Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Are you a member of the Splunk Community?
Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- Find Answers
- :
- About splunker9999
splunker9999
Path Finder
Member since:
01-21-2016
01-11-2021
Community Statistics
| Posts | 185 |
| Solutions | 0 |
| Karma Given | 7 |
| Karma Received | 11 |
| Member Since | 01-21-2016 |
Activity Feed
- Posted Re: Plot a line chart to compare against 2 time ranges by a specific field on Splunk Search. 01-08-2021 09:13 AM
- Posted Plot a line chart to compare against 2 time ranges by a specific field on Splunk Search. 01-07-2021 10:42 AM
- Got Karma for F5 Networks - Analytics - Failed Splunk cloud vetting. 06-16-2020 10:02 AM
- Karma Re: Should we perform a field extraction or field transformation on this sample log? for somesoni2. 06-05-2020 12:48 AM
- Karma Re: Why is my search with a where condition not filtering results as expected? for somesoni2. 06-05-2020 12:48 AM
- Karma Re: Why is my search with a where condition not filtering results as expected? for sundareshr. 06-05-2020 12:48 AM
- Got Karma for Why am I getting error "Application does not exist" when applying a shcluster-bundle via Deployer to a search head cluster?. 06-05-2020 12:48 AM
- Got Karma for How can we move alerts from one app to another?. 06-05-2020 12:48 AM
- Got Karma for Splunk App and Add-on for ServiceNow: Why is data not indexing and receiving "ValueError: No JSON object could be decoded" error?. 06-05-2020 12:48 AM
- Got Karma for Can we export saved search results to outputs.csv?. 06-05-2020 12:48 AM
- Got Karma for How can we send data to 2 different groups of indexers?. 06-05-2020 12:48 AM
- Got Karma for Re: How can we send data to 2 different groups of indexers?. 06-05-2020 12:48 AM
- Got Karma for How to create a daily alert to trigger if any new host is sending data to an index?. 06-05-2020 12:47 AM
- Got Karma for How to combine 2 dashboards, each with multiple panels, into one dashboard with tabs to switch between the two types of data?. 06-05-2020 12:47 AM
- Got Karma for Re: How can I write a search that shows up and down status in bar graph for past 30 days by server?. 06-05-2020 12:47 AM
- Karma Re: Is there a way to remove the "Open in Search, Inspect, and Export" options from the bottom of the dashboard? for nidhigoyal. 06-05-2020 12:46 AM
- Karma Re: Is there a way to remove the "Open in Search, Inspect, and Export" options from the bottom of the dashboard? for nfilippi_splunk. 06-05-2020 12:46 AM
- Karma Re: Is there a way to remove the "Open in Search, Inspect, and Export" options from the bottom of the dashboard? for proylea. 06-05-2020 12:46 AM
- Got Karma for Re: Can deployment server upgrade universal forwarders yet?. 06-05-2020 12:46 AM
- Karma Re: Scheduling csv view/dashboard delivery for willow75. 06-05-2020 12:45 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 1 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
09-01-2016
10:03 AM
Hi,
I have this search below, which produces results, but need to format these in a report.
index=imdc_w sourcetype="imdp:ITSM:changes"
|rename assignment_group as Assignmentgroup, u_chg_plan_impl_startdate as Time u_chg_reject_count as Reject_count ,u_chg_exped as Expedited, u_chg_unauthorized as Unauthorized, u_chg_plan_impl_stopdate as stopdate, closed_at as closeddate
| where Assignmentgroup != "assignment_group"
| join type=left Assignmentgroup [ |inputlookup sys_user_group.csv]
| eval Platform=if(isnull(Platform), "Unknown Platform", Platform)
| eval Tier=if(isnull(Tier), "L2", Tier)
|search Tier=*
| search Platform="*"
| search Director="*"
| search Assignmentgroup="*"
| search VP="*"
| eval type = if (type="Service Restore Emergency", number, null())
| eval Reject_count = if(Reject_count>0 AND state="Closed", number, null())
|eval Expedited=if(Expedited="true",number,null())
|eval Unsuccessful=if(u_chg_closure_code ="Unsuccessful",number,null())
|dedup change_request
|stats dc(type) as Emergency dc(Reject_count) as Rejected dc(Expedited) as Expedited dc(Unauthorized) as Unauthorized dc(Unsuccessful) as Unsuccessful dc(change_request) as Total by date_month
|xyseries date_month
Currently result output:
date_month Emergency Rejected Unauthorized Unsuccessful
Aug 0 0 2 3
Jul 1 2 2 1
I want to see results in below format:
Aug Jul Jun
Emergency 0 0 0
Rejected 2 1 0
Unauthorized 0 0 3
Unsuccessful
Can you please help?
