Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- Find Answers
- :
- About aditsss
aditsss
Motivator
Member since:
08-16-2020
11-21-2024
Community Statistics
| Posts | 599 |
| Solutions | 0 |
| Karma Given | 118 |
| Karma Received | 7 |
| Member Since | 08-16-2020 |
Activity Feed
- Posted How to fetch the word from logs on Dashboards & Visualizations. 11-21-2024 02:43 AM
- Posted Re: How to fetch a word from logs on Dashboards & Visualizations. 11-18-2024 03:24 AM
- Posted Re: How to fetch a word from logs on Dashboards & Visualizations. 11-18-2024 03:11 AM
- Posted Re: How to fetch a word from logs on Dashboards & Visualizations. 11-13-2024 08:55 PM
- Posted Re: How to fetch a word from logs on Dashboards & Visualizations. 11-13-2024 06:57 AM
- Posted Re: How to sort on multiple values on Dashboards & Visualizations. 11-13-2024 02:42 AM
- Posted Re: How to fetch a word from logs on Dashboards & Visualizations. 11-12-2024 10:25 PM
- Posted Re: How to sort on multiple values on Dashboards & Visualizations. 11-12-2024 07:53 PM
- Posted Re: How to sort on multiple values on Dashboards & Visualizations. 11-12-2024 11:28 AM
- Posted Re: How to sort on multiple values on Dashboards & Visualizations. 11-12-2024 08:42 AM
- Posted Re: How to sort on multiple values on Dashboards & Visualizations. 11-12-2024 07:09 AM
- Posted How to fetch a word from logs on Dashboards & Visualizations. 11-12-2024 07:08 AM
- Posted Re: How to sort on multiple values on Dashboards & Visualizations. 11-12-2024 06:32 AM
- Posted How to sort on multiple values on Dashboards & Visualizations. 11-12-2024 05:42 AM
- Karma Re: how to extract below fields from raw logs for richgalloway. 12-05-2023 07:02 PM
- Karma Re: how to extract below fields from raw logs for gcusello. 12-05-2023 07:02 PM
- Karma Re: how to extract below fields from raw logs for inventsekar. 12-05-2023 07:01 PM
- Posted how to extract below fields from raw logs on Dashboards & Visualizations. 12-01-2023 11:19 AM
- Posted Re: Not getting incident from Splunk on time on Dashboards & Visualizations. 11-29-2023 11:44 PM
- Posted Re: Not getting incident from Splunk on time on Dashboards & Visualizations. 11-28-2023 11:45 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
10-26-2023
08:28 AM
Hi Team,
I am using below query:
[search index="abc" sourcetype =600000304_gg_abs_ipc2 source="/amex/app/gfp-settlement-raw/logs/gfp-settlement-raw.log" "ReadFileImpl - ebnc event balanced successfully"
| eval True="✔"
| bin _time span=1d
| dedup _time
| eval EBNCStatus="ebnc event balanced successfully"
| table EBNCStatus True
I want if there are no events than message "ebnc event balanced successfully" should not get displayed.
Can someone guide me on that
... View more
10-26-2023
07:53 AM
@ITWhisperer
I am using same in my query but not getting correct starttime and end time
query:
index="abc"sourcetype =600000304_gg_abs_ipc2 source="/amex/app/gfp-settlement-raw/logs/gfp-settlement-raw.log" | rex "TRIM\.CNX(CTR)?\.(?<TRIM_ID>\w+)"
| transaction TRIM_ID startswith="Reading Control-File /absin/TRIM.CNXCTR." endswith="Completed Settlement file processing, TRIM.CNX."
|eval StartTime=min(_time)|eval EndTime=StartTime+duration|eval duration_min=floor(duration/60) |rename duration_min as TRIM.CNX_Duration| table StartTime EndTime TRIM.CNX_Duration| sort +StartTime +EndTime| fieldformat ProcessingStartTime = strftime(ProcessingStartTime, "%F %T.%3N")| fieldformat ProcessingEndTime = strftime(ProcessingEndTime, "%F %T.%3N")
... View more
10-26-2023
07:52 AM
Thanks @ITWhisperer for this help
... View more
10-26-2023
07:34 AM
@ITWhisperer How can I put it in my query can you please guide.
