Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About sandeepmakkena
sandeepmakkena
Contributor
Member since:
09-19-2018
06-05-2020
Community Statistics
| Posts | 166 |
| Solutions | 6 |
| Karma Given | 0 |
| Karma Received | 9 |
| Member Since | 09-19-2018 |
Activity Feed
- Got Karma for Day to day comparison. Using stats and timechart.. 06-05-2020 12:50 AM
- Got Karma for How to append column total to column name?. 06-05-2020 12:50 AM
- Got Karma for Re: How to append column total to column name?. 06-05-2020 12:50 AM
- Got Karma for Re: How to setup alert for x% decrease in count by market?. 06-05-2020 12:50 AM
- Got Karma for Re: How to setup alert for x% decrease in count by market?. 06-05-2020 12:50 AM
- Got Karma for Re: What's the delay between last event written to disk and now()?. 06-05-2020 12:50 AM
- Got Karma for Re: What's the delay between last event written to disk and now()?. 06-05-2020 12:50 AM
- Got Karma for Re: Length of every column in a table?. 06-05-2020 12:50 AM
- Got Karma for Re: Way to monitor splunkforwarder. 06-05-2020 12:50 AM
- Posted Re: Group by id. on Splunk Search. 11-11-2019 09:48 AM
- Posted Group by id. on Splunk Search. 11-08-2019 07:18 PM
- Tagged Group by id. on Splunk Search. 11-08-2019 07:18 PM
- Posted Re: print latest and values of status in an order. on Splunk Search. 11-08-2019 07:05 PM
- Posted Re: print latest and values of status in an order. on Splunk Search. 11-08-2019 06:05 PM
- Posted print latest and values of status in an order. on Splunk Search. 11-08-2019 05:14 PM
- Tagged print latest and values of status in an order. on Splunk Search. 11-08-2019 05:14 PM
- Posted Re: How to calculate percentage of usage on VPN on Security. 11-05-2019 02:31 PM
- Posted Re: Setting Workload Categories for Workload Management on Reporting. 11-05-2019 02:19 PM
- Posted Re: Pass Variable to Panel Title. on Dashboards & Visualizations. 11-05-2019 02:11 PM
- Posted Re: Blank screen instead of raw data on Dashboards & Visualizations. 11-04-2019 04:11 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
10-15-2019
04:03 PM
sourcetype=iis
cs_uri_stem="/SeverA*"
| eval myfield=case(time_taken > 10000, "Greater", time_taken <= 10000, "LessThan")
| chart count by myfield
| eventstats sum(count) as total
| eval percentage = ((count/total)*100)
| eval percentage =percentage ."%"
| search myfield=Greater
| table percentage
Hope this helps, let me know if you have any questions, thanks!
... View more
10-15-2019
03:31 PM
| rename Old_column as New_column_Name
I think you can just change the name, but when you pass tokens to other searches, you can pass the original name of the column as token value.
For example:
<set token=col>Old_column<set> you can use this token $col$ in your drilldown search.
Hope this helps, Thanks!
... View more
10-15-2019
03:12 PM
Cool! Thanks
... View more
10-15-2019
01:11 PM
Use the CLI
To add a search peer, run this command from the search head:
splunk add search-server ://: -auth : -remoteUsername -remotePassword
Note the following:
is the URI scheme: "http" or "https".
is the host name or IP address of the search peer's host machine.
is the management port of the search peer.
Use the -auth flag to provide credentials for the search head.
Use the -remoteUsername and -remotePassword flags for the credentials for the search peer. The
remote credentials must be for an admin-level user on the search peer.
For example:
splunk add search-server https://192.168.1.1:8089 -auth admin:password -remoteUsername admin -remotePassword passremote
You must run this command for each search peer that you want to add.
https://docs.splunk.com/Documentation/Splunk/7.3.2/DistSearch/Configuredistributedsearch
You can refer to the above link.
Hope this help, Thanks !
... View more
10-15-2019
01:00 PM
You can't really tell which graph is accurate based on forecast timespan.
The only reason why the 1st one is not showing the forecast data because of | where prediction!="" AND logins!="" , the logins will always be null in the feature.
