Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- Find Answers
- :
- About venky1544
venky1544
Builder
Member since:
01-09-2015
01-23-2024
Community Statistics
| Posts | 153 |
| Solutions | 13 |
| Karma Given | 6 |
| Karma Received | 35 |
| Member Since | 01-09-2015 |
Activity Feed
- Got Karma for Re: Date time. 09-03-2024 12:03 PM
- Karma Re: need to delete column from the result generated after timechart command for ITWhisperer. 01-23-2024 03:52 AM
- Posted need to delete column from the result generated after timechart command on Splunk Search. 01-23-2024 03:05 AM
- Tagged latest time values in search query on Splunk Search. 11-28-2023 02:17 PM
- Posted latest time values in search query on Splunk Search. 11-28-2023 12:29 PM
- Posted Re: timchart not working on lookup csv data on Splunk Search. 09-12-2023 06:03 AM
- Posted Why is timchart not working on lookup csv data? on Splunk Search. 09-12-2023 04:44 AM
- Posted Re: column sorting in descending order after timechart on Splunk Search. 08-10-2023 04:45 AM
- Karma Re: timechart plotting for top entity based on sorting for bowesmana. 08-09-2023 01:37 AM
- Posted Re: Is there way to refresh a Simple XML drop-down? on Dashboards & Visualizations. 07-27-2023 08:22 AM
- Karma Re: remove the label in piechart for vinod743374. 07-27-2023 07:14 AM
- Posted Re: remove the label in piechart on Dashboards & Visualizations. 07-27-2023 07:13 AM
- Posted Re: remove the label in piechart on Dashboards & Visualizations. 07-27-2023 06:22 AM
- Posted Re: remove the label in piechart on Dashboards & Visualizations. 07-27-2023 05:17 AM
- Posted remove the label in piechart on Dashboards & Visualizations. 07-26-2023 02:47 PM
- Posted How to do column sorting in descending order after timechart? on Splunk Search. 07-26-2023 09:55 AM
- Posted Dropdown panel issue- How do I get just one value in DIVISOR? on Splunk Search. 07-20-2023 08:23 AM
- Posted How to create a search for timechart plotting for top entity based on sorting? on Splunk Search. 07-18-2023 08:27 AM
- Posted need time fields extracted as start and end time on Splunk Search. 07-12-2023 04:37 AM
- Got Karma for Re: Classic Dashboard query - 3 visuals with 3 different times. 07-11-2023 05:51 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
03-23-2022
02:32 AM
@Venkat_Kumar are you facing some trouble in logging ?? if you have the creds just login
... View more
03-23-2022
02:03 AM
Hi @troy44112 if you think the solution can you please accept the solution whichever was relevant for your use case karma points are appreciated
... View more
03-22-2022
09:35 AM
hi @elomotanpru it should be $timerange.earliest$ you have extra $sign venky1544_0-1647966757063.png Hope it helps
... View more
03-22-2022
09:26 AM
Hi @I29851 Universal forwarders would not fetch the database operations there are two ways 1) use DB connect APP if you have a heavy forwarder install on it configure the parameters and get the data into splunk try the steps in this video https://www.youtube.com/watch?v=H3DxIMh8sb4 or the documentation https://docs.splunk.com/Documentation/DBX/3.8.0/DeployDBX/HowSplunkDBConnectworks 2) export the Database logs to file and then read the data using UF
... View more
03-22-2022
09:14 AM
1 Karma
Hi @troy44112 in your query | eval Need = CurrentTime - Late since the subtraction is in epoch time format it would give the values in seconds |eval need = (CurrentTime-late)/60 use something like this to convert it into minutes and then use the where clause need >=60 Hope this helps
... View more
03-22-2022
08:13 AM
Hi @elomotanpru just for curiosity why not concatenate the two fields before using for time format conversion | eval _time=strptime(DATE." ".eventHour,"%Y-%m-%d %H:%M:%S") is it not strptime would convert it into epoch and then you need to use again strftime to convert the timestamp in the desired format you need probably something like below hope it helps | makeresults |eval DATE="2021-01-03", eventhour="00:00:00" |append [| makeresults |eval DATE="2021-01-03", eventhour="02:00:00"] |append [| makeresults |eval DATE="2021-01-03", eventhour="03:00:00"] | eval newtime=DATE." ".eventhour | eval finaltime=strptime(newtime,"%Y-%m-%d %H:%M:%S") | eval date = strftime(finaltime,"%d/%m/%Y %H:%M:%S") |fields - finaltime _time newtime
... View more
03-16-2022
02:52 AM
Hey @myazdzik makresult was just to create the sample dataset as you dont need to use that but as @isoutamo said you probably have to work on the naming convention of the servers
... View more
03-15-2022
09:50 AM
Hi @Muwafi Did you download the appropriate JDBC driver for SQL server Did you copy the MS Generic driver ?? from inside the sqljdbc directory to \etc\apps\splunk_app_db_connect\drivers This is one of the pre-requisites
... View more
03-15-2022
09:36 AM
Hi @myazdzik try the below |makeresults |eval new="a100pc1" |append [|makeresults |eval new="a100pc10" ] |append [|makeresults |eval new="a100pc2" ] |append [|makeresults |eval new="a100pc20" ] |append [|makeresults |eval new="a100pc3" ]|fields - _time | rex field=new "a100pc(?<_new>\d+)"| sort _new
... View more
03-15-2022
06:06 AM
