About sjringo

sjringo · ‎11-12-2023

I had to re-think the way I was showing my job info in the UI as a orphaned Transaction could mean two different things. i.e. 'running' start with no end message or multiple starts along with modifying my initial SPL to look for an aborted message when a failure occurred. It was quite a learning experience is I went through all different permutations of keeporphans=true/false keepevicted=true/false and then look at the ending transaction data. I did notice that closed_txn defaults to null and not 0 and had to write some code to make it default to 0. eval closed_txn = if ( isnull(closed_txn,0, closed_txn) search closed_txn=0 to find those transactions that only has a START log event... Thanks for all you input as it gave me a different perspective from the way I was looking at it. I was also to rewrite some of my existing SPL to have fewer lines.

sjringo · ‎11-10-2023

Ok, my SPL is getting smaller.. But here is what is happening with the current scenario im testing with. I have 3 jobs. Two ran with no issues, each has a start & complete log event (No issues) The 3rd job has two start events and one complete event. Since it failed once, was restarted and then completed. When I use: | Transaction keeporphans=true host batchName startwith="start" endswith="completed" I end up with three transaction where closed_txn=1 and one where closed_txn is not defined or 0... for a total of 4 transactions. But, what I want to see in the resulting table is all jobs that have run to completion (closed_txn=1) and then any jobs that are currently running (closed_txn=0) or not defined. How would I go about eliminating from my results the 4th transaction when I have another transaction with the same jobName that has closed_txn=1 and then not remove it (since its still running) when I dont have a tranaction that has closed_txn=1 ? My Events: aJobName1 START aJobName2 START aJobName1 COMPLETE aJobName3 START aJobName2 START aJobName3 COMPLETE aJobName2 COMPLETE

sjringo · ‎11-10-2023

This seemed to work by adding | sort -_time | head 1 i.e. index=anIndex sourcetype=aSourcetype aJobName AND "START of script" | sort -_time | head 1 | append [ index=anIndex sourcetype=aSourcetype aJobName AND "COMPLETED OK" ] The way I understood sort 0 is that it forces all event but in this scenario there should not be more than a handfull. I think I saw the limit without the 0 was 10,000? So, I think this worked but need to do some additional testing. For what im working on I have 3 jobs that im trying to track and each has a different jobName so I ended up writing the initial query as: index=anIndex sourcetype=aSourcetype aJobName1 AND "START of script" | sort -_time | head 1 | append [ search index=anIndex sourcetype=aSourcetype aJobName1 AND "COMPLETED OK" ] | append [ search index=anIndex sourcetype=aSourcetype aJobName2 AND "START of script" | sort -_time | head 1 | append [ index=anIndex sourcetype=aSourcetype aJobName2 AND "COMPLETED OK" ]] | append [ search index=anIndex sourcetype=aSourcetype aJobName3 AND "START of script" | sort -_time | head 1 ] | append [ index=anIndex sourcetype=aSourcetype aJobName3 AND "COMPLETED OK" ]] Is there a better way to write this besides using three appends ? I cant use one append and then | head 3 for the Start query as one of the jobs multipe STARTS could kick out a START event from one of the other jobs depending upon when the jobs start...

sjringo · ‎11-10-2023

The keepevicted=true kind of works for one of the scenarios. The way it works under normal conditions (no errors) there will be only one Start and one Complete event except when a job has started and not ended due to it currently running... When there is an exception, the job was restarted and completed with no additional errors. I have from newest to oldest (Completed, Start, Start) or multiple starts depending upon how many errors caused it to abort. When currently running (Start only, or multiple starts) with no complete Then to add more to this. I am not looking for just one job but multiple, each wih its unique job name and creating the transaction using the job name and then there could be multiple jobs currently running... Instead of using Transaction im thinking I might need to do a join with the first query looking for events with the jobName and Started. The 2nd query looking for jobName and Completed, but then having multple starts for a jobName would cause problems on the join?

