Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- Find Answers
- :
- About Kukkadapu
Kukkadapu
Path Finder
Member since:
01-18-2016
10-13-2020
Community Statistics
| Posts | 60 |
| Solutions | 0 |
| Karma Given | 4 |
| Karma Received | 5 |
| Member Since | 01-18-2016 |
Activity Feed
- Karma Re: How to hide the dropdown input panel ? for martin_mueller. 06-05-2020 12:48 AM
- Karma Re: Is there any tool to automatically format a Splunk search to make it readable? for woodcock. 06-05-2020 12:48 AM
- Karma How to resolve Unable to initialize modular input "server" defined inside the app "splunk_app_db_connect" for teddyidc1101. 06-05-2020 12:48 AM
- Karma Unable to initialize modular input "server" defined inside the app "splunk_app_db_connect": Introspecting scheme=server: script running failed (exited with code 1). for sivaksk147. 06-05-2020 12:48 AM
- Got Karma for Re: How to add keepevicted=true in the datamodel or the query which uses datamodel (Data model has a transaction)?. 06-05-2020 12:48 AM
- Got Karma for Re: How to hide the dropdown input panel ?. 06-05-2020 12:48 AM
- Got Karma for How to search based on a time field that is not _time?. 06-05-2020 12:48 AM
- Got Karma for How to search based on a time field that is not _time?. 06-05-2020 12:48 AM
- Got Karma for How to search based on a time field that is not _time?. 06-05-2020 12:48 AM
- Posted How to have a drop down to the embedded report? on Dashboards & Visualizations. 02-08-2018 09:37 AM
- Posted Re: Is there a way to only get the response with "isDone" using the REST endpoint "search/jobs/{search_id}:"? on Getting Data In. 11-08-2017 02:09 PM
- Posted Is there a way to only get the response with "isDone" using the REST endpoint "search/jobs/{search_id}:"? on Getting Data In. 11-08-2017 12:39 PM
- Tagged Is there a way to only get the response with "isDone" using the REST endpoint "search/jobs/{search_id}:"? on Getting Data In. 11-08-2017 12:39 PM
- Tagged Is there a way to only get the response with "isDone" using the REST endpoint "search/jobs/{search_id}:"? on Getting Data In. 11-08-2017 12:39 PM
- Posted Re: How to run two different searches in a dashboard based on the selected time range? on Splunk Search. 01-09-2017 03:02 PM
- Posted How to run two different searches in a dashboard based on the selected time range? on Splunk Search. 01-09-2017 09:48 AM
- Tagged How to run two different searches in a dashboard based on the selected time range? on Splunk Search. 01-09-2017 09:48 AM
- Tagged How to run two different searches in a dashboard based on the selected time range? on Splunk Search. 01-09-2017 09:48 AM
- Tagged How to run two different searches in a dashboard based on the selected time range? on Splunk Search. 01-09-2017 09:48 AM
- Posted Re: How to add keepevicted=true in the datamodel or the query which uses datamodel (Data model has a transaction)? on Splunk Search. 11-02-2016 12:34 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
05-12-2016
02:50 PM
Yes, I tried it , but no luck. It doesn't show all the fields.
... View more
05-12-2016
02:33 PM
Jkat54, I've the same settings. The coverage is 1% or more.
... View more
05-12-2016
02:17 PM
Hi,
I have a log statement with almost 100 fields. When searched, it doesn't show all the fields in Selected fields nor in All fields tab. Is there a limitation for the number of fields in Splunk? If so, where do I change it?
I used the table command to make sure the missing fields are there, it's just not showing in the panel to the left.
Thanks.
... View more
04-29-2016
09:49 AM
Thank you. I'll try this.
... View more
04-28-2016
04:08 PM
Hi Ppablo, Yes, I'm looking for something like this. Do we have any tool to download by any chance and not the web version.
Thanks.
... View more
04-28-2016
03:47 PM
Hi, Do you know of any tool to beautify/format a Splunk search to make it readable?
Thanks.
... View more
04-27-2016
10:47 AM
Hi,..
I've implemented the Java SDK for Splunk and I'm able to pass the time arguments and it's working as expected. I'm trying to add additional parms/arguments in the saved search and pass the value from the code. It doesn't work. Which arguments do I need to use to pass the additional parameters?
Saved Search:
source="abc.log" index="index1" | search host=$temp$| stats count(host)
Java Code:
SavedSearchDispatchArgs dispatchArgs = new SavedSearchDispatchArgs();
dispatchArgs.setDispatchEarliestTime("1460590443");
dispatchArgs.setDispatchLatestTime("1460703600");
**dispatchArgs.put("temp", "host1");**
Job jobSavedSearch = null;
SavedSearch savedSearches1 = service.getSavedSearches().get("SavedSearchName");
jobSavedSearch = savedSearches1.dispatch(dispatchArgs);
Error :
Exception in thread "main" com.splunk.HttpException: HTTP 400 --
In handler 'savedsearch': Argument "temp" is not supported by this handler.
What arguments should I pass from the code?
Thanks
... View more
04-19-2016
12:59 PM
Perfect , This worked. It created a new column - "fieldnames" with the original column name. I could just search the new column which has no nulls.
Thanks for your time Javiergn.
