Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- Find Answers
- :
- About moizmmz
moizmmz
Path Finder
Member since:
10-19-2018
06-05-2020
Community Statistics
| Posts | 81 |
| Solutions | 0 |
| Karma Given | 10 |
| Karma Received | 2 |
| Member Since | 10-19-2018 |
Activity Feed
- Got Karma for How to get comma separated list of values?. 03-09-2022 06:05 AM
- Karma Re: How do you perform a mathematical calculation on the results of two queries? for ragedsparrow. 06-05-2020 12:50 AM
- Karma Re: How to get comma separated list of values? for sduff_splunk. 06-05-2020 12:50 AM
- Karma Re: How to get comma separated list of values? for kamlesh_vaghela. 06-05-2020 12:50 AM
- Karma Re: How to create a new field out of some evaluated data? for vinod94. 06-05-2020 12:50 AM
- Karma Re: How to create a new field out of some evaluated data? for cvssravan. 06-05-2020 12:50 AM
- Karma Re: Need the correct regular expression for my rex command for chrisyounger. 06-05-2020 12:50 AM
- Got Karma for How do I calculate the average no. of HTTP requests per second?. 06-05-2020 12:50 AM
- Karma Why does the timechart command display inconsistent results when the time range is changed? for fvegdom. 06-05-2020 12:48 AM
- Karma Re: How do I create a stacked bar chart? for hgrow. 06-05-2020 12:47 AM
- Karma Re: iplocation command not working in 6.3.0 for jplumsdaine22. 06-05-2020 12:47 AM
- Karma Re: Jump to next line in Search for MuS. 06-05-2020 12:46 AM
- Posted Refreshing the dashboard using the browser refresh button, breaks it. Have used selectFirstChoice and unset token, so there might be something there. on Dashboards & Visualizations. 06-14-2019 10:20 AM
- Tagged Refreshing the dashboard using the browser refresh button, breaks it. Have used selectFirstChoice and unset token, so there might be something there. on Dashboards & Visualizations. 06-14-2019 10:20 AM
- Tagged Refreshing the dashboard using the browser refresh button, breaks it. Have used selectFirstChoice and unset token, so there might be something there. on Dashboards & Visualizations. 06-14-2019 10:20 AM
- Posted Re: Dynamic dropdown dashboard with selectFirstChoice-->true doesn't work when you refresh it or share the link on Dashboards & Visualizations. 06-14-2019 10:09 AM
- Posted Dynamic dropdown dashboard with selectFirstChoice-->true doesn't work when you refresh it or share the link on Dashboards & Visualizations. 06-06-2019 11:45 AM
- Tagged Dynamic dropdown dashboard with selectFirstChoice-->true doesn't work when you refresh it or share the link on Dashboards & Visualizations. 06-06-2019 11:45 AM
- Posted Re: How to populate a dropdown based on selection from another input panel on Dashboards & Visualizations. 06-06-2019 11:38 AM
- Posted Re: How to populate a dropdown based on selection from another input panel on Dashboards & Visualizations. 06-06-2019 11:37 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 0 | |||
| 0 |
03-06-2019
10:19 AM
Sure, so the field: message.concurrent_sessions has different values in it which tell us the number of concurrent sessions. An image of which is below:
https://drive.google.com/open?id=1L-6q9Mlg5yrrZCWlc2xF8J0R523lqyro
As shown in the query, I'm doing stats sum(message.concurrent_sessions) and renaming the resulting tabular column as "Concurrent Sessions". But instead of just a tabular column, I want a whole new field which has the resulting values (that Concurrent Sessions has) in it.
I know it's stats sum(eval(condition)), but no matter what I try, Splunk says it's an error. Need to frame it right.