sjringo · ‎11-10-2023

I have a working query that uses Transaction to find the Starting / Ending log event. I am trying to make some changes but Transaction is not working as I expected. In my current working example I am looking for a 'job name' and then the starting and ending log event. In my current code I am using one query: index=anIndex sourcetype=aSourcetype aJobName AND ("START of script" OR "COMPLETED OK"). This works fine when there are no issues but now if a job fails there will be multiple "START of script" and only one 'COMPLETED OK' event. So, I tried reworking my query to be as follows to only get the most recent of either the start / completed log event. index=anIndex sourcetype=aSourcetype aJobName AND "START of script" | head 1 | append [ index=anIndex sourcetype=aSourcetype aJobName AND "COMPLETED OK" | head 1 ] But when I get to the part of creating a transaction the transaction only has the Starting log event ? | rex "(?<event_name>(START of script)|(COMPLETED OK))" | eval event_name=CASE(event_name="START of script", "script_start", event_name="COMPLETED OK", "script_complete") | eval event_time=strftime(_time, "%Y-%m-%d %H:%M:%S") | eval {event_name}_time=_time | rex field=_raw "Batch::(?<batchJobName>[^\s]*)" | transaction keeporphans=true host batchJobName startswith=(event_name="script_start") endswith=(event_name="script_complete") Is the use of | append [...] the cause ? If append cannot be used for transaction what other way can I get the data Im looking for ?

sjringo · ‎11-06-2023

I guess I was trying to overcomplicate things. Its starting to make more sense now working through all of these different scenarios. Thanks for the explination...

sjringo · ‎11-06-2023

Here is what I am attempting to do: I am trying to calculate the distinct count of the 'type' of users that are active. In my log files all of my users have a user name that follows this pattern: ABCD.aUserName I am trying to calculate how many distinct users there are that are active for each 'type' where in the above example ABCD is the type. First looking for high level approach ideas and want to dig into it myself to see what I can get to work but I just am not able to wrap my noodle around how to even approach it ? I can extract the 'type' and the 'username' but if I have two extracted fields how do I correlate the two to be able to perform a count of dc(usernames) by type ?

sjringo · ‎10-26-2023

Im really not sure what this is doing. I incorporated it into my code and was not what I was expecting. I have also shifted my efforts to using a span=15m for my timechart command due to some other calculations that are on the dashboard I am working on that using a span/bucket smaller than 15 minutes does not represent the data in the way the user(s) are expecting. So, my next question (I can start a new thread if needed) is that using a span=15m for an hour sample of four 15 min buckets. But, the buckets are at the 15 min mark of each hour and do not start from when the query is run. i.e. Buckets = 0-15, 15-30, 30-45, 45-00. Is there an option on timechart to force it to start at the current minute ? I found in the documentation a reference to <snap-to-time> but dont understand how to use it.

sjringo · ‎10-25-2023

What I am trying to do is graph / timechart active users. I am starting with this query: index=anIndex sourcetype=perflogs | rex field=_raw "^(?:[^,\n]*,){2}(?P<LoginUserID>\w+\.\w+)" | timechart distinct_count(LoginUserID) partial=false This works and the resulting graph appears to be correct for 120 mins resulting in 5min time buckets. Then if I shorten the time period down to 60 mins resulting in 1 min buckets then I have a question. In the 120 min graph with 5 min buckets @ 6:40-6:45 I have 318 Distinct Users but in the 90 min graph with 1 min buckets each 1 min bucket has 136, 144, 142, 131, 117 Distinct Users. I understand that a user can be active one minute and inactive the next min or two and then active again on the 4th/5th min which is what is happening? My question is how to get this to show across the one minute bin's users that were active in the previous 5, 1 min buckets resulting in a # that represents users that are logged in and not just active ? I believe I can add minspan=5min as a kludge but am wondering if there is a way to get this do what im trying to show at the 1min span ? I believe what I need to do is run two queries the first one as is above, then use an append that will query for events from -5min to -10min. But, from what I have been trying it either is not working or not doing it correctly. Basically im trying to find those userID's that are active in the first time bucket (1 min) that were also active in the previous time bucket(s) then do a distinct_count(..) on the usersID's collected from both queries ?

