About sieutruc

sieutruc · ‎01-10-2013

Hello, In order to do pdf reporting for an advanced XML dashboard, i would like to reuse the PDF Report Server app, but when installing it, i don't see any option "Use PDF Report Server box" on system setting -> Email alert settings. So is there anybody knows how to setup to reuse that PDF Report Server app ? My OS is Opensuse 64b.

sieutruc · ‎01-08-2013

Thanks, yes i did one of both separately, but got no success too

sieutruc · ‎01-08-2013

Hello, When i trigger a search like: host="win20_oslo-ifs_CC-DC" index="sqlobj" | multikv | eval BusinessEpoch=strptime(BusinessDay,"%m/%d/%Y %I:%M:%S %p") | eval _time=BusinessEpoch | table _time It gives a table of _time field that is converted from BusinessDay, but if i use: host="win20_oslo-ifs_CC-DC" index="sqlobj" | multikv | eval BusinessEpoch=strptime(BusinessDay,"%m/%d/%Y %I:%M:%S %p") | eval _time=BusinessEpoch | search earliest=-1d latest=now | table _time I've got no result , and i tried several times by changing the value of earliest or lastest but couldn't be successful. Can you suggest me what to do ?

sieutruc · ‎12-20-2012

It's good for their color in 2 figure as Splunk automatically detects them, but for alignment, you can see my extra added information with figures above

sieutruc · ‎12-20-2012

You can see clearly what are not lining up in 2 figures. The first is the Y axis' scale value and second is number of transaction types for each day, especially on 31/10/2012, there is no event 10 in the first figure. So how to fix X axis width for their vertical alignment, let transaction types be appearing similarly in 2 figures?

sieutruc · ‎12-18-2012

No, what i want is 2 column charts that have the same vertical alignment, so that i can see clearly how many event of one particular transaction type in one specific day, and its sum value corresponding.

sieutruc · ‎12-18-2012

Hello, I have a search like : total value of each transaction type for each business day host="test1" sourcetype="ObjTransaction" | chart sum(TransactionValue) over BusinessDay by TransactionType and another is number of events of each transaction type for each business day host="test1" sourcetype="ObjTransaction" | chart count as number over BusinessDay by TransactionType How can i display 2 colunm chars such that they have same vertical alignment basing on BusinessDay( time with unit is day) and have the same color for each TransactionType ? For ex: In column chart of number of events of each business day,on the 10/12/2012: there are 2 transactions A and B A has blue color and its number of events is 10, B has red color and its number of events is 20 In column chart of total value of each businessday, similarly, A, B have the same color as previous chart, means A in blue color with its value is 102$, et B in red color with its value = 80$

sieutruc · ‎12-17-2012

Yeah, it's worked. This charset has to be set on HF. Thanks

sieutruc · ‎12-13-2012

Yeah, data is forwarded by the following order:UniversalForwarder -> HeavyForwarder -> Indexer , i think it would be right setting charset in indexer, but iam still getting that issue

sieutruc · ‎12-13-2012

It's so strange. When i viewed search results in indexer on Firefox, the data seemed to be well displayed, but with Chrome it showed like "x001x002x00/x001x002x00/x0.....", but in 2 cases, i cannot use any report command to create table from them. The data's encoding is UTF-16LE.

sieutruc · ‎12-12-2012

Hello, When i monitored a file , at first its content is forwarded from forwarder to indexer in text format, so i can make a table with that content. But after the system has updated that file by deleting it and creating a new same-name file with different content, I see that Splunk indexes its new data in binary format 5:21:47.000 PM \x001\x002\x00/\x001\x002\x00/\x001\x002\x00 \x001\x008\x00:\x000\x005\x00:\x001\x007\x00,\x00 \x000\x000\x003\x002\x009\x00 \x00[\x000\x00x\x000\x007\x00E\x004\x00]\x00 \x00=\x00>\x00[\x00T\x00R\x00A\x00N\x00S\x00A\x00C\x00T\x00I\x00O\x00N\x00I\x00N\x00F\x00O\x00 However, i can open this file in notepad and view its content without any issue. So can you tell me what is the problem i have got ?

sieutruc · ‎12-10-2012

sorry for my mistake :), it's worked now , thanks for your help

sieutruc · ‎12-10-2012

My rising column is modifiedTime, do i need to replace $rising_column$ by modifiedTime to have SELECT * FROM mytable WHERE modifiedTime < dateadd(minute,1,getdate()) {{AND modifiedTime > ?}} ORDER BY modifiedTime ?? (MSSQL)

sieutruc · ‎12-10-2012

Hello, My table doesn't have column with an inreasing value totally. It has ID, but that ID changes such that it often increases and sometimes decrease (but its value is unique), so i think it's not appropriate to be a rising column. There is another timestamp field,it often increases and sometimes keeps the same value when 2 events arrive at the same time. So my question is how to monitor my table ? Is that timestamp field possible to be rising column ? I need your help .

sieutruc · ‎12-07-2012

Hello, I have a small question about incremented values field that is used to keep track new events in table. in my table there is field ID_temp that increases 1 when new event comes, but it'll get back to 0 when it reaches 100. And after that there might be 2 events with the same ID_temp, so does the new one like to be a new event when Splunk sees it ? Another thing is if i have incremented values field that also inscreases when there is new imcoming event , but sometimes that field keeps not change its value, for ex: 2 events arrive at the same time so the arriving time is the same for both. Are they indexed all by Splunk ?

