Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About aditsss
aditsss
Motivator
Member since:
08-16-2020
12-05-2023
Community Statistics
| Posts | 585 |
| Solutions | 0 |
| Karma Given | 118 |
| Karma Received | 7 |
| Member Since | 08-16-2020 |
Activity Feed
- Karma Re: how to extract below fields from raw logs for richgalloway. 12-05-2023 07:02 PM
- Karma Re: how to extract below fields from raw logs for gcusello. 12-05-2023 07:02 PM
- Karma Re: how to extract below fields from raw logs for inventsekar. 12-05-2023 07:01 PM
- Posted how to extract below fields from raw logs on Dashboards & Visualizations. 12-01-2023 11:19 AM
- Posted Re: Not getting incident from Splunk on time on Dashboards & Visualizations. 11-29-2023 11:44 PM
- Posted Re: Not getting incident from Splunk on time on Dashboards & Visualizations. 11-28-2023 11:45 PM
- Posted Re: Not getting incident from Splunk on time on Dashboards & Visualizations. 11-14-2023 11:39 PM
- Posted Re: Not getting incident from Splunk on time on Dashboards & Visualizations. 11-13-2023 11:12 PM
- Posted Re: Not getting incident from Splunk on time on Dashboards & Visualizations. 11-09-2023 01:07 PM
- Posted Re: Not getting incident from Splunk on time on Dashboards & Visualizations. 11-08-2023 11:05 PM
- Posted Not getting incident from Splunk on time on Dashboards & Visualizations. 11-08-2023 09:45 AM
- Posted How to fetch Error message from raw logs on Dashboards & Visualizations. 11-05-2023 08:13 AM
- Posted Re: How to include the result of both sourcetype on Dashboards & Visualizations. 11-05-2023 08:11 AM
- Posted How to include the result of both sourcetype on Dashboards & Visualizations. 11-05-2023 12:04 AM
- Posted How to not display a row if events are not there on Dashboards & Visualizations. 10-26-2023 08:28 AM
- Posted Re: Not getting correct time format in minutes on Dashboards & Visualizations. 10-26-2023 07:53 AM
- Posted Re: How to limit the instance for the fields according to drop down on Dashboards & Visualizations. 10-26-2023 07:52 AM
- Posted Re: Not getting correct time format in minutes on Dashboards & Visualizations. 10-26-2023 07:34 AM
- Posted Not getting correct time format in minutes on Dashboards & Visualizations. 10-26-2023 07:14 AM
- Posted Re: How to limit the instance for the fields according to drop down on Dashboards & Visualizations. 10-26-2023 06:53 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
10-01-2020
03:35 AM
Hi Everyone, Below are my logs: RID:492e0bd2-d3c4-4d28-a318-c4aee5f4e0-of1-team_a-dmrupload ARC_EL:ARC_1100: EVENT RECEIVED FROM SOURCE This is the RID 492e0bd2-d3c4-4d28-a318-c4aee5f4e0 that I have extracted from the logs: My search query: index=ABCns=XYZ app_name=api 22abe6c4-6eaf-4d47-8c4a-79b2594e Each RID has gone through different events like for this RID"22abe6c4-6eaf-4d47-8c4a-79b2594e" as we have seen in the below logs it has gone through the events like "ARC SUCCESSFULLY UPDATED RESPONSE BACK TO SOURCE OR SF" and "ARC SUCCESSFULLY RECEIVED RESPONSE FROM TARGET" etc. 2020-09-30T05:03:34.604056922Z app_name=ABC