Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About palisetty
palisetty
Communicator
Member since:
12-20-2019
06-05-2020
Community Statistics
| Posts | 75 |
| Solutions | 0 |
| Karma Given | 37 |
| Karma Received | 3 |
| Member Since | 12-20-2019 |
Activity Feed
- Karma Re: -45m@d what it means for to4kawa. 06-05-2020 12:51 AM
- Karma Re: power user pdf for richgalloway. 06-05-2020 12:51 AM
- Karma Re: power user pdf for woodcock. 06-05-2020 12:51 AM
- Karma Re: In Indexing phase, once data is written to disk, it cannot be changed for to4kawa. 06-05-2020 12:51 AM
- Got Karma for In Indexing phase, once data is written to disk, it cannot be changed. 06-05-2020 12:51 AM
- Karma Re: Stats Sum question for niketn. 06-05-2020 12:50 AM
- Karma Re: countfield question for vnravikumar. 06-05-2020 12:50 AM
- Karma Re: confusion with @ symbol for gcusello. 06-05-2020 12:50 AM
- Karma Re: confusion with @ symbol for gcusello. 06-05-2020 12:50 AM
- Karma Re: confusion with @ symbol for niketn. 06-05-2020 12:50 AM
- Karma Re: confusion with @ symbol for gcusello. 06-05-2020 12:50 AM
- Karma Re: Zoom to selection for niketn. 06-05-2020 12:50 AM
- Karma Re: Why dedup when we have stats values function for starcher. 06-05-2020 12:50 AM
- Karma Re: Why dedup when we have stats values function for jpolvino. 06-05-2020 12:50 AM
- Karma Re: Methods to create tables and visualizations for niketn. 06-05-2020 12:50 AM
- Karma Re: Your search did not return any events because you are in Smart Mode. for niketn. 06-05-2020 12:50 AM
- Karma Re: Alert set to medium severity but also creating high severity under alert list for niketn. 06-05-2020 12:50 AM
- Karma Re: Lookup table not found for Automatic lookup for ivanreis. 06-05-2020 12:50 AM
- Karma Re: Splunk Architecture in own words for gcusello. 06-05-2020 12:50 AM
- Karma Re: Using 'by' clause overrides 'limit'? for richgalloway. 06-05-2020 12:50 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
01-02-2020
09:14 AM
Thank You. I will start right now
... View more
01-02-2020
08:45 AM
I have an exam very soon
... View more
01-02-2020
07:25 AM
@gcusello @woodcock @richgalloway
I am sorry for the discomfort. Actually, I got that bit from Quizlet.
Let us take the proper query, I have an issue with multiple stats functions within a Search Component. I don't understand what is going on.
index=main sourcetype=access_combined_wcookie | stats values(useragent) as "Agents used" count as "Times used" by useragent
I have rewritten it so that everyone can see it. I don't want to use eval command as I have no idea about it.
... View more
01-02-2020
07:01 AM
I am sorry for the discomfort. Actually, I got that bit from Quizlet. Let us take the proper query, I have an issue with multiple stats functions within a Search Component. I don't understand what is going on.
index=main sourcetype=access_combined_wcookie | stats values(useragent) as "Agents used" count as "Times used" by useragent
... View more
01-02-2020
05:08 AM
I have sum (field) which has been piped into stats sum of another field, Not sure what is happening here. Kindly help me understand.
sum(field) {| stats sum(sc_bytes) as Bandwidth by s_host}
... View more
01-02-2020
04:25 AM
@gcusello
I have multiple count functions in the same search component. What does it mean by that? What is really happening here?
| stats count(vendor_action) as ActionEvents, count as TotalEvents
I can definitely understand count(vendor_action) as ActionEvents. What is this part count as TotalEvents saying in regards to the first count?
... View more
- Tags:
- stats-count
01-02-2020
04:07 AM
Thank You @soumyasaha25 I am not up to your level, I am just preparing for Fundamental 1 exam.
... View more
01-02-2020
04:06 AM
@gcusello So, you are saying, for the example of 9:37, if I say -h@h. @h will be 9 and -h will be from 8:00 to 8:59.
... View more
01-02-2020
03:29 AM
@gcusello we will go step by step, please be patient with me.
-h@h means? is it a previous hour?
for example, my current time is 4:56 what would -h@h constitute to?
a week ago @vnravikumar helped me understand -d@d means yesterday, -100d@d is like previous 100 days from today.
I am still stuck with time though.
... View more
01-02-2020
03:07 AM
I know that '@' rounds off to the nearest time. For example, if we have 9:37, shouldn't it round off to 10 instead of 9?
... View more
- Tags:
- symbol
01-01-2020
09:09 AM
Perfect. Thank you so much for patiently clearing my issue. Happy New Year
... View more
01-01-2020
08:54 AM
@woodcock any one example of not like fieldname=fieldvalue, please.
... View more
01-01-2020
08:48 AM
@woodcock @gcusello As far as I know, Search terms are something before '|'. If we take that into consideration, we have index="main", here 'index' is Field Name which is case sensitive, "main" is Field value which is not case sensitive. But we are calling search terms are not case sensitive, i am confused, kindly help.
... View more
01-01-2020
08:17 AM
@woodcock What are called search terms, please?
... View more
01-01-2020
05:41 AM
A location where Splunk stores and searches for event data. My answer is Index, Quizlet answer is Indexer. Please confirm
... View more
01-01-2020
04:53 AM
That is correct, I was thinking search terms come under everything before '|'. I forgot about Field Names and Field Values. Thank you for correcting me.