... View more
04-19-2016
12:00 PM
Can you explain the query please? I'm seeing this error
Failed to parse templatized search for field 'Id_1'
Failed to parse templatized search for field 'Id_2'
Failed to parse templatized search for field 'Id_3'
Failed to parse templatized search for field 'Id_4'
Thanks
... View more
04-19-2016
11:36 AM
Hi Sundareshr, Yeah , but the search string is also going to be in the other columns. I wanted to search only in the column Id_*
Thanks
... View more
04-19-2016
10:41 AM
Hi,
I have multiple columns (number of columns may vary) and wanted to search a string if it exists in any of the columns. How do I do this using a simple search?
Log example: There are three statements
Id_1="abc" Id_2="xyz" Id_3="123" Id_4="abcd" Id_5="abc" Id_6="abc"
Id_1="abc" Id_2="xyz" Id_3="123"
Id_1="abc" Id_2="123" Id_3="123" Id_4="abcd" Id_5="abc" Id_6="abc" Id_7="123"
I've used the table command like this: | table Id_* to get a table of Id's
OUTPUT for the above search:
Id_1="abc" Id_2="xyz" Id_3="123" Id_4="abcd" Id_5="abc" Id_6="abc" Id_7="xyz"
Id_1="abc" Id_2="xyz" Id_3="123" Id_4=null Id_5=null Id_6=null Id_7=null
Id_1="abc" Id_2="123" Id_3="123" Id_4="abcd" Id_5="abc" Id_6="abc" Id_7="123"
Now I wanted to search/get the records where Id_* is "xyz" . Can you help me with the search?
Thanks.
... View more
04-14-2016
11:37 AM
That makes sense. Thanks for your time 🙂
... View more
04-14-2016
11:37 AM
Thanks for your time and links jplumsdaine22 :).
... View more
04-14-2016
10:42 AM
Hi , Can you help me understanding "search" vs "where" command after first pipe. Is there any performance impact because of using either one?
Thanks
... View more
04-07-2016
11:25 AM
Thanks for your time guys:)
... View more
04-07-2016
11:25 AM
Thanks for your time 🙂
... View more
04-06-2016
11:11 AM
3 Karma
Hi,
I have two time fields.
_time (This is the splunk time stamp)
abctime (format YYYY-MM-DD)
How do I search the events for all time (_time), and then search abctime based on the time selected in the dashboard (earliest and latest time). Can you help me with the search?
Thanks.
... View more
03-14-2016
10:11 AM
Yes, Perfect. Thanks Maciep 🙂
... View more
03-11-2016
08:07 AM
Rich , Thanks for the reply. I've tried this earlier. If I use startswith and endswith , it's giving me a count of four instead of two.
... View more
03-10-2016
04:25 PM
This worked 🙂 Thanks Maciep.
And can you help me how to have a timechart for event 1 and event 3 where it changed from event 1 to 3 (So I can display a line chart for both event 1 and event 3 ). That would be great.
Thanks
... View more
03-10-2016
04:08 PM
Maciep, Thanks for the reply.
1 to 3 is switched two times
2016-03-09 01:47:45 id=1234 event=1
2016-03-09 01:47:46 id=1234 event=3
AND
2016-03-09 01:47:49 id=1234 event=1
2016-03-09 01:47:50 id=1234 event=3
I need the average time - The average time is going to be 1 second
Thanks.
... View more
03-09-2016
10:14 AM
Hi,
My events have the following structure
_time=time id=[id] event=[event]
For example:
2016-03-09 01:47:41 id=1234 event=1
2016-03-09 01:47:42 id=1234 event=1
2016-03-09 01:47:43 id=1234 event=1
2016-03-09 01:47:44 id=1234 event=1
2016-03-09 01:47:45 id=1234 event=1
2016-03-09 01:47:46 id=1234 event=3
2016-03-09 01:47:47 id=1234 event=3
2016-03-09 01:47:48 id=1234 event=3
2016-03-09 01:47:49 id=1234 event=1
2016-03-09 01:47:50 id=1234 event=3
2016-03-09 01:47:51 id=1234 event=4
2016-03-09 01:47:52 id=1234 event=5
2016-03-09 01:47:53 id=1234 event=2
2016-03-09 01:47:54 id=1234 event=2
2016-03-09 01:47:55 id=1234 event=1
2016-03-09 01:47:56 id=1234 event=1
2016-03-09 01:47:57 id=1234 event=1
2016-03-09 01:47:58 id=1234 event=1
2016-03-09 01:47:59 id=1234 event=2
2016-03-09 01:47:60 id=1234 event=5
| mvcombine delim=" " event
| nomv event
Output
1 1 1 1 1 3 3 3 1 3 4 5 2 2 1 1 1 1 2 5
I need the time taken from event=1 to event=3
I've used the following query but then it shows four transactions instead of two(In the data above we can see that there are only two places where the event changed from 1 to 3).
| transaction Id startswith=eval(event=1) endswith=eval(event=3) maxevents=2
Can you let me know how to get the time taken between the events?
Thanks
... View more
02-16-2016
12:25 PM
I've date_hour and date_wday fields. Thanks for your time.
... View more
02-16-2016
12:25 PM
Thanks that worked:)
... View more
- « Previous
-
- 1
- 2
- Next »
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
10-13-2020
12:39 PM
|
Karma from
