Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About puneetkharband1
puneetkharband1
Path Finder
Member since:
01-15-2015
08-23-2021
Community Statistics
| Posts | 40 |
| Solutions | 1 |
| Karma Given | 1 |
| Karma Received | 2 |
| Member Since | 01-15-2015 |
Activity Feed
- Posted Re: How do I create extractions where it can pick field names from the events See events below on Getting Data In. 05-28-2021 07:31 AM
- Posted Re: How do I create extractions where it can pick field names from the events See events below on Getting Data In. 05-28-2021 05:55 AM
- Posted How do I create extractions where it can pick field names from the events See events below on Getting Data In. 05-27-2021 08:37 PM
- Posted Splunk Search to see which queries they ran and exported out of Splunk on Splunk Search. 05-26-2021 07:41 AM
- Posted Re: Is it possible cluster master returns fqdn instead of IP's of Indexers ? on Getting Data In. 01-13-2021 08:00 AM
- Posted Is it possible cluster master returns fqdn instead of IP's of Indexers ? on Getting Data In. 01-13-2021 05:44 AM
- Posted Re: Splunk If else and severity search query on Splunk Search. 09-08-2020 03:11 PM
- Tagged Re: Splunk If else and severity search query on Splunk Search. 09-08-2020 03:11 PM
- Posted Splunk If else and severity search query on Splunk Search. 09-08-2020 02:13 PM
- Got Karma for Is it possible to have drop-down choice value as a link to another dashboard?. 06-05-2020 12:48 AM
- Karma Re: Splunk cloud for Splunker147. 06-05-2020 12:47 AM
- Got Karma for Browser type Display issues with Useragent. 06-05-2020 12:47 AM
- Posted Re: How to pass field values into splunk dashboard panels ? on Dashboards & Visualizations. 03-23-2020 09:04 PM
- Posted How to pass field values into splunk dashboard panels ? on Dashboards & Visualizations. 03-23-2020 09:03 PM
- Posted How do you calculate time difference between multiple events that aren't in chronological order? on Splunk Search. 10-18-2018 11:24 AM
- Tagged How do you calculate time difference between multiple events that aren't in chronological order? on Splunk Search. 10-18-2018 11:24 AM
- Posted Re: Eval formula to display dates till 31st december where start day is determined by a formula on Splunk Search. 09-22-2017 08:19 AM
- Posted Re: Eval formula to display dates till 31st december where start day is determined by a formula on Splunk Search. 09-21-2017 01:57 PM
- Posted Re: Help with a search to print date fields on Splunk Search. 09-21-2017 01:33 PM
- Posted Help with a search to print date fields on Splunk Search. 09-21-2017 01:06 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
05-28-2021
07:31 AM
if you see there is one pattern and these logs are generated from a tool(Xfer) and only 2 types of logs are there which I posted.
... View more
05-28-2021
05:55 AM
this doesnt work I tried delimiter option.
... View more
05-27-2021
08:37 PM
I have 2 types of logs from one source where I need to map fields vs values ...I dont want to create complex regex as they are from structured data so how do I create fields and values from events May 27 07:51:49 TESTHOSTTEST TESTDEVTEST_11.2.0.125: User '' (root) : FAILED: Sign On, ID: 123220127, InstID: 7653, IPAddress: 111.222.213.238, FolderID: 0, Username: root, AgentBrand: TEST DEV SSH, AgentVersion: 11.2.0.0, DEVSize: 0, Error: 2976, Message: Failed to sign on: This IP address has been locked out. May 27 07:51:34 TESTHOSTTEST TESTDEVTEST_11.2.0.125: User 'BLA BLA DI' (ei4o2f18pcsuo5tp) : Download File, ID: 123220102, InstID: 7653, IPAddress: 333.222.231.94, FileID: 770879833, FileName: 16680_Signup Detail_20210527 01-49-18-86.csv, FolderID: 472070079, FolderPath: /Home/test/TestWorks/Enhanced Affiliate Signup Reports, Username: TEST, AgentBrand: Chrome Browser, AgentVersion: 90.0.4430.212, DEVSize: 739698, Parm2: 0, Error: 0
... View more
Labels
- Labels:
-
JSON
-
props.conf
-
transforms.conf
05-26-2021
07:41 AM
I have a need to pull all the users and the files/sourcetype or queries they ran to export data out of splunk I found one query but that doesnt tell me what query they ran index=_internal file=export | fields file user uri_path | table file user uri_path
... View more
Labels
- Labels:
-
stats
01-13-2021
08:00 AM
by adding this parameter to the /opt/splunk/etc/system/local/server.conf file register_search_address = FQDN you can do that it will allow your fqdn to reflect in as fqdn instead of IP you can also put short name instead of fqdn whichever is preffered case.
