Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About ckunath
ckunath
Communicator
Member since:
03-30-2017
06-05-2020
Community Statistics
| Posts | 46 |
| Solutions | 4 |
| Karma Given | 13 |
| Karma Received | 1 |
| Member Since | 03-30-2017 |
Activity Feed
- Karma Re: Align all values of a table to the left (for PDF export) for gcusello. 06-05-2020 12:49 AM
- Karma Re: How do I use the reverse command to change the order of my table? for cmerriman. 06-05-2020 12:49 AM
- Karma Re: Convert YYYYMMDD number to DD.MM.YYYY format for richgalloway. 06-05-2020 12:49 AM
- Karma Re: Compare field values with field values from events before for woodcock. 06-05-2020 12:48 AM
- Karma Re: Save value of a field of one event and compare it with all other found events for gcusello. 06-05-2020 12:48 AM
- Karma Re: Save value of a field of one event and compare it with all other found events for gcusello. 06-05-2020 12:48 AM
- Karma Re: Compare two field values and get matching third value from table for lguinn2. 06-05-2020 12:48 AM
- Karma Re: Create a table that shows last 5 days and timestamps of found events each day for HiroshiSatoh. 06-05-2020 12:48 AM
- Karma Re: Can't manage the data that is getting forwarded to my Splunk Instance for brreeves_splunk. 06-05-2020 12:48 AM
- Karma Re: Deployment client only partially forwards data for adonio. 06-05-2020 12:48 AM
- Karma Re: Deployment client only partially forwards data for somesoni2. 06-05-2020 12:48 AM
- Karma Re: Deployment client only partially forwards data for somesoni2. 06-05-2020 12:48 AM
- Got Karma for Re: Help me with join query. 06-05-2020 12:48 AM
- Karma Re: Pdf reports Logo change for Azeemering. 06-05-2020 12:47 AM
- Posted Re: Convert YYYYMMDD number to DD.MM.YYYY format on Splunk Search. 08-11-2017 06:51 AM
- Posted Convert YYYYMMDD number to DD.MM.YYYY format on Splunk Search. 08-11-2017 06:21 AM
- Tagged Convert YYYYMMDD number to DD.MM.YYYY format on Splunk Search. 08-11-2017 06:21 AM
- Tagged Convert YYYYMMDD number to DD.MM.YYYY format on Splunk Search. 08-11-2017 06:21 AM
- Posted Re: Align all values of a table to the left (for PDF export) on Splunk Search. 08-11-2017 12:40 AM
- Posted Re: Align all values of a table to the left (for PDF export) on Splunk Search. 08-10-2017 11:30 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
08-11-2017
06:21 AM
Hello,
I am trying to convert a field value which contains a number in timeformat YYYYMMDD to DD.MM.YYYY
I tried several converting methods but it always end up with a whacky date, not the one that I require.
Can anyone help me out?
... View more
08-11-2017
12:40 AM
Thanks for the tip! I now however get the error message that, despite what's told in the docs, printf is undefined or unsupported in "eval". Could this be an error due to me using splunk 6.5.2? Or is there a way to fix this?
... View more
08-10-2017
11:30 PM
Thank you for your advise giuseppe! But is there a way to eval the values to string without the commas?
If I just simply do
eval amount=tostring(amount)
without the comma separators, it will still show the numbers on the right hand side in the table and in the .PDF.
... View more
08-10-2017
01:45 AM
Hello,
I am currently trying to create a table on which every value, whether number or string, is aligned to the left.
My main reason for this is that I want to export the dashboard that the table is on as PDF, and it just looks really off if the number values are aligned to the right while the other ones are aligned to the left.
Is there a way to do it via simple XML?
Any help is highly appreciated!
... View more
08-09-2017
05:32 AM
Oh boy, i feel stupid for not finding it myself. Thank you!
