Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Are you a member of the Splunk Community?
Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- Find Answers
- :
- About twh1
twh1
Communicator
Member since:
12-14-2016
06-05-2020
Community Statistics
| Posts | 80 |
| Solutions | 6 |
| Karma Given | 12 |
| Karma Received | 2 |
| Member Since | 12-14-2016 |
Activity Feed
- Karma [BUG] Why SPLUNK Dashboard export PDF resolves Tokens but Scheduled PDF does not for arayapati83. 06-05-2020 12:49 AM
- Karma Re: User a token with where and like for tiagofbmm. 06-05-2020 12:49 AM
- Karma Re: How do you change the cell color based on partial value? for mayurr98. 06-05-2020 12:49 AM
- Karma Add yesterday's date to scheduled report email subject for cnicholls. 06-05-2020 12:48 AM
- Karma Re: Display Date on Dashboard panel for niketn. 06-05-2020 12:48 AM
- Got Karma for What is the difference between a Pivot and a report?. 06-05-2020 12:48 AM
- Got Karma for How to track the editing history of a dashboard?. 06-05-2020 12:48 AM
- Karma Re: Field Extraction from space-aligned fields in multi-line events for landen99. 06-05-2020 12:47 AM
- Karma Re: single search multiple table in splunk? for MoorthyRajendra. 06-05-2020 12:47 AM
- Karma How to collect Apache logs in Splunk without a forwarder? for sloshburch. 06-05-2020 12:47 AM
- Karma Re: Compare a date field with current date for reed_kelly. 06-05-2020 12:46 AM
- Karma Re: Merge two fields into one field for lguinn2. 06-05-2020 12:46 AM
- Karma Re: limit timechart average values to two places for martin_mueller. 06-05-2020 12:46 AM
- Karma Re: Show result of multiple queries as rows of single Table (one query=one row) for somesoni2. 06-05-2020 12:46 AM
- Posted Re: Matching value from two multi-value field on Splunk Enterprise Security. 04-02-2020 01:04 AM
- Posted Matching value from two multi-value field on Splunk Enterprise Security. 04-01-2020 11:21 PM
- Posted How to control Report time range on Splunk Enterprise Security. 02-18-2020 10:53 PM
- Tagged How to control Report time range on Splunk Enterprise Security. 02-18-2020 10:53 PM
- Posted Accessing Saved Report output in json from Splunk Rest API on Getting Data In. 11-10-2019 09:29 PM
- Posted Re: Not able to generate timechart from a multivalue field on Splunk Search. 07-15-2019 08:32 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
02-25-2019
01:13 AM
I have scheduled PDF delivery of a dashboard in Splunk. I was getting the attachment in email with Splunk version 6.5.7. But after upgrading from 6.5.7 to 7.1.6 Splunk version, I am not getting the attachment. only emails, along with content I am getting.
I have not made any changes to my PDF schedule.
I am getting below error in email.
An error occurred while generating the PDF. Please see python.log for details.
... View more
02-13-2019
03:25 AM
Hi @chrisyoungerjds ,
I want the sum of free space and sum of used space with daily span.
... View more
02-13-2019
02:26 AM
I am running timechart command for sum of free space and used space with span of 1 day. I am missing data for few days. but when I am running the same command on those specific date, I am getting data.
Below command for last 7 days.
base search | timechart span=1d sum(Used_Space_GB) as "Used Space", sum(Free_Space_GB) as "Free Space"
_time Used Space Free Space
2019-02-06 0.03 0.95
2019-02-07 3744.03 2575.97
2019-02-08 56946.22 122232.70
2019-02-09 0 0
2019-02-10 0 0
2019-02-11 19.00 2330.00
2019-02-12 0 0
2019-02-13 399369.75 791924.36
but when I am running the same query for 12th Feb 2019. I am getting below result.
base search | timechart span=1d sum(Used_Space_GB) as "Used Space", sum(Free_Space_GB) as "Free Space"
_time Used Space Free Space
2019-02-12 00:00:00 398641.91 792654.95
... View more
11-14-2018
09:49 AM
Hi @kmaron
I have two different query to fetch the data. I cann't get both count in same stats.
