Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- About nabeel652
nabeel652
Builder
Member since:
04-15-2015
04-06-2026
Community Statistics
| Posts | 196 |
| Solutions | 16 |
| Karma Given | 40 |
| Karma Received | 41 |
| Member Since | 04-15-2015 |
Activity Feed
- Posted Regex match in a Splunk lookup on Splunk Cloud Platform. 02-11-2026 10:08 PM
- Tagged Regex match in a Splunk lookup on Splunk Cloud Platform. 02-11-2026 10:08 PM
- Tagged Regex match in a Splunk lookup on Splunk Cloud Platform. 02-11-2026 10:08 PM
- Got Karma for Re: Cron schedule in Splunk Cloud to run every second Tuesday of the month. 02-06-2026 06:33 AM
- Posted Re: Matching a substring with a lookup field on Splunk Search. 09-22-2025 08:52 PM
- Posted Matching a substring with a lookup field on Splunk Search. 09-21-2025 07:17 PM
- Got Karma for Re: How can we create Tabs using Link List in Splunk with only CSS Override NO SplunkXML JS Extension?. 09-05-2025 07:59 AM
- Got Karma for Re: How can we create Tabs using Link List in Splunk with only CSS Override NO SplunkXML JS Extension?. 01-30-2025 08:17 AM
- Posted Re: Cron schedule in Splunk Cloud to run every second Tuesday of the month on Alerting. 10-30-2024 04:07 PM
- Karma Re: Cron schedule in Splunk Cloud to run every second Tuesday of the month for gcusello. 10-30-2024 03:35 PM
- Posted Re: Cron schedule in Splunk Cloud to run every second Tuesday of the month on Alerting. 10-29-2024 09:32 PM
- Posted Cron schedule in Splunk Cloud to run every second Tuesday of the month on Alerting. 10-28-2024 10:29 PM
- Posted Embedding Splunk Cloud dashboard into a SharePoint on-prem page on Dashboards & Visualizations. 09-18-2024 06:03 PM
- Posted Change both Background and Text Colour in Single Value visualisation Conditionally on Dashboards & Visualizations. 07-30-2024 10:27 PM
- Posted Select last week as default in the dropdown on Dashboards & Visualizations. 07-25-2024 09:50 PM
- Posted Re: Count values changes only when value in a column changes on Splunk Search. 07-12-2024 02:33 AM
- Karma Re: Count values changes only when value in a column changes for gcusello. 07-12-2024 02:33 AM
- Posted Re: Count values changes only when value in a column changes on Splunk Search. 07-11-2024 05:10 PM
- Posted Re: Count values changes only when value in a column changes on Splunk Search. 07-10-2024 11:01 PM
- Posted Count values changes only when value in a column changes on Splunk Search. 07-10-2024 10:03 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
02-08-2018
04:47 PM
can you install Universal Forwarder on the system where that static file exists?
... View more
02-08-2018
03:27 PM
Well you can setup a lookup table that has all the subnets and necessary info like:
IPv4Address SubnetMask City lat lon
203.25.11.0/24 255.255.255.0 CityXYZ xxxx yyyy
Now create a lookup definition, say resolveIP, based on that .csv and add
CIDR(IPv4Address) in the field "Match Type"
in your search for map chart
...your search | lookup resolveIP IPv4Address OUTPUT City lat lon | geostats maxzoomlevel=18 globallimit=0 count by City
Hope that will help
... View more
02-06-2018
05:37 PM
If you still want duration through same query use this:
| stats count | eval data = "Event 1: Worker#108 [SWAPScheduler-INDIA] - [2018-01-31 04:30:04,340] - DEBUG - AppLogger: SWAPScheduler.executeInternal entry;Event 1: Worker#115 [SWAPScheduler-INDIA] - [2018-01-31 04:30:09,340] - DEBUG - AppLogger: SWAPScheduler.executeInternal entry;
Event 2: Worker#115 [SWAPScheduler-INDIA] - [2018-01-31 04:30:29,340] - DEBUG - AppLogger: SWAPScheduler.executeInternal exit;
Event 2: Worker#108 [SWAPScheduler-INDIA] - [2018-01-31 04:30:34,340] - DEBUG - AppLogger: SWAPScheduler.executeInternal exit" | makemv delim=";" data
| mvexpand data | rename data as _raw | rex field=_raw ".*Worker\#(?[\d+]*).*\-\s(\[(?[^\]]*).*entry|\[(?[^\]]*).*exit)" | stats first(entry_time) as entry last(exit_time) as exit by worker_id | eval entry = strptime(entry,"%Y-%m-%d %H:%M:%S") | eval exit = strptime(exit,"%Y-%m-%d %H:%M:%S") | eval diff = round(exit -entry,0)
... View more
02-06-2018
05:27 PM
Well for strptime you'll have to provide the timeformat string that matches the date/time in entry_time and exit_time. So you need to do:
| eval exit = strptime(exit_time,"%Y-%m-%d %H:%M:%S")
However by doing |eval diff = exit - entry you'll not get any useful results because entry_time corresponding to every exit_time (and vise versa) are NULL.
