Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- Find Answers
- :
- About niketn
niketn
Legend
Member since:
03-09-2015
Community Statistics
| Posts | 6912 |
| Solutions | 1166 |
| Karma Given | 832 |
| Karma Received | 2453 |
| Member Since | 03-09-2015 |
Activity Feed
- Got Karma for Re: How do I change the panel title font size using XML instead of CSS?. 06-18-2026 08:24 AM
- Got Karma for Re: Column width. 02-13-2026 10:41 AM
- Got Karma for Re: Use Token in Dashboard Title. 02-10-2026 01:29 AM
- Got Karma for Re: How can I embed a Splunk dashboard on an external website?. 01-26-2026 06:36 PM
- Got Karma for Re: Dashboard to display varied graph types on a single timeline with tool tip pointer. 12-18-2025 11:27 AM
- Got Karma for Re: Stop Processing Long Query When No Results Found. 12-17-2025 05:23 AM
- Got Karma for Re: How to archive specific Splunk data?. 10-14-2025 07:47 AM
- Got Karma for Re: Timeline - Custom Visualization: How to hide the legend?. 07-25-2025 03:19 AM
- Got Karma for Re: How can I create a visual progress bar/ tracker in Splunk? Use case: to show various phases of onboarding process.. 05-09-2025 07:43 AM
- Got Karma for Re: How to find the missing number sequence from a table?. 04-23-2025 01:54 PM
- Got Karma for Re: Resetting Dashboard Tokens using XML. 03-26-2025 08:06 AM
- Got Karma for Re: How to enlarge the size of a caption underneath a singe-value visualization. 03-06-2025 03:43 AM
- Got Karma for Re: is there a cleaner way to zeropad numeric values, ie add leading zeros?. 02-24-2025 10:24 AM
- Got Karma for Re: Using all values from a drop down list in a search query when the field is filtered based on another field. 02-05-2025 07:47 AM
- Got Karma for Re: How to add feature expand or collapse panel in dashboard using css in simple xml?. 02-04-2025 12:14 PM
- Got Karma for Re: How can we create Tabs using Link List in Splunk with only CSS Override NO SplunkXML JS Extension?. 01-30-2025 08:17 AM
- Got Karma for Re: Change Refresh Progress bar to spinning wheel in Splunk dashboard. 01-22-2025 12:40 PM
- Got Karma for Re: Using fillnull for multiple fields?. 12-30-2024 12:23 PM
- Got Karma for Re: How do you parse two time formats in Splunk?. 12-16-2024 06:56 AM
- Got Karma for Re: How to assign colors to values in a chart?. 11-10-2024 07:18 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 1 | |||
| 1 | |||
| 6 | |||
| 1 | |||
| 1 | |||
| 1 | |||
| 3 | |||
| 3 | |||
| 1 | |||
| 1 |
11-09-2016
04:03 AM
Edit Dashboard > Click Add Input > Choose Dropdown
Edit Dropdown by clicking on Edit input icon against field1.
1) Rename Label as Select Mail Server.
2) Check Search on Change option.
3) Select Token = selMailServer
4) Scroll to Static Options and add the following Name - Values :
Name= 01 -- Value=mailserver-01
02 -- mailserver-02
...
10 -- mailserver-10
4) Scroll back to Default field an choose 01 as the default field value.
PS: You can define lookup tables for more dynamic list and values and use Dynamic Options to populate Name/Value through Splunk Search String.
Following is the Simple XML Source Code for the same (Notice root node changes from dashboard to form the moment we add any form inputs.
<fieldset>
<input type="dropdown" token="selMailServer" searchWhenChanged="true">
<label>Select Mail Server</label>
<choice value="mailserver-01">01</choice>
<choice value="mailserver-02">02</choice>
<choice value="mailserver-03">03</choice>
<choice value="mailserver-04">04</choice>
<choice value="mailserver-05">05</choice>
<choice value="mailserver-06">06</choice>
<choice value="mailserver-07">07</choice>
<choice value="mailserver-08">08</choice>
<choice value="mailserver-09">09</choice>
<choice value="mailserver-10">10</choice>
<default>mailserver-01</default>
</input>
</fieldset>
5) Finally, in your search you can replace mailserver-01 with $selMailServer$
... View more
11-09-2016
01:12 AM
Few points about searches
1) They are more efficient if you use positive scenarios rather than negative (or NOT) scenarios i.e. if you know which status you need include only those.
2) You should filter results upfront rather than later. This will give most performance improvement.
IN the above case I assume Status is part of your extracted fields then
index = "my index" Transaction_Type=* Priority=* Category=* AND NOT (Status="Prod" OR Status="Go Live" OR Status="Completed") |eventstats count as Total_Events |eval due_time= strptime('Due By',"%d.%m.%Y") |eval now_time= now() |stats count as Total_events count(eval((due_time <= now_time))) as Missed_count
3) You should also be converting now_time to dd.mm.YYYY format.
