Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About ashvinpandey
ashvinpandey
Contributor
Member since:
08-22-2019
03-01-2024
Community Statistics
| Posts | 90 |
| Solutions | 15 |
| Karma Given | 2 |
| Karma Received | 32 |
| Member Since | 08-22-2019 |
Activity Feed
- Posted How to compare difference in a field from two different events? on Splunk Search. 06-12-2023 08:44 AM
- Got Karma for Re: Extract fields from CSV log file without header. 05-10-2023 01:28 AM
- Posted Re: Integration of Splunk and Freshdesk on Splunk Search. 02-19-2023 06:28 AM
- Posted Re: How to install Splunk in the Linux Environment on Installation. 01-11-2023 10:07 PM
- Got Karma for Re: Unable to extract from the field. 02-03-2022 09:49 PM
- Posted Re: Adding tooltip to panel/text box on a hover (Dashboard Studio) on Dashboards & Visualizations. 01-08-2022 10:47 PM
- Posted Re: Unable to extract from the field on Splunk Search. 01-07-2022 01:11 AM
- Tagged Re: Unable to extract from the field on Splunk Search. 01-07-2022 01:11 AM
- Got Karma for Re: Regex Help. 01-02-2022 06:32 AM
- Posted Re: Regex Help on Splunk Search. 01-01-2022 09:50 PM
- Posted Re: Specific query from Splunk SH to create a Dashboard on Monitoring Splunk. 01-01-2022 09:15 PM
- Posted Re: Specific query from Splunk SH to create a Dashboard on Splunk Search. 01-01-2022 08:51 PM
- Got Karma for Re: Script for UF. 01-01-2022 08:03 PM
- Posted Re: Script for UF on Monitoring Splunk. 01-01-2022 09:23 AM
- Got Karma for Re: Script for UF. 01-01-2022 05:16 AM
- Posted Re: Script for UF on Monitoring Splunk. 12-31-2021 10:47 PM
- Posted Re: Please Help on Splunk Search. 12-31-2021 05:32 AM
- Got Karma for Re: Please Help. 12-30-2021 11:33 PM
- Got Karma for Re: Search since beginning of yesterday. 12-30-2021 11:32 PM
- Posted Re: Unable to create field using regex on Splunk Search. 12-30-2021 11:21 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 |
12-15-2021
01:27 AM
I am stuck with a query where I am trying to pass the field value from sub search to parent search: Query: index=f5 sourcetype="*f5*" earliest=-1d@d latest=d@d
[| inputlookup user where country="US" | fields UserName | rename user_name ] Explanation: The field name which is going to match from the subsearch is the user_name, now in the parent search there are two fields for user that is user_name and Account_name and i need both of them in the end result (user_name contains internal users/ Account_name contains external users). I tried using coalesce to merge both the fields in the parent search but eval pops an error. Can anyone please help me in solving this problem ?
... View more
- Tags:
- splunk commands
11-13-2021
07:21 AM
@hrs2019 Can you please share the full raw log ?
... View more
10-25-2021
07:16 AM
@PickleRick Please try the below query: index="_internal" source=*access.log user!="-" */app/*
| rex "\/en\-US\/app\/(?<app>\w+)\/(?<dashboard>\w+)"
| search dashboard!="job_management" dashboard!="dbinfo" dashboard!="*en-US" dashboard!="search" dashboard!="home" dashboard!="alerts" dashboard!="alert" dashboard!="dashboards" dashboard!="reports" dashboard!="report" dashboard!="overview"
| search dashboard="*"
| bucket span=1m _time
| stats count sparkline max(_time) as lastaccess earliest(_time) as StartTime by user
| eval avg=count/5
| convert ctime(lastaccess) ctime(StartTime)
| sort -lastaccess
| rename user as "User" lastaccess as "Last accessed on" count as "No. of times accessed" avg as "Weekly Avg." StartTime as "First accessed on" Also if this reply helped you an up vote will be appreciated
... View more
10-18-2021
07:38 AM
@jip31 Please try using the below code: index=tutu
| timechart avg(web_duration_ms) as ResponseTime by Url
| eval ResponseTime=round(ResponseTime, 3) Also, if this reply helped you a thumbs up would be appreciated.