sieutruc · ‎11-30-2012

as i specified in my question, fillnull value=NULL doesn't work. It only works in case there is at least one value of the field is not empty, but if all the value of that field are empty , it doesn't work

sieutruc · ‎11-30-2012

Hello, When i did a search on my SQL data, there are a lot of empty-value fields, which don't contain anything, i want to fill them up with value " " , but i cannot find any efficient method to achieve that. I tried fillnull function , but it didn't work through. If i do it by hand, like eval field=case(isnull(field)," ",NOT isnull(field),field) it works, but if there are nearly 100 fields, it's impossible. So can you suggest me a solution for that ?

sieutruc · ‎11-26-2012

i don't know whether it's totally correct, when i upgrade all Splunk instances in my system \ to Version 5, all would be solved.

sieutruc · ‎11-22-2012

Hello, When i indexed a XML file in local machine (Splunk version 5) with option CHECK_MODE=xml for sourtype "test_XML" , i saw clearly the fields that Splunk extracted, in the left hand, have the formats such as: table{@id} , table.content{@text} ... But if i use splunk Universal Forwarder to forward that file to indexer (both have version 4.3.4), with CHECK_MODE=xml for that sourcetype, what i got in the left hand were : id, text... and i couldn't get any new field even using spath too. Can you tell me what is the problem ? The file is just one-lien long xml format.

sieutruc · ‎11-20-2012

i tested it, it doesn't work , 😞 sourcetype=text_xml_as|xpath outfield=test "//content_table/table2"|table test{@BUSINESS_ENTITY_1}

sieutruc · ‎11-20-2012

What i mean is to reduce content_table.table2 to only one field and use it to reference to its children field or its properties. For example: test:=content_table.table2 test{@BUSINESS_ENTITY_1} gives a result

sieutruc · ‎11-20-2012

Hello, I get difficult when manipulating XML field name, if i use like: sourcetype="test_xml_as" | table content_table.table2{@BUSINESS_ENTITY_1} It gave me desired result, but if i use rename function as: sourcetype="test_xml_as" | rename content_table.table2 as test | table test{@BUSINESS_ENTITY_1} This search hasn't any result. The reason that i want to use rename is to reduce some internal XML field name that are very long. So anyone can tell which function i should use to reduce XML field name ?

sieutruc · ‎11-17-2012

I tried CHECK_METHOD=modtime but it didn't work. Have you tested it before ?

sieutruc · ‎11-16-2012

In fact, i use your tool Sideview Utils and can do what you said. I just want to get my desired table above; and when doing drilldown, i use only $click.fields.type$ . And what do you mean "array-valued and you'd need some pretty advanced stuff to try and tease them apart." How can i find those stuffs ? Is it possible using variable as $click.fields.type$ in javascript ?

sieutruc · ‎11-15-2012

Hello, I have data which has maximum 8 types, associating with each type, there are maximum 4 status. When i use: ...| stats count by type type1 count type4 count type8 count ...| stats count by status status1 count status2 count status3 count status4 count But my boss wants me to display like type1 count status1 count Percent status2 count Percent status3 count Percent status4 count Percent type4 count status1 count Percent status2 count Percent status3 count Percent status4 count Percent type8 count ... Which count of all status equals count of specific type, and percent field is defined as countPerStatus/countOfTypeX (X=1...8) How can i archieve that in Splunk ? And what is the value of $click.value$ in this case ?

Posts	119
Solutions	3
Karma Given	14
Karma Received	26
Member Since	‎08-07-2012

Online Status	Offline
Date Last Visited	‎06-05-2020 02:03 AM

merge two events which have different fields but t...

Is there an alternative to using regex in my searc...

Transaction with different values of the same fiel...

How to replace integrated pdf server of Splunk 5 w...

Cannot use earliest and latest for _time field new...

Display 2 charts at the same timing alignment and ...

Splunk indexes text file in binary format ?

Database table doesn't have rising column totally?

Question about Auto incremented values field in DB...

How to detect and fill default value to empty-valu...

How to replace integrated pdf server of Splunk 5 w...

Re: Cannot use earliest and latest for _time field...

Cannot use earliest and latest for _time field new...

Re: Display 2 charts at the same timing alignment ...

Re: Display 2 charts at the same timing alignment ...

Re: Display 2 charts at the same timing alignment ...

Display 2 charts at the same timing alignment and ...

Re: Splunk indexes text file in binary format ?

Re: Splunk indexes text file in binary format ?

Re: Splunk indexes text file in binary format ?

Splunk indexes text file in binary format ?

Re: Database table doesn't have rising column tota...

Re: Database table doesn't have rising column tota...

Database table doesn't have rising column totally?

Question about Auto incremented values field in DB...

Re: How to detect and fill default value to empty-...

How to detect and fill default value to empty-valu...

Re: CHECK_MODE=xml doesn't work ?

CHECK_MODE=xml doesn't work ?

Re: How to rename XML field name into shorter name...

Re: How to rename XML field name into shorter name...

How to rename XML field name into shorter name ?

Re: How to use CHECK_METHOD in Univsersal Forwarde...

Re: How to create result table in result table (Ad...

How to create result table in result table (Advanc...

Join the Conversation