... View more
11-14-2018
09:14 AM
I have a requirement to print the source count from how many hosts we are collecting.
Expected output: source_count/host_count
index=main | eval host_count=[ search index=main sourcetype=log1 | dedup host | stats dc(host) as Host_Count | return $Host_Count | eval source_count=[ search index=main sourcetype=log1 | dedup source | stats dc(source) as Source_Count | return Source_Count] | eval count=source_count + "/" + host_count
... View more
11-12-2018
03:21 AM
I have two different fields (DB_INSTANCE_NAME & INSTANCE_NAME ) in two source types. These fields contain a similar value. I want distinct counts after combining both pieces of field data.
DB_INSTANCE_NAME= ansrp, flexp, sunopt, vlprod, buybprod, FDPOSPRD, aasprod, dcpscp, hydra, cidprod, gcdprd, pspprod, HDMPRD
INSTANCE_NAME= obieep, cnavprd, gcdprd, pspprod, svdprod, tumss2, fepauth, rulesu, ecmsprod, HDMPRD, csprod, RFEP1, pcip, vlprod
I want the count of ansrp, flexp, sunopt, vlprod, buybprod, FDPOSPRD, aasprod, dcpscp, hydra, cidprod, gcdprd, pspprod, HDMPRD, obieep, cnavprd, svdprod, tumss2, fepauth, rulesu, ecmsprod, HDMPRD, csprod, RFEP1, pcip
... View more
10-16-2018
04:34 AM
Hi @maryamchar ,
You can use the below query to set-up the alert.
index=foo "search string" | where stoarge_field > 70
... View more
10-16-2018
04:17 AM
Hi @umsundar2015 ,
you can use the below query to fill specific value.
base search | eval field_name= if(field_name==" ", "-", field_name)
This query will fill '-' if any null value come, else field value will be passed.
... View more
10-11-2018
04:16 AM
Yes @varun8159 . I want to compare if date date range is selected as 24th May to 25th May. I want to display the records, for which we have CREATE_TIME in between 24th May to 25th May.
... View more
10-03-2018
10:27 AM
Hi @lukasz92 ,
I have similar issue. I want to convert time picker value to epoch time so that i can put condition. Could you please elaborate more, how you this solution fixed your issue.
... View more
09-27-2018
09:29 AM
Hi @kamlesh_vaghela ,
I have selected the date range for which I have data, but still no data coming. (i.e. create date have data on 24th May to 27th May and I selected date as 24th May 00:00 - 24:00)
... View more
09-27-2018
06:09 AM
Hi @kamlesh_vaghela ,
I tried above option and selected date range as 24th May but not getting any result.
... View more
09-27-2018
04:11 AM
I have used below query and getting value properly.
base search | eval Current_High_Value=substr(HIGH_VALUE, 11, 20)
| rex "^(?:[^ \n]* ){5}(?P<Pre_High_Value>[^']+)"
| eval Previous_High_Value= case(like(PREV_HIGH_VALUE, "TTO_DATE%"), substr(PREV_HIGH_VALUE, 11, 20), like(PREV_HIGH_VALUE, "TIMESTAMP%"), Pre_High_Value)
... View more
09-26-2018
10:45 AM
Hi @kamlesh_vaghela ,
you can find the same at below link.
https://answers.splunk.com/answers/685745/how-do-you-get-tabular-event-with-field-value-pair.html
CREATE_TIME and TIMESTAMP is different times.
... View more
09-26-2018
10:42 AM
I have a field in my log which contains a huge text data with two different formats. I tried to catch a few parts in a new field but was unable to get all the data.
