Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Are you a member of the Splunk Community?
Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- Find Answers
- :
- About anooshac
anooshac
Communicator
Member since:
11-26-2019
03-19-2025
Community Statistics
| Posts | 306 |
| Solutions | 2 |
| Karma Given | 10 |
| Karma Received | 1 |
| Member Since | 11-26-2019 |
Activity Feed
- Posted Re: How to download the result of a search in csv using rest api or curl command? on Dashboards & Visualizations. 02-20-2025 09:42 PM
- Posted Re: How to download the result of a search in csv using rest api or curl command? on Dashboards & Visualizations. 02-20-2025 02:35 AM
- Posted How to download the result of a search in csv using rest api or curl command? on Dashboards & Visualizations. 02-19-2025 07:40 PM
- Posted timechart count and stats count are not matching on Splunk Search. 12-19-2024 10:04 PM
- Tagged timechart count and stats count are not matching on Splunk Search. 12-19-2024 10:04 PM
- Posted Re: how to color a column with custome value? on Dashboards & Visualizations. 12-11-2024 08:30 PM
- Posted how to color a column with custome value? on Dashboards & Visualizations. 12-11-2024 07:47 PM
- Posted Combine 2 events by a matching field without using join. on Dashboards & Visualizations. 12-02-2024 04:11 AM
- Posted Re: Find the difference between 2 tables. on Dashboards & Visualizations. 11-22-2024 02:31 AM
- Posted Find the difference between 2 tables. on Dashboards & Visualizations. 11-22-2024 02:15 AM
- Posted Re: How to calculate the count of a field for multivalued data? on Dashboards & Visualizations. 10-15-2024 08:49 PM
- Posted How to calculate the count of a field for multivalued data? on Dashboards & Visualizations. 10-15-2024 03:25 AM
- Posted Re: Create a table with Json data on Dashboards & Visualizations. 10-07-2024 04:19 AM
- Posted Re: Create a table with Json data on Dashboards & Visualizations. 10-07-2024 04:02 AM
- Posted Re: Create a table with Json data on Dashboards & Visualizations. 10-07-2024 03:30 AM
- Posted Create a table with Json data on Dashboards & Visualizations. 10-07-2024 02:51 AM
- Posted Re: Macro not working while used in dashboard, while it is working in search bar. on Splunk Search. 09-19-2024 03:22 AM
- Posted Re: Macro not working while used in dashboard, while it is working in search bar. on Splunk Search. 09-18-2024 11:01 PM
- Posted Macro not working while used in dashboard, while it is working in search bar. on Splunk Search. 09-18-2024 10:09 PM
- Posted Re: what is the alternative command to use for mvzip? on Dashboards & Visualizations. 09-17-2024 09:43 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
10-25-2021
04:24 AM
Hi sir, Thank you so much for the reply.. It works great.. Is there any way that i can merge error and failed into a single column called status? So that i can represent status in a single column?
... View more
10-24-2021
10:32 PM
Hi all, I have a xml file as below. <?xml version="1.0" encoding="UTF-8"?> <suite name="abc" timestamp="20.08.2021 15:47:20" hostname="kkt2si" tests="5" failures="1" errors="1" time="0"> <case name="a" time="626" classname="x"> <failure message="failed" /> </case> <case name="b" time="427" classname="x" /> <case name="C" time="616" classname="y" /> <case name="d" time="626" classname="y"> <error message="error" /> </case> <case name="e" time="621" classname="x" /> </suite> The cases which doesnt have failure or errors are the ones which are passed. I am able to make a list of cases but i am confused how to add a column of the status. Anyone know the solution for this? |spath output=cases path=suite.case{@name}| table cases This is how i extracted the cases. I want to add a column which shows the status. Please suggest some answers.
... View more
Labels
- Labels:
-
field extraction
10-21-2021
10:40 PM
Hi all, I have a xml file as below. <?xml version="1.0" encoding="UTF-8"?> <suite name="abc" timestamp="20.08.2021 15:47:20" hostname="kkt2si" tests="5" failures="1" errors="1" time="0"> <case name="a" time="626" classname="x"> <failure message="failed" /> </case> <case name="b" time="427" classname="x" /> <case name="C" time="616" classname="y" /> <case name="d" time="626" classname="y"> <error message="error" /> </case> <case name="e" time="621" classname="x" /> </suite> The cases which doesnt have failure or errors are the ones which are passed. I am able to make a list of cases but i am confused how to add a column of the status. Anyone know the solution for this? |spath output=cases path=suite.case{@name}| table cases This is how i extracted the cases. I want to add a column which shows the status. Please suggest some answers.
... View more
- Tags:
- extraction
- spath
- xml
Labels
- Labels:
-
field extraction
09-24-2021
03:06 AM
Yeah.. Thank you.. Forgot to put a semicolon 🙂
... View more
09-23-2021
11:56 PM
Hi, thank you for the reply.. Trying that, but the '&' between the tokens is coming as invalid. Tried writing & too.. Still not working.. Do you know any solution for this?
... View more
09-23-2021
10:13 PM
Hi all, I have 2 dashboards. The first dashboard has a table with 6 columns. Currently i am passing a value from a column "name" as a drill down token to another dashboard. There is column "URL" of the "name". I want to pass the value of URL of the selected name as token to be used in the second dashboard. I don't know how to pass the URL of the selected name to the second dashboard. Tried setting the URL like this. But its not working. <drilldown> <link target="_blank">/app/abcd/dashboard1?name=$row.PName$</link> <set token="tok_url">$row.URL$</set> </drilldown> Can anyone help me in this..