In order to get time difference between entry and exit you'll have to use the transaction command that I worked out earlier.
... View more
02-04-2018
04:23 PM
Well this is not achievable as tokens are only visible in Simple XML not in SPL. However, a workaround would be to get the user form an API call:
| rest /services/authentication/current-context splunk_server=local | fields username
Once you have the user name you can apply the search commands on or using the username
... View more
01-31-2018
10:32 PM
Please check the updated answer
... View more
01-31-2018
04:59 PM
Try this - You can run this as is copying and pasting it in your search. - you can tweak it a little bit to fit your needs:
| stats count | eval data = "Event 1: Worker#108 [SWAPScheduler-INDIA] - [2018-01-31 04:30:04,340] - DEBUG - AppLogger: SWAPScheduler.executeInternal entry;Event 1: Worker#115 [SWAPScheduler-INDIA] - [2018-01-31 04:30:09,340] - DEBUG - AppLogger: SWAPScheduler.executeInternal entry;
Event 2: Worker#115 [SWAPScheduler-INDIA] - [2018-01-31 04:30:29,340] - DEBUG - AppLogger: SWAPScheduler.executeInternal exit;
Event 2: Worker#108 [SWAPScheduler-INDIA] - [2018-01-31 04:30:34,340] - DEBUG - AppLogger: SWAPScheduler.executeInternal exit" | makemv delim=";" data
| mvexpand data | rename data as _raw | rex field=_raw ".*Worker\#(?<worker_id>[\d+]*).*\-\s(\[(?<entry_time>[^\]]*).*entry|\[(?<exit_time>[^\]]*).*exit)"
... View more
01-31-2018
04:18 PM
create bins of one hours and distinct count the users - you can show this in table or bar/column graph
index=yourindex | bin span=1h _time | stats distinct_count(Username) as active_users by _time
... View more
01-31-2018
03:58 PM
Ah sorry I got you wrong. Please see my updated answer 🙂
... View more
01-30-2018
09:39 PM
So you want to auto scroll to the panel on same dashboard. I think you'll have to use html for that by bookmarking the panel and applying token at the same time.
... View more
01-30-2018
09:35 PM
Are the field autoextracted or you have written field extractions for iis:web:common?
... View more
01-30-2018
05:18 PM
What I have understood you just need one query in order to:
i- filter out any files like E:\logs\icim\2018* ===> NOT source="E:\logs\icim\2018*"
ii- filter out files (source) containing "Transaction Rolled Back" OR "Process FNXML Complete" ===> NOT [|search index=velocity sourcetype="velocity:icim" (host=vel*) ("Transaction Rolled Back" OR "Process FNXML Complete") | dedup source | fields source]
So your query would be like:
index=velocity sourcetype="velocity:icim" (host=vel*) NOT source="E:\\logs\\icim\\2018*" NOT [|search index=velocity sourcetype="velocity:icim" (host=vel*) ("Transaction Rolled Back" OR "Process FNXML Complete") | dedup source | fields source] | your query continues...
... View more
01-30-2018
05:03 PM
Try this:
| stats count | fields - count | eval PageStartTime = 1517360016 | eval offset = tonumber(strftime(now(),"%z"))/100*3600 | eval PageStartTimeUTC = PageStartTime - offset | eval PageStartTimeUTC = strftime(PageStartTimeUTC,"%d/%m/%Y %H:%M:%S")
Explanation: PageStartTime is given a test value. offset is calculated by getting current user's timezone offset - converting it in seconds and subtracting it from the current time. If you're in a negative time zone subtraction will be converted to addition as a - (-b) = a + b. So the last PageStartTimeUTC shows the time in UTC
... View more
01-24-2018
05:51 PM
<snip> | fillnull ipexist value=unknown | lookup yourlookup ipexits output yourfields | </snip>
Hope this would work.