PS: If you want to continue to use your existing query you can try the following since you are applying not for each conditions, OR should be replaced with AND:
index = "my index" Transaction_Type = Priority= Category=* |eventstats count as Total_Events |eval due_time= strptime('Due By',"%d.%m.%Y") |eval now_time= now() |stats count as Total_events count(eval((due_time <= now_time) AND ('Status'!="Prod" AND 'Status'!="Go Live" AND 'Status'!="Completed"))) as Missed_count
... View more
11-09-2016
12:48 AM
Could you share query and output?
There is a Statistics tab where you can see the numerical tabular results of your query.
You can also run the query in Verbose mode and validate whether Interesting Fields are showing correct value for the field that you are using for charting or not.
... View more
11-08-2016
10:44 PM
Try sort command to arrange records in descending order of Total time spent and then use head command to get only 5
your base search | sort - Total_time_spent(out_of_collage) | head 5
... View more
11-08-2016
10:29 PM
You can try either one of the following correlation techniques:
1) append
2) appendcols
3) join
4) transaction
5) stats or eventstats
6) subquery
I would assume simplest to be appendcols, but depends on your use case, existing queries and data.
... View more
11-08-2016
10:27 PM
First off you would need to convert starthour_and_endhour_yesterday and average(starthour_and_endhour)_for_last_7_days to numeric field (either in hour or minutes)
For example 00-18 to be replaced with 18 (hrs), or something meaningful as per your use case. Then you can use stdev stats function on average numeric field multiplied by 3.
... View more
11-08-2016
09:10 PM
If the issue is with the following query run the same in Verbose mode and validate the extracted Product field whether it is s4 or an. As per the stats I expect it to be an.
index="ai.snv.mon.query.25" ScanTime!="ScanTime" Product=an OR Product=s4 OR Product=buyer Filename="*buyer_integrated_realms_front_door.query" OR Filename="*s4_integrated_realms_front_door.query" | eval Nstatus=if(Status== "info", 0, 1) | stats dc(Filename) AS iFrontdoors by Product
PS: Seems like Nstats field is not used.
... View more
11-08-2016
12:33 PM
@splk5000 I have converted my comment to answer since %d resolved the issue in this case.
... View more
11-08-2016
12:49 AM
3 Karma
Edit the source of the dashborad and set the following 60*5=300 to refresh every five minutes. Same applies if you have forms with input elements
<dashboard refresh=300>
OR
<form refresh=300>
If you have upgraded to Splunk Enterprise 6.5 You will have Refresh options available Directly through Edit Panel option where you can refresh each Panel individually.
... View more
11-07-2016
09:55 PM
I am not sure whether I get your question right. But seems like you should look for eventstats command which appends a field to events returned by search. Refer to documentation below:
http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Eventstats
... View more
11-07-2016
09:18 PM
Ideally based on the example the above should work. Have you tried printing table FIELDX FIELDY FIELDZ? Are the two fields FIELDX & FIELDY numeric?
Please provide Splunk search query and sample FIELDX and FIELDY.
... View more
11-07-2016
09:10 PM
2 Karma
You can try replace command on one of the delimiter fields and replace with other delimiter (in following case comma replaced with space) and then use single delimiter for split(in this case only delimiter will be space:
your base search | eval word=replace(word,","," ") | eval field2=mvindex(split(word, " "),2)
... View more
11-07-2016
09:00 PM
You can try timechart with span=1h for hourly bins which are filled with 0 by default:
<Your Base Search> | timechart span=1h count(eval(user="admin")) as LoginSuccess
... View more
11-07-2016
08:57 PM
1 Karma
You can use Field Aliases knowledge Objects provided in Splunk. Refer to the following documentation:
http://docs.splunk.com/Documentation/Splunk/6.5.1/Knowledge/Addaliasestofields
... View more
11-07-2016
11:04 AM
1 Karma
Would you be able to give the complete date string for timestamp? Also few sample events?