... View more
10-26-2023
07:14 AM
Hi All,
I have created below query:
search index="abc"sourcetype =600000304_gg_abs_ipc2 source="/amex/app/gfp-settlement-raw/logs/gfp-settlement-raw.log" | rex "TRIM\.CNX(CTR)?\.(?<TRIM_ID>\w+)"
| transaction TRIM_ID startswith="Reading Control-File /absin/TRIM.CNXCTR." endswith="Completed Settlement file processing, TRIM.CNX."
|eval StartTime=min(_time)|eval EndTime=StartTime+duration|eval duration_min=floor(duration/60) |rename duration_min as TRIM.CNX_Duration| table StartTime EndTime TRIM.CNX_Duration| sort +StartTime +EndTime]| fieldformat ProcessingStartTime = strftime(ProcessingStartTime, "%F %T.%3N")| fieldformat ProcessingEndTime = strftime(ProcessingEndTime, "%F %T.%3N")| table starttime EndTime
I am not getting the correct time I am getting in below format:
start time - 1697809010.604
EndTime - 1697809075.170
I want it in this format:
StartTime - 2023-10-20 02:16:56.629
EndTime - 2023-10-20 02:19:57.554
Can someone help me here.
... View more
10-26-2023
06:53 AM
@ITWhisperer
I tried below query
index="600000304_d_gridgain_idx*" sourcetype =600000304_gg_abs_ipc2 source="/amex/app/gfp-settlement-raw/logs/gfp-settlement-raw.log" "ReadFileImpl - ebnc event balanced successfully"
| eval True="✔"
| bin _time span=1d
| dedup _time
| eval EBNCStatus="ebnc event balanced successfully"
| table EBNCStatus True
When I am selecting last 7 days its showing 8 events instead of 7
... View more
10-26-2023
05:37 AM
@ITWhisperer I don't want to do anything if none of the events from a particular day have searchmatch yes , I just want the events where searchmatch("ebnc event balanced successfully") is true. But I want when I am selecting last 7 days it should show last 7 events only 1 event per day I want. So if it would be last 7 days it will look something like this:(only 7 events) EBNCStatus true ebnc event balanced successfully ✔ ebnc event balanced successfully ✔ ebnc event balanced successfully ✔ ebnc event balanced successfully ✔ ebnc event balanced successfully ✔ ebnc event balanced successfully ✔ ebnc event balanced successfully ✔
... View more
10-26-2023
05:10 AM
@ITWhisperer I have 60 events but I want when I select last 7 days from date drop down It should display only 7 results If I select last 30 days it should display only 30 results. current query index="abc" sourcetype =600000304_gg_abs_ipc2 source="/amex/app/gfp-settlement-raw/logs/gfp-settlement-raw.log" "ReadFileImpl - ebnc event balanced successfully" | eval True=if(searchmatch("ebnc event balanced successfully"),"✔","") | eval EBNCStatus="ebnc event balanced successfully" | table EBNCStatus True @ITWhisperer can you please guide
... View more
10-26-2023
04:48 AM
@ITWhisperer I want two columns only but currently when I am selecting last 7 days its coming more that 7. If I used dedup command its showing only 1 I want when I select last 7 days it should show only last 7 days I am selecting last 7 days its showing 60 statistics . query index="abc" sourcetype =600000304_gg_abs_ipc2 source="/amex/app/gfp-settlement-raw/logs/gfp-settlement-raw.log" "ReadFileImpl - ebnc event balanced successfully" | eval True=if(searchmatch("ebnc event balanced successfully"),"✔","") | eval EBNCStatus="ebnc event balanced successfully" | table EBNCStatus True PFA attached screenshot.
