Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Are you a member of the Splunk Community?
Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- Find Answers
- :
- About harishalipaka
harishalipaka
Motivator
Member since:
02-14-2017
04-26-2023
Community Statistics
| Posts | 269 |
| Solutions | 45 |
| Karma Given | 5 |
| Karma Received | 65 |
| Member Since | 02-14-2017 |
Activity Feed
- Got Karma for Re: How do you create a total column in a chart?. 3 weeks ago
- Got Karma for Re: Start Splunk using batch file. 02-29-2024 04:46 PM
- Got Karma for Re: How to remove decimal precision in single value visualization, but keep it in the trending value?. 05-17-2023 12:15 PM
- Got Karma for Re: Can you skip the first x rows returned in a search?. 05-16-2023 08:24 AM
- Posted Why is HTML & Css code is not working after Splunk Sloud update to Version: 9.0.2303.100? on Splunk Cloud Platform. 04-26-2023 01:46 AM
- Got Karma for Re: How do you create a total column in a chart?. 08-22-2022 01:07 PM
- Posted Re: How to get values from a Splunk field to particular decimals? on Splunk Search. 07-14-2022 04:31 AM
- Posted Re: How to find comman value from multiple watchlist on Splunk Search. 07-14-2022 04:23 AM
- Posted Re: How to configure Splunk Enterprise Security drill-down earliest offset? on Splunk Enterprise Security. 07-14-2022 04:13 AM
- Posted Re: Duplication of events when searching multi-value fields in Json using mvzip and mvexpand on Splunk Search. 07-14-2022 04:08 AM
- Posted Please help me to find the following Addon's and Apps are impacted with log4j or Not ? on Security. 12-13-2021 10:56 PM
- Posted Re: Query for Consecutive count for missed time range on Splunk Search. 08-25-2021 07:19 AM
- Posted Re: Query for Consecutive count for missed time range on Splunk Search. 08-24-2021 07:51 AM
- Posted Re: Query for Consecutive count for missed time range on Splunk Search. 08-24-2021 07:24 AM
- Posted Re: Query for Consecutive count for missed time range on Splunk Search. 08-24-2021 03:07 AM
- Posted Re: Query for Consecutive count for missed time range on Splunk Search. 08-24-2021 12:00 AM
- Posted Re: Query for Consecutive count for missed time range on Splunk Search. 08-23-2021 07:04 AM
- Posted Query for Consecutive count for missed time range on Splunk Search. 08-23-2021 04:42 AM
- Tagged Query for Consecutive count for missed time range on Splunk Search. 08-23-2021 04:42 AM
- Posted sending email individually with cc using query on Alerting. 01-27-2021 03:39 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 1 |
03-27-2019
11:31 PM
hi @ayushizile
You have to give one x-axis or you can add |transpose to end of your query..
| eval sr1=if(priority=1, 1, 0) | eval sr3=if(priority=3, 1, 0) | eval sr2=if(priority=2, 1, 0)
| table caseNumber sr1 sr2 sr3
| eventstats sum(sr3) as totalsr3, sum(sr2) as totalsr2, sum(sr1) as totalsr1
| stats first(totalsr1) first(totalsr2) first(totalsr3) |transpose
... View more
03-15-2019
04:47 AM
yes @kamlesh_vaghela ji,
i am also tried like this .Its working now
And one doubt is it working for all users are only for owner of that dashboard..?
ThanQ
... View more
03-15-2019
03:29 AM
hi @kamlesh ji
that is fine,but am getting this error Error in 'SearchOperator:loadjob': Artifacts are unavailable because the job (job_id='byd_line0_admin_YnlkX2xpbmUwX2FkbWlu_YnlkX2xpbmUw__search9_1552645537.487912_8303C2C4-C724-4485-878E-DA1E31862275') is still running.
