Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- Find Answers
- :
- About stwong
stwong
Communicator
Member since:
05-02-2012
05-08-2024
Community Statistics
| Posts | 139 |
| Solutions | 0 |
| Karma Given | 28 |
| Karma Received | 8 |
| Member Since | 05-02-2012 |
Activity Feed
- Posted Error in Observability Cloud Service Jump Start Guided Example on Splunk Cloud Platform. 05-07-2024 08:12 PM
- Posted Palo Alto Networks Add-on PANOS compatibility on All Apps and Add-ons. 02-21-2024 05:43 PM
- Got Karma for Re: JSON timestamp parsing- When events are being fed from UF, the timestamp can't be extracted?. 01-30-2024 07:09 AM
- Posted Re: co-relate random events on Splunk Search. 08-04-2023 02:16 AM
- Karma Re: co-relate random events for yuanliu. 08-04-2023 02:16 AM
- Karma Re: co-relate random events for ITWhisperer. 08-04-2023 02:07 AM
- Posted co-relate random events on Splunk Search. 08-04-2023 12:57 AM
- Karma Re: Help with Regex in transaction endswith for woodcock. 04-10-2023 06:28 PM
- Posted Re: Regex in transaction endswith on Splunk Search. 04-05-2023 11:44 PM
- Posted Re: Regex in transaction endswith on Splunk Search. 04-05-2023 08:17 PM
- Karma Re: Regex in transaction endswith for javiergn. 04-05-2023 06:22 PM
- Posted Re: Regex in transaction endswith on Splunk Search. 04-04-2023 01:58 AM
- Posted Help with Regex in transaction endswith on Splunk Search. 04-04-2023 01:22 AM
- Posted Splunk Add-on for Microsoft Office 365 - failed to parse URL for IPv6 on Splunk Dev. 12-29-2022 08:01 PM
- Posted Re: JSON timestamp parsing- When events are being fed from UF, the timestamp can't be extracted? on Getting Data In. 12-20-2022 08:03 PM
- Karma Re: JSON timestamp parsing- When events are being fed from UF, the timestamp can't be extracted? for richgalloway. 12-20-2022 05:46 PM
- Karma Re: Pls help: JSON timestamp parsing for wmazur-splunk. 12-20-2022 05:46 PM
- Posted JSON timestamp parsing- When events are being fed from UF, the timestamp can't be extracted? on Getting Data In. 12-20-2022 01:40 AM
- Posted Re: Macro definition = () on Splunk Enterprise Security. 09-09-2021 11:29 PM
- Karma Re: Macro definition = () for isoutamo. 09-09-2021 11:28 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
03-10-2017
08:32 AM
Hi, thanks. Tried addinfo before but seems add earliest/latest time for transaction instead of the first search in the pipe line.
Rgds
/st
... View more
03-10-2017
08:30 AM
Hi Giuseppe,
Thanks. Seems this returns time period of transaction. Can I get the time span for "your_search" ? It's Nagios log and logs status of all hosts. Some are okay and some have down/up status change. We hope to get the percentage of downtime of each host (period betwen down/up) over the entire period.
Bye,
/st
... View more
03-10-2017
02:15 AM
Hi,
Sorry for the newbie question. We want to calculate percentage of time between 2 events over the entire search period. We use transaction and get the sum of time between each pair of events:
| transaction dest service startswith="CRITICAL;SOFT;1" endswith=OK | stats sum(duration) as total_downtime by dest
But we've no idea how to pass the earliest(_time) and latest(_time) of so that we can do the calculation like
percentage = (total_downtime/(latest-earliest))*100
Would anyone please help?
Thanks a lot.
... View more
03-09-2017
10:14 PM
I left this question unchecked for long tims, as the time can be parsed correctly...
... View more
02-03-2017
02:29 AM
Thanks, but we hope to do some transform based on segment 3, e.g.
/data/asav/gw1new/log.1.gz
host_rex = 3 gives gw1new. Then we hope to do something like:
echo gw1new | sed 's/(gw[0-9])new$/mail\1/g'
that gives mailgw1.
Possible to do so?
Thanks.
... View more
02-02-2017
10:19 PM
Hi, we're going to monitor following files on a host with universal forwarder installed:
/data/asav/gw1new/log1.gz
/data/asav/gw2new/log1.gz
/data/asav/gw3new/log1.gz
Since there is no hostname recorded in the log, we want to set hostname like this for stanza [monitor:///data/asav/gw*/*gz]:
gw1new -> mailgw1
gw2new -> mailgw2
gw3new -> mailgw3
Would anyone please help?
Thanks a lot.
/ST Wong
... View more
01-25-2017
08:11 PM
Got it. Thanks.
... View more
01-14-2017
12:19 AM
Hi Giuseppe,
Thanks a lot for your help. Will try to make the time periods correct to avoid duplicated events. However, seems it's a bit difficult for us to use tscollect as we're using search head cluster, without any shared storage.
