Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About karthi2809
karthi2809
Builder
Member since:
12-07-2016
Online
Community Statistics
| Posts | 228 |
| Solutions | 0 |
| Karma Given | 95 |
| Karma Received | 6 |
| Member Since | 12-07-2016 |
Activity Feed
- Posted How to extract json field values? on Splunk Search. 11 hours ago
- Posted Re: How to separate sets of information with same field values without using JOIN? on Splunk Search. 16 hours ago
- Posted How to separate sets of information with same field values without using JOIN? on Splunk Search. 17 hours ago
- Karma Re: How to segregate the dropdown ALL values ? for kamlesh_vaghela. 19 hours ago
- Posted Re: How to segregate the dropdown ALL values ? on Dashboards & Visualizations. yesterday
- Posted Re: How to segregate the dropdown ALL values ? on Dashboards & Visualizations. yesterday
- Karma Re: How to segregate the dropdown ALL values ? for kamlesh_vaghela. yesterday
- Posted How to segregate the dropdown ALL values ? on Dashboards & Visualizations. Sunday
- Karma Re: How to get token values from dropdown to splunk query? for ITWhisperer. Sunday
- Karma Re: how to create dependent dropdown? for gcusello. Sunday
- Posted Re: how to create dependent dropdown? on Dashboards & Visualizations. Friday
- Posted Re: how to create dependent dropdown? on Dashboards & Visualizations. Friday
- Karma Re: how to create dependent dropdown? for gcusello. Friday
- Posted how to create dependent dropdown? on Dashboards & Visualizations. Friday
- Posted Re: How to get token values from dropdown to splunk query? on Dashboards & Visualizations. Thursday
- Posted How to get token values from dropdown to splunk query? on Dashboards & Visualizations. Thursday
- Posted How to use depend and reject use on input type dropdown and text? on Dashboards & Visualizations. a week ago
- Posted Re: How to exclude null values in mv fields? on Splunk Search. a week ago
- Posted How to exclude null values in mv fields? on Splunk Search. a week ago
- Karma Re: How to compare two fields values counts ? for ITWhisperer. 2 weeks ago
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 0 |
07-31-2018
12:31 AM
I have a scenario that i have to trigger alert when splunk forwarder is not running i have query that working fine.in that query i have to add index in the table .now i cant able to view index name in the query
My query:
| metadata type=hosts index=XXX index=YYY index=ZZZ| eval age = now() - recentTime | eval status= case(age < 1800,"Running",age > 1800,"DOWN") | convert ctime(recentTime) AS LastActiveOn
| eval age=tostring(age,"duration") | eval host = upper(host)
| table host age LastActiveOn status
| rename host as "Forwarder Name", age as "Last Heartbeat(min)",LastActiveOn as "Last Active On",status as Status| where Status= "DOWN"
... View more
07-31-2018
12:18 AM
This alert is consolidated.so i have to show index in the table
... View more
07-24-2018
03:13 AM
In my scenario I have to consolidated cpu utlization of all application in one query.But i cannot get proper output because my cpu for linux used vmstat for unix mpstat used so my output is mismatch .i will attach below.How to frame a query to get all server cpu .
Used Query:
index=XXX* OR index=FFF* OR index=EEE* OR index="GGG*" OR index="HH*"source=cpu | rex field=_raw "CPUPctUsed=(?\d*)" | eval CPUPctUsed2=100-pctIdle | fillnull value="NA" CPUPctUsed1 CPUPctUsed2 | eval CPUPctUsed=if(CPUPctUsed1="NA",CPUPctUsed2,CPUPctUsed1) | stats avg(CPUPctUsed) as "Avg" max(CPUPctUsed) as "Max" by host index | eval Avg=round(Avg,2) | where Max > 95 | table index host Avg Max
Thanks in advance
... View more
07-18-2018
11:09 PM
2018-07-19 02:05:13,901|3801531980313892|MA_SE|aabbcc|12121212|10|FGH|lOP|||EMAIL|KARTHI@GMAIL.COM|LEVEL2|12/22/2017|12/31/9999|FATAL|E0021|Member not found
... View more
07-17-2018
10:22 PM
1 Karma
One of my splunkforwarder is down last month .I am trying to find when the host is stop working .have to trigger alert when host is down.now i am using query that will check only 30 min .Can any one help on this.Thanks in advance
My query :
| metadata type=hosts index=XXX | eval age = now() - recentTime | eval status= case(age < 1800,"Running",age > 1800,"DOWN") | convert ctime(recentTime) AS LastActiveOn
| eval age=tostring(age,"duration") | eval host = upper(host)
| table host age LastActiveOn status
| rename host as "Forwarder Name", age as "Last Heartbeat(min)",LastActiveOn as "Last Active On",status as Status| where Status= "DOWN"
... View more
06-20-2018
10:23 PM
In my scenario the indexer is working but diskspace is 100% in /splunk/data1.when i used source=df i dint see the mentioned path in the result .how to find and set alert for the particular path.
... View more
06-20-2018
02:56 AM
101010|101010|101010|101010|101010|101010|101010||||101010|101010|101010|||FATAL|E000110|file not found
101010|101010|101010|101010|101010|101010|101010||||101010| 101010 |101010|||SUCCESS||
101010|101010|101010|101010|101010|101010|101010|||101010|101010| 101010 |101010|||FATAL|E10021|file not found
... View more
06-20-2018
02:27 AM
How to extract success and fatal into one field and also extract two Fields after FATAL
2018-06-18 02:06:34,606|261529301994221|MA_SELECT|785M91236|602304234|001|WGS20||||EMAIL|SPALACIOS810@GMAIL.COM|LEVEL2|||SUCCESS||
2018-06-18 02:06:34,294|7961529301994286|MA_SELECT|AN72688470000|202465241|001|NASCO||||EMAIL|SANGELI@OUTDRS.NET|LEVEL2|||
FATAL|E000057P|Member not found
... View more
06-20-2018
12:01 AM
How to trigger alert when the index from Down to Running State?
