Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- Find Answers
- :
- About kmaron
kmaron
Motivator
Member since:
10-12-2016
07-11-2023
Community Statistics
| Posts | 343 |
| Solutions | 54 |
| Karma Given | 88 |
| Karma Received | 78 |
| Member Since | 10-12-2016 |
Activity Feed
- Got Karma for Re: How do I force a timestamp to be recognized as UTC in a query for strptime?. 05-15-2023 08:14 AM
- Got Karma for Re: How can I extract the first 10 characters of token value in query?. 07-13-2022 02:48 AM
- Got Karma for Re: How do I get the total and percentage on each row on the following table?. 02-18-2022 11:53 PM
- Got Karma for Re: Dashboard - Base Search not returning results into panel. 02-03-2022 06:43 AM
- Got Karma for Re: What is the real difference between a $token$ and $form.token$?. 01-24-2022 04:58 PM
- Got Karma for Re: What is the real difference between a $token$ and $form.token$?. 12-16-2021 05:11 AM
- Posted Re: How to hide dashboard panel when user's search times out? on Dashboards & Visualizations. 09-09-2021 11:45 AM
- Posted How to hide dashboard panel when user's search times out? on Dashboards & Visualizations. 09-09-2021 09:46 AM
- Posted seemingly empty log returned with search query on Splunk Search. 06-22-2021 09:48 AM
- Got Karma for Re: How to drilldown a pie chart and get specific results for each slice of pie?. 04-27-2021 04:48 AM
- Posted I don't Re: Extracting fields from nested JSON event on Splunk Search. 12-08-2020 05:12 AM
- Posted Re: Extracting fields from nested JSON event on Splunk Search. 12-07-2020 05:02 AM
- Posted Extracting fields from nested JSON event on Splunk Search. 12-03-2020 12:46 PM
- Karma Re: Using NOT and != would return the same results. for woodcock. 06-05-2020 12:50 AM
- Karma Re: Using NOT and != would return the same results. for richgalloway. 06-05-2020 12:50 AM
- Karma Re: How do I add a check box to change my search? for niketn. 06-05-2020 12:50 AM
- Karma Re: How to clean up old indexes, reports, alerts, etc ? for DavidHourani. 06-05-2020 12:50 AM
- Karma Re: How do you extract fields from an existing field's value? for Raschko. 06-05-2020 12:50 AM
- Karma Re: how to get the first event time and last event time for field value for niketn. 06-05-2020 12:50 AM
- Karma Re: Can you help me identify when end time overlaps start time for the following events? for whrg. 06-05-2020 12:50 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
06-20-2018
05:19 AM
try this
| stats count
| eval filetype="Billing,SalesOrder,Clearing,Delivery,ReturnOrder,M39COGSSIT,M39AcutualRevenueRec"
| makemv delim="," filetype
| mvexpand filetype
| append
[ index=sap_bam sourcetype=sap_d059 earliest=-6h filetype=Billing OR filetype=SalesOrder OR filetype=Clearing OR filetype=Delivery OR filetype=ReturnOrder OR filetype=M39COGSSIT OR filetype=M39AcutualRevenueRec
| dedup source]
| stats sum(eval(if(isnull(_time),0,1))) as filecount by filetype
| eval alertme=if(filecount=0,1,0)
| table filetype filecount alertme
... View more
06-19-2018
01:05 PM
oh! Yes you should be able to do something like this
<eval token="ErrorCode">case(match($click.value$, "Connection Refused"), "ERRORCODE=-4992")</eval>
... View more
06-19-2018
12:52 PM
the token will be set from whatever is clicked automatically.
... View more
06-19-2018
12:37 PM
1 Karma
<drilldown>
<set token="token_name">$click.value$</set>
<link target="_blank">search?q=(sql goes here)</link>
</drilldown>
</chart>
Add a drilldown to your chart that sets the token from click.value. then use the token in your search
... View more
| eval domainmember = member_nt_domain.member
then use the token: $result.domainmember$
... View more
could you do an eval in the actual search to make a new token that is exactly what you want?
... View more
06-07-2018
12:55 PM
1 Karma
index=example* stuff
| stats count by user, sysuser
| where user!=sysuser
... View more
06-07-2018
07:48 AM
It's going to be the same thing. The only change is in the format of the strptime (which you can find here: https://docs.splunk.com/Documentation/Splunk/7.1.1/SearchReference/Commontimeformatvariables)
| eval TERMINATION=strptime(TERMINATION_DT,"%Y-%m-%d %H:%M:%S.%N")
| eval TERMINATION90days=TERMINATION+(90*24*60*60)
| where TERMINATION90days < _time
... View more
06-07-2018
07:42 AM
1 Karma
Try this:
service=Service1*
| fields TIME_TAKEN
| eventstats avg(TIME_TAKEN) as mean_time
| timechart span=5m avg(TIME_TAKEN) as service_time ,first(mean_time) as mean_time
| appendcols
[ service=Service1* earliest=-7d@d latest=now
| fields TIME_TAKEN
| eventstats avg(TIME_TAKEN) as mean_time_over_7_days
| timechart last(mean_time_over_7_days) as mean_time_over_7_days]
... View more
06-06-2018
09:58 AM
1 Karma
Using what you provided this is what I have
| makeresults
| eval animal = "a_cat a_snake a_dog b_cat b_snake b_dog c_cat c_snake c_dog"
| makemv animal
| mvexpand animal
| rex field=animal "^(?<Letter>.*?)_(?<Type>.*?)$"
| eval Type = upper(Type)
| chart values(animal) over Letter by Type
| fields - Letter
... View more
06-06-2018
09:51 AM
are a_snake a_cat, etc field names or values? I feel like you may be generalizing too much and something is getting lost. Your table command treats them like fields but then your example table has them like values.