`| where prediction!="" AND logins!=""` with this statement what you're really doing is eliminating the null value of logins and prediction, I'm not sure that's what you wanted.
Hope this helps. Thanks!
... View more
10-15-2019
12:39 PM
<change>
<eval token="timerange.earliest">[| inputlookup lookup.csv |output from | dedup from | sort from | head 1]</eval>
<eval token="timerange.latest">[| inputlookup lookup.csv |output from | dedup to | sort -to | head 1 ]</eval>
</change>
<set token="timerange.earliest">$result.from$</set>
<set token="timerange.latest">$result.to$</set>
Set those values to tokens something like above should work.
Hope this helps, Please let me know if you have any questions.Thanks!
... View more
10-15-2019
12:08 PM
| inputlookup assets.csv | return ProjectCode | search "ProjectCode"=99* | fillnull value="No Project Name" PROJ_NAME | dedup ProjectCode
Try this and also you can also try without the table part in your query. You don't have to use the table in a dropdown search.
Hope this helps. Thanks for the question.
... View more
10-11-2019
12:36 PM
Is your timestamp field is extracted?
Or As for your data in JSON format, you might also want to use | spath on that field.
I did a test on my data it works find.
... View more
10-10-2019
01:27 PM
your search
| dedup host
You can do this in a dynamic filed when you click edit dropdown option. You can pass time tokens to the search.
... View more
10-09-2019
02:53 PM
1 Karma
You can use for loop,
index=****
| table ColumnName
| foreach ColumnName
[eval length =len(ColumnName)]
| table ColumnName, length
Hope this will help. Thanks!
... View more
10-09-2019
01:34 PM
which code is for admin password change and which is for user change.
... View more
10-09-2019
01:00 PM
It's okay, Just wanted to time format. Can you try below one and let me know if you have any questions.
Thanks!
... View more
10-09-2019
12:57 PM
| eval Time = strptime(timestamp, "%Y-%m-%d %H:%M:%S")
| stats earliest(Time) as BeginTime, latest(Time) as FinishTime by NameOfJob
| eval dur=FinishTime-BeginTime
Try this.
... View more
10-09-2019
10:28 AM
Thanks for your response. What I'm looking for is different.
I want a stats count of URL, but I want to group count with this format /shop/buy-family/product/ as one and without that as a single URL.
Here is an example:
url field data:
/fr/shop/buy-phone/LG/v20-%0gsgwwguwfwrwwygswiswosubwbwi-nwsiwuhs/
/Ind/shop/buy-phone/LG/v30-%hxeuteiehiexhi/
/US/shop/buy-phone/Apple/iphone-4s
/ch/shop/buy-phone/LG/v60
/us/shop/buy-laptop/Mac/
/pk/shop/buy-laptop/Mac-pro/
/gr/shop/buy-laptop/Samsung/
/shop/browse/user/
/browse/user/laptop/
I want stats to be:
/shop/buy-phone/LG/ - 3
/shop/buy-phone/Apple/ - 1
/shop/buy-laptop/Mac/ -1
/shop/buy-laptop/Mac-pro/ -1
/shop/buy-laptop/Samsung/ -1
/shop/browse/user/. - 1
/browse/user/laptop/ - 1
... View more
10-08-2019
10:04 PM
index=*
| spath msg.uri
| rename msg.uri as url
| rex field=url "shop(?<ex_url>[a-zA-Z\/\-0-9\.]+)"
| rex field=ex_url "buy-(?<family>[^\/]+)\/(?<product>[^\/]+)"
| eval url_N="/shop/"+"buy-"+family +"/" + product +"/"
| eval N_url = coalesce(url, url_N)
| stats count by N_url
| sort -count
| head 100
I am trying to find count by URL, but I also need to combine count value that looks like /shop/buy-phone/LG'. /shop/buy-laptop/Mac as /shop/buy-phone/ or /shop/buy-laptop/ . Finally, when I count my URL I need to include these group URLs count with the other URL. I tried above, I am missing something.
Thanks for your time.
