Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About mah
mah
Builder
Member since:
06-10-2020
01-05-2022
Community Statistics
| Posts | 168 |
| Solutions | 5 |
| Karma Given | 22 |
| Karma Received | 10 |
| Member Since | 06-10-2020 |
Activity Feed
- Got Karma for Receiving error: Could not load lookup=LOOKUP-splunk_security_essentials. 06-12-2023 01:58 AM
- Got Karma for Receiving error: Could not load lookup=LOOKUP-splunk_security_essentials. 12-02-2022 02:18 AM
- Posted How to write field name in its value on Splunk Search. 01-05-2022 07:26 AM
- Posted How to reorganize a table on Splunk Search. 01-05-2022 05:31 AM
- Posted Re: Foreach command with eval if on Splunk Search. 01-04-2022 07:05 AM
- Posted Foreach command with eval if on Splunk Search. 01-03-2022 08:18 AM
- Posted Re: How to drilldown an external link with part of url in a row on Splunk Search. 12-20-2021 07:32 AM
- Posted Re: How to drilldown an external link with part of url in a row on Splunk Search. 12-20-2021 05:54 AM
- Posted Re: How to drilldown an external link with part of url in a row on Splunk Search. 12-20-2021 05:23 AM
- Posted How to drilldown an external link with part of url in a row on Splunk Search. 12-20-2021 04:59 AM
- Posted How to merge 2 lines in a table into one on Splunk Search. 12-20-2021 04:44 AM
- Posted How to find several terms in all _raw ? on Splunk Search. 12-19-2021 11:31 AM
- Got Karma for Receiving error: Could not load lookup=LOOKUP-splunk_security_essentials. 11-14-2021 11:12 PM
- Posted Re: How to break a json log into multiple events on Getting Data In. 10-07-2021 12:59 AM
- Posted Re: How to break a json log into multiple events on Getting Data In. 10-07-2021 12:21 AM
- Posted How to break a json log into multiple events on Getting Data In. 10-06-2021 08:10 AM
- Posted Re: How to apply icon in foreach command on Dashboards & Visualizations. 09-20-2021 09:43 AM
- Posted Re: How to apply icon in foreach command on Dashboards & Visualizations. 09-20-2021 09:34 AM
- Posted Re: How to convert epoch time field when using it as value in chart command on Dashboards & Visualizations. 09-20-2021 09:21 AM
- Karma Re: How to convert epoch time field when using it as value in chart command for ashvinpandey. 09-20-2021 09:21 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
09-29-2020
07:37 AM
Hi, I have a table like that : name percent AAA 90 BBB 60 70 I want to group the BBB percent in one percent. How I can do this command ? Thanks
... View more
- Tags:
- grouping
Labels
- Labels:
-
stats
09-24-2020
12:40 AM
hi @ITWhisperer , Exactly what I was looking for. I didn't know that the stat command had to be written after the bin command. That why the bin didn't work. Thank you very much.
... View more
09-23-2020
08:44 AM
Thanks, Now I have this : I applied the bin command, it doesn't work. I tried the bucket command, it doesn't work too. | eval time=strptime(substr(field_date,1,10),"%Y-%m-%d") | fieldformat time=strftime(time,"%Y-%m-%d") | table time OK KO TOTAL | bin time span=1d
... View more
09-23-2020
08:23 AM
Hi @ITWhisperer , It returns this : How can I write values of day field in %Y%m%d ?
... View more
09-23-2020
07:53 AM
Hi, I have a table like this : I want to group by day and tried the commande | bucket span=1d field_date but without success. How can I do ?
... View more
- Tags:
- grouping
09-15-2020
12:37 AM
Hi @gcusello , I run the above command : and I run the eval command I have in my begining search : But when I added the following command : | stats count(eval(Statut=="KO")) as KO by _time The problem still the same : it doesn't make a span by day anymore and the visualization goes wrong :
... View more
09-14-2020
09:27 AM
I put the "| stats count(eval(Statut=="KO")) as KO by _time" at the end in order to answer to this other issue : https://community.splunk.com/t5/Dashboards-Visualizations/Drilldown-not-working-at-all/m-p/519370#M34868 I've already tried to see command by command but I don't find where it goes wrong. I find out that at this command : index=abc | eval dummy="true" | eval epochnow = now() | eval epochHorodate=strptime(Horodate, "%Y-%m-%dT%H:%M:%S")| eval Horodate=strftime(epochHorodate, "%Y-%m-%dT%H:%M:%S") | where epochnow>=epochHorodate | eval _time=Horodate The _time returned like this : NaN/NaN/aN NaN:NaN:NaN.000 AM and then when I added this command and put a single value, the problem is the same : "These results may be truncated. This visualization is configured to display a maximum of 1000 results per series, and that limit has been reached."