Here's the raw text of one log:
{"message": {"account": "fox_nation", "title": "Fox News Talk Radio | Public", "timestamp": 1549440027975, "channelID": "f12a9d64997042498dbb8cbe1560355d", "missing_content_slate": 2, "concurrent_sessions": 2}}
... View more
03-06-2019
09:04 AM
Hello,
So here's my Query:
index=video-eng-live | rename message.timestamp as time | eval time=strftime(time/1000, "%m-%d-%Y %H:%M:%S") | dedup message.concurrent_sessions, time | stats sum(message.concurrent_sessions) as "Concurrent Sessions" by message.account | addcoltotals labelfield=message.account label="Total"
After I calculate the 'sum(message.concurrent_sessions)' I want to make a new field called 'Concurrent Sessions' out of it. How could I do that? I suppose it would have to be a combination of stats and eval but I just can't seem to get it right. Please help!
... View more
- Tags:
- splunk-enterprise
01-29-2019
01:31 PM
Awesome!!! thanks!!!
... View more
01-29-2019
12:06 PM
problem is, the events don't load in the sample events slot more than half the time
... View more
01-29-2019
11:59 AM
Can you pls explain this part: [^-]+-[^_]+_([^-]+) ??
... View more
01-29-2019
11:57 AM
Here is my raw data:
{"line":"level=debug t=\"2019-01-29T19:47:20.971Z\" rt=1 method=GET path=\"/service/health?apikey=DEFAULT\" sc=200 dma=999 apikey=DEFAULT amzn_trace_id=unknown enabledFeatures=recommendations,upcomingSearch,popularityQueriesPlatformSpecific,availabilityTimes,avoidDefaultQuery,useFavoritesExternalSchemaForD2C,useFavoritesV2ForFavoritesFilter,endCardRecommendations,cmsAuthFallback os=1 rid=\"dpp-proxy-draft-db0ae210-2baf-42e7-bd88-1379d3efb157\" mode=draft","source":"stderr","tag":"ecs-dev_dpp-proxy-draft_v1_blue-798-dev-service-dpp-proxy-draft-96eda4add3ca82ec5600/8c19f5d7ff4b","attrs":{"SERVICE_NAME":"dpp-proxy-draft","SERVICE_TAGS":"dpp-proxy","SERVICE_VERSION":"v1","com.amazonaws.ecs.task-arn":"arn:aws:ecs:us-west-2:776609208984:task/497f2b51-9bb7-4fb1-bce9-4058561bb2ad"}}
I hope to extract the highlighted portion seen above.
Pls help!!
... View more
- Tags:
- splunk-enterprise
01-29-2019
11:40 AM
Perfect! thank you!
... View more
01-29-2019
10:33 AM
Here is my event's raw data:
{"line":"level=info t=\"2019-01-29T18:19:42.999Z\" rt=2 method=GET path=\"/contentskus/5b7ee52a4f6b9c001b049ac3?dma=999\u0026itemsPerPage=25\u0026page=1\" sc=200 dma=999 apikey=DEFAULT amzn_trace_id=unknown enabledFeatures=recommendations,upcomingSearch,popularityQueriesPlatformSpecific,availabilityTimes,avoidDefaultQuery,useFavoritesExternalSchemaForD2C,useFavoritesV2ForFavoritesFilter,endCardRecommendations,cmsAuthFallback os=2 rid=\"6962240ed296c770\" mode=published","source":"stdout","tag":"ecs-uat_admin_v1sandbox_blue-35-uat-service-admin-d8d0a7a0c2dfe8ea6c00/503343765eaa","attrs":{"SERVICE_NAME":"admin","SERVICE_TAGS":"contentgroups,contentsettings,contentskus,metatags,settings,userroles,users,s3signurl","SERVICE_VERSION":"v1sandbox","com.amazonaws.ecs.task-arn":"arn:aws:ecs:us-west-2:776609208984:task/305f6e5a-d20d-4aa2-877d-1bba2d442a7b"}}
I'm trying to create a new field called service_name where I extract the highlighted portion in the above event. The regukar expression that I wrote is: \W\W\W[e][c][s]\S(?\w{1,})
Achieved result: uat_admin_v1sandbox_blue
Expected result: admin_v1sandbox_blue
Please help!!!
