Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- Find Answers
- :
- About felipesewaybric
felipesewaybric
Contributor
Member since:
02-08-2013
01-12-2026
Community Statistics
| Posts | 114 |
| Solutions | 9 |
| Karma Given | 8 |
| Karma Received | 25 |
| Member Since | 02-08-2013 |
Activity Feed
- Karma Re: After upgrading to 6.5.0, KV Store will not start for sylim_splunk. 04-13-2021 12:51 PM
- Got Karma for Re: I have installed Splunk on AWS Instance, How do I restart Splunk on AWS Instance?. 06-05-2020 12:50 AM
- Karma Re: Use timepicker earliest and latest as epoch time for rjthibod. 06-05-2020 12:49 AM
- Got Karma for Re: How do I extend the number of results that an external script returns to more than 100000 lines?. 06-05-2020 12:49 AM
- Got Karma for Re: What is multithreaded ingestion?. 06-05-2020 12:49 AM
- Got Karma for Re: Why is my JSON regex expression not working properly?. 06-05-2020 12:49 AM
- Got Karma for Re: Why is my JSON regex expression not working properly?. 06-05-2020 12:49 AM
- Got Karma for Re: Why is my JSON regex expression not working properly?. 06-05-2020 12:49 AM
- Got Karma for Re: Why is my JSON regex expression not working properly?. 06-05-2020 12:49 AM
- Got Karma for Re: Why is my JSON regex expression not working properly?. 06-05-2020 12:49 AM
- Got Karma for Re: Is there a way to export all searches, alerts and reports from all users to another Splunk instance?. 06-05-2020 12:49 AM
- Got Karma for Re: Is there a way to export all searches, alerts and reports from all users to another Splunk instance?. 06-05-2020 12:49 AM
- Got Karma for Re: Is there a way to export all searches, alerts and reports from all users to another Splunk instance?. 06-05-2020 12:49 AM
- Got Karma for Re: How to make Trellis smaller in the dashboard using the Status Indicator - Custom Visualization app?. 06-05-2020 12:49 AM
- Got Karma for Re: Is there an app that easily moves splunk alerts to another server?. 06-05-2020 12:49 AM
- Got Karma for Re: Why is the date format changing in the pdf from YYYY-MM to YYYY (splunk v6.5.0) in scheduled PDF?. 06-05-2020 12:49 AM
- Got Karma for Re: Why is the date format changing in the pdf from YYYY-MM to YYYY (splunk v6.5.0) in scheduled PDF?. 06-05-2020 12:49 AM
- Got Karma for Re: How to create tabs in Splunk dashboard without admin access?. 06-05-2020 12:48 AM
- Got Karma for Re: How to index multiple CSV file from a local machine?. 06-05-2020 12:48 AM
- Got Karma for How to use Javascript to create charts from a table?. 06-05-2020 12:48 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 2 | |||
| 0 | |||
| 0 | |||
| 2 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
02-07-2017
11:51 AM
And you can use in the options xml, like this:
{"field1":#23B5F9, "field2":#FB8900, "field3":#FF5733, "field4":#14B87C}
... View more
02-07-2017
11:43 AM
このファイルを編集することができます：datetime.xml
You can edit the file: datetime.xml
<datetime>
<define name="datefromfile" extract="year, month, day">
<text><![CDATA[source::.*?_(\d{4})(\d{2})(\d{2}]]></text>
</define>
<define name="timefromfile" extract="hour, second">
<text><![CDATA[source::.*?_\d{8}(\d{2})(\d{2}]]></text>
</define>
<timePatterns>
<use name="timefromfile"/>
</timePatterns>
<datePatterns>
<use name="datefromfile"/>
</datePatterns>
</datetime>
... View more
01-24-2017
10:34 AM
im trying Multiplexer, page 40.
One table, each row create a new chart.
... View more
01-23-2017
12:26 PM
2 Karma
Hey guys, i need help.
I have a table like this:
name, value, limit
teste1, 1500,3000
testeN,50,500
and i need to create one chart (filler gauge) for each line, but if the dashboard can dynamically create those charts, since is going to have more than just 2 rows in the table.
... View more
01-03-2017
08:32 AM
Hey guys,
How can I change the default of 0.8 or 0.7 to 0.95 or 1.0 for sensitivity in the cluster.
I need to replicate 100% of the events in my clustered ambient.
Thanks.
... View more
11-30-2016
09:26 AM
Hey guys,
i have 1 search head, 2 peers, and 1 master. On replication Factor 2.
my index has repFactor=auto , but i noticed that the events are not exactly the same:
Anyone knows how to resolve this?
Splunk 6.5.0
Thanks
... View more
11-30-2015
08:58 AM
2 Karma
How I can get back the design before the Splunk 6.3.1 update?
Now my panels have a mouse over that shows info in the worst place ever (lol).
... View more
07-22-2015
06:24 AM
<input type="multiselect" token="reason_token" searchWhenChanged="true">
<label>Filtro de Causas</label>
<search>
<query>| dbquery DB01 "select
idt_deduction as \"reason\",
des_deduction as \"desc\"
from deduction
where idt_deduction_group='$group_token$'"
| eval teste = $group_token$
| stats values(reason) as reason by desc
| eval Reason = reason + " - " + desc</query>
</search>
<fieldForLabel>Reason</fieldForLabel>
<fieldForValue>reason</fieldForValue>
<delimiter> , </delimiter>
<choice value="select
idt_deduction_reason
from deduction_reason
where idt_deduction_reason_group='$group_token$'">All
</choice>
</input>
... View more
07-21-2015
06:57 AM
Thank you, those _time, systemFrom, systemTo and was exactly what i need.