environment=e1ns=HJ pod_container=api pod_name=deployment-20-lmkq6 message=2020-09-29 22:03:34.602 INFO [blaze-arc-service,,,] 1 --- [ elastic-3] c.a.b.a.c.s.impl.SFCallbackService : RID:22abe6c4-6eaf-4d47-8c4a-79b2594ea612-of1-team_g ARC_EL:ARC_1600: ARC SUCCESSFULLY UPDATED RESPONSE BACK TO SOURCE OR SF 2020-09-30T05:03:34.604056922Z app_name=ABC environment=e1ns=HJ pod_container=api pod_name=deployment-20-lmkq6 message=2020-09-29 22:03:34.602 INFO [blaze-arc-service,,,] 1 --- [ elastic-3] c.a.b.a.c.s.impl.SFCallbackService : RID:22abe6c4-6eaf-4d47-8c4a-79b2594ea612-of1-team_g ARC_EL:ARC_1600: ARC SUCCESSFULLY RECEIVED RESPONSE FROM TARGET what I want is now when I click on one particular RID suppose as a hyperlink it should open the events and if the RID has gone through the events it should be right tick otherwise cross. Below are my events: ARC EVENT RECEIVED FROM SOURCE ARC FAILED TO INVOKE TARGET END POINT ARC SUCCESSFULLY RECEIVED RESPONSE FROM TARGET ARC FAILED TO RECEIVE RESPONSE FROM TARGET ARC SUCCESSFULLY UPDATED RESPONSE BACK TO SOURCE OR SF ARC FAILED TO UPDATE RESPONSE BACK TO SOURCE OR SF ARC FAILED TO DOWNLOAD FILE FROM SOURCE OR SF ARC S3 UPLOAD FAILED Is that possible in splunk? Can someone guide me on that.
... View more
Labels
- Labels:
-
simple XML
09-30-2020
02:24 PM
@ITWhisperer Thanks @ITWhisperer for your guidance. Yes its showing the correct count. There are some logs which contain the source with different pattern like: RID:5b23febe-1817-405d-8e7f-c4388feb9fbc-of1-team_b-ivurtupload 100: ARC EVENT RECEIVED FROM SOURCE So with the regex its only showing team_b-ivurtupload I want it should extract from here of1-team_b-ivurtupload For below logs the regex you give is working completely fine . I am able to get the source as of1-team_g that is what I want RID:22abe6c4-6eaf-4d47-8c4a-79b2594ea612-of1-team_g ARC_EL:ARC_1100: ARC EVENT RECEIVED FROM SOURCE I have mix logs . Can you provide me regex that will work for both? Also I not able to see RID my data is coming like this . RID is coming as blank. Can you guide me on this. index=ABC ns=XYZ app_name=api "ARC EVENT RECEIVED FROM SOURCE" | rex "RID:(?<RID>[\w-]+)-(?<sourceagent>\w+-\w+)" | stats count(RID) as count by sourceagent| rename sourceagent as "Source"|fields Source count sourceagent RID count of1-team_c 1 of1-team_d 4 of1-team_f 2 of1-team_g 2 team_a-dmrupload 1 team_b-ivurtupload 1 team_e-dmrupload 1
... View more
09-30-2020
12:22 PM
@ITWhisperer I don't have filter for pattern "ARC EVENT RECEIVED FROM SOURCE" How can I extract them in search query .Below are the Logs 2020-09-30T05:03:29.304428046Z app_name=abc environment=e1 ns=abc pod_container=api pod_name=api-deployment-20-lmkq6 message=2020-09-29 22:03:29.303 INFO [service,a79e96c3ef2c10c8,a79e96c3ef2c10c8,true] 1 --- [or-http-epoll-2] c.a.b.arc.controller.FileController : RID:22abe6c4-6eaf-4d47-8c4a-79b2594ea612-of1-team_g ARC_EL:ARC_1100: ARC EVENT RECEIVED FROM SOURCE Also I want to see the RID's. Currently its coming like this: My search query: index=ABC ns=XYZ app_name=GHJ | rex "RID:(?<RID>[\w-]+)-(?<source>\w+-\w+)" | stats count(RID) as count by source|fields source RID count This is not the source"/var/log/td-agent/tmp/containers.log" dont know why it is coming. source RID count /var/log/td-agent/tmp/containers.log 0 of1-team_c 3 of1-team_d 12 of1-team_f 16 of1-team_g 12 team_a-dmrupload 9 team_b-ivurtupload 7 team_e-dmrupload 11