... View more
10-08-2019
02:26 PM
I don't think you can do that unless the user has access to a specific index or data in the dashboard user can't see any results. You can generate reports and share them. I hope this helps
... View more
10-08-2019
02:17 PM
| eval BeginTime = strptime(BeginTime, "%Y-%m-%d %H:%M:%S")
| eval FinishTime = strptime(FinishTime, "%Y-%m-%d %H:%M:%S")
| eval dur=FinishTime-BeginTime
This is working fine, can you share some sample data. I not sure why you're doing this | eval BeginTime=substr(BeginTime,1,13) . sample data would make more sense.
... View more
10-08-2019
12:53 PM
... | timechart useother=f count by process_name
You can do this.
... View more
10-08-2019
10:13 AM
The only way you can do without IP is by lookup but, there is a problem with your data. Your country data is not following stands like iso2 or iso3 which can be looked up in geo_attr_countries.csv. Look at your geo_attr_countries.csv will give you a better idea.
... View more
10-07-2019
02:11 PM
I have a similar use case hope this works for you as well.
(index=A)
|rename A_field_match as B_field_match
| fields B_field_match
| join B_field_match
[ search index=B ]
| table A_interesting_field_1 A_interesting_field_2 A_interesting_field_3 A_interesting_field_4 B_interesting_field_1 B_interesting_field_2 B_interesting_field_3 B_interesting_field_4
As you are using two indexes, use give as many filters as possible like source type or source and run it on a small-time range to check the results.
Thanks.
... View more
10-07-2019
12:50 PM
Which version of Splunk are you using?
If you are using 7.2.x versions which had a number of CPU and memory implications. 7.2.4 addressed most of them.
You can try | noop search_optimization=false and see, Which I think would make your search a little better.
If you can share an example search you're using.
... View more
10-07-2019
12:36 PM
/hk-zh/shop/buy-phone/phone-1/5.8-%E5%90%8B%E9%A1%AF%E7%A4%BA%E5%99%A8-256gb-%E9%8A%80%E8%89%B2 1059
/hk/shop/buy-phone/phoneSS/5.5-inch-display-128gb-rose-gold 493
/hk-zh/shop/buy-phone/one6/5.5-%E5%90%8B%E8%9E%A2%E5%B9%95-128gb-%E7%8E%AB%E7%91%B0%E9%87%91%E8%89%B2 375
/shop/buy-tab/mini-3/128gb-gold-wifi 90
/shop/buy-tab/mini-3/128gb-silver-wifi 90
/hk-zh/shop/buy-phone/phone-sm/5.8-%E5%90%8B%E9%A1%AF%E7%A4%BA%E5%99%A8-64gb-%E9%8A%80%E8%89%B2 60
/hk-zh/shop/buy-phone/phone-ap/5.5-%E5%90%8B%E8%9E%A2%E5%B9%95-128gb-%E4%BA%AE%E9%BB%91%E8%89%B2 59
/hk-zh/shop/buy-phone/phone-lg/5.8-%E5%90%8B%E9%A1%AF%E7%A4%BA%E5%99%A8-64gb-%E5%A4%AA%E7%A9%BA%E7%81%B0 59
I want to extract URL starting from /shop/..... till special char like %E5 something.
Something like this.
/shop/buy-phone/phone-1/5.8
/shop/buy-phone/phoneSS/5.5-inch-display-128gb-rose-gold
/shop/buy-phone/one6/5.5
/shop/buy-tab/mini-3/128gb-gold-wifi
/shop/buy-tab/mini-3/128gb-silver-wifi
... View more
10-07-2019
12:24 PM
1 Karma
That's exactly what's happening. You can do "_indextime-_time" that would keep you avg down.
... View more
10-04-2019
03:47 PM
1 Karma
| eval lag=(_indextime-now())
You can do an avg of lag field. I think this will give you what you're looking for.
... View more
10-04-2019
10:21 AM
Hi @datamine I think you will have hour field in your interesting fields.
If not add this | eval date_hour=strftime(_time,"%H") before stats command.
As far count, I did test with my data it is working fine for me, can you add example data.
Thanks for your question.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:04 AM
|
