About _gkollias

_gkollias · ‎02-26-2014

Hi All, I'm trying to create a table that shows the duration of a transaction by the hour. I'm trying to use something similar to timechart. Here is my search: index=cg sourcetype=esb_audit esb_top_level=1 NOT bp_bp_name="*Task" svc_context_name=ordertype | stats earliest(_time) as start_time, latest(_time) as end_time, earliest(status) as start_status, latest(status) as exit_status, first(other) as exit_message, last(total) as total by svc_context_name |eval duration = (end_time-start_time) |convert ctime(start_time) |convert ctime(end_time) |table svc_context_name, start_time, end_time, start_status, exit_status, exit_message, duration This search is only giving me the one ordertype with what looks like a sum of total duration. How can I modify this search so that it will display all orders with this ordertype, and show the duration of the order? Thank You!

_gkollias · ‎02-26-2014

I'd like to add an area graph to an existing timechart I have using advanced xml. The search is exactly the same as the timechart, but when I reload the page the area graph isn't able to display. I'm adding this piece of xml in - <module name="PostProcess"> <param name="search"><![CDATA[  ]]></param> <module name="HiddenChartFormatter"> <param name="charting.chart">area</param> <param name="charting.chart.stackMode">default</param> <param name="charting.chart.nullValueMode">zero</param> <param name="charting.chart.data.preview">true</param> <param name="charting.chartTitle">PO Count</param> <param name="charting.legend.placement">bottom</param> <param name="charting.axisTitleX.text">test</param> <param name="charting.axisTitleY.text">test</param> <module name="FlashChart" layoutPanel="panel_row2_col1"/> </module> </module> I'm adding this in between the "SimpleResultsTable" module, and the "Redirector"> module (I'm using Sideview Utils for drilldown). Does this make sence, or am I adding the HiddenChartFormatter in the wrong place? Your input would be a huge help. Please let me know if you need more info. Thank You!

_gkollias · ‎02-24-2014

I'm adding Sideview Utils modules in order to do some URL passing, and I'd like to figure out a way to possibly drill down by column rather than row...is this possible? At the end of my search I use ...| timechart span=1h count by foo | - where I would like to see a chart of the data below its corresponding area graph. I'd like to be able to click on "count" below a particular header, rather than clicking on a row. The timechart has different order types, and the count by hour below. Here is a sample of the XML I'm using: <module name="SimpleResultsTable"> <param name="count">10</param> <param name="entityName">results</param> <param name="drilldown">row</param> <module name="Redirector"> <param name="url">cg_diversity_invoice_detail</param> <param name="arg.parameter_1">$click.fields.count$</param> </module> </module> </module> </module>  </module> </view> Is there anyway to do this, or will I need to edit/redo the timechart to something else where row would make sense? Your help would be much appreciated. Thank You

_gkollias · ‎02-06-2014

hmmm...I'm not getting any results with that. I'll keep playing around with it. If you have any other suggestions I'm all ears. Thanks!

_gkollias · ‎02-06-2014

Thanks for the response. I tried that and it just narrowed down the results from 32 to 23. A lot of the same servers that aren't really down are still showing up in the results.

_gkollias · ‎02-06-2014

Recently, the splunk agent has been down on various servers, and I'd like to set up an alert that tells us which servers are in a "DOWN" state once splunk stops running. I've created this search based on other questions that have been asked here: | metadata index=esb_prf type=hosts | append [metadata index=esb_dev type=hosts] | eval host = replace(host,".gtg.com","") | stats max(lastTime) AS last_time_active by host | eval age = now() - last_time_active | eval Status= case(age < 60,"Running",age > 60,"DOWN") | convert ctime(last_time_active) | search Status="DOWN" | table host, last_time_active , Status | sort host The problem I'm seeing is that not every host that lists in the table is actually "DOWN", but some of them are. Is there a way to modify this search to make it more accurate, and only show servers that are actually down? I've seen people use "index=_internal", but that is related to throughput of the Forwarder sending data. So if the Forwarder was up, but had no logs to send, you might get some false reports. This would probably be really rare, though. Another thing is searching _internal can be really slow because of all the stuff that gets crammed in there – especially in production. Your help would be much appreciated. Thank You

_gkollias · ‎02-05-2014

Awesome I'll try it out. Thank you very much for your help!