... View more
10-26-2023
04:07 AM
Hi Team, I am using below query: index="abc" sourcetype =600000304_gg_abs_ipc2 source="/amex/app/gfp-settlement-raw/logs/gfp-settlement-raw.log" "ReadFileImpl - ebnc event balanced successfully" | eval True=if(searchmatch("ebnc event balanced successfully"),"✔","") | eval EBNCStatus="ebnc event balanced successfully" | table EBNCStatus True when I selecting last 7 days its showing multiple columns . I want the value to be displayed according to drop down selected like last 7 days last 30 days. Can someone please guide me here
... View more
09-19-2023
05:39 AM
@gcusello Can you guide me with this query how can I use it index="abc" sourcetype =$Regions$ source="/amex/app/gfp-settlement-raw/logs/gfp-settlement-raw.log" "ReadFileImpl - ebnc event balanced successfully" | eval True=if(searchmatch("ebnc event balanced successfully"),"✔","") | eval EBNCStatus="ebnc event balanced successfully",Day=strftime(_time,"%Y-%m-%d")| dedup EBNCStatus Day|search EBNCStatus=* | table EBNCStatus True Day
... View more
09-19-2023
03:28 AM
@gcusello I tried with below query still one extra row is coming index="abc" sourcetype =$Regions$ source="/amex/app/gfp-settlement-raw/logs/gfp-settlement-raw.log" "ReadFileImpl - ebnc event balanced successfully" | eval True=if(searchmatch("ebnc event balanced successfully"),"✔","") | eval EBNCStatus="ebnc event balanced successfully",Day=strftime(_time,"%Y-%m-%d")| dedup EBNCStatus Day|search EBNCStatus=* | table EBNCStatus True Day
... View more
09-19-2023
03:25 AM
@gcusello How can I used Group By command here .Can you please guide.
... View more
09-19-2023
02:33 AM
@gcusello @richgalloway Below is the query search index="abc" sourcetype =$Regions$ source="/amex/app/gfp-settlement-raw/logs/gfp-settlement-raw.log" "ReadFileImpl - ebnc event balanced successfully" | eval True=if(searchmatch("ebnc event balanced successfully"),"✔","")|head 7 | eval EBNCStatus="ebnc event balanced successfully" | table EBNCStatus True |rename busDt as Business_Date |rename fileName as File_Name |rename CARS.UNB_Duration as CARS.UNB_Duration(Minutes) |table Business_Date File_Name StartTime EndTime CARS.UNB_Duration(Minutes) Records totalClosingBal totalRecordsWritten totalRecords EBNCStatus |sort -Business_Date The issue I am facing is when I am sorting with -businessDate businessDate is coming correct but startTime AND EndTime is not coming correct For example in below screenshot for BusinessDate 09/11 startTime and EndTime is coming as 09/13 it should be 09/12. @gcusello @richgalloway please guide
... View more
09-18-2023
04:02 AM
Hi Team, Below is my query search index="abc" sourcetype =$Regions$ source="/amex/app/gfp-settlement-raw/logs/gfp-settlement-raw.log" "ReadFileImpl - ebnc event balanced successfully"
| eval True=if(searchmatch("ebnc event balanced successfully"),"✔","")|head 7
| eval EBNCStatus="ebnc event balanced successfully"
| table EBNCStatus True ]
|rename busDt as Business_Date
|rename fileName as File_Name
|rename CARS.UNB_Duration as CARS.UNB_Duration(Minutes)
|table Business_Date File_Name StartTime EndTime CARS.UNB_Duration(Minutes) Records totalClosingBal totalRecordsWritten totalRecords EBNCStatus
|sort -Business_Date I am sorting on the basis of business date but my startTime and EndTime is not coming correct. Can someone guide me Below is the screenshot for the same
... View more
09-14-2023
09:29 AM
@gcusello I tried below query index=abc sourcetype =600000304_gg_abs_ipc2 source="/amex/app/gfp-settlement-raw/logs/gfp-settlement-raw.log" "ReadFileImpl - ebnc event balanced successfully" | eval True=if(searchmatch("ebnc event balanced successfully"),"✔","") | eval EBNCStatus=*"ebnc event balanced successfully",Day=strftime(_time,"%Y-%m-%d") | dedup EBNCStatus Day | search column1=* | table EBNCStatus True Day Getting below error Error in 'EvalCommand': The expression is malformed. An unexpected character is reached at '*"ebnc event balanced successfully",Day=strftime(_time,"%Y-%m-%d")'.