THanks
... View more
08-30-2016
01:45 PM
Hi,
We are looking for time chart that would give Status over time from our CSV file.
Line graph should plot by Month (this field does not exist in our data).
Here is sample data from the lookup which has date/Time Opened field. Using this, we need to get a timechart by status over month.
Case Contact Name Subject Status Case Age (days) Owner Name Date/Time Opened
29541 Yalamanchil Memory Open 289 Chandhok 11/11/2015 11:23
35594 Mullangi Gold DR- Closed 149 Chandhok 3/30/2016 9:00
37506 Yalamanchili CORAL volume Open 100 Chandhok 5/18/2016 21:16
Sample search looks like below:
|inputlookup Mapr_Ticket_Metrics.csv| eval Status= if(Status!="Closed", "Open", "Closed")|chart count over "Date/Time Opened"`by Status
This search lists by time value (but we need to aggregate these by month, our X-Axis should give month)
Thanks
... View more
08-26-2016
09:07 AM
will Embedding mulitple reports in to single webpage is possible?
... View more
08-25-2016
02:17 PM
Hi,
can some one please advice , we are looking to send our cluster statistics reports to our Leaders.
Being that we have dashboard and need to schedule this inline , will this be possible? being seen by senior VPS, we dont want this to be PDF schedule.
OR
If we can inculde multiple panels in a report, we can scheddule this inline? Is this possible to include multiple searches (panels) in a report from where we can schedule this inline?
Thanks
... View more
- Tags:
- splunk-enterprise
08-24-2016
11:12 AM
Hi,
We have a field which has both numeric values and words. We are looking to multiply all numeric values with 100.
Can some one please help?
... View more
08-19-2016
04:35 PM
Hi,
We are looking for a search which would give availability for the last 3 months.
We came come up with the search below that would give availability for the last 12 months. This search is built from an inputlookup file. Can you please advise how to enhance this search to only get data for the last 3 months?
|inputlookup availability_metrics.csv |replace ".Net" with Windows,sphere with Sphere,"Hadoop - Platinum" with Hadoop,"IDN Teradata" with TeraData,"IDN DW - IQAX" with Sybase,analytics with SAS,idndm with "Data Management" IDN with "IDN Mainframe"|rename Product as Platform | join type=left Platform [ |inputlookup sys_user_group.csv] | eval Tier=if(isnull(Tier), "L2", Tier) |stats values(Jan) as Jan values(Feb) as Feb values(Mar) as Mar values(Apr) as Apr values(May) as May values(Jun) as Jun values(Jul) as Jul values(Aug) as Aug values(Sep) as Sep values(Oct) as Oct values(Nov) as Nov values(Dec) as Dec by Platform
Thanks
... View more
08-18-2016
12:55 PM
In statistics it is displaying as correct value, but in single value panel it is rounding to the nearest value.
If result is as 99.99 , it is rounding to 100 in single value panel?
Also can you please advice how can we append Pecentage to value in single value panel?
... View more
08-18-2016
11:02 AM
In statistics it is displaying as correct value, but in single value panel it is rounding to the nearest value.
If result is as 99.99 , it is rounding to 100 in single value panel?