_gkollias · ‎02-05-2014

so do something like EXTRACT - eisci = ?

_gkollias · ‎02-05-2014

Right now, I have a name=value|name=value| format for some logs. But one problem is the Splunk auto-extract for that data stops working at white-space when there's no quotes around the data For example, the field Message: For one of the Failures, Message should equal "Message=Failed to deploy configurations to aliases [CITST:serverName,CITST:serverName,CITST:serverName,]" But when I see it in results I just have Message=Failed. There's way to do it in the search, but defining some props for that would help out. Does anyone know what I could add to my props.conf to make this successful? Thank you!

_gkollias · ‎01-31-2014

Thank you, Rob! I also want to make sure the startup sequence is added. Is that simply $SPLUNK_HOME/bin/splunk enable boot-start?

_gkollias · ‎01-30-2014

I have some servers that don't comply to our newer Splunk Standards, and I'm doing a "Remediation" on the servers that need home directories changed, increased disk space, etc. Will Splunkd need to be restarted after changing its home directory? Thanks

_gkollias · ‎01-30-2014

Thanks for pointing that out. I used a search I previously used and never removed it 🙂 That search helped, I really appreciate it!

_gkollias · ‎01-30-2014

I have a search that tables project name, the group it belongs to, and the total count of deployment types: index=eis_continuous_integration sourcetype=eisci |search Group="EG" | bucket span=1d _time as Date | eval Date = strftime(Date, "%m/%d/%Y") | stats count as total_deployment_count by SRCProject, Group It's a nice table and all, but I'd like to create a column chart that displays the different project names on the x-axis, the group it belongs to on the left hand side (not just "Group", but "EG", etc.), and the total deployment count as the y-axis. How can I modify this search so I get these results in a dashboard panel? Thank You

_gkollias · ‎01-29-2014

Maybe a chart with Date, SRCProject,EG,ESB,CG as headers and the values underneath?

_gkollias · ‎01-29-2014

Thanks all! I like index=eis_continuous_integration sourcetype=eisci |search Group="EG" | bucket span=1d _time as Date | stats count as totalTypes by Date, SRCProject, Group | eval Date = strftime(Date, "%m/%d/%Y") How can I modify this so in the chart in stead of "Group", It shows "EG" as a header, and the value "30" under it. Is that possible?

_gkollias · ‎01-29-2014

I have a search that gives me the date and total number of projects: index=eis_continuous_integration sourcetype=eisci | timechart span=1d count as projectTypes by SRCProject | rename _time as Date |convert timeformat="%m/%d/%Y" ctime(Date) How can I make it so the results are also sorted by Group ( Group is a field extracted in which its values are ESB, CG, and EG). I'd like to make it so the chart displays a break down of each group by project. When I use ...| timechart span=1d count as projectTypes by SRCProject, Group, Splunk sees ", Group" as an invalid argument. Do you know how I could modify this query to display the results I'm looking for? Thanks!

_gkollias · ‎01-24-2014

Exactly, so essentially all we use wget for is to download the scripts, splunk install stuff, etc from one of our search heads. Since we can't retrieve that stuff in that way, I will be manually installing the forwarder. Thanks for the links!

_gkollias · ‎01-24-2014

The main point is that since we are unable to install 'wget' I will need to install the forwarder manually. I guess I'm unfamiliar with which package I would need. I'll research that info. Thanks.

_gkollias · ‎01-24-2014

I'd like to start forwarding data from a server which is now "unsupported". Normally, I would install a forwarder by using wget to fetch the installation driver from our Splunk prod, however we weren't able to find the dependencies needed to install wget on the machine. I believe I can manually install the forwarder and then hand-configure some conf files in etc/system/local. Does anyone know how to manually install a Splunk forwarder in this use case? Thank You

_gkollias · ‎01-23-2014

That did it 🙂 Thanks!

