Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- Find Answers
- :
- About splunkman341
splunkman341
Communicator
Member since:
02-09-2015
06-05-2020
Community Statistics
| Posts | 80 |
| Solutions | 0 |
| Karma Given | 47 |
| Karma Received | 0 |
| Member Since | 02-09-2015 |
Activity Feed
- Karma Re: Finding total number for OOID for richgalloway. 06-05-2020 12:48 AM
- Karma Re: Finding total number for OOID for somesoni2. 06-05-2020 12:48 AM
- Karma Re: How to create a search out of an imported csv file for woodcock. 06-05-2020 12:47 AM
- Karma Re: Uploading a csv file into Splunk without adding it onto the physical splunk server for woodcock. 06-05-2020 12:47 AM
- Karma Re: How to create a search out of an imported csv file for woodcock. 06-05-2020 12:47 AM
- Karma Re: How to create a search out of an imported csv file for woodcock. 06-05-2020 12:47 AM
- Karma Re: How to create a search out of an imported csv file for woodcock. 06-05-2020 12:47 AM
- Karma Re: How to create a search out of an imported csv file for woodcock. 06-05-2020 12:47 AM
- Karma Re: How to create a search out of an imported csv file for woodcock. 06-05-2020 12:47 AM
- Karma Re: How to find 10 most active folders by their action of uploading documents for woodcock. 06-05-2020 12:47 AM
- Karma Re: Timechart for three different actions : Browse, View, Download for woodcock. 06-05-2020 12:47 AM
- Karma Re: Timechart for three different actions : Browse, View, Download for woodcock. 06-05-2020 12:47 AM
- Karma Re: Timechart for three different actions : Browse, View, Download for woodcock. 06-05-2020 12:47 AM
- Karma Re: Timechart for three different actions : Browse, View, Download for woodcock. 06-05-2020 12:47 AM
- Karma Re: Timechart for three different actions : Browse, View, Download for woodcock. 06-05-2020 12:47 AM
- Karma Re: Timechart for three different actions : Browse, View, Download for woodcock. 06-05-2020 12:47 AM
- Karma Re: How to search for three different actions: Browse, View, and Download? for richgalloway. 06-05-2020 12:47 AM
- Karma Re: How to search for three different actions: Browse, View, and Download? for richgalloway. 06-05-2020 12:47 AM
- Karma Re: How to edit my search to find the total count for three different actions? for bmacias84. 06-05-2020 12:47 AM
- Karma Re: How to edit my search to find the total count for three different actions? for woodcock. 06-05-2020 12:47 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
07-24-2015
07:52 AM
Hi guys,
I have this specific search that I want to edit:
index="tablet_os" sourcetype="df" host=dc1* sda3 OR Data| multikv fields FileSystem, UsePct | strcat host '@' Filesystem Host_FileSystem | timechart span=60m avg(UsePct) by Host_FileSystem | rename avg(UsePct) as %Used
and currently, it displays a graph with certain information. What I want to edit is as follows:
dc1prmtbap01/dev/mapper/localraid-Data TO BE CHANGED TO dc1prmtbap01 /data
dc1prmtbap01 /dev/sda3 TO BE CHANGED TO dc1prmtbap01/root
Sorry for the lack of clarity, but if you need me to further explain something, please don't hesitate to ask. Thanks in advance for your help.
... View more
07-09-2015
01:52 PM
WORKS BETTER THAN A DREAM!
... View more
07-09-2015
12:56 PM
I tried for one day and for 30 days and get the same result. I want the total count of each action on a day to day basis for the past 30 days.
... View more
07-09-2015
12:20 PM
I get one giant bar of null when executing:
index=doccloud_main sourcetype=doccloud_sb | rex "documentcloud\.rs\.services\.(?<service>[^\.]+)\.(?<document_action>[^\(]+)" | timechart span=1d count by document_action
I think it just added everything into one bar
... View more
07-09-2015
12:14 PM
I was kind of wondering if I could tweak this further(graphically) so it displays each of the actions mentioned above on a day-to-day basis. For example, it would show a count of how many documents added, updated, downloaded, view, e.t.c daily.
Is that possible?
... View more
07-09-2015
12:10 PM
EXCELLENT!!!