... View more
09-30-2020
09:21 AM
Hi Everyone, I have one requirement. Below are my logs: 2020-09-30T05:03:29.304446Z app_name=api environment=e1c.a.b.controller.FileController : RID:22abe6c4-6eaf-4d47-8c4a-79b2594ea612-of1-team_g A_EL_1100: EVENT RECEIVED FROM SOURCE 2020-09-30T05:00:17.765656Z app_name=api environment=e1c.a.b.controller.FileController : RID:b0d5b62f-080f-4292-a2d1-4991123eecce-of1-team_f A_EL:ARC_1100: EVENT RECEIVED FROM SOURCE In the above logs I have field RID(RequestID) like this which is not extracted: RID:22abe6c4-6eaf-4d47-8c4a-79b2594ea612-of1-team_g RID:b0d5b62f-080f-4292-a2d1-4991123eecce-of1-team_f what I want is I want to display the RequestId from a particular source. Like for below RID source is of1-teamg and RequestId is 2abe6c4-6eaf-4d47-8c4a-79b2594ea612.Source is appended at the end of RID. RID:22abe6c4-6eaf-4d47-8c4a-79b2594ea612 of1-team_g(Source) For 2nd RID b0d5b62f-080f-4292-a2d1-4991123eecce-of1-team_f. The source is of1-team_f and RequestId is b0d5b62f-080f-4292-a2d1-4991123eecce. There are multiple Sources and requestId's. I want to display the number of requestId received from a particular source. I only want to display the number of requestId received from a particular source for this pattern "EVENT RECEIVED FROM SOURCE". Like for below example: 2020-09-30T05:03:29.304446Z app_name=api environment=e1c.a.b.controller.FileController : RID:22abe6c4-6eaf-4d47-8c4a-79b2594ea612-of1-team_g A_EL_1100: EVENT RECEIVED FROM SOURCE RID-22abe6c4-6eaf-4d47-8c4a-79b2594ea612 Source - of1-team_g Pattern - EVENT RECEIVED FROM SOURCE Nothing is extracted as of now. Can some one guide me with the search query Number of RequestId Received from source for particular pattern.
... View more
Labels
- Labels:
-
panel
-
simple XML
09-30-2020
05:12 AM
@ITWhisperer It works exactly the way I want. Thank you so much.
... View more
09-30-2020
04:29 AM
@ITWhisperer @gcusello I have not extracted it . It was coming in splunk selected fields. But its only picking the first. Not sure where I am going wrong. Can someone guide me.
... View more
09-30-2020
03:33 AM
Hi All, Below is my log data 2020-09-30T05:15:41.732035345Z app_name=api environment=2 ns=ab-c2 integrationType=PULL_GR_FILE_UPLOAD, integrationType=LR_JSON, callbackConfig, integrationType=PUSH_S3_GRS I made the search query like this: <query>index=abc ns=ab app_name=ui|stats count by integrationType</query> The issue I am facing is I am only getting first IntegartionType that is "PULL_GR_FILE_UPLOAD" and its count. Its not taking other integrationType. The log contains 2-3 integration type for a particular date. Can someone guide me where I am going wrong. Attached is the screenshot.