Also can you please advice how can we append Pecentage to value in single value panel?
... View more
08-18-2016
09:50 AM
Hi,
We have a search which gives us availability of our platforms. We used the syntax below to round for 2 decimal places.
| stats avg(Value) as Average|eval Average=round((Average*100),2)|eval range=if(Average >=0, "low", "severe")
This is giving us results like below
Average
100.00
99.99
Now we want to round off only for values which have non zero in decimal places. Can we do this?
Output should show like this below.
Average
100
99.99
... View more
08-16-2016
03:24 PM
awesome...that works.
I used finalized.
Thank you very much.
... View more
08-16-2016
02:40 PM
Is there a way, we could get average of search?
tried stats avg(search) ,but not working?
... View more
08-16-2016
12:32 PM
Hi,
I am using single panel chart to display availability.
Let suppose, If I select any date during July( it should disply july month availability), similarly If we select any date in the month of march( it should display march availability detials).
Thanks
... View more
08-16-2016
12:26 PM
Below is my sample xml code used for this dashboard.
<single>
<title>$total$</title>
<search>
<query>index=imdc_vms (sourcetype=hadoop:app:opera) (host=lgpbdpv035* OR host=lgpbdpv535* ) return_message="SUCCESS" |eval Platform =if(sourcetype=="hadoop:app:opera", "OPERA","Fingerprint") | search Platform="*" | eval item ="Success Requests" | stats dc(request_id) as Count by item,Platform | append [search index=imdc_vms sourcetype=hadoop:app:tomcat:access source="*localhost_access_log*" (host=lgpbdpv035* OR host=lgpbdpv535* OR host=lgpbdpv050* OR host=lgpbdpv550*) ( method=POST OR method =GET) (uri="*opera*" OR uri ="*fingerprint*" ) | eval Platform=if(match(uri,".*opera.*"),"OPERA", "Fingerprint") | search Platform="*" | eval item ="Total Requests" | stats count(uri) as Count by item,Platform | eval t_req= Count ] | append [search index=imdc_vms sourcetype="hadoop:app:tomcat:catalina" ( host=lgpbdpv050* OR host=lgpbdpv550*) "Call to Response * took *" |eval Platform =if(sourcetype=="hadoop:app:opera", "OPERA","Fingerprint") | search Platform="*" | eval item ="Success Requests" | stats dc(request_id) as Count by item,Platform | eval s_req= Count ] | append [search index=imdc_vms sourcetype=hadoop:app:opera (host=lgpbdpv035* OR host=lgpbdpv535* ) ( EventDesc ="Got Request*" OR (EventDesc ="*Finished processing for request map*" AND tt_total >1000) ) |eval Platform =if(sourcetype=="hadoop:app:opera", "OPERA","Fingerprint") | search Platform="*" | eval item ="Error Requests" | transaction host pub_guid startswith="Got Request*" endswith="*Finished processing for request map*" maxevents=2 |stats count as Count by item,Platform ] | eval Platform = Platform +":"+ item +": "+ Count
| table Platform, Count| eventstats sum(Count) as total|fields - Platform Count|head 1
</query>
<progress>
<set token="total">$result.total$</set>
</progress>
... View more
08-16-2016
11:30 AM
Hi tried this, value is not displaying in title, it is displaying as "$result._total$"?
... View more
08-16-2016
09:55 AM
Hi ,
Thanks, we are not looking to display in fieldname , instead some thing we are looking to display in title or some way inside panel is also fine?
Thanks
... View more
08-16-2016
09:53 AM
Hi, we have 5 rows with one column and i used the latter to my search.
| eventstats sum(yourcolumn) as _total
and tried calling this in my panel title $result._total$ as suggested, but value is not displaying in panel?
Is there anything need to do?
Thanks
... View more
08-15-2016
05:43 PM
Hi,
Is there any possibility to display total count of all fields inside a panel?
We have pie chart that displays 5 fields with some values for each. Now we need to display something like "total" may be at top of the panel or bottom of the panel.