In my case those search will take more time
... View more
03-15-2019
02:15 AM
hi @sagar1992
index="test_mulesoft" source=RoyalCaninOMSDev "ProcessOrder" | rex field=_raw "corelationid.:\W+(?.)\"" | eval DateTime=strftime(_time,"%Y-%m-%dT%H:%M:%S") | eventstats earliest(DateTime) as request, latest(DateTime) as response by Request_Id | eval it = strptime(request, "%Y-%m-%dT%H:%M:%S") | eval ot = strptime(response, "%Y-%m-%dT%H:%M:%S") | eval diff = ot - it
... View more
03-15-2019
12:46 AM
Hi All,
I am giving a dummy dashboard based on this i will explain what i want..
<form>
<label>test_hari</label>
<fieldset submitButton="false">
<input type="dropdown" token="field1">
<label>field1</label>
</input>
<input type="dropdown" token="field2">
<label>field2</label>
</input>
<input type="time" token="time1">
<label></label>
<default>
<earliest>-24h@h</earliest>
<latest>now</latest>
</default>
</input>
</fieldset>
<row>
<panel>
<table>
<title>vot</title>
<search id="votquery">
<query>index="_internal" |stats count as vot by action, host</query>
<earliest>$time1.earliest$</earliest>
<latest>$time1.latest$</latest>
</search>
<option name="drilldown">none</option>
</table>
</panel>
</row>
<row>
<panel>
<table>
<title>LT</title>
<search id="ltquery">
<query>index="_internal" |stats count as LT by host</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
</search>
<option name="count">10</option>
<option name="drilldown">none</option>
<option name="refresh.display">progressbar</option>
</table>
</panel>
</row>
</form>
O had two tables VOT , LT
And i want another table with Total=VOT+LT
Note:- I don't want to use join or append those two queries.like query1 |append [search query2]
I need to pass two tokens from dropdown So i can't use init on the page load,Just i want to store those query results .
Once that query1 executed just i reuse those results only i dont want to run again and again..
please help me for this ,thanks in Advance.
... View more
03-12-2019
06:25 AM
hi @SathyaNarayanan
have a look into this . https://answers.splunk.com/answers/708628/can-you-help-me-with-an-issue-im-having-with-splun.html
... View more
03-07-2019
05:09 AM
hi @vijaysri
https://docs.splunk.com/Documentation/Splunk/7.2.4/SearchReference/Eventcount
... View more
03-07-2019
04:02 AM
hi @rashid47010
u want to remove that link to search ust add in your proprties..
<option name="drilldown">none</option>
... View more
03-07-2019
01:21 AM
hi @rajhemant26
try like this
| makeresults
| eval Date="12/08", shiftA=102, shiftB=10, shiftC=200
| append
[| makeresults
| eval Date="25/08", shiftA=240, shiftB=102, shiftC=52]
| table Date shift*
| eval Max=0
| foreach shift*
[eval Max=case(Max>=<<FIELD>>,Max,true(),<<FIELD>>)] |sort - Max |head 1
... View more
02-11-2019
11:33 PM
Hi All,
I'm about to integrate Tanium Connect with Splunk Cloud ( Not Splunk Enterprise ) to forward data from Tanium to Splunk Cloud in the 'syslog' format.
In this regard, I would like to know details on the following -
Connection settings that need to be done in Tanium Connect ( like what to be filled in port no ,host name etc ) ,
Is there any difference in forwarding data from Tanium Connect to Splunk Enterprise and Splunk Cloud OR is it same for both,
what are the list of ports that need to be opened in them system where Tanium console is installed,
Which port is used for communication between Tanium connect and Splunk cloud,
Any URL that need to be white-listed in the Firewall that is present in the network where, Tanium is present,
what are the methods that are implemented in Splunk cloud to secure data,
What are the security measures that are followed while sending data from Tanium to Splunk cloud etc.,
ThanQ in advance 🙂
... View more
02-06-2019
05:47 AM
hi @ashok968
have a look into this,,
https://answers.splunk.com/answers/565349/dashboard-conditional-drill-down-with-form-input-t-1.html
... View more
02-05-2019
10:59 PM
hi @dfrench151
in your query you are displaying results are string.But in your code properties are related to values like value range ,rangecolour.
can u pls give me a clarity on this .