... View more
09-23-2021
12:02 AM
Hello all, I haven't used rex many times. I have a URL like this, http;s://ab-abcd.in.xyz.com/abcd_xyz/job/example_name/" . Here ab-abcd.in.xyz.com is server name, abcd_xyz is project name and example_name is task name. I have to extract these using regex. I have tried using this query, |rex field=URL "https:\//(?<server_name>\w*)/\(?<project_name>\w*)\/job\/(?<task_name>\w*)\/"| table server_name project_name task_name I know that this query is wrong.But confused on how to correct it. Can anyone help me to correct this query.
... View more
08-08-2021
10:13 PM
No. How exactly should i use that?
... View more
08-08-2021
09:40 PM
source="abc_data1_*" index="testing" sourcetype="_json"
| transaction startswith=(STATUS="FAIL") endswith=(STATUS="SUCCESS") This is only my full search.
... View more
08-06-2021
07:29 AM
Hi sir, I am getting the events like this. only one event is older and the rest is new data. As you can see only first event is older.
... View more
08-06-2021
02:30 AM
Hi all, i have a query for transaction, source="abc_data1_*" index="testing" sourcetype="_json"
| transaction startswith=(STATUS="FAIL") endswith=(STATUS="SUCCESS") The events in the results are considered from most recent to oldest. But i want this transaction to consider the the older data first to the processing. I want the data to be sorted from the beginning and then apply the transaction. "Reverse" doesn't work with this.Anyone knows how to do this?
... View more
Labels
- Labels:
-
transaction
08-03-2021
12:12 AM
Hi Sir, Thanks for the response. I tried like this. source="abc_data1_*" index="testing" sourcetype="_json"
| transaction startswith=(STATUS="FAIL") endswith=(STATUS="SUCCESS") And i am able to get the events. But the search is not considering the data from the beginning, instead it is considering latest data first. It affects the results. How to make the transaction to read the data from the beginning? Like the order should be from old to new. I tried to sort by _time but its not changing.
... View more
08-02-2021
02:07 AM
I have another search for different requirement. The search is as follows and the result i get is as follows. But for the above query even the first line didn't generate anything. Not sure i'm doing it properly or not.
... View more
08-01-2021
11:51 PM
Hi Sir, Thanks for the reply. The first line itself doesn't give anything. I don't know if i am following the right path or not. Is there any different method exists to find the failed tasks and their respective immediate successful task?
... View more
08-01-2021
11:12 PM
Hi , Thanks for your response. I am sorry.. I tried running the query step by step, It is showing as no results. What i exactly want is the list of failed task and its immediate next successful task. And from that details i want to plot a graph. I think the approach im following is wrong.
... View more
07-30-2021
07:46 AM
Hi, thanks for the response.. I tried your solution but it didn't work. My requirement is to get duration of every failed task to a passed task. How much time the tool took to get a successful task after a failed task. Every failed task should have a time to recover. Previously i was doing everything manually. But now i am trying it to do by the Splunk query.Can you suggest anything to implement this? Thanks in advance.
... View more
07-29-2021
10:35 PM
Hello all, I have a dashboard and the source is json files. { "ID": "123", "TIME": "Jul 11, 2021, 08:55:54 AM", "STATUS": "FAIL", "DURATION": "4 hours, 32 minutes" } I have many tasks with ID and each task has json files. I want to plot a graph for MTTR( taken from each failed task to next successful task) for these tasks. Previously i was collecting data separately for the MTTR and the graph was plotted direclty from it. But now i have to calucalte MTTR from the above json files.(failed to passed task) and later i want to plot a graph for it. I tried writing a query for it but it's not working. source="*cc_as_sw_cx_kpi_GEEA_iB2_PSW_Int_csw_build_beta2_*" index="testing" sourcetype="_json" | transaction STATUS startswith="Status=FAIL" endswith="Status=SUCCESS"|stats avg(Duration) as avg_duration by STATUS | eval MTTR=tostring(avg_duration,"Duration") |timechart dc(MTTR) I know this not the proper query for it. can anyone please help me in this. I am trying this from few days and this was all i got. Thanks in advance.
... View more
Labels
- Labels:
-
timechart
-
transaction
07-29-2021
07:57 AM
yeah.. Got it! Thanks once again!!
... View more
07-29-2021
07:42 AM
Thank you so much!! It is working properly.. Can you please explain that query?
... View more
07-29-2021
05:03 AM
Hi all, I have a multiple json files. The format is like as below. { "ID": "123", "TIME": "Jul 11, 2021, 08:55:54 AM", "STATUS": "FAIL", "DURATION": "4 hours, 32 minutes", } From these json files i want to use the DURATION field and convert the value into hours. After that i want to use these values of all the json files to plot a graph. I have used regex to extract the value, but its not working. Below is the query that i have used. | rex field=DURATION "(?<duration_hour>\d*)hours, ?(?<duration_minute>\d*)minutes" | eval DURATION=duration_hour+(duration_minute)/60 can anyone please tell me what is mistake here?
... View more
07-21-2021
06:39 AM
okay.. Thank you so much!
... View more
07-21-2021
04:31 AM
#table .table thead th.string, .table tbody tr td.string{ text-align:center !important; } Is this the right way to do that? I am sorry if it has mistakes..
... View more
07-21-2021
04:08 AM
Thank you so much for this! its working properly.. I have one more doubt.. Same should be done for the non-numeric values too right? Because i want all the values to be aligned to the center..
... View more
07-21-2021
02:51 AM
yes.. I have a table with numeric and non-numeric values, together they look odd, is there any method by which i can align numeric and non-numeric to the same side?
... View more
07-21-2021
02:06 AM
The table header's alignments seem completely random. Some are aligned to the left and others are aligned to the right. Is there a way to make them all the same? I have already aligned the cells, but i am not getting how to align the header. Can anyone please help me in this?
... View more
Labels
- Labels:
-
table
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
03-19-2025
02:12 AM
|