First type
------------------------------------
Timestamp=26/SEP/2018 16:37:38 UTC|DBA_GROUP=X2Oracle_NSS|TOWER=NSS|DB_INSTANCE_NAME=lsrprod|DB_HOST_NAME=ABC|UAID=0|TABLE_OWNER=STAGE|TABLE_NAME=NFMDAT|PARTITION_POSITION=6|PARTITION=P2018|HIGH_VALUE=TTO_DATE(' 2019-01-01 00:00:00', 'SYYYY-MM-DD HH24:MI:SS', 'NLS_CALENDAR=GREGORIAN')|PREV_HIGH_VALUE=TTO_DATE(' 2018-01-01 00:00:00', 'SYYYY-MM-DD HH24:MI:SS', 'NLS_CALENDAR=GREGORIAN')
Second type
-------------------------------------------------
Timestamp=26/SEP/2018 16:01:06 UTC|DBA_GROUP=X2Oracle_GFS|TOWER=GFS|DB_INSTANCE_NAME=ecs02prd|DB_HOST_NAME=ASD|UAID=UDBID-15360|TABLE_OWNER=ECSREFRESH_EXCEPTION|TABLE_NAME=ECS_TRAN_AUDIT_HSTR_BKP|PARTITION_POSITION=27|PARTITION=ECSTRANAUDTHSTR_20170430|HIGH_VALUE=TIMESTAMP' 2017-05-01 00:00:00'|PREV_HIGH_VALUE=TIMESTAMP' 2017-04-01 00:00:00'
partition_check_En_Time=12:01:07 PM
End_Time: Wed Sep 26 12:01:07 EDT 2018
I used the below query to get the new field from above log.
base search | eval Current_High_Value=substr(HIGH_VALUE, 11, 20) | eval Previous_High_Value=substr(PREV_HIGH_VALUE, 11, 20)
I am getting value properly for Current_High_Value field but not getting complete data in Previous_High_Value. Its not picking data for second type of log.
... View more
09-26-2018
10:35 AM
I have posted this as a new question. below is the link.
https://answers.splunk.com/answers/689581/how-to-compare-the-log-date-with-time-picker-date.html
... View more
09-26-2018
10:34 AM
I want to check the records for which CREATE_TIME matches based on my date selection from time picker control. Currently, I am using the below query, which is always checking only for today's date.
index=os_na sourcetype="oracle_os:healthcheck" "ADR Home =" | multikv | table HOSTNAME INCIDENT_ID PROBLEM_KEY CREATE_TIME TIMESTAMP | dedup INCIDENT_ID | eval create_day=substr(CREATE_TIME, 1, 10) | eval now_day = strftime(now(), "%m/%d/%Y") | where INCIDENT_ID!=" " AND create_day==now_day
Could you please help me to get desired result.
... View more
09-26-2018
04:58 AM
Hi @reed.kelly ,
Yes, we can get this for fixed time.
I want to check the records for which CREATE_TIME match based on my date selection from time picker control. Currently I am using below query, which is always checking only for today's date.
index=os_na sourcetype="oracle_os:healthcheck" "ADR Home =" | multikv | table HOSTNAME INCIDENT_ID PROBLEM_KEY CREATE_TIME TIMESTAMP | dedup INCIDENT_ID | eval create_day=substr(CREATE_TIME, 1, 10) | eval now_day = strftime(now(), "%m/%d/%Y") | where INCIDENT_ID!=" " AND create_day==now_day
Could you please help me to get desired result.
... View more
09-26-2018
04:35 AM
Hi @msivill_splunk ,
I have have a question on above query.
You have used below line for getting daily count.
| bin _time span=1d
| stats count as daily_count by _time, host_name, event_msg
Why you are using below lines.
| bin _time span=2d
OR
| bin _time span=4d
Is above query will print amber if same data is repeating for 2 day then status will be amber and if repeated for 4 days status will be Red. Am I correct?
... View more
09-25-2018
10:27 AM
Hi @reed.kelly,
How we can get the epoch time for relative time like -7d@h.
earliest = -7d@h
... View more
09-25-2018
08:10 AM
@msivill_splunk ,
My requirement is like, if we take set of host, instance & event(n3pvdo1001, cogcsprd, enq: TX - row lock contention ) and this combination is occurring every day for last 2 weeks or more, then status should be Red. If this combination is occurring every day for last 1 weeks, then status should be Amber, if this combination is occurring less than 7 days, then status as Green.
... View more
09-25-2018
05:29 AM
Hi @msivill_splunk ,
I need Splunk query. This data is already in splunk.
... View more