... View more
- Tags:
- visualization
09-14-2020
08:55 AM
Hi, I have a search like this applied on many queries : index="abs" field1="aaa" field2="bbb" | eval dummy="true" | eval epochnow = now() | eval epochHorodate=strptime(Horodate, "%Y-%m-%dT%H:%M:%S") | eval Horodate=strftime(epochHorodate, "%Y-%m-%dT%H:%M:%S") | where epochnow>=epochHorodate | eval _time=Horodate | stats count(eval(Statut=="KO")) as KO by _time | sort _time ASC | appendpipe [| stats sum(KO) as KO | eval _time=now()] Usually the search return a result like this : I have the sum of KO / day. And then I use the single value for the visualization : My issue is that on one query I have this error : And it doesn't span bay day anymore. Can you help me please ?
... View more
- Tags:
- visualization
Labels
- Labels:
-
stats
09-14-2020
01:28 AM
1 Karma
It works great ! I didn't know this subtlety ! Thanks for your help.
... View more
09-11-2020
04:47 AM
Hi, Here is my xml code of 2 pannels : <panel> <single> <search base="abc"> <query> | eval Duration=round(abs((relative_time(now(), "@d")-relative_time(strptime(Timestamp, "%Y-%m-%dT%H:%M:%S.%N"), "@d"))/86400),0) | table Duration | rename Duration | head 1</query> </search> <option name="colorBy">value</option> <option name="colorMode">none</option> <option name="drilldown">all</option> <option name="numberPrecision">0</option> <option name="rangeColors">["0x53a051","0xf1813f","0xdc4e41"]</option> <option name="rangeValues">[0,1]</option> <option name="refresh.display">progressbar</option> <option name="showSparkline">1</option> <option name="showTrendIndicator">1</option> <option name="trellis.enabled">0</option> <option name="trellis.scales.shared">1</option> <option name="trellis.size">medium</option> <option name="trendColorInterpretation">standard</option> <option name="trendDisplayMode">absolute</option> <option name="useColors">1</option> <option name="useThousandSeparators">1</option> <drilldown> <link target="_blank">/app/myapp/myapp__details</link> </drilldown> </single> </panel> <panel> <single> <search base="abc"> <query> | eval dummy="true" | eval epochnow = now() | eval epochHorodate=strptime(Horodate, "%Y-%m-%dT%H:%M:%S")| eval Horodate=strftime(epochHorodate, "%Y-%m-%dT%H:%M:%S") | where epochnow>=epochHorodate | eval _time=Horodate | stats count(eval(Statut=="KO")) as KO by _time | sort _time ASC | addcoltotals</query> </search> <option name="colorBy">value</option> <option name="colorMode">none</option> <option name="drilldown">all</option> <option name="rangeColors">["0x53a051","0xf8be34","0xdc4e41"]</option> <option name="rangeValues">[0,50]</option> <option name="refresh.display">progressbar</option> <option name="trellis.enabled">0</option> <option name="unit">KO</option> <option name="useColors">1</option> <option name="useThousandSeparators">1</option> <drilldown> <link target="_blank">/app/myapp/myapp__details</link> </drilldown> </single> </panel> The first drilldown works perfectly, but the second which is exactly the same doesn't works at all. Can you please help me ? Thanks.
... View more
- Tags:
- drilldown
Labels
- Labels:
-
drilldown
08-26-2020
05:08 AM
hi, here are the rights applied to the script : And the fact that it works when I run the script in the folder with command : python my_script.py The json files are returned in splunk successfully parsed. So I really don't understand.
... View more
08-26-2020
02:35 AM
Hi, sorry I did a bad copy paste, the script is already located in /opt/splunk/etc/apps/my_app_poller/bin/my_script.py After a new test I get the error below : ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/my_app_poller/bin/my_script.py" IOError: [Errno 13] Permission denied: ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/my_app_poller/bin/my_script.py" Traceback (most recent call last😞 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/my_app_poller/bin/my_script.py" File "/opt/splunk/etc/apps/my_app_poller/bin/my_script.py", line 13, in <module>
... View more
08-26-2020
02:03 AM
Hi, Yes I tried to run the script in the file my_app_poller_/bin : the json files went back to splunk with correct parsing. I use this batch parameter because uselly I apply this input configuration with .sh script ans it works well. The only difference I changed is to put a .py script instead of .sh, and it does not work anymore. Last, I search in _internal and I find out this error : ERROR ExecProcessor - Ignoring: "/opt/splunk/etc/my_app_poller/bin/my_script.py" ERROR FrameworkUtils - Incorrect path to script: /opt/splunk/etc/my_app_poller/bin/my_script.py. Script must be located inside $SPLUNK_HOME/bin/scripts. Can you tell me if I have to put my script in a path like : /opt/splunk/etc/my_app_poller/bin/scripts ?