... View more
07-09-2015
10:45 AM
I tried to put it together with the document actions as mentioned, and the search did not work. I get the error mesage
Error in 'rex' command: Encountered the following error while compiling the regex '(?<service>EmployeeDocumentServicesImpl\.(?<document_action>listDocuments()|getDocumentPDF()|getDocument()[^\(]+)': Regex: missing )
The code i tried to execute is as follows:
index=doccloud_main sourcetype=doccloud_sb | rex "(?<service>EmployeeDocumentServicesImpl\.(?<document_action>listDocuments()|getDocumentPDF()|getDocument()[^\(]+)" | stats count by document_action
... View more
07-07-2015
10:03 AM
EmployeeDocumentServicesImp.getDocument() is one of the three actions
... View more
07-07-2015
09:39 AM
Hi guys,
I wanted to know how I would go about getting the total count for each document action over the past 30 days. The document actions are as follows:
BROWSE DOCUMENTS
... View more
07-06-2015
08:26 AM
I do but that is not what I want. I do not want the sum or average of each elapsedTime; I want to display each elapsedTime for each document action day by day.
... View more
07-06-2015
08:06 AM
Hi woodcock. I was wondering if you were able to view my link
... View more
07-02-2015
08:09 AM
Please see this link as a reference to what exactly I am trying to accomplish.
https://answers.splunk.com/answers/235496/how-to-search-for-three-different-actions-browse-v.html
... View more
07-01-2015
01:11 PM
That does not display anything and gives the message "This visualization is configured to display a maximum of 1000 results per series, and that limit has been reached."
I have three fields I need to display with their corresponding elapsedTimes which are :
-EmployeeDocumentServicesImp.getDocument
-EmployeeDocumentServicesImp.getDocumentPDF
--EmployeeDocumentServicesImp.listDocuments
... View more
07-01-2015
12:51 PM
That does not display any information either, and says "Your search generated too much data for the current visualization configuration".
In the statistics tab, it displays alot more information as well that I do not need.
... View more
07-01-2015
12:40 PM
No it does not, it displays an empty chart.
... View more
07-01-2015
12:31 PM
Hi guys,
So I have a query which displays elapsedTime values for three different actions which are browse, view, and download. I am wondering if it possible to display this information into a timechart, where the x-axis displays the date by day and the y-axis displays the value. Here is the query I am trying to make the timechart out of
index=doccloud_main sourcetype=doccloud_sb | rex "(?P<service>EmployeeDocumentServicesImp[l]?\.getDocument(?:PDF)?|EmployeeDocumentServicesImp[l]?\.listDocuments)\(.* Elapsed time:\s+-\s\[(?P<elapsedTime>[\d\.]+)\]" | timechart values(elapsedTime) by service
Thanks in advance for your help
... View more
- Tags:
- regex
06-18-2015
07:17 AM
So it is not possible to search for this file unless it is on the physical server?
... View more
06-17-2015
01:51 PM
Inside Settings > lookups...
The file is not on the physical server that is running Splunk.
... View more
06-17-2015
01:42 PM
It's still giving me the same result as the previous times. " No results found"
... View more
06-17-2015
01:27 PM
hmm its still not displaying any information at all even without the parameters. Was I suppose to do something else after adding it into my lookups?
... View more
06-17-2015
12:57 PM
Thanks for your answer. I tried doing inputcsv categoryLabels | stats values(Label) AS Label - but it would not execute. I am not interested in the ID field, but instead, the label field.
I also have tried inputcsv categoryLabels | table label also did not work.
Also, do I need to include the .csv in my file name? The whole file name is categoryLabels.csv
... View more
06-17-2015
11:25 AM
Hi guys,
So I have just imported a csv file that has two kinds of information : Label & ID number. Now, I am trying to create a search to add into my dashboard that displays the Label and not the ID number.
The xml file's info is as shows right here:
Sorry for the long list. Can someone please help?
Thanks in advance for your help!
... View more
06-17-2015
10:33 AM
Thanks for your response.
So i went to Settings > look ups > look up table files and when I tried to add my csv file I get an error message saying : Encountered the following error while trying to save: In handler 'lookup-table-files': File has no line endings.
Any idea on how to successfully upload it?
... View more
06-17-2015
08:33 AM
Hi guys,
I've roamed the prestigious documents of splunk on how to go about this but I am stumped and can't find any guidance. Just as the question states, I am trying to upload a csv file into splunk, without having to go on the physical splunk server and moving it in. Is this possible?
Thanks in advance for your help
... View more
- Tags:
- csv
Labels
- Labels:
-
CSV
06-16-2015
11:18 AM
Hi guys,
I need to exclude returning the words "DRAFT" from the current query that I have, but I am not sure on where exactly to put it. Here is the query :
index=doccloud_main sourcetype=doccloud_catalina "Document workspace"| rex "Category:\s*(?<Category>[^,]*),\s*subCategory:\s*(?<subCategory>.*)" | stats count by Category, subCategory | sort 30 - count
Can someone please help?
... View more
- Tags:
- regex
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:04 AM
|
Karma given to