sjringo · ‎10-05-2023

Yup, I was trying to do the BY _time after each count ((...)) AS ... by _time instead of doing it after the very last one... I knew I was close I just was not seeing it !!!

sjringo · ‎10-05-2023

I have a query that gives me four totals for a month. I am trying to figure out how to show each four total for each day searched ? Here is what I have so far: index=anIndex sourcetype=aSourcetype "SFTP upload finished" OR "File sent to MFS" OR "File download sent to user" OR "HTTP upload finished" earliest=-0month@month latest=now | bucket _time span=day | stats count(eval(searchmatch("SFTP upload finished"))) as SFTPCount count(eval(searchmatch("File sent to MFS"))) as MFSCount count(eval(searchmatch("File download sent to user"))) as DWNCount count(eval(searchmatch("HTTP upload finished"))) as HTTPCount | table SFTPCount MFSCount DWNCount HTTPCount SFTPCount MFSCount DWNCount HTTPCount 30843 535 1584 80 Now to show the results by each day ? I have a line to specify my bucket ?

sjringo · ‎09-06-2023

What I have done is to add these lines at the end of my query, from my initial testing it works. Is this what you were getting at ? | eval hour=strftime(now(),"%H") | eval weekday=strftime(now(),"%w") | where NOT (hour IN (13,14)) AND weekday != 0 This would not generate any results if its Sunday between 1 AM through 2:59 AM ?

sjringo · ‎09-06-2023

I have an idea and am looking for some input on how to approach it, where to start. As mentioned in the subject. I do not want an alert to be triggered if lets say its Sunday between 1-2 AM. I cannot do this via CRON so looking for an alternative solution. Questions/Thoughts: (1) What is the best/simplest way to get from Splunk the Day and Hour (2) Once I get day & hour how should I incorporate that into my existing alert query. Should I create a var to indicate outage or not (0/1) (3) Once I determine if I am in an outage (1) is there an easy way to force the alerts results to = 0 I know there are going to be many questions so fire away and I will try to explain or answer the best I can as there are many alerts im trying to make this work for and they are all slightly different in their implementation...

sjringo · ‎08-26-2023

Here is what I am proposing as a manual workaround to pause some alerts but not all alerts during an release weekend / evening and looking for some input. We have several alerts that routinely are being triggered when there is a release due to no logins, missing data, etc... I cant 'break' the Splunk emailer as there are other apps that are not doing a release. If I identify those alerts that need to be disabled during a release I would like to name them so that they are easily identified in the Alert search tab. What I am thinking of doing is adding a character at the end of the alert name that makes it obvious that it is one of these 'special' alerts so that other alerts not needing to be disabled are not disable inadvertently. Does anyone know of any issues with using the 'registered trademark' character in the alert name ? ALT 0174 = ® Then, when searching for alerts I would search for all alerts that include: *®*, disable them, then do the same and enable them once the release is over..

sjringo · ‎07-15-2023

The only reason I mentioned staying away from subsearches and/or joins is that when I was reading other posts with similar questions or looking for a similar solution I kept seeing comments to stay away from it. I actually stumbled across a different 'solution' which was to use: set diff [..] using two overlapping time frames. 1st timeframe is -32 to now, 2nd is -32 to -17. then removing duplicates and then doing a stats count(LoginUserID) by host I wanted to get all three 'solutions' working and then compare the results to see if the all were the same which they are. My queries are not running long nor am I worried about performance. I prefer less code so I am leaning toward giving 'credit' to your first solution even though PickleRicks also does the same job with a few more 'steps' and PickleRick has helped me in the past so I have to figure a way to recognize both of your time/effort !!!

sjringo · ‎07-15-2023

My mistake. I had modified the query/code and it was giving me false results. What I am working on now is that I have the results. i.e. Host, Period, LoginUserID X,first_half, user1 X, second_half, user2 X, second_half, user1 Im not interested in specific users, just the total for each host. Or the difference between the two period's? i.e. Users that are active in the second_half that did not exist in the first_half

sjringo · ‎07-15-2023

Im working through this and have a question about one line. | eval period=if( time < relative_time(now(),"-17m@m"),"first_half","second_half") In this line what is "time" ? I am aware of _time and have made the necessary changes to get my query to run with results. I have changed the query to use "time" and "_time" and both return the same results ?