... View more
02-05-2019
03:19 AM
1 Karma
@TonyJobling
You have to create a role and give permission to only your APP which one you want to restrict and assign the user to that role. If the user has created some dashboards in another app earlier, you can move those objects to the new app so that user will still be able to access them
... View more
02-05-2019
02:41 AM
hi @ruchijain
try this
index=_internal sourcetype=splunkd_ui_access user!="-"
| stats earliest(_time) AS StartTime latest(_time) AS EndTime count by user date_mday
| join type=left user [
| rest /services/authentication/users
| rex field=id "https:\/\/127.0.0.1:8089\/(\w+\/)+(?<user>\w+)"
| rename realname AS Name
| fields user
]
| search user=*
| eval
Duration=tostring(EndTime-StartTime,"Duration"),
StartTime=strftime(StartTime,"%d/%m/%Y %H.%M.%S"),
EndTime=strftime(EndTime,"%d/%m/%Y %H.%M.%S")
| sort user
| table user StartTime EndTime Duration | dedup user
... View more
02-05-2019
02:14 AM
hi @rohanmiskin
try like this index="abc" earliest=-d latest=now StatusCode="4*" OR StatusCode="5*" OR StatusCode="206 " OR StatusCode="3" | stats count(StatusCode) as NoOfFailures by StatusCode | replace "404 Not Found" with "Medium", "206 Partial Content" with "Low", "400 Bad Request" with "Medium" | table StatusCode,NoOfFailures |stats sum(NoOfFailures) as NoofFailure by StatusCode
... View more
02-04-2019
12:01 AM
[Updated]
hi @v709587 try this below query
|makeresults |eval IMSI1="This is Splunk Dashboard. The list of hosts are as shown." | makemv delim="." IMSI1 | mvexpand IMSI1 |table IMSI1
if you want to add new row try append , appendpipe
if you want to add new column try appendcols
... View more
02-03-2019
11:59 PM
1 Karma
hi @soundv
try this ..if you want sum
|makeresults |eval IMSI1="1.12,9.54,4.1,6.8,5.52,7.10" | makemv delim="," IMSI1 | mvexpand IMSI1 | rex field=IMSI1 "(?<IMSI1>\d).(?<IMSI2>\d+)" | table IMSI1 IMSI2
| eventstats sum(IMSI1) as sum_IMSI1,sum(IMSI2) as sum_IMSI2 |eval diff=sum_IMSI1-sum_IMSI2
Or count od IMSIs try this
|makeresults |eval IMSI1="1.12,9.54,4.1,6.8,5.52,3" | makemv delim="," IMSI1 | mvexpand IMSI1 | rex field=IMSI1 "(?<IMSI1>\d).(?<IMSI2>\d+)" | table IMSI1 IMSI2
| eventstats count(IMSI1) as count_IMSI1,count(IMSI2) as count_IMSI2 |eval diff=count_IMSI1-count_IMSI2
... View more
01-29-2019
11:45 PM
hi @ips_mandar
i didn't understand what do u want ,i can't see above example Type
Can u explain what u had and what do u want simply
... View more
01-29-2019
11:26 PM
Some cron implementations support the "L" flag to represent the last day of the month.
0 55 23 L * ?
That will run at 11:55 pm on the last day of every month.
... View more
01-29-2019
11:09 PM
hi @ganji
check your user timezone
... View more
01-29-2019
10:54 PM
yes @kamlesh same thing on that way.
that is also ok.or instead of token create a macro with that token and use in other dashboards
... View more
01-29-2019
10:35 PM
Hi dudes,
I have run a query in one dashboard based on that result created a token.
Now i want to create a macro with that token results using java script or jquery.
Note:- I have to access that macro in diff dashboards also.
Thanks in advance.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
04-26-2023
10:10 AM
|
