Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- Find Answers
- :
- About akarivaratharaj
akarivaratharaj
Communicator
Member since:
07-11-2017
01-06-2025
Community Statistics
| Posts | 186 |
| Solutions | 1 |
| Karma Given | 21 |
| Karma Received | 4 |
| Member Since | 07-11-2017 |
Activity Feed
- Got Karma for Re: How to fetch only the top x rows for each category in the same search query?. 09-23-2025 06:23 PM
- Posted Re: Unexpected results with field values - Splunk Enterprise on Getting Data In. 01-05-2025 08:45 PM
- Posted How to pass tokens to a dashboard created with Java script? on Splunk Enterprise. 01-05-2025 08:41 PM
- Tagged How to pass tokens to a dashboard created with Java script? on Splunk Enterprise. 01-05-2025 08:41 PM
- Tagged How to pass tokens to a dashboard created with Java script? on Splunk Enterprise. 01-05-2025 08:41 PM
- Tagged How to pass tokens to a dashboard created with Java script? on Splunk Enterprise. 01-05-2025 08:41 PM
- Posted Re: Unexpected results with field values - Splunk Enterprise on Getting Data In. 05-23-2024 04:24 AM
- Posted Re: Unexpected results with field values - Splunk Enterprise on Getting Data In. 05-23-2024 04:02 AM
- Posted Re: Unexpected results with field values - Splunk Enterprise on Getting Data In. 05-23-2024 03:53 AM
- Posted Re: Unexpected results with field values - Splunk Enterprise on Getting Data In. 05-23-2024 03:41 AM
- Posted Unexpected results with field values - Splunk Enterprise on Getting Data In. 05-23-2024 02:10 AM
- Posted Re: why the DB Connect input fetch the same data twice in a single run? on Splunk Enterprise. 05-08-2024 03:17 AM
- Posted Re: why the DB Connect input fetch the same data twice in a single run? on Splunk Enterprise. 05-06-2024 04:24 AM
- Posted Re: why the DB Connect input fetch the same data twice in a single run? on Splunk Enterprise. 05-05-2024 10:08 PM
- Posted why the DB Connect input fetch the same data twice in a single run? on Splunk Enterprise. 05-03-2024 04:24 AM
- Posted How to extract a field value which have combination of number and special characters? on Splunk Search. 01-17-2024 12:26 AM
- Posted Re: How to get the history of modifications made to a lookup file? on All Apps and Add-ons. 12-18-2023 03:29 AM
- Posted Re: How to get the history of modifications made to a lookup file? on All Apps and Add-ons. 12-12-2023 10:09 PM
- Posted How to get the history of modifications made to a lookup file? on All Apps and Add-ons. 12-12-2023 02:25 AM
- Posted Re: How to forward the data from AWS S3 to Splunk Enterprise? on Splunk Enterprise. 11-22-2023 02:11 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
08-20-2019
03:56 AM
@here I have a similar issue with adding the HTML code for Splunk dashboard. The code is to set the color to a specific field in a panel with table representation.
I have added the below code, which is working fine for the number field
<format type="color" field="COUNT">
<colorPalette type="minMidMax" maxColor="#D6563C" minColor="#FFFFFF">
</colorPalette>
<scale type="minMidMax"></scale>
</format>
I would like to add the same code for a field which represents the time duration in the format of "HH:MM:SS". The above code is not supporting the time format.
Could anyone please help me in getting the right code to support the time format fields also.
... View more
05-17-2019
02:56 AM
I have tried going through Terms and Conditions but nowhere I could find. Just want to know what happens to all of my posted questions on Splunk Answers, if I delete my Splunk Answers account. Will the questions turn as posted by "Unknown User" or Orphaned questions something?
Please someone help me to know on this.
... View more
- Tags:
- splunk-enterprise
04-16-2019
02:09 AM
I would like to know how to display the exact date of the time modifiers which are specified in the earliest and latest time range.
Eg: earliest=-1q@q latest=@q
We know that this is nothing but the last quarter details, which is earliest =01-01-2019 and latest=31-03-2019.
I am using the time modifier in my query and I want to display the above format date along with my other panels in my dashboard.
This may change according to each quarter/year we select from input.
I am using this in a case condition,
<condition>
<eval token="growth_title2">case($result.time_period$=="earliest=-1q@q latest=@q","xxxx", $result.time_period$=="earliest=-1y@y latest=@y", "yyyy")</eval>
</condition>
The place xxxx and yyyy needed the logic to display the earliest & latest time in date format
Could anyone please help me to display time which is mentioned in time modifier as date format.
... View more
04-02-2019
08:28 PM
Hi @vnravikumar ,
Any suggestions on this?