... View more
01-13-2021
05:44 AM
Is it possible cluster master returns fqdn instead of IP's of Indexers ? if yes please explain how ?
... View more
Labels
- Labels:
-
indexer
09-08-2020
03:11 PM
not sure you understood my question ...thanks for looking into that ....but how to define the condition in the search thats where I am getting confused Condition 1 Index=abc sourcetype=QWE action=XYZ OR condition2 NOT (test=blablaand action=xyz)
... View more
- Tags:
- eval
09-08-2020
02:13 PM
I am trying to write splunk search where I have 2 conditions and my query returns the results based on that for example if condition1 matches create a new field (SEVERITY)=SEV2 if condition 2 matches SEVERITY=SEV2 else SEVERITY=SEV3 How can I achieve this ...In my search string I am using couple of fields to filter the data putting that as SEV2 criteria ...I am able to filter it but and get the results for both the conditions but I am stuck where I cannot call everything else as SEV3
... View more
03-23-2020
09:04 PM
@somesoni2 can you please recommend any solution to this ?
... View more
03-23-2020
09:03 PM
I have splunk dashboard where I am displaying logs from 2 different data centers and based on data centers number of host/hostname changes.
if I select datacenter 1 from drop down then server 1 & 2 becomes active and their logs reflect in panels below.
if I select datacenter 2 from drop down then server 3 & 4 becomes active and their logs reflect in panels below.
I dont want to create 2 seapate dashboards as this DC numbers will increase so wanted to have one single dashboard.
Server is a field which has 4 values server1-4
Please recommend solutions how do I pass values from server field to another panels in the same dashboard.
... View more
10-18-2018
11:24 AM
I have 6 events. Each one has a timestamp, and I have extracted the time of each into a new field using eval. But now, I am not able to create timedifference between event6-event1 or event4-event3 as per my needs.
I do not want to use the transaction command as I need to write multiple searches, and I am trying to solve this in search.
I am at a point where my last seach line is
| table Fourm_step_1_Time Fourm_step_2_Time Fourm_step_3_Time Fourm_step_4_Time Fourm_step_5_Time Fourm_step_6_Time
results are
0 0
0 0
0 0
0 0
0 123435453
1234545433 0
so on
@somesoni2
... View more
09-22-2017
08:19 AM
thank you Somesh ...that will definitely bring me closer to what I am trying to do.
... View more
09-21-2017
01:57 PM
Hey Rich
I am actually calculating the difference between 2 dates where my year is dynamic based on the data.
In return I need to whole date in the same format
whole idea is to calculate the thanks giving day of the year also when I ll have thanks giving day as year-mon-day I need to print one week in the same format from that day.
2016
2015
2017
I tried this index="test" source="test" date=* mon=* year=* (STATDATE>=2016-11-22 AND STATDATE<=2016-11-30) SITE=USA | eval day_c = strftime(_time,"%Y-%m-%d") | eval enddate= year+"-11-29"| eval startdate= year+"-11-24" | eval DiffInSecs = strptime(enddate, "%Y-%m-%d")-strptime(startdate, "%Y-%m-%d") | eval td = strftime(DiffInSecs, "%Y-%m-%d %A") | table day_c td
but seems strftime doesnt work here
... View more
09-21-2017
01:33 PM
I am actually calculating the difference between 2 dates where my year is dynamic based on the data.
In return I need to whole date in the same format
whole idea is to calculate the thanks giving day of the year also when I ll have thanks giving day as year-mon-day I need to print one week in the same format from that day.