... View more
10-18-2021
07:31 AM
@SamHTexas Below dashboard code can be useful for you: <form>
<label>License Usage Monitor</label>
<fieldset submitButton="false"></fieldset>
<row>
<panel>
<single>
<title>Today's License Usage In Bytes</title>
<search>
<query>index=_internal source=*license_usage.log type=Usage pool=* | stats sum(b) | rename poolsz as "Daily License Quota" sum(b) as "Daily License Quota Used"</query>
<earliest>@d</earliest>
<latest>now</latest>
</search>alhost/<option name="colorBy">value</option>
<option name="colorMode">block</option>
<option name="drilldown">all</option>
<option name="numberPrecision">0</option>
<option name="rangeColors">["0x604E8F","0x604E8F"]</option>
<option name="rangeValues">[0]</option>
<option name="showSparkline">1</option>
<option name="showTrendIndicator">1</option>
<option name="trendColorInterpretation">standard</option>
<option name="trendDisplayMode">absolute</option>
<option name="underLabel">BYTES</option>
<option name="unitPosition">after</option>
<option name="useColors">1</option>
<option name="useThousandSeparators">1</option>
</single>
</panel>
</row>
<row>
<panel>
<input type="radio" searchWhenChanged="true" token="NumberOfDays">
<label>SELECT TIMESPAN:</label>
<choice value="0">Today</choice>
<choice value="6">Last 7 Days</choice>
<choice value="13">Last 14 Days</choice>
<choice value="29">Last 30 Days</choice>
<choice value="89">Last 90 Days</choice>
<default>6</default>
<initialValue>6</initialValue>
</input>
<chart>
<title>Daily License Quota Usage in TB's</title>
<search>
<query>index=_internal source=*license_usage.log type=Usage pool=* | rename _time as Date | eval Date=strftime(Date, "%m-%d-%y") | stats sum(b) as ub by Date | eval ub=round(ub/1024/1024/1024/1024,3) | rename ub as "Daily License Quota Used"</query>
<earliest>-$NumberOfDays$d@d</earliest>
<latest>now</latest>
<sampleRatio>1</sampleRatio>
</search>
<option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
<option name="charting.axisLabelsX.majorLabelStyle.rotation">45</option>
<option name="charting.axisTitleX.visibility">visible</option>
<option name="charting.axisTitleY.text">TB's Used</option>
<option name="charting.axisTitleY.visibility">visible</option>
<option name="charting.axisTitleY2.visibility">visible</option>
<option name="charting.axisX.scale">linear</option>
<option name="charting.axisY.scale">linear</option>
<option name="charting.axisY2.enabled">0</option>
<option name="charting.axisY2.scale">inherit</option>
<option name="charting.chart">line</option>
<option name="charting.chart.bubbleMaximumSize">50</option>
<option name="charting.chart.bubbleMinimumSize">10</option>
<option name="charting.chart.bubbleSizeBy">area</option>
<option name="charting.chart.nullValueMode">gaps</option>
<option name="charting.chart.overlayFields">"Daily License Quota Used"</option>
<option name="charting.chart.showDataLabels">all</option>
<option name="charting.chart.sliceCollapsingThreshold">0.01</option>
<option name="charting.chart.stackMode">default</option>
<option name="charting.chart.style">shiny</option>
<option name="charting.drilldown">all</option>
<option name="charting.layout.splitSeries">0</option>
<option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
<option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
<option name="charting.legend.placement">top</option>
</chart>
</panel>
</row>
<row>
<panel>
<chart>
<title>Index Usage - Today - Top 20</title>
<search>
<query>index=_internal source=*license_usage.log type=Usage pool=* | stats sum(b) as b by idx | eval MB's=round(b/1024/1024,2) | rename idx as Index MB's as "MB's Used" | fields Index "MB's Used" | sort 20 - "MB's Used"</query>
<earliest>@d</earliest>
<latest>now</latest>
</search>
<option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
<option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
<option name="charting.axisTitleX.visibility">visible</option>
<option name="charting.axisTitleY.visibility">visible</option>