_gkollias · ‎01-23-2014

I have a query that lists a bunch of information, and I'd like to add a Duration field to the table. The query below is trying to create the table, use append to find duration, and finally add it to the overall table, but it's not working that way. Here is the query I'm using: index=eis_continuous_integration sourcetype=eisci | table _time, Group, Action, SRCRepo, SRCProject, Name, Type, TGTAlias, host, Status | eval Date=_time | convert timeformat="%m/%d/%Y" ctime(Date) | append [ search index=eis_continuous_integration sourcetype=eisci | stats min(_time) AS earliest, max(_time) AS latest by Name | eval Duration = (latest-earliest) | convert timeformat="%H:%M:%S" ctime(earliest) | convert timeformat="%H:%M:%S" ctime(latest) | convert timeformat="%S.%3N" ctime(Duration)] | table Date, Group, Action, SRCRepo, SRCProject, Name, Type, TGTAlias, host, Status, Duration The search after append gives me duration in seconds, but it won't add the duration to the overall table. I thought I could use append to find duration and then add it to the table. Your help would be much appreciated, Thanks!

_gkollias · ‎01-22-2014

You're a genius.. Thank you!

_gkollias · ‎01-22-2014

Thanks! This worked: index=eis_continuous_integration sourcetype=eisci | bucket _time span=1d | stats count as totalType, values(Type) as Types by Group, _time | eval Date=_time | convert timeformat="%m/%d/%Y" ctime(Date) If I wanted to put this in a column chart, how could I make it so I could match the count with what Group it is associated with (i.e. same color)? To try and paint the picture-- a column chart with count on the left(y-axis), date on the x-axis, and then have Group on the right. Is that possible?

_gkollias · ‎01-22-2014

Hi All, I'm using a query to get the total count of individual fields. Here is the search and chart being displayed: index=eis_continuous_integration sourcetype=eisci | bucket _time span=1d | stats count as totalType by Group, Type, _time |eval Date=_time |convert timeformat = "%m/%d/%Y" ctime (Date) | table Date, Group, Type, totalType _time Group Type totalType 12/16/13 EG DEPLOY 16 12/16/13 EG POST-DEPLOY 8 12/16/13 EG PRE-DEPLOY 4 12/16/13 EG ROLLBACK 2 What I'd like is the sum of totalType by Group--this way when more groups are added I will have the sum of Type by each Group. So it would look like: date group totalCount 12/16 EG 30 12/16 CG X...etc How can I add up the totalTypes column to obtain the results above? I've tried playing around with sum, addtotals, etc. but have had no luck. Thanks!

_gkollias · ‎01-18-2014

That timestamp is actually part of the log. I've come across many instances where I've used the MAX_TIMESTAMP_LOOKAHEAD and other time-like attributes that have been great. Being that these logs are more human-friendly than computer-friendly (ex name=value format where Splunk can auto extract the values) using regex to extract would be a great help, but I'm not too sure I've used it properly. I'll take a look at the link you gave me...Thanks!

Posts	220
Solutions	8
Karma Given	90
Karma Received	39
Member Since	‎08-21-2013

Online Status	Offline
Date Last Visited	3 hours ago

Are there time look back limitations when exportin...

Splunk Add-on for ServiceNow: How to populate cus...

ERROR: The kvstore port [foo] is already bound. S...

How to Create Dynamic Dropdown Inputs at Search Re...

Pretty Print XML - How to create an HTML section i...

How to use multiple tokens with multiple searches ...

How to export very large datasets from Splunk?

Why are there missing days in the results of my "M...

Have I properly configured advanced conditional at...

How to replace a status with a new value?

Help displaying duration of all orders of a single...

Adding a chart to advanced xml

Sideview Utils: Drilldown by Column?

Re: Splunk Agent Status by Host

Re: Splunk Agent Status by Host

Splunk Agent Status by Host

Re: Extracting Logs at Whitespace

Re: Extracting Logs at Whitespace

Extracting Logs at Whitespace

Re: Restarting Splunk Agent when Home Directory is...

Restarting Splunk Agent when Home Directory is cha...

Re: Query Modification

Query Modification

Re: Query Help: Sorting Results by Group

Re: Query Help: Sorting Results by Group

Query Help: Sorting Results by Group

Re: Manually Installing Splunk Forwarder

Re: Manually Installing Splunk Forwarder

Manually Installing Splunk Forwarder

Re: Adding "Duration" to a Table of Information

Adding "Duration" to a Table of Information

Re: Sum of Field values

Re: Sum of Field values

Sum of Field values

Re: Using RegEx in Props.conf