Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- Find Answers
- :
- About moizmmz
moizmmz
Path Finder
Member since:
10-19-2018
06-05-2020
Community Statistics
| Posts | 81 |
| Solutions | 0 |
| Karma Given | 10 |
| Karma Received | 2 |
| Member Since | 10-19-2018 |
Activity Feed
- Got Karma for How to get comma separated list of values?. 03-09-2022 06:05 AM
- Karma Re: How do you perform a mathematical calculation on the results of two queries? for ragedsparrow. 06-05-2020 12:50 AM
- Karma Re: How to get comma separated list of values? for sduff_splunk. 06-05-2020 12:50 AM
- Karma Re: How to get comma separated list of values? for kamlesh_vaghela. 06-05-2020 12:50 AM
- Karma Re: How to create a new field out of some evaluated data? for vinod94. 06-05-2020 12:50 AM
- Karma Re: How to create a new field out of some evaluated data? for cvssravan. 06-05-2020 12:50 AM
- Karma Re: Need the correct regular expression for my rex command for chrisyounger. 06-05-2020 12:50 AM
- Got Karma for How do I calculate the average no. of HTTP requests per second?. 06-05-2020 12:50 AM
- Karma Why does the timechart command display inconsistent results when the time range is changed? for fvegdom. 06-05-2020 12:48 AM
- Karma Re: How do I create a stacked bar chart? for hgrow. 06-05-2020 12:47 AM
- Karma Re: iplocation command not working in 6.3.0 for jplumsdaine22. 06-05-2020 12:47 AM
- Karma Re: Jump to next line in Search for MuS. 06-05-2020 12:46 AM
- Posted Refreshing the dashboard using the browser refresh button, breaks it. Have used selectFirstChoice and unset token, so there might be something there. on Dashboards & Visualizations. 06-14-2019 10:20 AM
- Tagged Refreshing the dashboard using the browser refresh button, breaks it. Have used selectFirstChoice and unset token, so there might be something there. on Dashboards & Visualizations. 06-14-2019 10:20 AM
- Tagged Refreshing the dashboard using the browser refresh button, breaks it. Have used selectFirstChoice and unset token, so there might be something there. on Dashboards & Visualizations. 06-14-2019 10:20 AM
- Posted Re: Dynamic dropdown dashboard with selectFirstChoice-->true doesn't work when you refresh it or share the link on Dashboards & Visualizations. 06-14-2019 10:09 AM
- Posted Dynamic dropdown dashboard with selectFirstChoice-->true doesn't work when you refresh it or share the link on Dashboards & Visualizations. 06-06-2019 11:45 AM
- Tagged Dynamic dropdown dashboard with selectFirstChoice-->true doesn't work when you refresh it or share the link on Dashboards & Visualizations. 06-06-2019 11:45 AM
- Posted Re: How to populate a dropdown based on selection from another input panel on Dashboards & Visualizations. 06-06-2019 11:38 AM
- Posted Re: How to populate a dropdown based on selection from another input panel on Dashboards & Visualizations. 06-06-2019 11:37 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 0 | |||
| 0 |
11-09-2018
10:58 AM
Thank you thank you thank you thank you thank you!!!!
Marry me!
... View more
11-09-2018
10:07 AM
😛 You guys hiring?
... View more
11-09-2018
09:46 AM
How about for a Splunk enterprise instance?
... View more
11-09-2018
09:45 AM
My manager wont install it 😛
... View more
11-09-2018
09:39 AM
I am running the following query:
index=uplynk slice_played | rex field=_raw "^(?<date>\S*)\s*(?<time>\S*)\s*(?<slice_played>\S*)\s*(?<assetID>\S*)\s*(?<sliceNumber>\S*)\s*(?<isLive>\S*)\s*(?<userIP>\S*)\s*(?<playerUserAgent>\S*)\s*(?<referrerURL>\S*)\s*(?<externalUserID>\S*)\s*(?<sessionID>\S*)\s*(?<playingOwnerID>\S*)\s*(?<channelID>\S*)\s*(?<eventID>\S*)\s*(?<duration>\S*)" | dedup channelID | search isLive=1 | stats values(playerUserAgent)
And I get the following values for the newly created field playerUserAgent:
-
AppleCoreMedia%20/%201.0.0.12B411%20(iPhone;%20U;%20CPU%20OS%208_1%20like%20Mac%20OS%20X;%20en_us)
AppleCoreMedia/1.0.0.12H606%20(Apple%20TV;%20U;%20CPU%20OS%208_4_2%20like%20Mac%20OS%20X;%20en_us)
AppleCoreMedia/1.0.0.16A404%20(iPad;%20U;%20CPU%20OS%2012_0_1%20like%20Mac%20OS%20X;%20en_us)
AppleCoreMedia/1.0.0.16J602%20(Apple%20TV;%20U;%20CPU%20OS%2012_1%20like%20Mac%20OS%20X;%20en_us)
AppleCoreMedia/1.0.0.18A391%20(Macintosh;%20U;%20Intel%20Mac%20OS%20X%2010_14;%20en_us)
Dalvik/2.1.0%20(Linux;%20U;%20Android%208.0.0;%20SM-J337P%20Build/R16NW)%20FOX%20NOW/3.10.2
Lavf/57.83.100
Mozilla/5.0%20(Linux;%20Android%205.1.1;%20AFTT%20Build/LVY48F;%20wv)%20AppleWebKit/537.36%20(KHTML,%20like%20Gecko)%20Version/4.0%20Chrome/59.0.3071.125%20Mobile%20Safari/537.36
Mozilla/5.0%20(Linux;%20Android%207.1.2;%20AFTN%20Build/NS6255;%20wv)%20AppleWebKit/537.36%20(KHTML,%20like%20Gecko)%20Version/4.0%20Chrome/59.0.3071.125%20Mobile%20Safari/537.36
Mozilla/5.0%20(Windows%20NT%2010.0;%20Win64;%20x64)%20AppleWebKit/537.36%20(KHTML,%20like%20Gecko)%20Chrome/70.0.3538.77%20Safari/537.36
Mozilla/5.0%20(X11;%20Linux%20armv7l)%20AppleWebKit/537.36%20(KHTML,%20like%20Gecko)%20Chrome/66.0.3359.120%20Safari/537.36%20CrKey/1.32.124602
Mozilla/5.0%20(X11;%20Linux%20armv7l)%20AppleWebKit/537.36%20(KHTML,%20like%20Gecko)%20Chrome/69.0.3497.86%20Safari/537.36%20CrKey/1.35.137090
Mozilla/5.0%20(X11;%20Linux%20i686)%20AppleWebKit/537.36%20(KHTML,%20like%20Gecko)%20Chrome/29.0.1547.57%20Safari/537.36
Mozilla/5.0%20(X11;%20Linux%20x86_64;%20rv:28.0)%20Gecko/20100101%20Firefox/28.0
Mozilla/5.0%20(iPhone;%20CPU%20iPhone%20OS%207_1%20like%20Mac%20OS%20X)%20AppleWebKit/537.51.2%20(KHTML,%20like%20Gecko)%20Version/7.0%20Mobile/11D167%20Safari/9537.53%20Witbe
Roku/DVP-8.10%20(048.10E04145A)
Roku/DVP-8.10%20(098.10E04131A)
Roku/DVP-8.10%20(288.10E04155A)
Roku/DVP-8.10%20(558.10E04145A)
Roku/DVP-8.20%20(088.20E04167A)
Roku/DVP-9.0%20(559.00E04052A)
I'm aiming to create a new field called 'devicetype' which shows the following:
Roku
iOS
Android and so on
So maybe I can use a search match or something..where if I find the word Roku in the string..I can put it under 'Roku'
Pls help!
... View more
- Tags:
- splunk-enterprise
11-09-2018
09:31 AM
Yep. Thanks!!
... View more
11-09-2018
09:30 AM
Wow thanks!!
... View more
11-08-2018
03:23 PM
Hello, the image below shows the dashboard that I have created.
https://drive.google.com/file/d/1HGTJWHO78qoCdwdKhLebTM2ExRu0wmZT/view?usp=sharing
link text
The token of the Channel dropdown is called field3.
The graph below (named: DC Account Groups) is supposed to take the Channel input from the above dropdown and run the query to display results. But for some reason, even after selecting an input (channel in this case) from the dropdown, the graph still says: Waiting for input.
Here is the query i'm running in the graph:
index=uplynk slice_played | rex field=_raw "^(?<date>\S*)\s*(?<time>\S*)\s*(?<slice_played>\S*)\s*(?<assetID>\S*)\s*(?<sliceNumber>\S*)\s*(?<isLive>\S*)\s*(?<userIP>\S*)\s*(?<playerUserAgent>\S*)\s*(?<referrerURL>\S*)\s*(?<externalUserID>\S*)\s*(?<sessionID>\S*)\s*(?<playingOwnerID>\S*)\s*(?<channelID>\S*)\s*(?<eventID>\S*)\s*(?<duration>\S*)" | dedup channelID | search isLive=1 | lookup test.csv channelID OUTPUT channelID channelname accountgroup| search channelname="$field3$" | stats values(channelname)
The edit settings for the graph are in the image below:
https://drive.google.com/file/d/1vnySlPLHxLv5h6mnWgmLgoQz_6WhnENr/view?usp=sharing
Is there anything I should change there? Also, autorun dashboard is off.
Pls help ASAP.
Thanks
... View more
11-07-2018
01:31 PM
I'm just trying to view the monitoring console. I was told that's possible using the jumbox key that I have...