<option name="charting.axisTitleY2.visibility">visible</option>
<option name="charting.axisX.scale">linear</option>
<option name="charting.axisY.scale">linear</option>
<option name="charting.axisY2.enabled">0</option>
<option name="charting.axisY2.scale">inherit</option>
<option name="charting.chart">pie</option>
<option name="charting.chart.bubbleMaximumSize">50</option>
<option name="charting.chart.bubbleMinimumSize">10</option>
<option name="charting.chart.bubbleSizeBy">area</option>
<option name="charting.chart.nullValueMode">gaps</option>
<option name="charting.chart.showDataLabels">none</option>
<option name="charting.chart.sliceCollapsingThreshold">0.01</option>
<option name="charting.chart.stackMode">default</option>
<option name="charting.chart.style">shiny</option>
<option name="charting.drilldown">all</option>
<option name="charting.layout.splitSeries">0</option>
<option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
<option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
<option name="charting.legend.placement">right</option>
</chart>
</panel>
<panel>
<table>
<title>Index Usage - Today</title>
<search>
<query>index=_internal source=*license_usage.log type=Usage pool=* | stats sum(b) as b by pool idx | eval MBs=round(b/1024/1024,2) | addcoltotals MBs labelfield=idx label="TOTAL MB's USED:" | rename idx as Index pool as "License Pool" MBs as "MB's Used" | fields "License Pool" Index "MB's Used" | sort - "MB's Used"</query>
<earliest>@d</earliest>
<latest>now</latest>
<sampleRatio>1</sampleRatio>
</search>
<option name="count">20</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">cell</option>
<option name="percentagesRow">false</option>
<option name="rowNumbers">false</option>
<option name="totalsRow">false</option>
<option name="wrap">true</option>
<format type="color" field="Index">
<colorPalette type="map">{"TOTAL MB's USED:":#604E8F}</colorPalette>
</format>
</table>
</panel>
</row>
<row>
<panel>
<chart>
<title>SourceType Usage - Today - Top 20</title>
<search>
<query>index=_internal source=*license_usage.log type=Usage pool=* | stats sum(b) as b by st | eval MB's=round(b/1024/1024,2) | rename st as SourceType MB's as "MB's Used" | fields SourceType "MB's Used" | sort 20 - "MB's Used"</query>
<earliest>@d</earliest>
<latest>now</latest>
</search>
<option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
<option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
<option name="charting.axisTitleX.visibility">visible</option>
<option name="charting.axisTitleY.visibility">visible</option>
<option name="charting.axisTitleY2.visibility">visible</option>
<option name="charting.axisX.scale">linear</option>
<option name="charting.axisY.scale">linear</option>
<option name="charting.axisY2.enabled">0</option>
<option name="charting.axisY2.scale">inherit</option>
<option name="charting.chart">pie</option>
<option name="charting.chart.bubbleMaximumSize">50</option>
<option name="charting.chart.bubbleMinimumSize">10</option>
<option name="charting.chart.bubbleSizeBy">area</option>
<option name="charting.chart.nullValueMode">gaps</option>
<option name="charting.chart.showDataLabels">none</option>
<option name="charting.chart.sliceCollapsingThreshold">0.01</option>
<option name="charting.chart.stackMode">default</option>
<option name="charting.chart.style">shiny</option>
<option name="charting.drilldown">all</option>
<option name="charting.layout.splitSeries">0</option>
<option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
<option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
<option name="charting.legend.placement">right</option>
</chart>
</panel>
<panel>
<table>
<title>SourceType Usage - Today</title>
<search>
<query>index=_internal source=*license_usage.log type=Usage pool=* | stats sum(b) as b by pool st idx | eval MBs=round(b/1024/1024,2) | addcoltotals MBs labelfield=st label="TOTAL MB's USED:" | rename pool as "License Pool" st as SourceType idx as Index MBs as "MB's Used" | fields "License Pool" SourceType Index "MB's Used" | sort - "MB's Used"</query>
