Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- Find Answers
- :
- About kranthimutyala
kranthimutyala
Path Finder
Member since:
07-03-2016
10-07-2022
Community Statistics
| Posts | 91 |
| Solutions | 0 |
| Karma Given | 5 |
| Karma Received | 1 |
| Member Since | 07-03-2016 |
Activity Feed
- Posted Re: How to combine events which got generated in a specific span on Getting Data In. 10-07-2022 12:44 AM
- Posted How to combine events which got generated in a specific span? on Getting Data In. 10-06-2022 10:03 PM
- Tagged How to combine events which got generated in a specific span? on Getting Data In. 10-06-2022 10:03 PM
- Posted Re: Help with extracting JSON fields on Splunk Search. 09-23-2022 07:31 AM
- Posted Re: Convert a time duration to a number on Splunk Search. 09-23-2022 05:20 AM
- Posted Help with extracting JSON fields on Splunk Search. 09-23-2022 05:06 AM
- Tagged Help with extracting JSON fields on Splunk Search. 09-23-2022 05:06 AM
- Karma Re: Convert a time duration to a number for gcusello. 09-23-2022 05:02 AM
- Posted How do I convert a time duration to a number? on Splunk Search. 09-20-2022 11:01 PM
- Tagged How do I convert a time duration to a number? on Splunk Search. 09-20-2022 11:01 PM
- Posted Re: compare splunk ingestion volume on Splunk Search. 05-24-2022 05:21 AM
- Posted How to compare splunk ingestion volume? on Splunk Search. 05-24-2022 01:29 AM
- Posted Re: combine two queries on Getting Data In. 04-27-2022 06:32 AM
- Posted Re: combine two queries on Getting Data In. 04-27-2022 06:20 AM
- Posted How to combine two queries? on Getting Data In. 04-27-2022 03:47 AM
- Tagged How to combine two queries? on Getting Data In. 04-27-2022 03:47 AM
- Posted Re: How to send Splunk data to Snowflake? on Getting Data In. 02-22-2022 04:29 AM
- Posted How to optimize view of a line chart in Splunk? on Getting Data In. 02-17-2022 07:45 AM
- Tagged How to optimize view of a line chart in Splunk? on Getting Data In. 02-17-2022 07:45 AM
- Posted How to send Splunk data to Snowflake? on Getting Data In. 02-17-2022 07:40 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
05-08-2020
12:33 AM
got this error on the search head, Please help us to resolve this .Thanks
Search peer xxxxxx has the following
message: The metric
value=0.00003393234971117585 provided
for
source=/opt/splunkforwarder/var/log/splunk/metrics.log,
sourcetype=splunk_metrics_log,
host=xxxxx, index=_metrics is not a
floating point value. Using a
"numeric" type rather than a "string"
type is recommended to avoid indexing
inefficiencies. Ensure the metric
value is provided as a floating point
number and not as a string. For
instance, provide 123.001 rather than
"123.001"
... View more
01-29-2020
08:06 AM
Ok the actual problem here is as an admin i have setup everything and im able to load the data into the lookup file.But when user is trying to add the data into this file he is getting "error in outputlookup command have insufficient priviliges" but for both collections and lookup i have given them the write access
How to troubleshoot this
... View more
01-29-2020
07:35 AM
Hi Guys,
I have created a kvstore lookup file with collection name as kvstore_collection and corresponding lookup file under transforms as kvstore_transforms
When i write the data into this lookup file it is showing as results written to collection "kvstore_collection" . But im not able to find the results file on the server.
What is the location of this file on the server ??
This kvstore lookup file is setup under search app.
Thanks for any help..
... View more
12-17-2019
03:36 AM
I have created a dashboard with multi select input to select the required value from the list and a time picker input to restrict the results for a specific time period.
Now i want to use this time picke
... View more
- Tags:
- splunk-enterprise
12-12-2019
01:10 AM
Hi Guys,
I'm working on a dashboard where i need to show up the count of top 1 host in the single value visualization.