Can you please suggest?
Thanks
... View more
08-15-2016
03:10 PM
These queries are working till stats command, but afterthat they are not retrieving results because we have filtered by linux1 ,linux2 and linux3 are values not fields?
... View more
08-15-2016
03:00 PM
Thanks, and will this not work for the span (1d or 1h)? this is not retrieving any results if I change span to 1h or 1d to check 7days period?
... View more
08-15-2016
02:27 PM
Looks Good, Is there a way we can format time on X axis?
Currently this looks like 2016-08-15T00:05:00.000-07:00 is not in readable format? is there a way we can get this to readable for mat something like 8.30AM Mon Aug 15 2016
... View more
08-15-2016
01:54 PM
Hi,
We have a search which gives us average CPU time by host and we want to plot a line graph to get hosts which have CPU usage greater than 25%.
Our search below is giving us results, but when we filter results like search host>25 , it is filtering the results, but it is displaying other hosts during that time.
Ex: If we need to check CPU perc on *linux1, linux2, linux3, and we have CPU>25 for linux1 at 10 mins ago, we are getting results for other hosts as well.
Results we are getting like below, but we are looking only for >25 (linux1 here below)
_time linux1 linux2 linux3
10.00 27 16 17
10.10 30 18 20
Search:
index=idx1 sourcetype=cpu host=linux1* OR host=linux2* OR host=linux3* all | rex field=host "(?P<hostname>[^.]+)" | eval hostname=lower(hostname) `linux_hostname` | eval linuxCPU=100 - pctIdle | timechart span=10m avg(linuxCPU) as cpu by hostname useother=f limit=0
|search linux3>25 OR linux2>25 OR linux1 >25
We should results like
_time linux1
10.00 27
10.10 25
... View more
08-12-2016
06:49 AM
HI,
We have 2 dashboards ,trending and live : we are looking to include a link to live dashboard for trending and viceversa ?
Link on top of the dashboard would looks good.
Can someone please help ?
Thanks
... View more
- Tags:
- splunk-enterprise
08-12-2016
06:13 AM
Hi, This is working ,but when ever 0 results found, I could see fields on Pie chart is visible(only with lines), can we some how hide those details.
I thought of hiding this panel when 0 results found by setting token $showpanel$,,but this panel is already depends on another panel , can we use 2 panel depends?
Thanks
... View more
08-11-2016
02:44 PM
Thanks, Works like a champ.
... View more
08-11-2016
02:07 PM
Hi,
We have the search below and are looking to view results in pie chart format. We are facing difficulties to visualize this with Pie chart. How do we edit our search to make this possible?
index=index sourcetype=hadoop: us.LogUtility | eval TotalTimeSolr = Solr_Personalized_Instore + Solr_Personalized_Online + Solr_NonPersonalized | eval TotalTimeHBase = Hbase_Card_Master + Hbase_Card_Upgrade_Info + Hbase_Cust_Info_Specialoffers + Hbase_Cust_Info_CMData + Hbase_Offer_Details + Hbase_Global_Offers_InfoEnrol + Hbase_Global_Offers_Info_Lob + Hbase_Cust_Info_Feedback + Hbase_Offer_Popular + Hbase_Offer_Random |where (TotalTime > 5000 OR TotalTimeSolr>5000 OR TotalTimeHBase>5000)
|eval TotalTime=if(TotalTime<5000,0,TotalTime)
|eval TotalTimeSolr=if(TotalTimeSolr<5000,0,TotalTimeSolr)
|eval TotalTimeHBase=if(TotalTimeHBase<5000,0,TotalTimeHBase)
|stats count(eval(TotalTime!=0)) as TotalTime count(eval(TotalTimeSolr!=0)) as SolrTime count(eval(TotalTimeHBase!=0)) as HBaseTime
Please advise or suggest if there is a way we can convert this.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
01-11-2021
06:08 PM
|
Karma from
Karma given to
