Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- Find Answers
- :
- About Mohsin123
Mohsin123
Path Finder
Member since:
08-10-2018
04-07-2022
Community Statistics
| Posts | 146 |
| Solutions | 0 |
| Karma Given | 1 |
| Karma Received | 4 |
| Member Since | 08-10-2018 |
Activity Feed
- Posted Is there any splunk query to fetch vmware snapshots? on Getting Data In. 04-06-2022 07:53 AM
- Posted Re: splunk service availability dashboard on Dashboards & Visualizations. 02-26-2022 01:02 AM
- Posted Re: splunk service availability dashboard on Dashboards & Visualizations. 02-26-2022 12:58 AM
- Karma Re: splunk service availability dashboard for gcusello. 02-26-2022 12:53 AM
- Posted Re: splunk service availability dashboard on Dashboards & Visualizations. 02-25-2022 09:37 PM
- Posted Error in timestamp at earliest- How can I fix this? on Splunk Search. 02-25-2022 12:04 PM
- Posted Traffic light view to my service availability- Am I able to implement something like this? on Dashboards & Visualizations. 02-25-2022 04:34 AM
- Posted how to make a new field based on status code on Dashboards & Visualizations. 02-25-2022 02:11 AM
- Posted Re: How to hide token which is in the row and panel and not in fieldset? on Dashboards & Visualizations. 02-25-2022 02:02 AM
- Posted How to hide token which is in the row and panel and not in fieldset? on Dashboards & Visualizations. 02-24-2022 11:34 AM
- Posted Re: splunk service availability dashboard on Dashboards & Visualizations. 02-18-2022 04:27 AM
- Posted Re: splunk service availability dashboard on Dashboards & Visualizations. 02-18-2022 04:14 AM
- Posted Re: splunk service availability dashboard on Dashboards & Visualizations. 02-18-2022 04:08 AM
- Posted Re: splunk service availability dashboard on Dashboards & Visualizations. 02-18-2022 04:08 AM
- Tagged Trouble with creating a splunk service availability dashboard on Dashboards & Visualizations. 02-18-2022 03:36 AM
- Tagged Trouble with creating a splunk service availability dashboard on Dashboards & Visualizations. 02-18-2022 03:36 AM
- Posted Trouble with creating a splunk service availability dashboard on Dashboards & Visualizations. 02-18-2022 03:12 AM
- Got Karma for Can you help me use the "sort" and "top" commands in a search?. 06-05-2020 12:50 AM
- Got Karma for Which index does search.log data populates in, in splunk?. 06-05-2020 12:49 AM
- Got Karma for Re: How to create a dashboard showing in progress, completed, and pending status. 06-05-2020 12:49 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
07-07-2018
06:12 AM
Hi ,
i have a events based on such a flow :
every transaction id has 4 logpoints (logpoint is a field) :
request-in , request-out,response-in,response-out
Can anyone help ?
... View more
- Tags:
- uniq
07-06-2018
12:39 AM
hi ,
i'm computing this :
failure=Uniq(# transaction_id having Req-in, NO Req-out and Response out with status-code=500)/ Uniq(# transaction_id of Req-in)
fields : logpoint, transaction-id,status-code
logpoint values: request-in,request-out,response-in,response-out
to translate this :
failure is the computation result
Numerator : unique transaction ids for those logpoints which have request in and no request out AND response out with status code as 500)
NOTE : every logpoint has a status code
so by response code with status cod=500 means only for response-out
Denominator: unique transaction ids with logpoint as request-in
... View more
07-05-2018
06:58 AM
Also Niket,
Can i use 2 where condition in a single search , each where should be made on the base search
... View more
07-05-2018
06:38 AM
eval a = if( countrycode=NZ and countrycode!=AU , then a= employee ids of both the satisfying condition
eval b=if(areacode=2345, then b=employee ids of the satisfying condition
combine a and b into c
... View more
07-05-2018
06:37 AM
eval a = if( countrycode=NZ and countrycode!=AU , then a= employee ids of both the satisfying condition
eval b=if(areacode=2345, then b=employee ids of the satisfying condition
combine a and b into c
... View more
07-05-2018
05:15 AM
Hi ,
Can I use an eval statement inside an if?