... View more
08-09-2017
05:23 AM
Hello,
I currently have a table that is ordered by time, ascending. It looks like this:
Date | Action
9pm | Order finished
8pm | Processing order step 3
8pm | Processing order step 2
8pm | Processing order step 1
7pm | Start processing order
When I try to sort by time descending, I however get this:
Date | Action
7pm | Start processing order
8pm | Processing order step 3
8pm | Processing order step 2
8pm | Processing order step 1
9pm | Order finished
As you can see, the events at 8pm did not change their order, therefore making it harder to read the table.
How can I correctly "turn the table around"? Any help is appreciated.
... View more
08-08-2017
01:53 AM
Thank you for your solution! Is there a way to set the URL path so that it gets the name of the current app and then redirects to the dashboard? e.g.
<a href='/app/<currentApp>/reports'>Scheduled Searches </a>
... View more
08-08-2017
12:11 AM
Hello,
I would like to rename the "reports" and "alerts" dashboard to something else. Is there a way to do this, or are their names set?
Thank you in advance!
... View more
05-12-2017
10:49 AM
Doing it the way somesoni suggested is much better - why do you insist on using subsearch if I may ask?
... View more
05-12-2017
10:46 AM
1 Karma
index=ABC sourcetype=xyz | stats count by XID | rename XID as MyID
| join MyID [index=ABC sourcetype=pqr | table MyID Name]
| table MyID Name count
... View more
05-12-2017
02:23 AM
The correct syntax in that regard would be
[WinEventLog://*]
Don't forget the two forward-slashes before putting the asteriks for all
... View more
05-12-2017
01:49 AM
Hi sassens,
if the stanzas are predefined by the app and disabled is 0 on default, changing them to 1 will do the trick.
... View more
05-11-2017
07:03 AM
You can specify fields when using transaction aswell as the maximum time that the events can be apart. That should un-clutter your transactions.
your search | transaction User maxspan=5m
... View more
05-08-2017
11:18 PM
I don't know what part of splunk you are trying to install, please be more exact with your question
http://docs.splunk.com/Documentation/Splunk/6.5.3/Installation/Whatsinthismanual
... View more
05-06-2017
01:40 AM
Are you sure that the $datacenter$ token is set before the search runs? What exactly are you searching for with datacenter?
... View more
05-06-2017
12:46 AM
Oh, my bad. Try
blacklist = .*restConnect.*\.log$
... View more
05-06-2017
12:42 AM
Is each line with an outputdate its own event? Is outputdate the timestamp of your event?
... View more
05-05-2017
11:56 AM
your search here | stats values(PurgeDate) by TableName
should show a table with each TableName and the dates that they have been purged
... View more
05-05-2017
10:29 AM
index=your_index State="Active" earliest=@w6@d latest=@w6@d+7d | stats count
Shows the count of all open tickets from previous Saturday until the end of Friday.
If you want to exclude friday, use latest=@w5@d+7d
... View more
05-05-2017
10:15 AM
What does an event with an open ticket look like? Is it just the event being there or is there a certain field value to look out for?
... View more
05-05-2017
10:07 AM
index=your_index earliest=-6d@d latest=now | timechart span=1d count(open_tickets) by date_wday
This search should always show the count of open_tickets for each weekday in the last 7 days.
Do you want to create a dashboard panel of it? Otherwise you could save this as report and let it run on every Friday night.
... View more
05-05-2017
09:45 AM
blacklist = restConnect.*\.log$
This should blacklist every file that starts with "restConnect" and ends with .log
... View more
05-05-2017
09:34 AM
I'm not completely understanding your question - do you what to have a timechart that always goes from last saturday to next friday with a bar that shows how many open tickets there are on that day, and how many there were on that weekday of the last week?
... View more
05-05-2017
09:24 AM
Have you tried looking into mvexpand and mvsplit?
http://docs.splunk.com/Documentation/Splunk/6.5.3/SearchReference/Mvexpand
... View more