... View more
11-07-2018
01:10 PM
How can I view the monitoring console if I've been given the .pem file and the jumpbox ip address?
Basically, I'm trying to access the dashboards in the monitoring console so I can recreate them with some changes in my regular Splunk. That's possible right?
Also, I'm using Windows, so going through the putty route. Pls help!!
Thanks
... View more
- Tags:
- splunk-cloud
11-02-2018
10:10 AM
Hi,
I have a weird problem. I have a field called 'playerUserAgent' which returns the following sample of values:
Mozilla/5.0%20(Linux;%20Android%205.1.1;%20AFTT%20Build/LVY48F;%20wv)%20AppleWebKit/537.36%20(KHTML,%20like%20Gecko)%20Version/4.0%20Chrome/59.0.3071.125%20Mobile%20Safari/537.36
Roku/DVP-8.10%20(048.10E04145A)
Roku/DVP-8.10%20(518.10E04500A)
Roku/DVP-8.10%20(298.10E04159A)
Roku/DVP-8.10%20(468.10E04145A)
Roku/DVP-8.12%20(308.12E04024A)
Roku/DVP-8.10%20(138.10E04140A)
Mozilla/5.0%20(Linux;%20Android%205.1.1;%20AFTS%20Build/LVY48F;%20wv)%20AppleWebKit/537.36%20(KHTML,%20like%20Gecko)%20Version/4.0%20Chrome/59.0.3071.125%20Mobile%20Safari/537.36 16,471 3.344%
Roku/DVP-8.10%20(248.10E04145A) 16,434 3.337%
AppleCoreMedia%20/%201.0.0.12B411%20(iPhone;%20U;%20CPU%20OS%208_1%20like%20Mac%20OS%20X;%20en_us)
In each of the above field values, you will see either 'Android' or 'Roku' or 'Apple' mentioned. I'm trying to make a new field called 'deviceType' which will replace each of those lines with just — 'Android' or 'Roku' or 'Apple' or whatever else, respectively.
Any thoughts?
Also, pls note, the field 'playerUserAgent' itself has been extracted using the rex command. Here's the query:
index=uplynk slice_played | rex field=_raw "^(?\S*)\s*(?\S*)\s*(?\S*)\s*(?\S*)\s*(?\S*)\s*(?\S*)\s*(?\S*)\s*(?<**playerUserAgent**>\S*)\s*(?\S*)\s*(?\S*)\s*(?\S*)\s*(?\S*)\s*(?\S*)\s*(?\S*)\s*(?\S*)" | search playerUserAgent="*"
Pls help!!
Thanks
... View more
- Tags:
- splunk-enterprise
10-25-2018
12:24 PM
https://drive.google.com/file/d/13tgNyaelfyPwxIvgAOA1Gn1hI628dGB2/view?usp=sharing[link text]1
I want to rename the T1FCC as Tier 1, T2FCHAC as Tier 2, T3FCCB as Tier 3, T4FCBW as Tier 4M, T4FCPW as Tier 4F.
Need it immediately, pls help!!
... View more
- Tags:
- splunk-enterprise
10-25-2018
10:23 AM
Nope it gives an error 😞
... View more
10-25-2018
09:58 AM
I just ran this and it worked perfectly!!'
Marry me 😛
... View more
10-23-2018
09:03 PM
Worked like a charm 🙂 Thank you!!
... View more
10-23-2018
05:52 PM
Here's my query:
index=dcg_prod handler=CanIplay sc=200|chart count as "calls" by assetId
I want to limit this query to the assetId s with the highest calls, i want just the highest 10 (top10)
I've used the top command, but it doesn't work. Pls help!!
... View more
- Tags:
- splunk-enterprise
10-23-2018
01:37 PM
But there's no value for error_rate. It doesn't seem to be calculating it. I'm sorry for all the trouble 😞
... View more
10-23-2018
01:16 PM
Well... the result displays the status, total_logins and number of errors. However, I want to display only the error rate and the status
... View more
10-23-2018
12:34 PM
This doesn't work 😞 Help pls!
... View more
10-23-2018
12:31 PM
Here's my query:
index=akamai cp=654130 login| stats count (status)
This basically gives me the total logins.
Next, status=200 gives me successful logins and status!=200 gives me failed logins.
... View more
10-23-2018
12:28 PM
There's one small problem I'm facing. I'm not able to use the single value visualization for this. I need to put it as a dashboard panel.
... View more
10-23-2018
12:11 PM
hmm.. I still dont understand how to get them. pls help!!
For example: how would I get total_logins?
... View more
10-23-2018
11:33 AM
Its not working. Problem is that I cant use count in eval.
For example: Here Total_logins is count(status)
so I wrote: eval Total_logins=count(status), but it returns an error. Pls help!
... View more
- « Previous
- Next »
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:04 AM
|
Karma given to