... View more
09-14-2023
07:53 AM
@gcusello where I need to put this EBNCStatus=* Below is my query: index="abc" sourcetype =600000304_gg_abs_ipc2 source="/amex/app/gfp-settlement-raw/logs/gfp-settlement-raw.log" "ReadFileImpl - ebnc event balanced successfully" | eval True=if(searchmatch("ebnc event balanced successfully"),"✔","") | eval EBNCStatus="ebnc event balanced successfully",Day=strftime(_time,"%Y-%m-%d")| dedup EBNCStatus Day | table EBNCStatus True Day
... View more
09-14-2023
07:14 AM
@gcusello This query is not working for me index="abc" sourcetype =600000304_gg_abs_ipc2 source="/amex/app/gfp-settlement-raw/logs/gfp-settlement-raw.log" "ReadFileImpl - ebnc event balanced successfully" | eval True=if(searchmatch("ebnc event balanced successfully"),"✔","") | eval EBNCStatus=*"ebnc event balanced successfully",Day=strftime(_time,"%Y-%m-%d")| dedup EBNCStatus Day | table EBNCStatus True Day
... View more
09-14-2023
05:28 AM
@gcusello Apologies the query is working but I am getting one additional row . My query: search index="abc" sourcetype =$Regions$ source="/amex/app/gfp-settlement-raw/logs/gfp-settlement-raw.log" "ReadFileImpl - ebnc event balanced successfully" | eval True=if(searchmatch("ebnc event balanced successfully"),"✔","") | eval EBNCStatus="ebnc event balanced successfully",Day=strftime(_time,"%Y-%m-%d")| dedup EBNCStatus Day | table EBNCStatus True Day
... View more
09-14-2023
05:17 AM
@gcusello yes but with that I am only getting two message I have selected last 7 days and I am getting only two. I want if I select last 7 it should show 7 message when I select yesterday it should show 1 message.
... View more
09-14-2023
05:10 AM
@gcusello Can you please guide me on this .
... View more
09-14-2023
03:28 AM
@gcusello I have selected last 7 days but its showing only 2 with below query index="abc" sourcetype =$Regions$ source="/amex/app/gfp-settlement-raw/logs/gfp-settlement-raw.log" "ReadFileImpl - ebnc event balanced successfully" | eval True=if(searchmatch("ebnc event balanced successfully"),"✔",""), EBNCStatus="ebnc event balanced successfully", Day=strftime(_time,"%Y-%m-%d") | dedup EBNCStatus Day | table EBNCStatus True Day
... View more
09-14-2023
03:07 AM
@gcusello Currently when I am doing dedup and selecting last 7 days its showing only event. I want when I select last 7 days it should show 7 times that message. when I select last 30 days it should 30 times that message. Can you help me with this.
... View more
09-14-2023
01:55 AM
Hi Team, I have below query: index="abc" sourcetype =$Regions$ source="/amex/app/gfp-settlement-raw/logs/gfp-settlement-raw.log" "ReadFileImpl - ebnc event balanced successfully" | eval True=if(searchmatch("ebnc event balanced successfully"),"✔","") | eval EBNCStatus="ebnc event balanced successfully"|dedup EBNCStatus | table EBNCStatus True I am deduping my EBNC status so when I am selecting date Filter as yesterday its showing one count but when I am selecting 7 days from date filter still showing one count. I want when I select 7 its should show 7 count . Can someone help me with this,
... View more
09-06-2023
04:53 AM
Hi @richgalloway I tried with this query but not able to see any result: index="abc" sourcetype =$Regions$ source="/amex/app/gfp-settlement-raw/logs/gfp-settlement-raw.log" "StatisticBalancer - statisticData: StatisticData" |rex "totalOutputRecords=(?<totalOutputRecords>),busDt=(?<busDt>),fileName=(?<fileName>),totalAchCurrOutstBalAmt=(?<totalAchCurrOutstBalAmt>),totalAchBalLastStmtAmt=(?<totalAchBalLastStmtAmt>),totalClosingBal=(?<totalClosingBal>),totalRecordsWritten=(?<totalRecordsWritten>),totalRecords=(?<totalRecords>)" | where fileName="TRIM.UNB.D082923.T045920" |table busDt fileName totalAchCurrOutstBalAmt totalAchBalLastStmtAmt totalClosingBal totalRecordsWritten totalRecords
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
11-21-2024
10:28 PM
|
Karma given to