I have to implement something like this :
I have two fields : one country code and another area code .
I have to give list of employee ids who have country code as NZ , country code not like AU and area code like 2345
Can anyone help me with this?
... View more
06-18-2018
04:09 AM
Also , i wrote this
it says , error ..invalida character name
... View more
06-18-2018
04:03 AM
Hi Niket,
I am using this calender functionalty . Could you please help me where exactly i will write this..
i placed it in sh deployer's path :
/opt/SP/apps/splunk/etc/shcluster/apps/analytics/default
as calendar_custom_override.css
and pushed the app .
is this enough ?
would you mind sharing your number?
... View more
06-14-2018
01:30 AM
Hi,
My source file gets updated every 5 minutute . How to chart values of a field by the latest source file?
... View more
06-13-2018
07:11 AM
no it dint work
this is my sample
No it dint work,
this is my sample
6/13/18
4:10:04.000 PM
{ [-]
cdate: Wed Jun 13 16:10:04 2018
finalStatus: SUCCEEDED
id: application_xxxxx
name: Export job (158882): xxxxxxxxxxxxxx
startedTime: 1528840802983
user: xxxx
}
... View more
06-13-2018
07:11 AM
No it dint work,
this is my sample
6/13/18
4:10:04.000 PM
{ [-]
cdate: Wed Jun 13 16:10:04 2018
finalStatus: SUCCEEDED
id: application_xxxxx
name: Export job (158882): xxxxxxxxxxxxxx
startedTime: 1528840802983
user: xxxx
}
... View more
06-13-2018
06:46 AM
Hey There !
I have this sort of entry in my event :
startedTime: 1528840802983
this is in epoch time
I was trying a regex for the TIME_FORMAT
TIME_PREFIX=\"startedTime\": \"
TIME_FORMAT= %s%3N
Could you pl correct me on the TIME_FORMAT
... View more
05-03-2018
08:32 AM
Hi ,
I have to implement this in a dashboard .
i have to create a dashboard for a job status percentage formula , the logic is as below :
in a 5 min interval , there is job status information in splunk :
sample
status=complete
status=running
status=running
so and so ....
Logic:
say within 5 min interval, wen the data ingests in ,
Running : 10
Succeeded:5
Failed: 2
Killed: 1
so percentage of job succeeded =( total jobs succeeded / total jobs already done)* 100
=(5/8(5+2+1))* 100
Now after 5 min ,
Running : 2+5 (new jobs added)
Succeeded: 5
Failed: 1
Killed: 2
so percentage of job succeeded =( total jobs succeeded / total jobs already done)* 100
=(5 (now) + 5 from(previous 5 min))/16 (5+2+1(from previous) + (5+1+2)(from now)) * 100
dashboard requirement :
show a single value of job success in live in percentage .
rules:
1. A single job has to be considered once .
2. in that gap of 5 minutes , whatevr job has a state change should also appear in the pecentage
Thanks
... View more
- Tags:
- jobprogress
03-16-2018
02:45 AM
Hi ,
ERROR UiAuth - user= action=login status=failure reason=sso-failed useragent="Mozilla/5.0 (Windowxxxxxxxx64; x64) AppleWxxxxxxxxML, like Gecko) Chrome/64.0.3282.137.36" clientip=10.2xxx6
action = login host = xxx SHC index = _internal message = user= action=login status=failure reason=sso-failed useraxxxxxindows NT 6.1; WinxxxxxKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.186 Safari/537.36" clientip=10xxxx8.6 reason = sso-failed
... View more
- Tags:
- unauthorized
03-14-2018
11:52 PM
I asked you how we can rewrite event at HF level, so that data come only having Body data.
