Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- Find Answers
- :
- About _gkollias
_gkollias
Builder
Member since:
08-21-2013
02-09-2026
Community Statistics
| Posts | 221 |
| Solutions | 8 |
| Karma Given | 91 |
| Karma Received | 39 |
| Member Since | 08-21-2013 |
Activity Feed
- Karma Splunk Cloud Platform EDU courses! for SplunkCommunity. 01-17-2025 07:10 AM
- Posted Re: File growth rate must be higher than indexing or forwarding rate on Getting Data In. 01-17-2025 06:28 AM
- Karma Re: i want to refresh the dashboard on button click. is it possible? for niketn. 11-27-2023 09:42 AM
- Karma Re: Splunk Agent Status by Host for martin_mueller. 05-12-2023 03:06 PM
- Karma Announcing Our Splunk MVPs for jhupka_splunk. 03-03-2023 05:06 PM
- Got Karma for Re: Why search with postprocessing returns no results in dashboard, but the actual search does?. 02-09-2022 11:17 PM
- Karma Re: What is the difference between Splunk and ELK Stack Elasticsearch in terms of Security, Infrastructure, deployment etc? for outcoldman. 01-17-2022 11:31 AM
- Karma Re: Query for Users, Roles, AD Groups and Indexes. for harsmarvania57. 10-11-2021 02:07 PM
- Karma Re: how to display pattern tab result in report in dashboard? for s2_splunk. 07-23-2021 10:43 AM
- Got Karma for Splunk Agent Status by Host. 07-02-2021 03:06 PM
- Karma Re: Splunk Agent Status by Host for somesoni2. 06-14-2021 08:32 AM
- Karma Re: Splunk Agent Status by Host for martin_mueller. 06-14-2021 08:31 AM
- Karma Re: Splunk Agent Status by Host for Runals. 06-14-2021 08:31 AM
- Karma Re: Splunk Add-on for ServiceNow: How to populate custom mandatory fields in a ServiceNow Incident? for chrisyounger. 03-25-2021 02:03 PM
- Karma Re: Extract data from within only double quotes "*" in a _raw log for niketn. 02-24-2021 12:56 PM
- Posted Re: License Usage by Each Indexer on Splunk Search. 08-18-2020 11:42 AM
- Karma Re: Parse nested json array without direct key-value mapping for to4kawa. 08-18-2020 06:47 AM
- Karma Re: Have I properly configured advanced conditional attributes for my alert in savedsearches.conf? for frobinson_splun. 08-03-2020 01:31 PM
- Posted Re: Parse nested json array without direct key-value mapping on Splunk Search. 07-16-2020 07:01 PM
- Karma Re: Regex/Rex - Non Capture Groups for gcusello. 07-16-2020 01:37 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 2 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
03-18-2014
08:47 AM
Good call.We have version 1.3.5 🙂 That'll do it
... View more
03-18-2014
07:36 AM
I'm finding that Link just creates a link for users to access a different page. I actually want to click a single value - the actual number - and drill down in to those. Is that possible?
... View more
03-18-2014
06:12 AM
Thanks guys! There is still something up with Link.. it doesn't seem to like my page, as it keeps hanging on "Loading". I will continue to play around with this and follow up with what I come up with. If you have anymore feedback please let me know! UPDATE: Essentially these SingleValues will represent the status of a transaction (Success, Failure, Error, Hold, Reprocess, etc.) and I would like to also drill down by status - that is when I will add that passing variable "$status$"
... View more
03-17-2014
05:55 AM
Thank you for your response. I'm a bit confused to why I need to add another field (i.e. "someOtherField") in order to do a drilldown from a singleValue. Or, is it that I need to re-define "count"? Also, what you have suggested doesn't seem to work with my page. The dashboard hangs on loading
... View more
03-14-2014
01:01 PM
I'm looking for a module reference to add a redirector to a singlevalue in advanced xml
Here is my XML Sample - Note the question marks in the redirector module:
<![CDATA[
| stats sum(count) as count | eval count = tostring(count,"commas") ]]>
</param>
count
Transaction Count
range
cg_diversity_channel_detail
$click.???$
Do you know what I can add there so the drilldown will work? Thanks!!