... View more
06-05-2018
01:35 PM
1 Karma
| eval LastLogon=strptime(lastLogonTimestamp,"%Y-%m-%dT%H:%M:%S.%6N")
| eval LastLogon90days=LastLogon+(90*24*60*60)
| where LastLogon90days < _time
... View more
06-05-2018
01:03 PM
I had to do something similar with a dashboard I was using. It's not 100% but it might help get you close.
TimeRange is the name of my token from the time picker.
start with your DateHour eval
| eval start_time=relative_time(now(),"$TimeRange.earliest$")
| eval start_time2="$TimeRange.earliest$"
| eval start_time=if(start_time>0,start_time,start_time2)
| eval end_time=relative_time(now(),"$TimeRange.latest$")
| eval end_time2="$TimeRange.latest$"
| eval end_time=if(end_time2="now",9999999999,end_time)
| eval end_time=if(end_time>0,end_time,end_time2)
| eval timestamp=strptime(DateHour,"%Y-%m-%d-%H")
| where timestamp>=start_time AND timestamp<=end_time
... View more
06-05-2018
12:50 PM
when you say "last 24 hours" do you mean a specific DAY like 'Tuesday' or do you mean a rolling 24 hours (like 4pm Monday to 4pm Tuesday)?
... View more
06-05-2018
12:48 PM
Do you always have a very specific number of steps for the type of grouping you're looking for? If you do you can use eventcount to filter out the ones that go past your NEEDSATTENTION. It tells you how many events were grouped into your transaction so you could do a where eventcount<7
... View more
06-05-2018
12:34 PM
2 Karma
you could create a new token that is the substring of the original and use the new token in your search.
<change>
<eval token="uin_short">substr($uin$,0,10)</eval>
</change>
... View more
06-05-2018
12:22 PM
I think I figured it out but it's a bit messy. Hopefully this will work or someone else will have a different idea.
<form>
<label>dashbaord label</label>
<init>
<set token="field1">Data1</set>
</init>
<fieldset submitButton="false">
<input type="checkbox" token="field1">
<label>field1</label>
<choice value="Data1">Data1</choice>
<choice value="Data2">Data2</choice>
<default>Data1</default>
<change>
<eval token="field1">if(isnull($field1$), " ", $field1$)</eval>
</change>
<initialValue>Data1</initialValue>
<delimiter> </delimiter>
</input>
</fieldset>
Okay so basically initialize the token (field1) at the top to the default vaule
Set the default and initial value in the definition of the checkbox (Data1)
Then the eval looks for the undefined (null) case when the box is unchecked.
... View more
05-31-2018
04:54 AM
These all say 'started' so I would assume these are all start times? Are there different logs that are end times? or is the end time something derived from what is here?
... View more
05-30-2018
01:02 PM
1 Karma
Is it possible your Application has a space in the value? If it does try changing your token to: Application=$appservicefield|s$
The |s means "wrap the value in quotes"
... View more
05-30-2018
10:34 AM
1 Karma
I believe the alignment has to do with the type of data in the field(s). Anything numeric will be right aligned.
... View more
05-30-2018
08:07 AM
You could try using appendcols : https://docs.splunk.com/Documentation/Splunk/7.1.0/SearchReference/Appendcols
If you provide your specific query it might help to get more specific.
... View more
05-30-2018
07:35 AM
instead of using timechart try using a time bucket
index=_internal type=Usage source="/opt/splunk/var/log/splunk/license_usage.log"
| bucket _time span=1d
| stats sum(b) as b_sum by _time
| eval GB=(round(b_sum/1024/1024/1024,1))
| stats avg(GB) as Average max(GB) as Peak
... View more
05-24-2018
09:34 AM
1 Karma
is there extra whitespace you're not accounting for when you use a literal instead of a wildcard?
... View more
05-17-2018
10:25 AM
I believe there are other, less expensive, ways to do this but I do it using transaction.
You can do something like this:
(host=request OR host=images) ("c.m.p.t.ThumbnailProcessor" OR "Successfully rendered") <- or however to combine your data
| eval Start_Time = case(host="request",_time)
| eval End_time = case(host="images",_time)
| transaction RequestID (fill in maxspan, etc that fits your query)
| eval Elapsed_Time = (End_time - Start_Time)
... View more
05-17-2018
10:19 AM
I had a similar issue here: https://answers.splunk.com/answers/623015/question-involving-breaking-out-multiple-multivalu.html
Maybe that answer can help you as well.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
07-11-2023
03:09 PM
|