2016
2015
2017
... View more
09-21-2017
01:06 PM
need to print dates from Thanksgiving onward for the rest of the week until Monday
index="test" source="test" date=* mon=* year=* (STATDATE>=2016-11-22 AND STATDATE<=2016-11-30) SITE=USA | eval day_c = strftime(_time,"%Y-%m-%d") | eval enddate= year+"-11-29"| eval startdate= year+"-11-24" | eval DiffInSecs = strptime(enddate, "%Y-%m-%d")-strptime(startdate, "%Y-%m-%d") | eval td = strftime(DiffInSecs, "%Y-%m-%d %A") | table day_c td
Expected Results:
2016-11-24 2016-11-24 Thursday
Actual results:
2016-11-29 1970-01-05 Monday
2016-11-28 1970-01-05 Monday
2016-11-27 1970-01-05 Monday
2016-11-26 1970-01-05 Monday
2016-11-25 1970-01-05 Monday
2016-11-24 1970-01-05 Monday
2016-11-23 1970-01-05 Monday
2016-11-22 1970-01-05 Monday
... View more
09-21-2017
11:01 AM
Hey Everyone I am trying to write an eval when a user enter an year it should return a date
formula works fine in excel DATE(F6,11,29)-WEEKDAY(DATE(F6,11,24))
F6 is user input for an year.
idea is to display the days from the days from thanksgiving to december 31st for any year I input.
... View more
09-20-2017
12:59 PM
Actually what you did is great and I miss something as part of my requirement is this sample is only for one year
I have data for 3-4 years so in that case how difference will work I am not sure. as I need to compare data for all 3 years in one shot.
... View more
09-20-2017
10:54 AM
index="test" source="test" year=* date=* mon=* SITE=US | stats values(field) as auth by year, mon, date | stats list(mon) list(date) values(auth) by year
this is what i tried
this is how raw data looks like
2016-12-31 00:00:00.000, date="2016-12-31 00:00:00.0", field="1234567", SITE="US"
I have extracted year month and date as part of time values
I do not have any time values but date year month thats what matters as I need to compare the numbers from last year
... View more
09-20-2017
08:33 AM
Hi,
I have data in 2 fields in table: one is date and the other is some value, for each year respectively.
Now I want to perform an action like compare date_1 from 2015 vs date_1 from 2016, then perform some evals on the data.
For example:
01-01-2015 1234567
02-01-2015 1234578
01-01-2016 1234563
02-01-2016 1234577
Now I want to compare 01-01-2015 with 01-01-2016, see if they are equal greater less, and do a percentage change based on the data.
Sample:
index="test" source="test" year= date= mon=* SITE=US | stats values(field) as auth by year, mon, date | stats list(mon) list(date) values(auth) by year
this is what i tried
this is how raw data looks like
2016-12-31 00:00:00.000, date="2016-12-31 00:00:00.0", field="1234567", SITE="US"
I have extracted year month and date as part of time values
I do not have any time values but date year month thats what matters as I need to compare the numbers from last year
Please recommend
I have pulled all the dates using stats values by date and appended by a similar fashion for each year by adding the where clause in the date range.
... View more
05-26-2017
09:25 AM
Actually gtranslate app does exist but its my bad I am not able to use it they way it should be used ...so if anyone can help me with the requirements for that would be great !!
... View more
05-26-2017
09:00 AM
Thanks for the reply but I have tried gtranslate app(not sure how exactly it works but that can solve my problem if I find some help their document doesnt say much) and all the options you mentioned above looks like they are not going to solve my problem
My data is in French (all the events) all I am looking for is within splunk if any french data appears that gets converted into english
... View more
05-26-2017
07:41 AM
Hey Everyone
I have some data written to Splunk in native language (let's say French), can i translate that into English in Splunk?
... View more
03-06-2017
12:10 PM
Thanks Iguinn for replying ...i was wondering if someone is already doing that stuff or someone can share a sample script if possible ...I just want to put a text check to a webpage that we ping to or curl to.
... View more
03-06-2017
06:49 AM
Is there a way i can test a webpage and validate a text from the response using splunk ? I am using website monitoring app which tells me the web page response based on the status code but that is not conclusive enough to prove the website is up and running so I need to validate a text check on the page ?
... View more
06-15-2016
12:09 PM
1 Karma
I have one drop-down on dashboard 1 and dashboard 2 collects the value and runs a search on that.
Is there a way to use a link in the drop-down on dashboard 1?
MainPage_Drilldown
<input type="dropdown" searchWhenChanged="true" token="App">
<label>Application</label>
<choice value=>abc</choice>
<choice value="abc1">abc1</choice>
<choice value="abc3">abc2</choice>
<choice value="TCI">abc</choice>
</input>
</fieldset>
I want the Value here to be a link to dashboard which Is a token in search on the same dashboard.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
08-23-2021
04:15 PM
|