... View more
Labels
- Labels:
-
panel
09-29-2020
01:15 PM
Hi Everyone, I have one dashboard which consists of two Panels Failure and Failure Trend. I have one date range Indicator for which I have set Earliest time as -7d@d and latest time as @d. The Issue I am facing is when I load my dashboard for the first its taking the correct time (Earliest time as -7d@d and latest time as @d) and showing the data accordingly. But when I select some other presets say "Yesterday" and then again selecting last 7 days its picking time range as Earliest Time -7d@h and latest time as now due to which my data is decreasing. Can someone guide me on that. Below is my XML Code: <input type="time" token="field1" searchWhenChanged="true"> <label>Date/Time</label> <default> <earliest>-7d@d</earliest> <latest>@d</latest> </default> </input> <panel> <chart> <title>FAILURE TREND</title> <search> <query>index="ABC" sourcetype=XYZ FAILURE $OrgName$ | bin span=1d _time |stats count by _time</query> <earliest>$field1.earliest$</earliest> <latest>$field1.latest$</latest> <sampleRatio>1</sampleRatio> </search> <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option> <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option> <option name="charting.axisTitleX.visibility">visible</option> <option name="charting.axisTitleY.visibility">visible</option> <option name="charting.axisTitleY2.visibility">visible</option> <option name="charting.axisX.abbreviation">none</option> <option name="charting.axisX.scale">linear</option> <option name="charting.axisY.abbreviation">none</option> <option name="charting.axisY.scale">linear</option> <option name="charting.axisY2.abbreviation">none</option> <option name="charting.axisY2.enabled">0</option> <option name="charting.axisY2.scale">inherit</option> <option name="charting.chart">line</option> <option name="charting.chart.bubbleMaximumSize">50</option> <option name="charting.chart.bubbleMinimumSize">10</option> <option name="charting.chart.bubbleSizeBy">area</option> <option name="charting.chart.nullValueMode">gaps</option> <option name="charting.chart.showDataLabels">none</option> <option name="charting.chart.sliceCollapsingThreshold">0.01</option> <option name="charting.chart.stackMode">default</option> <option name="charting.chart.style">shiny</option> <option name="charting.drilldown">none</option> <option name="charting.layout.splitSeries">0</option> <option name="charting.layout.splitSeries.allowIndependentYRanges">0</option> <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option> <option name="charting.legend.mode">standard</option> <option name="charting.legend.placement">right</option> <option name="charting.lineWidth">2</option> <option name="trellis.enabled">0</option> <option name="trellis.scales.shared">1</option> <option name="trellis.size">medium</option> </chart> </panel> <panel> <single> <title>FAILURE</title> <search> <query>index="ABC" sourcetype=XYZ FAILURE $OrgName$ | bin span=1d _time | stats count by _time | eventstats first(_time) as firsttime last(_time) as lasttime | where _time = firsttime OR _time = lasttime | fields _time count </query> <earliest>$field1.earliest$</earliest> <latest>$field1.latest$</latest> </search> <option name="colorBy">trend</option> <option name="drilldown">all</option> <option name="height">100</option> <option name="numberPrecision">0</option> <option name="trendDisplayMode">percent</option> <option name="unit"></option> <option name="rangeValues">[0,10,25,40]</option> <option name="rangeColors">["0xFF0000","0xFF0000","0xFF0000","0xFF0000","0xFF0000"]</option> <option name="trendColorInterpretation">inverse</option> <option name="useColors">1</option> <option name="showSparkline">1</option> <option name="trendDisplayMode">percent</option> </single> </panel>
... View more
09-29-2020
05:02 AM
@ITWhisperer Thank you once again . It works exactly the way I want.
... View more
09-29-2020
02:43 AM
@ITWhisperer I tried like below . Not able to get any result Where I am going wrong! index=abc ns=sigh nodeException node="*" Id=* |rex field="message=(?P<datetime>\d{4}-\d{2}-\d{2}\s\d{2}:\d{2}:\d{2}\.\d+)\s"|fields datetime
... View more
09-29-2020
02:14 AM
Hi Everyone, Below is my data( raw logs) pod_name=node-fdzz message=2020-09-25 21:09:33.969 ERROR [node,00e,4deca,false]67 --- [r-84-548] c.r.Resolver How do I extract Date and time 2020-09-25 21:09:33.969 from the above log data? Can anyone guide me on this.
... View more
09-28-2020
03:26 PM
@ITWhisperer Your are the best . It works like a magic. Thank you so much for this solution.
... View more
09-27-2020
11:24 AM
@ITWhisperer Can you please guide me on below. I need to complete this ASAP. In the first scenario if we select 15th Sep to 18th Sep from date range . Then it would be something like this: URL count1(15thSep) count2(18thSep) diff "/lightning/page/home" 60 40 -20 Only the first day count and the last day count and their difference no other day in between. How can we calculate first day count and last day count and their difference. Dates with counts Search time Date to compare 16 and 17 15 - 18 15th and 18th counts and their difference(No other day counts in between) 16 and 17 15 - 17 15th and 17th counts 16 and 17 16 - 18 16th and 18th counts 16 15 - 17 15th and 17th counts 16 16 - 17 16th and 17th counts 16 15 - 16 15th and 16th counts.