<earliest>@d</earliest>
<latest>now</latest>
<sampleRatio>1</sampleRatio>
</search>
<option name="count">20</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">cell</option>
<option name="percentagesRow">false</option>
<option name="rowNumbers">false</option>
<option name="totalsRow">false</option>
<option name="wrap">true</option>
<format type="color" field="SourceType">
<colorPalette type="map">{"TOTAL MB's USED:":#604E8F}</colorPalette>
</format>
</table>
</panel>
</row>
<row>
<panel>
<chart>
<title>SourceType Usage - Last 7 Days</title>
<search>
<query>index=_internal source=*license_usage.log type=Usage pool=* | eval MBs=round(b/1024/1024,2) | timechart sum(MBs) by st</query>/run/media/draesner/USB30FD<earliest>-6d@d</earliest>
<latest>now</latest>
<sampleRatio>1</sampleRatio>
</search>
<option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
<option name="charting.axisLabelsX.majorLabelStyle.rotation">45</option>
<option name="charting.axisTitleX.text">Date</option>
<option name="charting.axisTitleX.visibility">visible</option>
<option name="charting.axisTitleY.text">MB's</option>
<option name="charting.axisTitleY.visibility">visible</option>
<option name="charting.axisTitleY2.visibility">visible</option>
<option name="charting.axisX.scale">linear</option>
<option name="charting.axisY.scale">linear</option>
<option name="charting.axisY2.enabled">0</option>
<option name="charting.axisY2.scale">inherit</option>
<option name="charting.chart">area</option>
<option name="charting.chart.bubbleMaximumSize">50</option>
<option name="charting.chart.bubbleMinimumSize">10</option>
<option name="charting.chart.bubbleSizeBy">area</option>
<option name="charting.chart.nullValueMode">gaps</option>
<option name="charting.chart.showDataLabels">none</option>
<option name="charting.chart.sliceCollapsingThreshold">0.01</option>
<option name="charting.chart.stackMode">default</option>
<option name="charting.chart.style">shiny</option>
<option name="charting.drilldown">all</option>
<option name="charting.layout.splitSeries">0</option>
<option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
<option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
<option name="charting.legend.placement">right</option>
</chart>
</panel>
</row>
</form> Also, if this reply helped you a thumbs-up would be appreciated!
... View more
10-08-2021
11:07 PM
1 Karma
@SplunkDash First of all for both UF & HF the process is same. First login to your linux instance via CLI. Now change ownership to splunk user. Go to bin directory of your splunk, in most common cases the path will be /opt/splunk/bin. If you don't remember the path of where your splunk is installed you can use the below command to check it: echo $SPLUNK_HOME Now to to splunk/bin directory and check the splunk status using below commands. ./splunk status If splunk is already running you can directly restart it using below command. ./splunk restart If splunk is not running you need to start your service by using below command. ./splunk start Now again check the splunk status by using the above status command and check if the splunk is running. That's all you need to do for a restart. Also if this reply helped you a thumbs-up would be appreciated.
... View more
10-08-2021
07:33 AM
@Gunnar Try this once: | eventstats avg(Capacity) as Avg_Capacity
| stats mean(Capacity) as Mean_Capacity
| table Avg_Capacity Mean_Capacity
... View more
10-08-2021
07:22 AM
1 Karma
@graziaedu Try using the below command: | rex field=field_name "\/\w+\/\w+\/(?P<field_name>.*?)\/" NOTE: Change the field_name in the above command with your field name. Also, If this reply helps you a thumbs-up would be appreciated.
... View more
10-08-2021
07:15 AM
@Gunnar Try using the below one: | stats avg(Capacity) as Avg_Capacity mean(Capacity) as Mean_Capacity OR | chart avg(Capacity) as Avg_Capacity mean(Capacity) as Mean_Capacity Also, If this reply helps you, a thumbs-up would be appreciated.
