Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Are you a member of the Splunk Community?
Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- Find Answers
- :
- About pramit46
pramit46
Contributor
Member since:
04-07-2014
03-31-2022
Community Statistics
| Posts | 132 |
| Solutions | 6 |
| Karma Given | 80 |
| Karma Received | 17 |
| Member Since | 04-07-2014 |
Activity Feed
- Karma How do I route data to specific index based on a field? for melonman. 03-31-2022 07:29 AM
- Karma Re: What Capabilities do I need to enable so a user can change sharing permission on their searches? for mattness. 01-11-2022 03:07 AM
- Karma Re: Pass the label of an input to the title of a panel for BorisGrochalski. 08-31-2021 05:22 AM
- Karma Re: How can we create Tabs using Link List in Splunk with only CSS Override NO SplunkXML JS Extension? for niketn. 06-10-2021 04:10 AM
- Karma How to capture only string and remove optional digits with regex for ncrs5699. 01-17-2021 11:31 AM
- Karma Re: How to capture only string and remove optional digits with regex for niketn. 01-17-2021 11:31 AM
- Karma Re: How to capture only string and remove optional digits with regex for woodcock. 01-17-2021 11:31 AM
- Karma Re: Installed Splunk Enterprise 7.2.1 and promoted it as cluster master. Splunk Web is not loading. for scheng_splunk. 11-09-2020 11:11 PM
- Karma Re: Installed Splunk Enterprise 7.2.1 and promoted it as cluster master. Splunk Web is not loading. for marend. 11-09-2020 11:10 PM
- Karma Search factor vs Replication factor-If I change my SF=2 , does this mean 2 copies are changed to primary? for jiaqya. 11-08-2020 10:50 AM
- Karma Re: Search factor vs Replication factor for jiaqya. 11-08-2020 10:50 AM
- Karma Re: search peers sick for chinmoya. 11-03-2020 11:12 PM
- Karma How to insert checkboxes in a simple statistics results table? for allan_newton. 07-06-2020 07:40 AM
- Karma Re: Why is KV Store initialization failing on one of our add-on to receive logs? for khusain_splunk. 07-02-2020 11:16 PM
- Karma Re: How to remove if ALL selection is selected in multiselect based on field for label not by Value? for kamlesh_vaghela. 06-11-2020 10:59 PM
- Karma Re: How to make a second download button for hallt3. 06-05-2020 12:50 AM
- Karma Re: What is the best way to pull out IP Addresses from a multivariate field? for HiroshiSatoh. 06-05-2020 12:50 AM
- Karma Re: How to set earliest time based on current time for mayurr98. 06-05-2020 12:50 AM
- Got Karma for How to Run a search using searchmanager (from javascript) when browser/tab closes?. 06-05-2020 12:50 AM
- Got Karma for Re: AND Condition to find the keywords in logs. 06-05-2020 12:50 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 1 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
06-12-2015
05:28 AM
when I use the following:
index= _internal | bucket size bins=3 |stats count(_raw) by size
I see:
size-----------count(_raw)
0-100000000-------------7
But if use:
index= _internal | bucket size bins=4 |stats count(_raw) by size
I see:
size---------------count(_raw)
0-10000000--------------4
20000000-30000000---2
30000000-40000000---1
Should it not also show 3 rows when bin number was set to 3?
... View more
04-19-2015
12:03 AM
1 Karma
I'm trying to find out if splunk stores the searches in a log file. I know |history shows the list of queries, but it does not show the file name. Can any let me know if there is any physical file that splunk stores the history in?
... View more
04-03-2015
12:07 AM
I'm not sure how to club the actual log files since they will be picked from separate source paths and be considered as individual files, but if you want to query on all the log files, try OR
index=idx1 source="yourpath1\source1" OR source="yourpath2\source2" OR source="yourpath3\source3"
and if they are different files under same root folder, you can use wildcard too:
source= "yourpath\source*"
Let me know if this helps
... View more
04-02-2015
11:56 PM
Real time puts a little stress on the system, and since your application updates in every 5 minutes, why not hitting a scheduled search in every 5 minute and look for the data for last 5 minutes. Try this simple cron to trigger the job in every 5 min.
*/5 * * * *
... View more
04-01-2015
03:46 AM
try:
<option name="count">0</option>
... View more
01-07-2015
12:35 AM
thanks @jayannah 🙂
... View more
12-30-2014
05:45 AM
1 Karma
I want to index the splunk resultset for future use. Do I always have to store it in a file?
... View more
- Tags:
- indexing
11-18-2014
02:02 AM
when do you use 0?
... View more
11-11-2014
03:06 AM
Thanks a lot @russellliss. This was really helpful
... View more
11-10-2014
01:57 AM
1 Karma
I have a query that looks like the following:
index=<> host=<> |rex=<> spath <>|table a,k,h|sort time|append[|dbquery DB "select X,Z,W,P from table_T where <> Order By time_col"]
the result set has the following columns:
a|k|h|P|W|X|Z
While I expect
a|k|h|X|Z|W|P
How can I get rid of this automatic alphabetical sorting?
While I run the dbquery alone, it works fine and shows me the expected columns.
... View more
07-04-2014
07:52 AM
1 Karma
@rsennett_splunk, I also found that in the job inspector page it shows the memory space the query had consumed.
... View more
07-02-2014
11:10 PM
guys,
How can I find out how much memory does a Splunk Query consume?