... View more
07-15-2015
07:13 AM
True, this is how it ends:
| eval "Media Dia em Minutos" = round(duration/60, 2)
Thanks for the help.
... View more
07-14-2015
11:16 AM
there is a way to set to hours and minutes?
... View more
07-14-2015
06:27 AM
i try already, but what i need is to show the time in the red line when mouseover, now, when i mouse over the red live Intervalo, it show only the seconds, like 1420.882232.
I know how to convert, the problemn is when is already converted, the red line disapear.
... View more
07-13-2015
12:57 PM
The chart.overlay (Intervalo) only show when is in the epoch format, but i need something like %T when you mouse over in the overlay
... View more
07-13-2015
10:59 AM
yes, and wont work, only apears in the epoch time, example:
with formatted_time -> 02:08:00 wont show the line
without formatted_time -> 18480.639752 show the line
... View more
07-13-2015
10:34 AM
That works only in the table, but not with chart overlay
... View more
07-13-2015
10:27 AM
How can I use Chart Overlay with an epoch field converting the same in time?
I have 2 fields, one is Intevalo with epoch time, and the other called Tempo Limite with the epoch turned into time with 'duration'.
How can I set the chart overlay to time, like 01:22:04 or something like that.
... View more
07-07-2015
09:38 AM
| dbquery PROD
"select dat_collect_transaction as \"data\", dat_update as \"update\", idt_inscription_account as \"conta\" from collect_transaction where idt_payment_method = 221 and dat_collect_transaction > sysdate -15 and dat_collect_transaction < sysdate-1"
| eval intervalo=update-data
| convert timeformat="%Y/%m/%d" ctime(data)
| eval Date=strftime(strptime(data,"%Y/%m/%d"), "%d/%m/%Y")
| eventstats avg(intervalo) as Intervalo
| eval Intervalo = Intervalo*2
| stats count(eval(intervaloIntervalo)) as "Acima do tempo medio" by Date
| eval data_sort = strftime(strptime(Date,"%d/%m/%Y"), "%m/%d")
| sort 15 - data_sort | reverse
| table Date, "Acima do tempo medio", "Dentro do tempo medio"
... View more
07-06-2015
09:43 AM
Thanks, this is the complete search, works like a charm:
| dbquery PROD-UOL7-MANUT-MONITORACAO
"select
dat_collect_transaction as \"data\",
TO_CHAR(dat_collect_transaction, 'DD/MM') as \"Date\",
dat_update as \"update\",
idt_inscription_account as \"conta\"
from collect_transaction
where idt_payment_method = 221 and dat_collect_transaction > sysdate -15 and dat_collect_transaction < sysdate-1"
| eval intervalo=update-data
| eventstats avg(intervalo) as Intervalo
| eval Intervalo = Intervalo*2
| stats count(eval(intervaloIntervalo)) as "Acima do tempo medio" values(conta) as Contas by Date
| table Date, "Acima do tempo medio", "Dentro do tempo medio", Contas
... View more
07-06-2015
08:00 AM
How can i have those 2 stats?
| dbquery PROD-UOL7-MANUT-MONITORACAO
"select
dat_collect_transaction as \"data\",
TO_CHAR(dat_collect_transaction, 'DD/MM') as \"Date\",
dat_update as \"update\",
idt_inscription_account as \"conta\"
from collect_transaction
where idt_payment_method = 221 and dat_collect_transaction > sysdate -5 and dat_collect_transaction < sysdate-1"
| eval media=update-data
| stats avg(media) as Media
| eval Media = Media*2
| eval MediaTotal=tostring(Media, "duration")
| stats count(eval(media<MediaTotal)) as "Down" count(eval(media>MediaTotal)) as "Up" by Date
| table Date, Down, Up
... View more
- Tags:
- stats
07-06-2015
06:18 AM
Hi guys, i have this search:
| dbquery PROD-UOL7-MANUT-MONITORACAO
"select
dat_collect_transaction as \"data\",
dat_update as \"update\",
idt_inscription_account as \"conta\"
from collect_transaction
where idt_payment_method = 221 and dat_collect_transaction > sysdate -15 and dat_collect_transaction < sysdate-1"
| eval media=update-data
| convert timeformat="%Y/%m/%d %H:%M:%S" ctime(data) ctime(update)
| convert timeformat="%H:%M:%S" ctime(media)
but this is what return:
2015/06/21 10:11:33 2015/06/21 10:51:05 31298717 21:39:32
2015/06/21 10:12:34 2015/06/21 10:12:40 41224153 21:00:06
I dont understand why get set to 21h as 00h, anyone have this issue?
... View more
- Tags:
- ctime
- timeformat
07-03-2015
12:58 PM
ok, i think i found what i need:
| where Date >= strftime(relative_time(now(), "-4d"), "%m/%d")
... View more
07-03-2015
11:23 AM
Hey guys, i have | eval Date=strftime(strptime(data,"%Y/%m/%d"),"%m/%d") returning
07/02
07/01
06/30
06/29
06/28
but i want to receive only the last 4 days.
07/02
07/01
06/30
06/29
The data is in a lookup_table csv
... View more
- Tags:
- strftime
05-04-2015
07:09 AM
maybe if you import your csv in Lookup table files (settings/lookups).
Than you can use something like
| inputlookup something.csv
... View more
- « Previous
- Next »
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
01-12-2026
11:35 AM
|
Karma from
Karma given to