... View more
10-06-2021
02:12 PM
@smaran06 Try using the below command: | rex field=host "\.\w+.\d+.\d+.\d+.\d+.(?P<aws_region>.*)" Also, If this reply helps you, an upvote would be appreciated.
... View more
10-01-2021
01:47 PM
@PickleRick i think there is a correction in your eval: | eval ar=if(cr=1,0,ar) Also, If this reply helps you, an upvote would be appreciated.
... View more
10-01-2021
08:18 AM
1 Karma
@mkulicke Try using the below rex: | rex field=_raw "x-client-id\"\:\[\"(?P<client_id>\d+)" Also, If this reply helps you, an upvote would be appreciated.
... View more
09-30-2021
08:48 AM
1 Karma
@kvnpichon This post can help you please take a look: https://blog.avotrix.com/different-ways-to-remove-headers-in-splunk/ Also, If this reply helps you, an upvote would be appreciated.
... View more
09-29-2021
11:46 AM
@tinylund Please try using the below rex: | rex field=_raw "RPC-tx-(?P<dscvIP>.*?)\s" Also, If this reply helps you, an upvote would be appreciated.
... View more
09-28-2021
01:22 PM
1 Karma
@ctaylor3819 Try using the below query for the date and time: eventtype=wineventlog_security (EventCode=4776 OR EventCode=4777 OR EventCode=680 OR EventCode=681)
| stats latest(_time) as Latest_Time by Logon_Account
| convert ctime(Latest_Time) In order to filter the users you can you a lookup file containing the list of users you want to get or the list of genuine users and use a lookup command to get only those users. Also, If this reply helps you, an upvote would be appreciated.
... View more
09-28-2021
08:35 AM
@saad Check if this works ? Also, If this reply helps you, an upvote would be appreciated.
... View more
09-28-2021
08:23 AM
@saad Try using this: [monitor:////hboprod/itdept/jira/domain/logs/access_log*.*]
... View more
09-28-2021
08:16 AM
@saad You can use the below stanza: [monitor:////hboprod/itdept/jira/domain/logs/*.<file_extension>] You need to add the file extension and rest all remains the same. Also, If this reply helps you, an upvote would be appreciated.
... View more
09-28-2021
07:44 AM
2 Karma
@PickleRick Yes tstats wont work in all the environments, yet if you need this can help: | tstats latest(_indextime) WHERE index=* BY index Also, If this reply helps you, an upvote would be appreciated.
... View more
09-28-2021
07:41 AM
@PickleRick Here is the official link from splunk where the list of all the special characters are mentioned, Also the "equal to" sign is present: https://docs.splunk.com/Documentation/StyleGuide/current/StyleGuide/Specialcharacters Also, If this reply helps you, an upvote would be appreciated.
... View more
09-28-2021
07:36 AM
1 Karma
@tigawi Yup if you are adding index=* it will show the list of all index with their indexing time of first and last event. Also, If this reply helps you, an upvote would be appreciated.
... View more
09-28-2021
07:29 AM
1 Karma
@tigawi try using the below query: index=<your_index_name>
| stats earliest(_indextime) as etime latest(_indextime) as ltime by index
| convert ctime(etime) ctime(ltime)
| rename etime as "First Event Time" ltime as "Last Event Time" This query will return the first event time when it was indexed and last event time of the event when it was indexed. Also, If this reply helps you, an upvote would be appreciated.
... View more
09-28-2021
07:22 AM
1 Karma
@aasabatini Try adding the below query: | eval latitude=mvindex(Company_Name,0), longitude=mvindex(Company_Name,1)
| table Company_Name latitude longitude Also, If this reply helps you, an upvote would be appreciated.
... View more
09-28-2021
06:52 AM
@PickleRick Hey, There is not any exact document for only a "=" but you can find a doc for regex and you can get more info with this: https://docs.splunk.com/Documentation/SCS/current/Search/Escapecharacters Also, If this reply helps you, an upvote would be appreciated.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
03-01-2024
12:06 AM
|
Karma from
| User | Karma Count |
|---|---|
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 3 |