Below is the code i'm using
index=abc
|top limit=1 host
| table count
I need the host value to be displayed in the panel title or in the single value caption.
Thank you
... View more
11-27-2019
02:08 AM
Hi renjith.nair ,
Thanks for the answer.Its working well but whenever if the results are not found we see a message No results Found! .
But when i change the input and press submit till the time i get any results its showing as No results Found!. So once the search is waiting for data i don't want to see this message. Strcitly want this message only if result count is < 0 because the user might think that no results found even if the background search is running and trying to fetch some results.
Search results < 0 -- > No results found
search waiting for data or input is changed -->? No results found message should disappear and show waiting for data
Any help is highly appreciated...
... View more
11-21-2019
03:45 AM
1 Karma
Hi Guys,
I have 6 panels in a dashboard and all the panels depend on the post process search results.If a panel doesn't return any results panel gets hidden.Similarly if search results are zero in all the panels the dashboard should show/pop up a message saying no results found instead of white space.
and similarly if a panels search results are greater than zero(suppose long running searches), rather than showing blank white space panels a message should be showing like Fetching the results.
This is the sample xml which im using in all the panels to hide.
<condition match="'job.resultCount' == 0">
<unset token="panel1"></unset>
<unset token="count1">$job.resultCount$</unset>
</condition>
<condition match="'job.resultCount' > 0">
<set token="panel1">true</set>
<set token="count1">$job.resultCount$</set>
Regards,
Kranthi M
... View more
11-15-2019
03:48 AM
Hi All,
Im working on windows AD data and gathering info from various eventIds.
i have grouped the eventIds and each group has a specific Action field in the output table based on the fields related to those eventIds
For Eg: (eventId=1234 OR eventid=2345 OR eventId=3456) => Action field should have the value Action1(which is alos field created with the values related to these 3 event Ids)
similary
(eventId=9876 OR eventid=8765 OR eventId=7654 OR eventid=5432) => Action field should have the value Action2(which is also field created with the values related to these 4 event Ids)
similarly
(eventId=1122 OR eventid=2233 OR eventId=3344 ) => Action field should have the value Action3(which is also field created with the values related to these 3 event Ids)
I tried this logic in my spl using eval if and eval case but didnt get the expected ,can someone please look into it and help me with the soloution.
Thanks in advance.
... View more
11-14-2019
05:45 AM
Thanks for the update, but the export option for the result table panel is disabled .How to make that enable and download the CSV file
... View more
11-14-2019
01:14 AM
I tried but not able to see any results being generated.Can you please provide sample run anywhere code .Thank you
... View more
11-14-2019
01:13 AM
Thanks for the answer... I need all the panel output to single csv file which can be downloaded to the local machine, is that possible ??
... View more
11-13-2019
05:25 PM
@woodcock
can you please post where should the xml piece of code to be placed as im getting warnings.
... View more
11-13-2019
05:19 PM
where i need to add this module exactly in the xml, because i getting warnings
... View more
11-13-2019
05:16 PM
Hi Guys,
I have a dashboard with panels.Im trying to export the dashboard results to csv file but im seeing only export to PDF which is not very useful.Can someone help me how to enable export to csv option or export all the panel results into single csv file.
I want the csv to be downloaded to local machine
Regards,
Kranthi M
... View more
11-13-2019
05:12 PM
Hi Splunkers,
I have 6 panels in my dashboard and all the panels have different underlying query but the output fields in the panel stats table are same and the results in all the panels look like the below sample table.
I want to club all the results into a single panel/table at the end.So i just want to display one panel which contains the results from all the other panels.
Thank you.
user action time object group difference modifier
zbc xyz 10-Sep hddh dj-dhdh 6 jhyy
dhdh cnnc 10-Sep fhfhf jjj-ggg 8 gg
... View more
11-12-2019
02:11 AM
Thanks for the answer, how can we remove the unwanted values for eg: if the values contain symbol hyphen ( - ) or or NULL
... View more
11-11-2019
08:06 PM
I need to combine 3 fields as single field
eg:
Field1 Field2 Field3
3 6 xyz
4 7 56
5 abc ghj
Field4
3
4
5
6
7
abc
xyz
56
ghj
... View more
10-28-2019
01:33 AM
Hi Niket,
Thanks for your answer, I tested it and working well , but i want to include something like whenever the input value is NULL/undefined it should get changed to asterisk * internally (not using default value setting) and search should run on a submit button click.