Anyway, will keep trying in order to learn more.
Thanks again and bye.
/ST
... View more
01-11-2017
03:52 AM
Hi, I run tscollect multiple times for some testing. Seems data will be counted multiple times if I run tscollect on the same time range repeatedly. Is that true?
How can I delete the 'namespace' (or tsindx file) created by tscollect?
Thanks a lot.
/ST
... View more
01-09-2017
07:21 AM
Thanks a lot.
Bye
/ST
... View more
01-09-2017
07:10 AM
If making tscollect in a scheduled search, shall I specify time range based on the scheduled, say running everyday, with time range of -1d@d so that all data will be tscollect'd?
Thanks again.
/ST
... View more
01-09-2017
06:36 AM
Got it and thanks. Too bad that there is naming convention in our shop that I've to follow, and thus I'm not allowed to modify the dashboard name.... Even if I clone one, I still have to keep the original name... :-S
Rgds,
/ST
... View more
01-09-2017
06:34 AM
Got it and thanks. Too bad that there is naming convention in our shop that I've to follow, and thus even I clone one, I still have to keep the original name... :-S
Bye,
/ST
... View more
01-09-2017
06:32 AM
Thanks. Shall I put the tscollect statement as a base search in the dashboard, and use tstats in panel searches? Seems it's beneficial when there are lot of panels that need tstats as the tscollect command takes some time to build. The dropdown list built from search is the first one in the panel, and takes some time before user can get the list (tscollect + tstats).
Besides, chances are user will select the "All" option which is "deptcode=*". Seems tstats can't do with wildcard.
Thanks again.
/ST
... View more
01-09-2017
05:53 AM
Right, that's what I read from manual. Thanks a lot.
... View more
01-09-2017
02:25 AM
Hi, i created an app using an existing dashboard. In myApp/default/data/ui/nav/default.xml:
<nav color="#d15c34">
<collection label="Web Statistic">
<view name="my)web_statistics_20170109_dashboard" default='true'>
<label>Web Statistics</label>
</view>
</collection>
</nav>
I tried to my label in collection and view tags but the app keeps displaying "my_web_statistics_20170109_dashboard". Can I change this name without renaming my dashboard?
Sorry for the newbie question.
Thanks and regards,
/ST Wong
... View more
- Tags:
- splunk-enterprise
01-09-2017
01:49 AM
Hi all,
We created a dashboard where $d_name$ in following search is user input:
<search>
<query>
<![CDATA[index=application host="landing.itsc.cuhk.edu.hk" POST OR GET status<400 $d_name$ | rex field=uri "\/(?<deptcode>[^\/]+)\/" | fields deptcode useragent| search deptcode=$d_name$ | timechart count
]]>
</query>
</search>
<fieldForLabel>deptcode</fieldForLabel>
<fieldForValue>deptcode</fieldForValue>
</input>
Seems using post-process search is slower in our environment as there are more than 1 search peer. Is that correct?
Then I try to convert the inline searches into reports and thus accelerate wherever possible. However, can I do that with input field to be passed to the saved search/report, while base search is not used?
Thanks a lot.
Regards,
/ST Wong
... View more
01-08-2017
05:56 PM
Hi all,
Thanks for your help. Both ways work with custom time range is selected. However, strftime doesn't understand relative time specifiers like -30m@m, which is used quite frequently by our users.
Thanks again.
... View more
01-06-2017
08:03 AM
Hi, is it possible to format time picker value, e.g. $earliest$ and $latest$, in panel title? If i do something like this:
<title>Total access for department $d_name$ between $earliest$ and $latest$</title>
It gives raw time format, or the relative values like -4d@d. We hope to print the values in yyyymmdd HH:MM:SS in title. Please help.
Thanks a lot.
/ST Wong
... View more
01-06-2017
07:55 AM
Sorry that i accidentally added token="xxx" in time picker instead of using default time_tok. It works after removing the token field.
Somes post-process searches can only use default time_tok, right?
... View more
01-06-2017
07:33 AM
Got it. Passing more fields in base search makes post search work, however, the time range earliest and latest nodes specified in base search can't be passed to post searches. I also can't specify or nodes in post search (gives unknown node error if i specify them in post search). Probably something else is missed in my code....
... View more
01-06-2017
03:03 AM
Thanks. The drop down list works after appending "fields" to the base search. May I know the reason behind?
However, post search in panels still not working (just "waiting for data"). e.g.
<panel>
<title>Time distribution of browser for department $d_name$</title>
<chart>
<search base="baseSearch">
<query>
search deptcode=$d_name$ | rename useragent as http_user_agent | lookup user_agents http_user_agent | timechart count by ua_family usenull=f useother=f
</query>
</search>
Again, using full search instead of base+post search works before. Would you help again?
Thanks a lot.
... View more
