Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About indeed_2000
indeed_2000
Motivator
Member since:
11-24-2019
02-23-2024
Community Statistics
| Posts | 528 |
| Solutions | 7 |
| Karma Given | 95 |
| Karma Received | 2 |
| Member Since | 11-24-2019 |
Activity Feed
- Posted Re: Compare resp code count of two dates for each servername on Splunk Search. 02-23-2024 10:28 AM
- Karma Re: Compare resp code count of two dates for each servername for ITWhisperer. 02-23-2024 10:26 AM
- Posted Re: Compare resp code count of two dates for each servername on Splunk Search. 02-23-2024 04:00 AM
- Posted Compare resp code count of two dates for each servername on Splunk Search. 02-23-2024 12:34 AM
- Posted Re: compare two result on Splunk Search. 02-21-2024 09:18 PM
- Karma Re: compare two result for bowesmana. 02-21-2024 09:18 PM
- Posted Re: compare two result on Splunk Search. 02-20-2024 08:57 AM
- Posted compare two result on Splunk Search. 02-19-2024 08:41 PM
- Karma Re: splunk 8.0.4 support mpreview? for PickleRick. 01-22-2024 09:27 AM
- Posted splunk 8.0.4 support mpreview? on Splunk Search. 01-21-2024 08:50 PM
- Posted Re: Need to create summary index continuously realtime on Splunk Search. 01-18-2024 02:19 AM
- Posted Re: Need to create summary index continuously realtime on Splunk Search. 01-18-2024 12:03 AM
- Posted Re: Need to create summary index continuously realtime on Splunk Search. 01-17-2024 11:31 AM
- Posted Re: Need to create summary index continuously realtime on Splunk Search. 01-17-2024 11:28 AM
- Posted Re: Need to create summary index continuously realtime on Splunk Search. 01-15-2024 11:26 AM
- Posted Need to create summary index continuously realtime on Splunk Search. 01-15-2024 09:49 AM
- Posted Re: issue with "_time" after using fit command in DLTK on Splunk Search. 01-09-2024 04:42 AM
- Posted issue with "_time" after using fit command in DLTK on Splunk Search. 01-09-2024 03:55 AM
- Posted Re: Download splunk apm on premises on Splunk Search. 12-20-2023 09:59 AM
- Posted Re: Extract fields in query or in config file on Splunk Search. 12-20-2023 09:37 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
07-12-2022
11:53 PM
Hi @gcusello, As I mention log files are same, i mean same name, same content. the only different is time frame. and definitely it will be index twice but on the different path and index so they should not overlap with each other. any other idea? Thanks
... View more
07-12-2022
11:43 PM
Hi
I have suspecious behaviour of splunk when index log file. here is the issue when I search through yesterday log it only show events from 12:00 to 23:59! log from 00:00 to 12:00 missed!
I have two path that continiously index by splunk, like below:
index today
/data/today
index yesterday
/data/yesterday
index today: log will be copy on above path, every day and contain log file from 00:00 to 12:00 of today
index yesterday: log copy on above path, every day and contain log file from 00:00 to 23:59 of yesterday
FYI: index and path completely different.
FYI: log files are same and the only different is "today log" contain data till 12:00
any idea?
Thanks
... View more
Labels
- Labels:
-
eval
-
field extraction
-
fields
-
regex
-
rex
07-05-2022
02:23 AM
actually it's not regex, it's some search command, any other idea? current: | eval Failed=if(match(_raw, "Failed_Condition_Regex"), 1, 0)
| eval Other=if(match(_raw, "Other_Condition_Regex"), 1, 0) expected: 1- TURNOFF NOT DISPOSE AND "A[*00]" AND "Packet Processed:" 2- TURNOFF NOT DISPOSE AND "Packet Processed:" search A!=*00 3- TURNOFF NOT DISPOSE AND "Packet Processed:" AND "A[*]"
... View more
07-05-2022
01:21 AM
@ITWhisperer any idea?
... View more
07-04-2022
09:11 AM
Would you please explain more? What is the different between "bin span=5m" vs "timechart span=5m"
... View more
- Tags:
- u
07-04-2022
12:19 AM
Hi What is the different between "bin span=5m" vs "timechart span=5m"? I mean it is better to use bin span then use timechart without timechart? which one efficient? what is the different at all?
Thanks,
... View more
Labels
- Labels:
-
eval
-
field extraction
-
fields
-
regex
-
rex
07-01-2022
10:43 PM
Hi I have three search commands that need to combine result and show on a timechart.
I have to count "Success", "Fail", "Total", "Other"
Here is my SPL:
index="myindex" TURNOFF NOT DISPOSE AND "A[*00]" AND "Packet Processed:" source="/data/app.log*"| bin _time span=1h | stats count AS Success by _time
| join _time
[search index="myindex" TURNOFF NOT DISPOSE AND "Packet Processed:" source="/data/app.log*"| rex "R\[(?<R>\d+)"| search A!=*00| bin _time span=1h | stats count AS Failed by _time ]
| join _time
[search index="myindex" TURNOFF NOT DISPOSE AND "Packet Processed:" AND "A[*]" source="/data/app.log*"| bin _time span=1h | stats count AS Totals by _time ]
| eval TotalSF=Success+Failed | eval Other=Totals-TotalSF | fields - Totals TotalSF| addtotals
it works correctly on a specific time range (like 2 or 3 hours) but when I set the time to Yesterday and it created a negative number (for field that I call Other).