Whenever both inputs were not mentioned OR both were marked as asterisk() , then please specify at-least one input pop should come up OR Both values are not allowed to use asterisk() at the same time
and lastly if the results of the panel are zero, we need to hide that panel assuming we have more than one panel and these tokens are used across different panels.
If you need any additional info please let me know
Thank you
... View more
10-27-2019
12:19 AM
Hi Guys,
I have 2 text inputs and want to restrict an user from entering (asterix * ) in both the input fields at the same time.If they enter Asterix in any one of the field ,it is accepted but both inputs as ( * ) at the same time is not accepted. If both were entered as aestrisk ( * ) we need to show a pop-up like Please enter at least one input ,
Please help.
Thank you in advance.
... View more
10-26-2019
10:13 PM
@Niketnilay
Hi Niket,
I'm looking fro a similar kind of solution, but i have two text box inputs.So i need to Prevent the users from entering wildcard(Asterix) in both the inputs.I have tested the above solution but not sure on how to implement the same for 2 inputs(both being text inputs).If they enter Asterix in any one of the field is accepted but both at the same time is not accepted or we can show a pop-up like "Please enter atleast one input."
Please help.
Thank you in advance.
... View more
10-25-2019
04:28 AM
@gaurav_maniar Thanks for your answer, its working well.Thank you very much
... View more
10-25-2019
02:56 AM
$(document).on("click", "#submit", function(e){
var tok2 = tokens.get("token2");
if (tok2 == undefined || tok2 == ""){
tokens.set("token2", "*");
I have added this snippet for token2, but its not working .Can you please help me with the script for more than one token change
... View more
10-25-2019
02:54 AM
require([
'underscore',
'jquery',
'splunkjs/mvc',
'splunkjs/mvc/tableview',
'splunkjs/mvc/searchmanager',
'splunkjs/mvc/simplexml/ready!'
], function(_, $, mvc, TableView, SearchManager) {
var tokens = mvc.Components.get("default");
$(document).on("click", "#submit", function(e){
var tok1 = tokens.get("token1");
if (tok1 == undefined || tok1 == ""){
tokens.set("token1", "*");
}
});
$(document).on("click", "#submit", function(e){
var tok2 = tokens.get("token1");
if (tok2 == undefined || tok2 == ""){
tokens.set("token2", "*");
}
});
});
this code is not working , i want to implement this for two tokens
... View more
10-25-2019
02:45 AM
I have two TEXT fields Object and modifier. I want to create dashboard based on either of the field. tried with "if condition", it did not work.
Javascript is also fine
Example:
field1=object
field2=modifier
| index=name event=$object$ action=$modifier$ |table content group
-->if both fields are provided no worries
-->if both are not provided then both should be "wildcard(star)"
-->if field1 is specified and field2 is not specified then field2 should be "wildcard(star)"
-->if field2 is specified and field1 is not specified then field1 should be "*"
How to achieve this?
Note:I dont want to achieve this by using * in default value
Thanks.
Kranthi M
... View more
10-25-2019
02:20 AM
I have two TEXT fields Object and modifier. I want to create dashboard based on either of the field. tried with "if condition", it did not work.
Javascript is also fine
Example:
field1=object
field2=modifier
| index=name event=$object$ action=$modifier$ |table content group
-->if both fields are provided no worries
-->if both are not provided then both should be "wildcard(star)"
-->if field1 is specified and field2 is not specified then field2 should be "wildcard(star)"
-->if field2 is specified and field1 is not specified then field1 should be "*"
How to achieve this?
Thanks.
Kranthi M
... View more
- « Previous
- Next »
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
10-07-2022
09:46 AM
|