For the following data strptime timestamp format %b %d %Y %H:%M:%S.%3N worked for me:
JAN 3 2016 20:17:13.000, my test data line 1
JAN 3 2016 20:17:14.000, my test data line 2
JAN 3 2016 20:17:15.000, my test data line 3
... View more
11-07-2016
10:22 AM
1 Karma
Following will give you count of various pages accessed for the list of all users. Lower count implies rarely accessed.
your base search
| chart count over user_id by page | rename count as page_accessed
Similarly, you can also reverser user_id and page field as per your need, which will give you a list of all pages and users count for those who accessed the same.
your base search
| chart count over page by user_id | rename count as page_accessed
While above is statistical function to get data for user logins. What you really want is to detect outliers in user access. Refer to Splunk Machine Learning Toolkit app which has Showcase example to "Detect Outliers in Number of Logins (vs. Predicted Value)"
... View more
11-07-2016
07:18 AM
1 Karma
If the following query is working fine use eventstats command to calculate the total and append to each event.
index=someindex sourcetype=somesourcetype
| stats count(eval(if_OK=="Success")) as TC, sum(field1) as field1, count as TM by Hour,CITY
| join Hour,CITY [ search index=someindex sourcetype="anothersourcetype"
| stats count as TV by Hour,CITY ]
| eval EventConversion=round((TV*100)/TC,2)
| eventstats sum(EventConversion) as TotalConversion
| eval EventQuality=round((TC*100)/TM,2)
| eval RelativeConversion=round(EventConversion/TotalConversion,2)
... View more
11-07-2016
07:03 AM
@nivethainspire_07 If your search query in the question is what you need you can modify the earliest and latest to time range you want and delta will give you difference between each consecutive rows.
Following compares last 7 days with difference of OSScore for each consecutive day:
index=sample earliest=-7d@d latest=now | eval Segments = if(like(Segments ,"%om%"), "omg", "DTDC")|search Segments=Omg Class=Server OR Name=Server OR Class=""|stats sum(evn) as evn sum(eval(if(Flags=="NULL" AND blank!="NULL",evn, 0))) as "OSScore" by date_mday | delta OSScore as Difference
... View more
11-07-2016
06:48 AM
I have edited my answer as I was missing Summary like conditions in the not condition. Can you please retry the above and confirm?
... View more
11-07-2016
06:43 AM
I have edited my answer as per you last example to display top 10 host names and EventCode. Try the following:
your base search | eval myField= host + " - " + EventCode| top 10 myField showperc=f
-----Editing answer again--- Following will give top 10 EventCode counts over all hosts:. Please try and confirm(eventstats will add ECCount field to all existing event which can be used in stats sum command later):
your base search here | eventstats count as ECCount by EventCode | chart limit=10 userother=f sum(ECCount) over host by EventCode
... View more
11-07-2016
05:58 AM
@nnmiller Splunk DB Connect 2 allows querying of database to be displayed in Splunk Web UI through DB Lookups Operations. Advantage is that it will not add to daily indexing volume, however, it will impact performance of Database as they will be queried directly through Splunk.
Having said that MongoDB is not listed in supported DBs for DB Connect 2 app. http://docs.splunk.com/Documentation/DBX/latest/DeployDBX/Supporteddatabases
Hunk App for MongoDB seems to be only possibility for this. However, it is better to check with Splunk representatives on Licensing/cost.
... View more
There are three options you have:
1) Create a Scheduled Report with Send Email action. Refer to the following documentation: http://docs.splunk.com/Documentation/Splunk/6.5.0/Report/Schedulereports
2) Create a scheduled monthly Alert with Send Email as alert action and attach report generate by Search result as csv or pdf as per your need. Refer to following documentation: http://docs.splunk.com/Documentation/Splunk/6.5.0/Alert/Setupalertactions
3) You save Search result as a Table in Dashboard and schedule email as PDF.
In either of the above three cases you have to ensure that Email exchange is properly setup on Splunk Server. There is an option to send test email with PDF delivery as option, in order to check the same. Most of email alert setup configuration have been called out in the following documentation:
http://docs.splunk.com/Documentation/Splunk/6.5.0/Alert/Emailnotification
... View more
11-07-2016
05:18 AM
can you add some sample events?
... View more
11-07-2016
05:18 AM
Your values of TIME_FORMAT and TIME_PREFIX seems to pick up the timestamp from example event you have provided here.
1) Can you please check whether MAX_TIMESTAMP_LOOKAHEAD is atleast 32 or more? You can increase this to very high number also just to see if at least one event is identified properly and also confirm that there is an issue with event break in that case.
2) Also look into your Event Breaks that all events are being identified properly. Otherwise individual events can become too large and identification of timestamp may become difficult.
If above two do not help can you provide at least two or more sample events after anonymizing from your logs, it would be possible to look further.
TIME_FORMAT=%Y-%m-%dT%H:%M:%S.%3N%z
TIME_PREFIX=Updated': u'
MAX_TIMESTAMP_LOOKAHEAD=32
... View more
11-07-2016
04:35 AM
NOT keyword in not supported for case statement, so use ! instead for performing not expression.
|eval Application = case(Summary like "%Java%" AND ! ( Summary like "%chrome%" OR Summary like "%firefox%"),"Java",Summary like "%flash%","flash")
... View more