Any idea? Thank
... View more
Labels
- Labels:
-
eval
-
field extraction
-
fields
-
regex
-
rex
06-24-2022
08:38 PM
is there anyway to consider whole non english charecter in each line as one extraction? 2022-06-20 11:16:10,381 INFO [APP] log in : 38773763@#123@دالكي string تست exception result: تست دالكي
... View more
06-22-2022
10:30 PM
Still not work as expected, if more that one non english word exist on each line i expect consider them. e.g. Expected result for below line: دالكي هلت "2022-06-20 11:16:10,381 INFO [APP] log in : 38773763@#123@دالكي هلت "
... View more
06-21-2022
08:59 AM
Consider each character as separate, in this line i only have one non English word! Excpected output: | table NonEnglish دالكي Any idea?
... View more
06-21-2022
07:58 AM
@DanielMustaine not work on this 2022-06-20 11:16:10,381 INFO [APP] log in : 38773763@#123@دالكي any idea?
... View more
06-15-2022
10:39 AM
06-02-2022
02:36 AM
i remove the part that i use in beginning and use your suggestion. work like charm 🙂 Thanks
... View more
06-02-2022
01:23 AM
Thanks it work, i just add this to the beginning of spl to remove spaces that exist in fields and work perfectly. ... | rex mode=sed field=A "s/ //g"
... View more
06-01-2022
10:45 PM
hi
need to calculate count and percentage of fields.
orginal post here, the main issue is fields contain space or balnk (2 single quotation
i have spl like below,
| eventstats count as namecount by name
| eventstats count as colorcount by color
| eventstats count as statuscount by status
| eventstats count(name) as nametotal
| eventstats count(color) as colortotal
| eventstats count(status) as statustotal
| eval name=printf("%04u %s %d", 10000-namecount, name, nametotal)
| eval color=printf("%04u %s %d", 10000-colorcount, color, colortotal)
| eval status=printf("%04u %s %d", 10000-statuscount, status, statustotal)
| stats values(name) as name values(color) as color values(status) as status
| eval cname=mvmap(name,10000-tonumber(mvindex(split(name," "),0)))
| eval ccolor=mvmap(color,10000-tonumber(mvindex(split(color," "),0)))
| eval cstatus=mvmap(status,10000-tonumber(mvindex(split(status," "),0)))
| eval pname=mvmap(name,100*(10000-tonumber(mvindex(split(name," "),0)))/tonumber(mvindex(split(name," "),2)))
| eval pcolor=mvmap(color,100*(10000-tonumber(mvindex(split(color," "),0)))/tonumber(mvindex(split(color," "),2)))
| eval pstatus=mvmap(status,100*(10000-tonumber(mvindex(split(status," "),0)))/tonumber(mvindex(split(status," "),2)))
| eval name=mvmap(name,mvindex(split(name," "),1))
| eval color=mvmap(color,mvindex(split(color," "),1))
| eval status=mvmap(status,mvindex(split(status," "),1))
| fields name cname pname color ccolor pcolor status cstatus pstatus
i have some "date" or "color" like this: 'Mon May 30 00:00:00 USDT 2022' or ''
FYI: some of them contain space between Single quotation like this 'Mon May 30 00:00:00 USDT 2022', some of them are empty just has Single quotation like this ''
not show them correcty and won't calculate percentage of them.
current output:
Date cDate %Date Color cColor %Color
'Mon 2 '' 1
'Today' 1 33.0 'red' 2 66.0
expected output:
Date cDate %Date Color cColor %Color
'Mon May 30 00:00:00 USDT 2022' 2 66.66 '' 1 33.3
'Today' 1 33.0 'red' 2 66.0
... View more
06-01-2022
11:59 AM
you right it's typo, now fixed i have some "date" or "color" like this: 'Mon May 30 00:00:00 USDT 2022' or '' FYI: some of them contain space between Single quotation like this 'Mon May 30 00:00:00 USDT 2022', some of them are empty just has Single quotation like this '' not show them correcty and won't calculate percentage of them. current output: Date cDate %Date Color cColor %Color 'Mon 2 '' 1 'Today' 1 33.0 'red' 2 66.0
... View more
06-01-2022
09:49 AM
@ITWhisperer about this line, how can i limit to 2 decimal places like this 33.33? | eval pname=mvmap(name,100*(10000-tonumber(mvindex(split(name," "),0)))/tonumber(mvindex(split(name," "),2)))
... View more
06-01-2022
08:30 AM
how about this? expected output: Name cName %Name Color cColor %Color jack 2 66.6 red 1 33.3 daniel 1 33.3 blue 1 33.3 green 1 33.3
... View more
06-01-2022
07:48 AM
@ITWhisperer Thank you for answer, 1-is it possible to do this with simpler SPL? e.g seperate count column? 2-is it possible add percentage beside count? expected output: name count percentage color count percentage jack 2 66.6 red 1 33.3 daniel 1 33.3 blue 1 33.3 green 1 33.3
... View more
06-01-2022
04:24 AM
Hi I have table like this:
name color status
jack red fail
jack blue fail
daniel green pass
expected output:
name color status
jack(2) red(1) fail(2)
daniel(1) blue(1) pass(1)
green(1)
any idea?
Thanks,
... View more
Labels
- Labels:
-
eval
-
field extraction
-
fields
-
regex
-
rex
05-31-2022
10:06 AM
i’m look for something like exist on pattern tab, show percentage of each pattern.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
02-23-2024
01:48 PM
|
Karma given to