... View more
01-22-2018
09:21 PM
Your requirement is a bit unclear to me. You have only one value in each of first and second csv. Anyway the following query may work by selecting bar or column chart from the visualisations. The following query will show TotalTime from first csv and append TotalTime form second csv underneath that.
| inputlookup csv1.csv | append [|inputlookup csv2.csv] | table TotalTime
... View more
01-22-2018
07:40 PM
1 Karma
Try something like this:
| stats count | eval data = "
801 20/01/2018 18:40 262719 329507;
863 20/01/2018 23:50 264437 331450;
864 20/01/2018 23:55 264454 331467;
865 21/01/2018 0:00 264464 331477;
1151 21/01/2018 23:50 271316 339177;
1152 21/01/2018 23:55 271328 339189;
1153 22/01/2018 0:00 271339 339201;
1154 22/01/2018 0:05 271354 339221;
1155 22/01/2018 0:10 271365 339232;
1156 22/01/2018 0:15 271373 339240" | makemv delim=";" data | mvexpand data | rex field=data "(?<serial>[\d]*)\s+(?<time>\d{2}\/\d{2}\/\d{4}\s+\d{1,2}\:\d{1,2})\s+(?<delivery>\d+)\s+(?<sent>\d+)" | eval _time=strptime(time,"%d/%m/%Y %H:%M") | table serial time _time delivery, sent | timechart span=1d min(serial) as serial min(delivery) as delivered min(sent) as sent | eval result=sent - delivered | where isnotnull(result)
Or something like:
...| bin span=1d _time | stats min(_time) as time min(delivery) as delivered min(sent) as sent by _time | eval result=sent - delivered | eval time =strftime(time,"%d/%m/%Y %H:%M")
... View more
01-21-2018
11:41 PM
Thanks mayurr98
I've tried the code and query you provide, but as I stated in my question - the env tokens work fine with panel labels or in html panels however it doesn't work in SPL queries. Hence this part doesn't work form me:
<search>
<query>index=_audit action="login attempt" user=$env:user|s$ | table _time user action info</query>
<earliest>-24h</earliest>
<latest>now</latest>
</search>
I'm using Splunk 6.6 in Cloud.
... View more
01-18-2018
04:52 PM
Hi Guys
I am trying to load searches based upon the logged user - In this way one dashboard can suffice the need for user based data access. I know that we can access the global tokens $env:user$ or $env:user_realname$ etc in the panel titles or html panels - for instance:
<panel>
<html>
<p>Currently Logged In User: $env:user$</p>
<p>Full name of logged in user: $env:user_realname$</p>
</html>
</panel>
but when I try something like this:
| stats count | eval user1 = $env:user$ | eval user = case($env:user$ == "admin","hello admin",1==1,"hello user")
It doesn't seem to work in simple xml. Any solution for that? I am on Splunk Cloud so don't have much room to play with .js files with simple xml.
... View more
12-19-2017
10:57 PM
Hi Guys
I have a field named Comments that is in HTML format:
Comments="<div class="ExternalClass05ED2D0CB5224BC285C4E4A53F3717E0">Adobe Air Run-Time;IMS 564125</div>"
Is there a simple way to show it in plain text? I don't want to use regex as there are almost unlimited options.
... View more
12-09-2017
02:21 AM
Are you using "sort" command somewhere in your query? That limits the records to 10,000 by default. Use zero like "Sort 0 field1 field2" to include all records.
... View more
12-09-2017
02:14 AM
I have one panel that contains some rows - upon clicking a row a panel opens on the rights (depends token="$sometoken$"). I have created a single choice link list with the only value "Close". When user clicks on "Close" option of link list in the dependent panel it unsets the $sometoken$ and the RHS panel closes - Works fine up to this point - However, next time when the user tries to drill down the RHS panel opens but now the "Close" choice is already selected and grayed out. So clicking has no effect. I want it to be unselected on the subsequent drilldowns like the first time. Below is the RHS panel code:
<panel depends="$sometoken$">
<title>Details for $sometoken$</title>
<input type="link" token="unused" depends="$sometoken$">
<label></label>
<choice value="close">Close</choice>
<change>
<condition>
<unset token="sometoken"></unset>
</condition>
</change>
<default>close</default>
<initialValue>close</initialValue>
<search>
<query />
</search>
</input>
<table id="table3">
<search>
<query>"Some query populating the table"</query>
<earliest>0</earliest>
<latest></latest>
</search>
<option name="drilldown">none</option>
<option name="rowNumbers">true</option>
</table>
</panel>
... View more
- Tags:
- tokens
12-05-2017
03:05 PM
1 Karma
thanks for your help mate 🙂
... View more
12-05-2017
03:38 AM
Awesome mate. Almost there but a small thing:
The time ranges don't match the outages - for instance.
App1 Down 600 600 2017-12-01 01:30:00 300 1 01/12/17 01:25AM
_time and lasttime show a 5 mins span but outage is 600 secs. Is there a way we can keep both the time ranges also intact as for this one
App1 Down 600 600 2017-12-01 01:35:00 300 1 01/12/17 01:25AM
There are 5 minutes extra in both app results.
Clever solution though (y).
... View more