Hi there seems to be a space before the number i guess thats why regex was failing try it now and try twice once removing the backend slashes before single quote and once including the backslash with single quotes ' index=publishing* |rex max_match=0 field=_raw "{\'totalWordCount\':\s(?<totalWordCount>\d+)" |table totalWordCount venky1544_0-1647348909035.png
... View more
03-15-2022
05:50 AM
Hi @jayeshrajvir PFB screenshot hope this helps | makeresults |eval new = "[A028 : 00]" |append [|makeresults |eval new="[F037 : 928323177452]"] |append [|makeresults |eval new="[F038 : 456137]"] |append [|makeresults |eval new="[F039 : 0]"] |rex field=new "(\[A028|\[F038)\s:\s(?<num>\d+)\]" venky1544_0-1647348590034.png
... View more
03-15-2022
02:48 AM
hi @jayeshrajvir try this regex \[\w+\s:\s\d+\] just curious what are you doing with the regex coz there is no named group in the regex ?? is this a tweaked query you pasted here
... View more
03-15-2022
02:09 AM
Hi @kkosiur oks thats because of the double quotes in my regex your data has single quotes i have changed it |rex max_match=0 field=_raw "\'totalWordCount\':(?<totalWordCount>\d+)" |table totalWordCount try now and incase of error can you paste the complete search what you are running it would be helpful
... View more
03-15-2022
02:05 AM
1 Karma
Hi @Kisame27 if this solution helped can you please accept it it might help others as well
... View more
03-14-2022
09:35 AM
Hi @kkosiur try this |rex max_match=0 field=_raw "\"totalWordCount\":(?<totalWordCount>\d+)" |table totalWordCount you can try the above regex but just a query out of curiosity is it not if you assign your data as sourcetype _JSON this is a json format data right it should extract the field as field1.totalwordcount and you can simply get the count why try the regex ?
... View more
03-11-2022
08:02 AM
@sandyvaldez are you sure its syslog >>deployment server usually its syslog>> HF >>indexer cluster i guess you are missing a HF component and its where you were probably should be looking
... View more
03-11-2022
07:59 AM
|makeresults |eval Name1="Bala",Name2="kasa",Name3="Reddy" |append [|makeresults |eval Name2="kasa",Name3="Reddy"] |append [|makeresults |eval Name3="Reddy"]| stats count(eval(Name1="Bala")) AS A,count(eval(Name2="kasa")) AS B,count(eval(Name3="Reddy")) AS C | eval count=B+C |fields - B,C
... View more
03-11-2022
07:39 AM
Hi @Bala Just use the rename command should work | addtotals |fields - A,B,C |rename Total as Failure Note : PLease accept the solution if the reply worked for you it might help others as well
... View more
03-11-2022
07:24 AM
FYI venky1544_1-1647012265053.png
... View more
03-11-2022
06:20 AM
Hi @Bala use | addtotals |fields -A,B,C it should give you total 6
... View more
03-11-2022
05:17 AM
1 Karma
Hi @human96 Yes it will not move the background image you need to place the image at the similar location in the production environment in whichever app you created the dashboard place the image in the /app/static in the prod environment and the dashboard might be able to access it
... View more
03-11-2022
04:08 AM
1 Karma
Hi @b_chris21 try to add the full path and give it a try /usr/sbin/tcpdump
... View more
03-11-2022
03:13 AM
Hi @dminguez so when you say "it doesn't write the directories in the destinations that are given" 1) so you meant syslog is not writing the data to the directories or splunk UF is not reading the directory you need to share your syslog conf details 2) is your VM(ubuntu) receiving the data from the three different endpoints how are you validating that ?? Thanks
... View more
03-10-2022
05:30 AM
Hi @Bleepie did you tried |timechart span=1d count by _time
... View more
03-09-2022
08:30 AM
Hi @Poojitha is this something you are trying for Hope it helps venky1544_0-1646843335568.png <dashboard> <label>Table with color Based on Status</label> <row> <panel> <title>check</title> <html depends="$alwaysHideHTMLCSSPanel$"> <style> #tableColorFinalRowBasedOnData table tbody td div.multivalue-subcell[data-mv-index="2"]{ display: none; } </style> </html> <table id="tableColorFinalRowBasedOnData"> <search> <query>| makeresults | eval source="test_hec,test_s3" ,events= "123,90"| makemv source delim=","| makemv events delim="," |append [|makeresults | eval source="test_hec,test_s3" ,events= "80,900"| makemv source delim=","| makemv events delim=","] | multikv forceheader=1 | eval new=mvindex(events,0) |eval new2= mvindex(events,1) |eval status=if(new <new2,"BIG","SMALL") |foreach source,events [ eval <<FIELD>>=mvappend('<<FIELD>>',status)] | fields - new,new2,status</query> <earliest>-24h@h</earliest> <latest>now</latest> <sampleRatio>1</sampleRatio> </search> <option name="refresh.display">progressbar</option> <format type="color" field="events"> <colorPalette type="expression">case (match(value,"BIG"), "#DC4E41")</colorPalette> </format> <format type="color" field="source"> <colorPalette type="expression">case (match(value,"BIG"), "#DC4E41")</colorPalette> </format> </table> </panel> </row> </dashboard>
... View more
- Tags:
- hi
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
01-23-2024
07:46 AM
|
Karma given to