... View more
09-27-2020
03:12 AM
@ITWhisperer Thanks you for all your guidance. Your suggestions always worked. In the first scenario if we select 15th Sep to 18th Sep from date range . Then it would be something like this: URL count1(15thSep) count2(18thSep) diff "/lightning/page/home" 60 40 -20 Only the first day count and the last day count and their difference no other day in between. Dates with counts Search time Date to compare 16 and 17 15 - 18 15th and 18th counts and their difference(No other day counts in between) 16 and 17 15 - 17 15th and 17th counts 16 and 17 16 - 18 16th and 18th counts 16 15 - 17 15th and 17th counts 16 16 - 17 16th and 17th counts 16 15 - 16 15th and 16th counts.
... View more
09-26-2020
01:05 PM
@ITWhisperer Can you please guide me on this. I need to complete this ASAP. It would be a great help from your side. Your suggestions always work for me please provide your guidance here. Lets just take the example if I select date range from 15th Sep to 17th Sep. I just want 15th Sep and 17th Sep URL's count and their difference and not 16th Sep URL's count. I don't want any 16th Sep URL's count nor the difference of 15th Sep And 16th Sep URLS' count. I want to display the counts of all URL's that are present on 15th Sep and 17th Sep and their difference. I want first day count and last day count and their difference not any other day in between. In this example I want Count1 should be15th Sep and Count2 should be 17th Sep and then their difference. Is their any way to achieve this. Something like below: URL count1(15thSep) count2(17thSep) diff "/lightning/page/home" 60 40 -20 Can you guide me how to achieve this <input type="time" token="field1" searchWhenChanged="true"> <label>Date/Time</label> <default> <earliest>-7d@d</earliest> <latest>@d</latest> </default> </input> <table> <title>Timeout Exceptions</title> <search> <query>index="ABC" sourcetype=XYZ Timeout* | bin span=1d _time | stats count by PAGE_URL _time | eventstats first(_time) as firsttime last(_time) as lasttime by PAGE_URL | where _time = firsttime OR _time = lasttime | autoregress count p=1 | eval count_p1=if(_time = firsttime,0,count_p1) | where _time = lasttime | eval diff=count_p1 - count | rename count as count1, count_p1 as count2 | fields PAGE_URL count1 count2 diff | sort diff</query> <earliest>$field1.earliest$</earliest> <latest>$field1.latest$</latest> </search> <option name="count">100</option> <option name="refresh.display">progressbar</option> </table>
... View more
09-26-2020
02:17 AM
Hi ITWhisperer, Can you please guide me on this. I need to complete this ASAP. It would be a great help from your side. Your suggestions always work for me please provide your guidance here. Lets just take the example if I select date range from 15th to 17th Sep. I just want 15th Sep and 17th Sep URL's count and not 16th Sep URL's . I don't want 16th Sep URL's . Count1 should be15th Sep and Count2 should be 17th Sep and then their difference. I don't want any 16th Sep URL's nor the difference of 15th And 16th Sep URLS' count. I want first day count and last day count and their difference not any other day in between. Is their any way to achieve this. Something like below: URL count1(15thSep) count2(17thSep) diff "/lightning/page/home" 60 40 -20 Can you guide me how to achieve this <input type="time" token="field1" searchWhenChanged="true"> <label>Date/Time</label> <default> <earliest>-7d@d</earliest> <latest>@d</latest> </default> </input> <table> <title>Timeout Exceptions</title> <search> <query>index="ABC" sourcetype=XYZ Timeout* | bin span=1d _time | stats count by PAGE_URL _time | eventstats first(_time) as firsttime last(_time) as lasttime by PAGE_URL | where _time = firsttime OR _time = lasttime | autoregress count p=1 | eval count_p1=if(_time = firsttime,0,count_p1) | where _time = lasttime | eval diff=count_p1 - count | rename count as count1, count_p1 as count2 | fields PAGE_URL count1 count2 diff | sort diff</query> <earliest>$field1.earliest$</earliest> <latest>$field1.latest$</latest> </search> <option name="count">100</option> <option name="refresh.display">progressbar</option> </table>