sjringo · ‎07-14-2023

I have been trying to figure this out but getting stumped. I have seen other questions similar but just slightly different. I have read from other posts to try to not use outer join's ? I have two queries that are executing the same query just over two different time frames and I want to find only those UserID's that exists in Query1 but not in Query2 which would tell me the user is currently active but was not active before... Query 1: index=anIndex sourcetype=aSourceypte earliest=-17m@m latest=-2m@m | rex field=_raw "^(?:[^,\n]*,){2}(?P<LoginUserID>\w+\.\w+)" | dedup host LoginUserID | sort host LoginUserID | table host LoginUserID Query2: index=anIndex sourcetype=aSourceypte earliest=-32m@m latest=-17m@m | rex field=_raw "^(?:[^,\n]*,){2}(?P<LoginUserID>\w+\.\w+)" | dedup host LoginUserID | sort host LoginUserID | table host LoginUserID Been trying to figure out a way to use the count of the occurrences of LoginUserID and if it = 1 then that tells me it only exists in one query but stumped there too. Am I close or thinking about this the wrong way ?

sjringo · ‎05-19-2023

Getting results using your updated TSTATS query. I am going to need a little time to compare data from both queries and mash up the results just to figure out if both results are returning the same results, etc... But the speed of the query results is better. a few seconds compared to 15 minutes !!! TSTATS is still a little bit fuzzy but having something that works will help me going forward... Thanks for your help ...

sjringo · ‎05-18-2023

Ok, I had to massage your posting somewhat to work with what I was looking for. I am aware of TSTATS but struggling to get it to work for the query that I am starting with ? Here is what I have working: index=anIndex earliest=-4d latest=now | eval recent=if(_time>(now()-129600 ),1,0) ```<--- No Logs in 1.5 Days ``` | stats max(_time) AS max_time count(eval(recent=1)) AS CurrentCount count(eval(recent=0)) AS HistoricalCount BY sourcetype host | where ( (CurrentCount < 1 AND HistoricalCount > 0) OR ( CurrentCount > 0 AND HistoricalCount < 1)) ```<--- Missing & New``` | eval status=case(CurrentCount > 0 AND HistoricalCount > 0, "OK", CurrentCount < 1 AND HistoricalCount > 0, "MISSING", CurrentCount > 0 AND HistoricalCount < 1, "NEW", 1=1,"Unknown" ) | eval lastTime=strftime(max_time, "%m/%d/%y %H:%M:%S") | sort sourcetype | rename status AS Status, host AS Host, sourcetype AS "Source Type", CurrentCount AS "Log Entries in 1.5 Days", HistoricalCount AS "Log Entries over 1.5 Days", lastTime AS "Last Log Entry" | table Status Host "Source Type" "Log Entries in 1.5 Days" "Log Entries over 1.5 Days" "Last Log Entry" Any help in getting it to work with TSTATS would be appreciated...

sjringo · ‎05-18-2023

I found the following search to identify Missing / New sourcetypes and made a few changes. I am getting data and my next enhancement is to add the latest date/time a sourcetype was 'seen'. Here is the search I am starting with: index=anIndex earliest=-4d latest=now | eval recent=if(_time>(now()-129600 ),1,0) ```<--- No Logs in 1.5 Days ``` | stats count(eval(recent=1)) AS CurrentCount count(eval(recent=0)) AS HistoricalCount BY sourcetype host | where ( (CurrentCount < 1 AND HistoricalCount > 0) OR ( CurrentCount > 0 AND HistoricalCount < 1)) ```<--- Missing & New``` | eval status=case(CurrentCount > 0 AND HistoricalCount > 0, "OK", CurrentCount < 1 AND HistoricalCount > 0, "MISSING", CurrentCount > 0 AND HistoricalCount < 1, "NEW", 1=1,"Unknown" ) | sort sourcetype | table status host sourcetype CurrentCount HistoricalCount I think this is returning the last time a sourcetype was seen: index=anIndex earliest=-2d latest=now | stats max(_time) as last_searched by sourcetype host | eval lastTime=strftime(last_searched, "%m/%d/%y %H:%M:%S") | sort sourcetype host | table host sourcetype lastTime But, when I try to add these two lines into my original query I do not get any data ? | stats max(_time) as last_searched by sourcetype host | eval lastTime=strftime(last_searched, "%m/%d/%y %H:%M:%S") I have tried placing it in several different places but always get 'No Results found...' What am I missing ?