... View more
- Tags:
- splunk-enterprise
01-04-2019
01:49 PM
Good question 😛 Well, my manager sees that there is a problem and he expects me to fix it. There are other solutions, but I guess he just prefers this one 😛
... View more
01-04-2019
12:40 PM
Hello,
I created a scheduled report in Splunk to send me an email with a link to the report and its results. However, in the email, the link returned is through a private IP address. Which is why it doesn't open. I understand that this is because the IP address belongs to one of my search heads which sits in a private network. But is there a way I can get the results on a public IP and send that link to my email instead, so I can view it?
I'm a little stumped here. Thanks.
... View more
- Tags:
- splunk-cloud
12-13-2018
01:31 PM
I read in another answer that if the ip addresses are private, the command won't work. (quite obvious now that I think about it)
... View more
12-07-2018
04:34 PM
The alert is not triggering and when I try:
DMC under Search--->SchedulerActivity:Instance---->Instance(DMC)--->look for Skipped Scheduled Reports(it will display the reason too)
The inputs don't even populate in the multiselect.
I dont see nothin 😞
... View more
12-07-2018
02:49 PM
Hello,
I've been asked to set up an alert for disk space exceeding 80%.
I enabled the DMC Alert - Near Critical Disk Usage alert on the monitoring console and simply changed it to trigger for 40% (my current usage was on 50% . I just wanted to see if the alert triggers).
But the alert didn't trigger!!!
How do I make sure it triggers?
... View more
- Tags:
- splunk-enterprise
12-07-2018
09:51 AM
Never mind, used dedup 😛
... View more
12-07-2018
09:36 AM
Hey..I'm seeing a problem, the time stamp is repeating in some cases
... View more
12-07-2018
09:27 AM
But on explicitly eliminating that data using '!=', I got what I wanted 🙂
Thank you!!
... View more
12-07-2018
09:22 AM
It is giving me the 3s interval. Thanks 🙂
But its also giving me other data I don't want. Sorta combining two mv values
... View more
12-06-2018
05:07 PM
Nope.
The results are mv and without a timestamp.
... View more
12-06-2018
03:50 PM
Query I am running:
index="dcg-video-eng-live-services-stage" | spath "message.req.originalUrl" | search "message.req.originalUrl"!="/health-check"| spath severity | search severity!=warn|search message.extraLogInfo./api2/asset/get.assets{}.desc!=null()
|table _time message.extraLogInfo./api2/asset/get.assets{}.desc message.extraLogInfo./api2/asset/get.assets{}.duration
| rename message.extraLogInfo./api2/asset/get.assets{}.desc as Channel, message.extraLogInfo./api2/asset/get.assets{}.duration as Duration
|sort -_time
This results in the following table:
https://drive.google.com/open?id=1PaUuxMNy29QYtjzKbc2i0ulGybXXSnL6 (also shown in image)
As shown in the image, the results have varying time intervals.
I want to get the results in the table to be in time intervals of 3s.
How do I go about doing it?
Thanks!
... View more
11-09-2018
04:56 PM
Hello,
I am currently using Splunk sitting on a machine connected to public network.
What I want to do, is, open the overview (indexing information and disk usage information) on Splunk in the cluster master (which sits on a remote server in a private network).
I am supposed to connect to the cluster master through a bastion host.
I have been given the key (.pem file), as well as the ip addresses of the bastion host and the remote server that hosts the cluster master. I have also been told by my manager that port forwarding can be used.
Thing is, this is my first time doing this. And I don't know the putty commands or procedure.
Pls help!!
Thanks
... View more
- Tags:
- splunk-enterprise
11-09-2018
11:27 AM
What does the % inside the double quotes signify?
... View more
11-09-2018
10:59 AM
Did EXACTLY what I wanted!
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:04 AM
|
Karma given to