... View more
09-25-2020
11:35 PM
Hi ITWhisperer, Can you please guide me on below. I need to complete this ASAP. It would be a great help from your side as your suggestions always works for me. Lets just take the example if I select date range from 15th to 17th Sep. I just want 15th and 17th URL's count and not 16th Sep URL's . I don't want 16th Sep URL's . Count1 should be15th Sep and Count2 should be 17th Sep and then their difference. I don't want any 16th Sep URL's nor the difference of 15th And 16th Sep. Is their any way to achieve this. Something like below: URL count1(15thSep) count2(17thSep) diff "/lightning/page/home" 60 40 -20 Can you guide me how to achieve this <input type="time" token="field1" searchWhenChanged="true"> <label>Date/Time</label> <default> <earliest>-7d@d</earliest> <latest>@d</latest> </default> </input> <table> <title>Timeout Exceptions</title> <search> <query>index="ABC" sourcetype=XYZ Timeout* | bin span=1d _time | stats count by PAGE_URL _time | eventstats first(_time) as firsttime last(_time) as lasttime by PAGE_URL | where _time = firsttime OR _time = lasttime | autoregress count p=1 | eval count_p1=if(_time = firsttime,0,count_p1) | where _time = lasttime | eval diff=count_p1 - count | rename count as count1, count_p1 as count2 | fields PAGE_URL count1 count2 diff | sort diff</query> <earliest>$field1.earliest$</earliest> <latest>$field1.latest$</latest> </search> <option name="count">100</option> <option name="refresh.display">progressbar</option> </table>
... View more
09-25-2020
02:32 PM
Hi ITWhisperer, Lets just take the example if I select date range as 15th to 17th Sep. I just want 15th and 17th URL's count and not 16th Sep URL's . I don't want 16th Sep URL's . Count1 should be15th Sep and Count2 should be 17th Sep and then their difference. I don't want any 16th Sep URL's nor the difference of 15th And 16th Sep. Is their any way to achieve this. Something like below: URL count1(15thSep) count2(17thSep) diff "/lightning/page/home" 60 40 -20 Can you guide me how to achieve this <input type="time" token="field1" searchWhenChanged="true"> <label>Date/Time</label> <default> <earliest>-7d@d</earliest> <latest>@d</latest> </default> </input> <table> <title>Timeout Exceptions</title> <search> <query>index="ABC" sourcetype=XYZ Timeout* | bin span=1d _time | stats count by PAGE_URL _time | eventstats first(_time) as firsttime last(_time) as lasttime by PAGE_URL | where _time = firsttime OR _time = lasttime | autoregress count p=1 | eval count_p1=if(_time = firsttime,0,count_p1) | where _time = lasttime | eval diff=count_p1 - count | rename count as count1, count_p1 as count2 | fields PAGE_URL count1 count2 diff | sort diff</query> <earliest>$field1.earliest$</earliest> <latest>$field1.latest$</latest> </search> <option name="count">100</option> <option name="refresh.display">progressbar</option> </table>
... View more
09-25-2020
01:13 PM
Hi ITWhisperer, This solution is awesome . Its calculating the 1st and last count and their difference . Just need your one more guidance. The issue I am facing is when I select suppose15th Sep to 17th Sep from date Range drop-down. Its also displaying the URL's that are present on 16th Sep as well .Also if URL's are not present on 17th Sep and its present on 16th Sep and 15th Sep then its calculating the difference of 16th Sep and 15th Sep . I don't want 16th Sep URL's to display nor any difference of 16th Sep and 15th Sep. If I select say15th Sep to 17th Sep then it should take all the URL's of 15th Sep and 17th Sep (1st day count and last day count and their difference)not the 16th Sep URL's. If the URL's are present on both 15th Sep and 17th Sep then in that case it should be like this: URL count1(15thSep) count2(17thSep) diff "/lightning/page/home" 60 40 -20 If the URL is only present on 15th Sep and not on 17th Sep then in that case it should be like this: URL count1(15thSep) count2(17thSep) diff "/lightning/page" 60 0 -60 If the URL is only present on 17th Sep and not on 15th Sep then in that case it should be like this: URL count1(15thSep) count2(17thSep) diff "/lightning/page" 0 60 60 If I select from 15th September to 17th September then it should show all the URL's of 15th September and 17th September not of 16th September. If I select from 14th September to 19th September then it should only show URL's counts of 14th Sep and 19th Sep and their difference(Not any other day in between like 15thSep,16thSep etc). I want the first day count and last day count and their difference whatever date range I select. Also it should be non-zero count means if I select last 7 days that is 16th Sep to 22nd Sep and there is no data for 22nd Sep (0 data) then in that case the Counts will be of 16th Sep and 21st Sep(the one which contains data). URL count1(16thSep) count2(21stSep) diff "/lightning/page" 80 90 10 Can you guide me on this. Thanks in advance My current XML Code: <input type="time" token="field1" searchWhenChanged="true"> <label>Date/Time</label> <default> <earliest>-7d@d</earliest> <latest>@d</latest> </default> </input> <table> <title>Timeout Exceptions</title> <search> <query>index="ABC" sourcetype=XYZ Timeout* | bin span=1d _time | stats count by PAGE_URL _time | eventstats first(_time) as firsttime last(_time) as lasttime by PAGE_URL | where _time = firsttime OR _time = lasttime | autoregress count p=1 | eval count_p1=if(_time = firsttime,0,count_p1) | where _time = lasttime | eval diff=count_p1 - count | rename count as count1, count_p1 as count2 | fields PAGE_URL count1 count2 diff | sort diff</query> <earliest>$field1.earliest$</earliest> <latest>$field1.latest$</latest> </search> <option name="count">100</option> <option name="refresh.display">progressbar</option> </table>
... View more
09-23-2020
10:33 PM
Hi ITWHisperer, Is that possible . Can you please guide me on this. Thanks in advance.
... View more
09-23-2020
10:24 PM
Hi ITWHisperer, Is that possible . Can you please guide me on this. Thanks in advance.
... View more
09-23-2020
12:26 PM
Hi ITWhisperer, The below script is working correctly but only for the last and previous day. Means when I select two days say 15th Sep and 16th Sep then its showing correct counts and their difference so this is fine. But suppose I select 16th Sep to 19th Sep then its taking count of 18th Sep and 19th Sep means the last day and previous day . I want to calculate the 1st count and the last count and their difference whatever time range I select. So suppose I select 16th Sep to 19th Sep then in this case it should show the count of 16th Sep and count of 19th Sep and their difference . So suppose I select last 7 days from date picker that is 16th Sep to 22nd Sep then it should show the count of 16th Sep and 22nd Sep and their difference. In short I want First count and last count and their difference whatever time range I select. Also it should be non-zero count means if I select last 7 days that is 16th Sep to 22nd Sep and there is no data for 22nd Sep (0 data) then in that case the Counts will be 16th Sep and 21st Sep(the one which contains data). Can you please suggest me on this. Thanks in advance. </input> <table> <title>Timeout Exceptions</title> <search> <query>index="ABC" sourcetype=XYZ Timeout* | bin span=1d _time | stats count by PAGE_URL _time | eval tomorrow=_time+(60*60*24) | eval time=mvappend(_time,tomorrow) | mvexpand time | eval count=if(time=tomorrow,0,count) | eval _time=time | fields - time tomorrow | autoregress count p=1 | eventstats first(_time) as firsttime by PAGE_URL | eval count_p1=if(_time = firsttime,0,count_p1) | stats sum(count) as count sum(count_p1) as count_p1 by PAGE_URL, _time | addinfo | where _time=relative_time(info_max_time-1,"@d") | eval diff=count_p1 -count | rename count as count1, count_p1 as count2 | fields PAGE_URL count1 count2 diff | sort diff</query> <earliest>$field1.earliest$</earliest> <latest>$field1.latest$</latest> </search> <option name="count">100</option> <option name="refresh.display">progressbar</option> </table>
... View more
09-23-2020
11:54 AM