... View more
01-01-2020
04:05 AM
Search terms are case sensitive or case insensitive?
(components of search language)?
For me, the answer is case sensitive but Quizlet says case insensitive. To verify, I tried it on the search bar and when I type "Index", it doesn't produce any results while I type "index", I see the events on the event list.
I am sorry I am asking some questions from Quizlet as it contradicts my understanding and I am just trying to make sure I am correct.
... View more
- Tags:
- case-sensitive
01-01-2020
03:03 AM
1 Karma
(T/F) Using NOT and != would return the same results.
For me, the answer is false but quizlet says true. I say false because status!=200 or NOT status=200 wouldn't necessarily lead to the same results.
... View more
- Tags:
- boolean
12-31-2019
08:42 PM
@gcusello Hello Sir, first of all, Happy New Year to you and your family.
Here for the file, we have values like. How do they even look like they are sorted
product.screen
cart.do
category.screen
oldlink
success.do
passwords.pdf
error.do
userlist
account
api
... View more
12-31-2019
10:24 AM
Can anyone who has taken exam on Fundamentals 1 please give some tips and things to look out for
... View more
- Tags:
- tip
12-31-2019
06:17 AM
I used the following query where I used '-' just beside "Total bytes" without space. As per my understanding, if we have multiple fields after sort and when use '-' just next to the field that field will be sorted descending and the other fields are sorted in ascending order. But I am not getting desired results. Kindly correct me if I am wrong.
index="main" host="web_application" status=200
| stats sum(bytes) as "Total bytes" by file
| sort -"Total bytes" file
file Total bytes
product.screen 123344678
cart.do 122623448
category.screen 84500260
oldlink 82699602
success.do 67725818
passwords.pdf 22207970
error.do 7495294
userlist 55380
account 8476
api 2912
... View more
- Tags:
- sort
12-30-2019
10:33 AM
@henriq_c Hello, Good Afternoon. Why is that every question is post goes to moderation? Please let me know?
... View more
- Tags:
- administrator
12-30-2019
10:28 AM
I have written the query
index="main" host="web_application"
| stats count by status
The result is:
status count
200 233056
400 4156
403 1658
404 3652
406 4184
408 4142
500 4088
I am happy with this. But when I use dc for the same,
index="main" host="web_application"
| stats dc by status
I get:
status dc(JSESSIONID) dc(action) dc(bytes) dc(categoryId) dc(clientip) dc(date_hour) dc(date_mday) dc(date_minute) dc(date_month) dc(date_second) dc(date_wday) dc(date_year) dc(date_zone) dc(detail) dc(file) dc(host) dc(ident) dc(index) dc(items) dc(linecount) dc(method) dc(msg) dc(other) dc(password) dc(pg) dc(productId) dc(punct) dc(q) dc(referer) dc(referer_domain) dc(req_time) dc(root) dc(source) dc(sourcetype) dc(splunk_server) dc(start) dc(t) dc(timeendpos) dc(timestartpos) dc(uri) dc(uri_path) dc(uri_query) dc(user) dc(useragent) dc(version)
200 11192 5 3802 7 183 24 30 60 2 60 7 1 1 1 10 1 1 1 0 1 2 5 902 1 9 16 105 1 110 5 106359 2 1 1 1 1 0 7 7 95883 12 95879 1 26 1
400 1837 5 1595 1 182 24 30 60 2 60 7 1 1 0 5 1 1 1 0 1 2 0 794 0 0 2 80 0 13 4 2078 0 1 1 1 0 0 7 7 2021 5 2021 1 26 1
403 670 5 657 1 178 24 30 60 2 60 7 1 1 2 6 1 1 1 0 1 2 0 536 0 0 1 70 0 15 4 826 1 1 1 1 0 0 7 7 713 6 712 1 26 1
404 1624 5 1471 1 183 24 30 60 2 60 7 1 1 0 21 1 1 1 1 1 2 0 793 0 0 2 87 0 16 4 1826 7 1 1 1 0 1 7 7 1803 26 1743 1 26 1
406 1850 5 1635 1 182 24 30 60 2 60 7 1 1 0 5 1
Why is this? What is that I am missing?
It may be a dumb question but.
... View more
12-30-2019
12:47 AM
I have two fields on the event list. I have used Top command for that, I have got two fields and count and percent.
index="main" host="web_application"
| top JSESSIONID uri
For which corresponding fields are these metrics count and percent for?
JSESSIONID uri count percent
SD1SL10FF2ADFF4960 /oldlink?&JSESSIONID=SD1SL10FF2ADFF4960 30 0.011426
SD4SL10FF5ADFF4959 /oldlink?&JSESSIONID=SD4SL10FF5ADFF4959 26 0.009902
SD2SL1FF6ADFF4962 /oldlink?&JSESSIONID=SD2SL1FF6ADFF4962 26 0.009902
SD0SL2FF3ADFF4961 /oldlink?&JSESSIONID=SD0SL2FF3ADFF4961 26 0.009902
SD7SL5FF6ADFF4959 /oldlink?&JSESSIONID=SD7SL5FF6ADFF4959 24 0.009140
SD6SL6FF8ADFF4964 /oldlink?&JSESSIONID=SD6SL6FF8ADFF4964 24 0.009140
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:03 AM
|
