09-02T14:01:02.228 Name=UPS6Z444706F2 Chkd_Out=Y DomID="Upstreamaccts\\racantr" Model="ProLiant WS460c Gen8 WS Blade" VideoAdapter="NVIDIA Quadro K3100M,HP Remote Graphics Driver" q_Action=reboot q_Status=SUCCESS q_DTRequest=1441219778.000 MenuID=43 RootName=RGFX Level1Name=Standard Type=Win7 Category=RGFX
Name = UPS6Z444706F2
host = UPSSQL15
source = dbmon-tail://WoRP/Worp_Reboot1
sourcetype = rgfx_Rebootstatus
The above is one event of many. I want to know the top 10 Name by q_Action
... View more
I used this and it worked
0 */12 * * *
... View more
i tried using your example it says invalid cron
... View more
- « Previous
- Next »
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
03-06-2023
02:14 PM
|