Hi ITWhisperer, The below script is working correctly but only for the last and previous day. Means when I select two days say 15th Sep and 16th Sep then its showing correct counts and their difference so this is fine. But suppose I select 16th Sep to 19th Sep then its taking count of 18th Sep and 19th Sep means the last day and previous day . I want to calculate the 1st count and the last count and their difference whatever time range I select. So suppose I select 16th Sep to 19th Sep then in this case it should show the count of 16th Sep and count of 19th Sep and their difference . So suppose I select last 7 days from date picker that is 16th Sep to 22nd Sep then it should show the count of 16th Sep and 22nd Sep and their difference. In short I want First count and last count and their difference whatever time range I select. Also it should be non-zero count means if I select last 7 days that is 16th Sep to 22nd Sep and there is no data for 22nd Sep (0 data) then in that case the Counts will be 16th Sep and 21st Sep(the one which contains data). Can you please suggest me on this. Thanks in advance. index="ABC" sourcetype=XYZTimeout* | bin span=1d _time | stats count by PAGE_URL _time /* create an event for following day with count = 0 */ | eval tomorrow=_time+(60*60*24) | eval time=mvappend(_time,tomorrow) | mvexpand time | eval count=if(time=tomorrow,0,count) | eval _time=time | fields - time tomorrow /* autoregress to get previous day's count */ | autoregress count p=1 /* set previous day's count to 0 for the first event for the PAGE_URL */ | eventstats first(_time) as firsttime by PAGE_URL | eval count_p1=if(_time = firsttime,0,count_p1) /* join the daily counts together */ | stats sum(count) as count sum(count_p1) as count_p1 by URL, _time /* only keep the event for the last day of the query time */ | addinfo | where _time=relative_time(info_max_time-1,"@d") /* calculate the difference between the counts for the last day and the previous day */ | eval diff=count_p1 - count | rename count as count1, count_p1 as count2 | fields PAGE_URL count1 count2 diff | sort diff
... View more
09-22-2020
08:15 AM
Hi ITWhisperer, Sorry for all the changing requirements . I dont want the count_p1 to zero . My requirement is like somewhat like this: With the below query I am able to display the correct difference between the counts . The only issue here is its only displaying the URL's which is present in both the days . There are some URL's which are present on 15th sep but not 16th of sep or vice versa. I want to show them as well like suppose there is one URL "/page/view" whose count is 2 and its present only on 15th september but its not present on 16th then I want to display like this.Either we can keep 16th september count as blank or we can keep 0 there so the difference will be 2 only. URL count 15th sep count 16thsep diff /page/view 2 2 The below Script was working correctly but its only showing the URL's which are present on both days.I want to show all the URL's. index="ABC" sourcetype=XYZTimeout* | bin span=1d _time | stats count by PAGE_URL _time | autoregress count | eventstats first(_time) as firsttime by PAGE_URL | where _time != firsttime | eval diff=count_p1 - count | rename count as count1, count_p1 as count2 | fields PAGE_URL count1 count2 diff|sort diff
... View more
09-22-2020
06:31 AM
Hi ITWhisperer, Thank you ITWhisperer once again for your wonderful suggestion. Its removing the first URL that's correct. But its only showing the URL's which is present on both days 15th sep and 16th sep. There are some URL's which is present on 15th September but they are not present on 16th September or vice versa. I want like if the particular URL is present on 15th September and 16th September then it should show the count on 15th sep say 120 and 16th sep it should be "0" or blank . so the difference will be 120 only. Can you guide me how can I achieve this index="ABC" sourcetype=XYZ Timeout* | bin span=1d _time | stats count by PAGE_URL _time | autoregress count | eventstats first(_time) as firsttime by PAGE_URL | where _time != firsttime | eval diff=count_p1 - count | rename count as count1, count_p1 as count2 | fields PAGE_URL count1 count2 diff|sort diff
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
12-05-2023
08:04 PM
|
Karma given to