... View more
03-14-2014
06:27 AM
thanks! I will probably add the table command to list the order numbers as well
... View more
03-13-2014
05:13 PM
I have a search that brings up specific order types by order numbers that begin with a 7:
index=contract_gateway sourcetype=esb_audit earliest=-1d@d latest=@d esb_top_level=1 NOT bp_bp_name="Task"
svc_context_name="orderType.channel." OR
svc_context_name="orderType:receive" OR
svc_context_name="orderType:receive"
| stats earliest(_time) as _time count AS event_count, first(OrderNumber) AS OrderNumber first(svc_context_name), latest(status) AS exit_status, latest(GrandTotal) AS GrandTotal by svc_context_id
| search OrderNumber=7*
Basically this tables time, UUID(svc_context_id),eventcount, ordernumber, ordertype/servicename, exit_status(the status of the order as it exits - success,fail, etc.), and grand total ($).
What I am doing is trying to compare these orders with orders I receive in a .CSV from an AS400 to try and make a match/ find out what is not coming in Splunk that is in the CSV.
Since forwarding the CSV is currently a manual process, I have the inputs of the .CSV being forwarded/indexed through a different index and sourcetype:
index=contract_gateway sourcetype=contract_sunrise order_num="7*" - all of the order numbers I am concerned with are 10 digit numbers that begin with 7.
Is there a way I can combine the searches (i.e. via ...| append [ ) and be able to list/sort order numbers that begin with a 7 that are in the CSV but not in Splunk?
Thanks in advance!
... View more
03-13-2014
07:28 AM
Heres an example:
<![CDATA[ search status="$status$" | stats
current search ]]>
5
results
row
cg_diversity_channel_detail $click.fields.svc_context_name$
$status$
... View more
03-13-2014
07:26 AM
Thatnks for your quick response! I am actually using tokens, it's advanced XML with the SideViewUtils module.
... View more
03-13-2014
07:18 AM
I've built a dashboard where users can do a drilldown by selecting an order status in a drop-down list, and then clicking the orderType with that status
Is it possible to add a multi-click feature, where a user can click multiple status's to drill down in to those orders?
Thanks!
... View more
- Tags:
- drilldown
- multiclick
03-13-2014
05:11 AM
Thank you for the help. The weird thing about this CSV is that there are commas in the date time sections, so the data is indexing but its all over the place. I think I'll do some event line breaking and try to re-format the time and I'll see how it goes. Thanks again!
... View more
03-12-2014
10:31 AM
I never knew what CSV stood for 🙂
Good thinking - I would go with the first 2. Timestamp parsing could most likely be the issue. How could I specify that? It seems like a monitor stanza relative to the one in my question would be best for timestamp parsing..I'm sure there is a way to modify what you've given above?
... View more
03-12-2014
06:08 AM
I'm not seeing any data coming in. One thing I forgot to mention was the format I listed are also the headers. The data follows the same pattern of the headers listed above.
... View more
03-12-2014
05:34 AM
Hi Kristian, the ",," is actually in the CSV file - I assumed they acted as separators. So field2, field4, field6 - they represent the various commas? I will try this out now - Thanks!
... View more
03-11-2014
12:37 PM
I'm trying to create a props.conf for a .CSV, but I am unsuccessful and believe its because of the field extraction. The format below follows the same data pattern as these headers listed:
TPCode,,"date",,"time",,PurchaseOrderNumber,,"OrderNumber",,,CompanyNumber,,Division,,"CustomerNumber",,BillToSeq,,ShipToID
Here is my props:
[contract_sunrise]
SHOULD_LINEMERGE = false
TIME_PREFIX = ^
TIME_FORMAT = %Y-%m-%d_%H:%M:%S
MAX_TIMESTAMP_LOOKAHEAD = 40
EXTRACT-contract_sunrise = ^.+\s+(?<TPCode>[^\s]+)\s+(?<"date">[^\s]+)\s+(?<"time">[^\s]+)\s+(?<PurchaseOrderNumber>[^\s]+)\s+(?<"OrderNumber">[^\s]+)\s+(?<CompanyNumber>[^\s]+)\s+(?<Division>[^\s]+)\s+(?<"CustomerNumber">[^\s]+)\s+)\s+(?<BillToSeq>[^\s]+)\s+(?<ShipToID>[^\s]+)
The various "," were automatically added as separators, but if I could forward the data with just the headers and its corresponding data that would be best. Any suggestions on the EXTRACT portion would be greatly appreciated. Thanks!
... View more
03-04-2014
07:41 AM
Hi All,
I'd like to create a props.conf for log files in this format:
DEBUG[ScriptingSession] 2013-11-30 15:52:40.869 EST: <-initialize
Here is what I have so far:
[mws_debug]
SHOULD_LINEMERGE = false
TIME_PREFIX = ^
TIME_FORMAT=%Y-%m-%d $H:%M:%S.%3N
MAX_TIMESTAMP_LOOKAHEAD = 50
EXTRACT-mws_debug = "(? [^"]+)","(? [^"]+)","(? [^"]+)"
I think the field extraction is off, but I can't seem to get this to work.