... View more
06-13-2014
11:35 PM
Wow.. this one works like a miracle...Thanks a lot @dart
Just one thing. it totally ignores and removes the timestamp section in the beginning. How can I retain that and still be able to parse the json?
... View more
06-10-2014
07:14 AM
I don't remember on top of my head right now, but I guess, you can try to look into access_combined and see if you can find any hint there.
... View more
06-09-2014
05:40 AM
You form the query based on the requirements.
You can start with the following,
I assume, you website must be having some mechanism to reject the malicious requests, for which it may return HTTP status code 500 or 503 or something like this. You can start by tracking those IPs which have generated more number of these status codes.
List down the response times against those IPs, and also the number of hits they make.
You can start with this and then enhance the query as required.
... View more
05-15-2014
02:31 AM
PersonName | Age | MaritalStatus | Location | Concat
A|10|M|New York|10,M
B|20|-|London|20,NULL
C|-|U|Mumbai|NULL,U
D|30|-|Sydney|30,NULL
... View more
05-15-2014
02:30 AM
@MuS, I tried that after you suggested, but I guess, the way the above query works is to find a field in the logs, list down all the values in a column, and then move to the next field. May be that is the reason the 'fillnull' option does not make any difference.
I need to find the Age, MaritalStatus and Location where Name='A' ('B' or whatever). Not sure if I'm using a right query to fetch the data. 😞
Also, Can I have a column which has a concatenated values per row? like below:
... View more
05-13-2014
01:13 AM
Thanks a lot for helping MuS. But I want to print atleast some identifier even if I do not find any values in that field for that row. (say, NULL
If I can do that, then I can simply read a row and put the delimited data into an object which is my ultimate goal.
Can you please help me achieving that?
... View more
05-12-2014
11:25 PM
This query should check the value 'A' against the PersonName field in S1 & S2 and print data.
sourcetype=S1
OR
sourcetype=S2
|where (S1_PersonName = "A"
OR
S2_PersonName = "A")
|stats
list(sourcetype) AS sourcetypes,
list(S1_PersonName) AS PersonName,
list(S1_Age) AS Age,
list(S2_MaritalStatus) AS MaritalStatus,
list(S2_Location) AS Location,
|eval combined_fieldvalues= toString(Age)+":"+toString(MaritalStatus) // I also wanted to concatenate 'Age' & 'MaritalStatus' for each row, but it appends all the values of 'MaritalStatus' after all the values of 'Age' and gives a big single field.
... View more
05-12-2014
11:16 PM
@somesoni2,
That example was a hypothetical situation. Unfortunately, I cannot provide the actual data in here. But I can give you a pseudo query which looks exactly like my query which I tried. Even if I could print "NULL" or a simple " " for a null value, that would also help. The only thing I want is to have each row in a column holding related values instead of merging them together.
How can I print "NULL" or " " for a null value in a multivalued field while using list()?
... View more
05-12-2014
09:28 AM
I have a several multivalued fields fetched from different sourcetypes and I'm using list() to print the values. Problem is, it lists out all the values of that field irrespective of the other values in that row. Due to this I cannot map the values within a row.
For example: I am printing: PersonName, Age, MaritalStatus, Location.
All are multivalued fields which can have null (or no) values, as well.
Now list() gives me, ('-' denotes no value)
PersonName | Age | MaritalStatus | Location
A|10|M|New York
B|20|U|London
C|30|M|Mumbai
D|-|-|Sydney
E|-|-|Sydney
Whereas, the actual data is:
PersonName | Age | MaritalStatus | Location
A|10|M|New York
B|20|-|London
C|-|U|Mumbai
D|30|-|Sydney
E|-|M|Sydney
How can I print the data properly?
... View more
- Tags:
- list
- multivalue
- search
05-05-2014
06:22 AM
Thanks @lguinn, it worked. But I guess, if you can help me with one more thing, I should be in a good shape.
Suppose, I'm publishing 15 fields (columns) in my search result, is there any way I can club certain columns together and give them a logical name? for example: If I have (mv)fields F1-F15 in output, now along with them, can I also print the following logical fields L1(by clubbing F1, F9, F13), L2(by clubbing F1, F9, F10), L3(by clubbing F4, F8, F13).
Please note that I have certain (actual) fields common in the values of logical fields.
Can I use mvzip/mvexpand for these?
... View more
05-02-2014
12:46 AM
@lguinn, when I use outputcsv, I receive the data in following format:
F1,F2,F3,
"F1-Value1" "F1-Value2" "F1-Value3",
"F2-Value1" "F2-Value2" "F2-Value1",
"F3-Value1" "F3-Value2" "F3-Value3"
Now how can I format the data in a way so that my java program can form the above XML by identifying the relation between the data? Do I need to add or remove something in my search query?
Not sure if I gave you enough information, so please let me know if you still have confusions
... View more
05-02-2014
12:32 AM
@lguinn, Unfortunately I cannot show you the actual data, so I'll try to put a relevant example.
I have some logs coming in from one subsystems which may be linked with the logs generated from other subsystems (may be by input file name or some other fields).
Now, all the sub-systems process the input file differently and store different fields in the respective logs. Thus, the values of F1 & F2 extracted from S1 may or may not be related to the value of F3 coming from S2.
But from the input filename, I can identify which values are related to that filename and put them in the same XML block.
... View more
05-01-2014
11:19 PM
@Ayn, Can you please explain why did you rename the field2?
I also have the same question as that in Selim's comment. Any help would be appreciated.
... View more
- « Previous
- Next »