... View more
08-26-2020
12:45 AM
Hi, I can't see where I am wrong in my configuration file : inputs.conf : /opt/splunk/etc/apps/my_app_poller/local [script://./bin/my_python_script.py] interval = 27 7 * * * index = my_index sourcetype = script:python source = script://./bin/my_python_script.py disabled = 0 [batch:///opt/splunk/etc/apps/my_app_poller/bin/*my_python_script.json] move_policy = sinkhole index = my_index sourcetype = script:python crcSalt = <SOURCE> disabled = 0 props.conf : /opt/splunk/etc/apps/my_app_2/default [script:python] INDEXED_EXTRACTIONS = json DATETIME_CONFIG = CURRENT TRUNCATE = 999999 JSON_TRIM_BRACES_IN_ARRAY_NAMES = true
... View more
08-25-2020
01:39 AM
Sorry for our misunderstanding and if I express myself badly. Your solution works great ! Thanks a lot for your help.
... View more
08-25-2020
12:36 AM
I think it is the chart command that filtering the result on fields account, month and total. account jan feb mar total c 1 4 7 12 d 2 5 8 15 e 3 6 9 18 And after this command, even if I call the fields platform in the table command I will never have the values of that field because of the chart filtering. Let me know if I am wrong. I am looking for a solution where I can add platform column after the chart in order to have this table : platform account jan feb mar total A c 1 4 7 12 A d 2 5 8 15 B e 3 6 9 18
... View more
08-24-2020
07:28 AM
I have already tried that query, and it returns empty cells because the | chart ... makes a filter on account, month, Total so that it is impossible to have "platform" at the end in the | table ....
... View more
08-24-2020
06:17 AM
Sorry I think you made a mistake in your answer because I already did that. What I want is at the end a table like that : | table platform, account, janv,feb,...,Total
... View more
08-24-2020
05:58 AM
OK thanks it correctly add at the end the end column platform ! Now, I want to create a request which gives me the following table : platform account jan feb mars ... Total A aaa A bbb B ccc B ddd I created a request that gave me a part of the solution : | inputlookup append=t first_csv.csv | lookup second_csv.csv account_number as id OUTPUT platform | search Year="2020" | search account=* | chart sum(Total) by account, Month useother=false | addtotals | table account,Jan,Feb,Mar,Apr,May,Jun,Jul,Aug,Total but how can I append the column platform like the table I want ? is it possible ?
... View more
08-24-2020
05:05 AM
Hi,
My issue is :
I want to link 2 different CSVs that have 1 column in common.
My first csv :
account
id
year
month
total
aaa
111
2020
jan
445
My second csv :
account_num
platform
111
zzz
The values of the header id in the first CSV corresponding to th value of account_num in the second CSV.
What I want is to link both csv with the id/account_num so that platform values (2nd csv) match to the right account (1st csv).
Is there a way to do this?
Thanks !
... View more
Labels
- Labels:
-
table
08-19-2020
11:59 PM
Hi, My issue is : I have a query which contains a "NetworkIterface" field: eni-12345, eni-6789, ... I have a lookup which contains the list of network interfaces whose ip are public: I want to be able to create a request which, by combining the search and the lookup, only shows the network interface whose ip are public only. I have a lookup like that : ENI Public IP eni-1234 192.10.10.10 eni-5678 192.10.10.11 eni-9012 192.10.10.12 My search is basic : Index=abc sourcetype=xyz NetworkInterface=* Thanks for your help !
... View more
08-11-2020
01:09 AM
Hi, My issue is : I have a panel like that : what I want is to change dynamically the color (red for example) when this is not equal to the curent time. I have my request like this : index=abc | stats count by Timestamp | eval epochtime=strptime(Timestamp, "%Y-%m-%dT%H:%M:%S.%N")| eval desired_time=strftime(epochtime, "%d/%m/%Y %H:%M:%S") | rename desired_time as timestamp | fields timestamp | sort timestamp desc | eval now = now() | fieldformat now = strftime(now, "%d/%m/%Y %H:%M:%S") | head 1 | where timestamp<now The format option is not useful in this case. How can I do this ? Thanks !
... View more
- Tags:
- visualisation
Labels
- Labels:
-
other
- « Previous
- Next »
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
01-05-2022
12:42 PM
|