Your help in modifying this stanza will be much appreciated.
Thanks!
... View more
- Tags:
- extraction
- field
- props
02-28-2014
07:04 AM
Yes, that is exactly what svc_context_name is..its the actual name of the service/channel where the transactions go through, and I basically want to monitor those 7 or 8 Order Types to see how many orders are successful/failures/errors and add some additional stats and drilldowns etc. Here are some fields that I think are most interesting - bp_context_id(business process ID), svc_context_id(service ID),TPCode
... View more
02-27-2014
11:26 AM
Theres a ton of fields being extracted. I have data coming up with this :
index=contract_gateway sourcetype=esb_audit esb_top_level=1 status="SUCCESS" NOT bp_bp_name="Task"
svc_context_name="SplseDiversity.channel.*" OR
svc_context_name="StaplesOAG:receive" OR
svc_context_name="ediversity.cXML:receive"
|transaction svc_context_name eval(status==START) eval(status==SUCCESS) keepevicted=true
| search closed_txn=1
I notice that the transaction command really slows down the search because of all of the data it pulls out
... View more
02-27-2014
11:15 AM
Cool, thank you for the feedback. Pick-a-cell mode would be fantastic. I actually modified my search from using timechart to stats so users can select the orderTypes easier. It looks like:
<![CDATA[
index=contract_gateway earliest=-4h@h sourcetype=esb_audit esb_top_level=1 status="SUCCESS" NOT bp_bp_name="Task"
svc_context_name="x." OR
svc_context_name="y" OR
svc_context_name="z"
| addinfo
| eval current_hour = strftime(info_search_time,"%H")
| eval marker = case(date_hour=current_hour,"this",date_hour=(current_hour-1),"one",date_hour=(current_hour-2),"two",date_hour=(current_hour-3),"three")
| stats
count(eval(marker="this")) AS PO_Count_This_Hour,
count(eval(marker="one")) AS PO_Count_Last_Hour,
count(eval(marker="two")) AS PO_Count_2_Hours_Ago,
count(eval(marker="three")) AS PO_Count_3_Hours_Ago,
by svc_context_name
| fillnull PO_Count_This_Hour, PO_Count_Last_Hour, PO_Count_2_Hours_Ago, PO_Count_3_Hours_Ago
| sort svc_context_name ]]>
</param>
<module name="SimpleResultsTable">
<param name="count">10</param>
<param name="entityName">results</param>
<param name="drilldown">row</param>
<module name="Redirector">
<param name="url">cg_diversity_channel_detail</param> <!-- View name or other URL here -->
<param name="arg.svc_context_name">$click.fields.svc_context_name$</param>
Thanks again!
... View more
02-27-2014
06:46 AM
Thank you! hmm..I'm not seeing any results using the above search. I'll keep trying to play around with it a bit. Really appreciate your help!
... View more
02-27-2014
05:57 AM
Here is a portion of what I'm seeing:
ordertype 02/26/2014 08:00:03.162 02/26/2014 08:59:06.393 START SUCCESS Sucessfully wrote PO
... View more
02-27-2014
05:52 AM
Thank you!! It looks like the duration is being summed up..for example the duration for all orders is greater than 3300.000 seconds, but the times are also being spread out by the hour, so maybe that is total duration for the entire hour?
... View more
02-27-2014
05:33 AM
I have a search where I'd like to show the duration of the order.
My search below almost gives me that, but the start_time and end_time are showing as the same, giving duration a value of 0.000
Here is my search:
index=cg sourcetype=esb_audit esb_top_level=1 NOT bp_bp_name="*Task" svc_context_name="$svc_context_name$" | stats min(_time) as start_time, max(_time) as end_time, earliest(status) as start_status, latest(status) as exit_status, first(other) as exit_message, last(total) as total by svc_context_name, _time |eval duration = (end_time-start_time) |convert ctime(start_time) |convert ctime(end_time) |search exit_status="SUCCESS" |table svc_context_name, start_time, end_time, start_status, exit_status, exit_message, duration
I've also tried doing ...|stats earliest(time) as start_time, latest(time) as end_time, etc...| But I get the same results.
Is there a way to modify this search to get more accurate start/end time values?
Thanks!
... View more
- Tags:
- duration
02-27-2014
05:15 AM
I can now see individual orders within a specific ordertype, but the stats min(_time) as start_time, max(_time) as end_time portion seems to be screwy, as both the start_time and end_time are the same, leaving duration at 0.000. Would you know what is causing this?
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
02-09-2026
09:56 AM
|
Karma from
Karma given to