My query is to find index is down.But it will trigger only once.I need to continuously when the index is to running state .
| metadata type=hosts index*_prod | eval age = now() - recentTime | eval status= case(age < 900,"Running",age > 900,"DOWN") | convert ctime(recentTime) AS LastActiveOn
| eval age=tostring(age,"duration") | eval host = upper(host)
| table host age LastActiveOn status
| rename host as "Forwarder Name", age as "Last Heartbeat(min)",LastActiveOn as "Last Active On",status as Status|where Status= "DOWN"
... View more
06-19-2018
10:59 PM
i need to trigger alert when the splunkforwarder is down for the particular index
... View more
05-15-2018
10:55 PM
In below scenario i want to ignore two vales are null in the result.
index=test |stats count by ErrorDetail ErrorMessage|fillnull value="Not Available" ErrorDetail |fillnull value="Not Available" ErrorMessage|where ErrorDetail!="Not Available" AND Errormessage!="Not Available"
Result:
PHARMACY Not Available Not Available 16
BenefitAccums INFRASTRUCTURE ERROR- WGMMMIOS BAD RETURN; RC = 1 Not Available 18
Excpected Result:
BenefitAccums INFRASTRUCTURE ERROR- WGMMMIOS BAD RETURN; RC = 1 Not Available 18
Have to exclude both field have not available in the result.
Thanks
... View more
05-11-2018
06:43 AM
I have 6 jvm
/ws/jvma1/test.logs
/ws/jvmb1/test.log
Both the paths have same log file have to compare the count of jvma1 and jvmb1.How to find volume comparision from both the path.
... View more
05-11-2018
05:20 AM
In my scenario i have to compare counts of two different JVM
A- Jvm B-jvm
jvma1 jvmb1
jvma2 jvmb2
jvma3 jvmb3
Have to compare count of the jvm
Expected output:
A- Jvm count B-jvm count
jvm1 10 jvmb1 20
jvm2 20 jvmb2 40
jvm3 100 jvmb3 200
... View more
05-02-2018
04:11 AM
index="testd" | rex field=_raw "Remote host:(?.*):" |dedup Remotehost |stats count by Remotehost
My events:
Remote host:
2.136.12.186
:34126]@684574 useCount=1 bytesRead=0 bytesWritten=2994631 age=163708ms lastIO=5ms ))).onExceptionWrite exception
Expected output:
2.136.12.186
Thanks in advance
... View more
04-26-2018
12:18 AM
I have two directory having two log files
Directory:
/logs/Test1/
/logs/Test2/
The directory have two log files:
Logs:
error.log
systemout.log
Have to trigger alert for the directory and logs have no transaction for 10 min
... View more
04-16-2018
03:28 AM
How to extract URI following rex command?
My field
URI=/v4/cp/members/summary?hcid=
AN5635356
&firstnm=ELLEN&lastnm=BRODBINE&dob=1962-01-02
My rex command :
| rex field=_raw "URI=/v4/cp/members/summary?(?[^ ]*)"
?hcid=AN5635356&firstnm=ELLEN&lastnm=BRODBINE&dob=1962-01-02
Expected output:
AN5635356
... View more
04-05-2018
07:15 AM
what is earliest and latest time
... View more
04-05-2018
07:03 AM
i need in single alert
... View more
04-05-2018
06:48 AM
Hi This is the time frame
Morning 9 AM , 1 PM and 4 PM.
Morning 9 AM : Cycle will be previous day 4 PM to Today 9 AM
Afternoon 1 Pm : Cycle will be 9 AM to 12.59 PM
Evening 4 PM : Cycle will be 1 PM to 3.59 PM
... View more
04-05-2018
06:30 AM
Have to set alert for three different timestamp?
ex: 4am to 7am , 9am to 2 pm,5pm to 10pm
Thanks
Karthi
... View more
04-04-2018
02:53 AM
Three type of status:
status:400
status:404
status:500
need total count and status count. if count of status more than 10% need to trigger alert?
... View more
03-29-2018
06:48 AM
Thanks a lot
There is lot of URL i will send some complicated URI
/v1/utility/hcpcsprocedurecodes/j7q
/v1/utility/hcpcsprocedurecodes/m
/v1/utility/hcpcsprocedurecodes/m7zv
/v1/utility/hcpcsprocedurecodes/m7zz
/v1/utility/revenuecodes/m
/v1/utility/revenuecodes/m7zv
/v3/securemessages/members/afae0-a4ecae9be1/categories
/v3/securemessages/members/afbfc-a7d3-f4afedf/categories
/v3/securemessages/members/bda8eaaa-bdaf1e/messages/incident/reply
Have to remove ' bda8eaaa-bdaf1e','afbfc-a7d3-f4afedf'
... View more
Contact Me
| Online Status |
Online
|
| Date Last Visited |
Sunday
|
Karma from
| User | Karma Count |
|---|---|
| 2 | |
| 1 | |
| 1 | |
| 1 | |
| 1 |
Karma given to