You are giving me query I gave you 😄
... View more
03-14-2018
03:38 AM
Hi,
I want to replace my events with _raw=Body
can anyone help ? pl let me know the regex .
Regards
Shraddha
... View more
03-09-2018
10:28 AM
Hi,
I'm getting the below error while deploying an app from the deployer
/opt/SP/apps/splunk/bin $ ./splunk apply shcluster-bundle -target https://:8089 Warning: Depending on the configuration changes being pushed, this command might initiate a rolling restart of the cluster members. Please refer to the documentation for the details. Do you wish to continue? [y/n]: y Error while deploying apps to first member: Error while updating app=xyz on target=https://:8089: Non-200/201 status_code=404; {"messages":[{"type":"ERROR","text":"Application does not exist: "}]}
Pls suggest
Regards Shraddha
... View more
- Tags:
- deployer
Labels
- Labels:
-
deployer
02-28-2018
06:38 AM
Thanks,
finding macros:
|rest splunk_server=* /servicesNS/-/-/admin/macros|where like(definition,"%idx_abc%")
... View more
02-28-2018
02:42 AM
Hi,
I want to extract list of all the views,searches, dashboards that use a particular index, say , idx_abc and the fields used in them all.
List of views and searches part is done (open for suggestions) :
List of searches :
| rest timeout=600 splunk_server=local /servicesNS/-/-/saved/searches|eval scheduled=if(is_scheduled=1,"yes","no")|where like(search,"%idx_abc%")|table title search scheduled
List of views :
| rest /servicesNS/-/-/data/ui/views splunk_server=*|rename eai:data as data|where like (data,"%idx_abc%")|table label, data
How to get list of fields used ???
Also , there might be eventtypes and macros making use of idx_abc (though i have checked manually at UI) . Still any idea of a query ?
Thanks,
Shraddha
... View more
Hi ,
One of the scheduled search fails at the time9and even changed) with this error in scheduler.log
status=delegated_remote_error
Pls help
Regards
Shrdadha
... View more
- Tags:
- scheduled-search
02-21-2018
01:40 AM
Hi ,
Its strange something that has happened in our cluster today .
We find all our roles, except a few , missing from the splunk search head .
We did no change but we performed an app upgrade last night where we pushed bundle to the cluster .
Any idea what might have happened that has caused most of the roles to disappear .
And any idea how to recover ?
Thanks,
Shraddha
... View more
- Tags:
- roles
02-15-2018
05:12 AM
1 Karma
Hi ,
Does anyone know which index does search.log data populates in?
I find search.log during a job inspect, mostly its the source /var/run/ dispatch.
How to fetch that in Splunk UI?
Also another question,
What does the line below represent? Does it report the size in MB?
INFO DispatchThread - Disk quota = 31457280000
Cheers !
... View more
- Tags:
- index
- search.log
02-14-2018
12:36 AM
Hi Ansif,
Let me clarify a bit ..
We have around 300 approx hosts which send data to splunk .
At those ends if forwarders are there , then in their outputs.conf file , our HFs are reporting .
we want them to change the details of HFs .
Now challenge is that few hosts already have our new HF details and few are pointing to the old ones that we are planning to decommision .
So , i found out list of hosts that send data to splunk by using below queries ...but how can i know which host have pointers to old HFs and which have pointers to new HFs . Can you please frame me a query to achieve this ?
My queries used are below :
index=_internal sourcetype=splunkd source=*metrics.log forwarder|eval forwarder=mvindex(split(source, "/"),-5)|chart values(forwarder) as FORWARDER by host
index=_internal |chart values(h) as HOST by idx
... View more
02-13-2018
02:08 AM
Hi,
Can anyone help me with the query how to list the hosts with forwarder and port details .
Ex, which application has which hosts and whther they have forwarders installed or not?
If they have then , which forwarders are they pointing to with port details
... View more
- Tags:
- forwarders
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
04-07-2022
06:50 AM
|