sjringo · ‎05-17-2023

Shortly after I posted this I made a change to the one line in question to add eval(recent=1) and eval(recent=0) | stats count(eval(recent=1)) as CurrentCount count(eval(recent=0)) as HistoricalCount by sourcetype host I am now getting the results that I expected.

sjringo · ‎05-17-2023

Sorry to ask questions on such an old post but interested in this piece of code but not sure that it is working correctly. | stats count(recent==1) as CurrentCount count(recent==0) as HistoricalCount by sourcetype host I would have expected to get a bunch of results where CurrentCount and HistoricalCount are greater than 0. When I modified this to look at my data I get zeros for Current and Historical counts ?

sjringo · ‎03-10-2023

I was looking at the data being returned for this version and have a question. I removed | where count=2 and in my results data I then see 3 series, here is an example of the data. I ran this query at 10:40 AM and received these results. Time Range / range total 10:10 - 10:20 / 438 10:20 - 10:30 / 1642 10:30 - 10:40 / 1474 Total = 3554 Since I am looking at 10 minute time buckets. I ran the query again at 10:50 AM and got these results. I expected the last row to move to the middle. Middle row to the first row and to get a new row as the last but instead this is the data I received. 10:20 - 10:30 / 406 10:30 - 10:40 / 1860 10:40 - 10:50 / 1601 Total = 3867 Is this working as expected or am I missunderstanding something ?

sjringo · ‎03-09-2023

This works too !!! I like that the snap to on earliest / latest uses whole 10 minute time periods ( if that is the correct term ? ) I compared the results from your solution to @Tom_Lundie and got the same results so both are valid solutions. I cant accept two solutions so how should I go about giving 'credit' to both of you ?

Posts	95
Solutions	4
Karma Given	29
Karma Received	10
Member Since	‎09-08-2021

Online Status	Offline
Date Last Visited	‎03-03-2025 01:03 PM

How to count based upon relative_time ?

How to get events that have only a starting 'strin...

Transaction with start & end with the same time in...

Visualization's label ellipses: ellipsesNone ?

Dashboard Studio, how to show token 'label' instea...

How to find the most recent log event for each use...

Does Transaction work with append [ ... ] ?

Input on how to perform a search, field extraction...

Timechart and auto bin sizing

Stats Count by day ?

Re: Does Transaction work with append [ ... ] ?

Re: Does Transaction work with append [ ... ] ?

Re: Does Transaction work with append [ ... ] ?

Re: Does Transaction work with append [ ... ] ?

Does Transaction work with append [ ... ] ?

Re: Input on how to perform a search, field extrac...

Input on how to perform a search, field extraction...

Re: Timechart and auto bin sizing

Timechart and auto bin sizing

Re: Stats Count by day ?

Stats Count by day ?

Re: Set alert search results to 0 or have my query...

Set alert search results to 0 or have my query not...

What is the Manual work around for Pausing/disabli...

Re: UserID exists in query 1 but not query 2 by ho...

Re: UserID exists in query 1 but not query 2 by ho...

Re: UserID exists in query 1 but not query 2 by ho...

UserID exists in query 1 but not query 2 by host ?

Re: Finding max(_time) for sourcetypes & host by s...

Re: Finding max(_time) for sourcetypes & host by s...

How to find max(_time) for sourcetypes & host by s...

Re: How to Monitor missing sourcetypes/hosts

Re: How to Monitor missing sourcetypes/hosts

Re: Comparing two consecutive time chunks of event...

Re: Comparing two consecutive time chunks of event...

Join the Conversation