... View more
04-01-2019
10:03 PM
Hi @adonio , I have tried this method but it is not giving me the expected one. Below is my current search query. Here we are comparing the current depth of the queue with a threshold limit which is fed through a lookup file. If possible please let me know any other ways to achieve this.
earliest=-5m@m index=* sourcetype=* host=prod*
|stats latest(DEPTH) AS "QueueDepth" latest(AGE) as "MessageAge" by QUEUE, _time
| lookup Queue_Threshold.csv QUEUE OUTPUT THRESHOLD_DEPTH, THRESHOLD_AGE
|eval Behaviour=case((QueueDepth > THRESHOLD_DEPTH AND MessageAge > THRESHOLD_AGE),"Abnormal",MessageAge > THRESHOLD_AGE, "Abnormal", 1=1,"Normal")
| search Behaviour="Abnormal" AND QueueDepth > 0
|stats latest(QueueDepth) as QueueDepth, latest(MessageAge) as MessageAge, max(THRESHOLD_DEPTH) as NormalThresholdQueueDepth, max(THRESHOLD_AGE) as NormalThresholdMessageAge by QUEUE
... View more
03-26-2019
10:21 AM
I have a requirement, where I need to display name of an queue, for which the size of the queue is keep on increasing. Basically I am searching for every 15 minutes, to check in each 5 minutes of time span, what is the size of my queue. If the size of the queue in each 5 minutes shows some gradual increase, I want that queue to be displayed. There may be the case first 10 minutes, it increase and again the 3rd time it may decrease. I dont want that kind of information. For example
Queue Name: XY
Size of the Queue in last 15 minutes:
1st 5 minute size - 10
2nd 5 minute size - 20
3rd 5 minute size - 30
4th 5 minute size - 35, etc.,
So in this kind of situation I want to check only the 15 minutes with 5 minutes time span and see whether there is any increment in the value of the field. If there is a positive growth in continuous 3 times, then I need to display that particular queue.
I have checked that streamstats will be helpful in this case. Can anyone please suggest me on this?
... View more
03-21-2019
07:19 AM
@vnravikumar I referred the link which you shared. People have suggested both Java script and xml code also. But our requirement does not match with this, as they are suggesting to disappear other items when one item selected.
If that is the case, we no need to prefer multiselect, just we can go with drop down list.
I have checked the splunk docs and got the answer.
There is a little change in the code which you suggested me.
<change>
<condition label="All Apps">
<set token="showPanel">true</set>
</condition>
<condition>
<unset token="showPanel"></unset>
</condition>
</change>
This I added in my multiselect input code block. Then it worked.
... View more
03-21-2019
02:20 AM
No. If I choose All, still other input values are showing for selection. Similarly if I choose any other items also, the other item values are showing.
... View more
03-21-2019
02:03 AM
@vnravikumar , I have tried your above sample code with two situations.
Situation 1 -> This is working fine only when I have two values in my input (as you mentioned All & one ).
Situation 2 -> When I have multiple values in my input, delimiter comes into picture as this is a multi select input. So during that time, my Panel1 and Panel2 are not at all displaying for any kind of values I select. Though I am selecting All values option, these panels are still hidden
I tried using the rejects command in other dashboards also. But this does not work
... View more
03-21-2019
12:27 AM
This is for the same dashboard. Earlier I had three panels, now I have added two more.
Panel1 & Panel2 —> Shows overall results only when the input selected as All . Which is token App_Value =*
Panel3 & Panel4 -> have some query and fetch me some result.
Panel5 —> just have custom text which displays whenever the Panel1, Panel2, Panel3 & Panel4 do not have any results.
I have tried the below conditions to hide the panels accordingly
<condition match="$App_Value$ == *">
<condition $App_Value$="*">
But both of these are not working. Panel 1 & Panel 2 are displaying whenever Panel 3 & Panel4 also are displaying.
Could you please help me.
... View more
03-20-2019
11:24 PM
@vnravikumar I have one more problem.
I have a multiselect input (token is App_Value). So whenever I click all option (all=*), only then my panel1 should display. For any other inputs, my panel1 should be hidden.
Currently I am trying like this but not working
<done>
<condition $App_Value$="*">
<set token="hide_panel">true</set>
</condition>
<condition>
<unset token="hide_panel"></unset>
</condition>
</done>
Can you please help me
... View more
03-20-2019
11:19 PM
Hi,
I am trying the similar kind of condition to hide the panel. I have multiselect input (token is App_Value ). So whenever I click all option (all=*), only then my panel1 should display. For any other inputs, my panel1 should be hidden.
Currently I am trying like this but not working
<done>
<condition $App_Value$="*">
<set token="hide_panel">true</set>
</condition>
<condition>
<unset token="hide_panel"></unset>
</condition>
</done>
Could anyone please help me on this
... View more
03-19-2019
02:00 AM
Thankyou.. its working 🙂
... View more
03-19-2019
01:31 AM
Hi @vnravikumar,
I am facing one more problem with the above code. If I provide the shorter time duration like 15 minutes, 1 hour, 4 hours, my query is running faster, fetching the results and showing Panel1 & Panel2 . If there are no results, it is giving me the Panel3.
But, whenever we give larger time duration (which fetches more logs/events) like 24 hours, 3 days, 1 week, etc., my query is taking sometime to execute and show the results. In between this query search/execute time, my panel3 is getting displayed. Once the query execution is over and it gives me result, my panel3 disappears and panel1 & panel2 is getting displayed.
That should not happen. Basically my panel1 & panel2 is executing its query, nothing should be displayed on the dashboard. Once the query completes its execution it should display either case1 or case2.
Could you please help me on this?
... View more
03-18-2019
02:49 AM
@vnravikumar Wow!! Its working...!! Thankyou for the quick response
... View more
03-18-2019
02:32 AM
I have three panels in my dashboard. Panel1 & Panel2 —> have some query and fetch me some result. Panel3 —> just have custom text which displays whenever the Panel1 & Panel2 do not have any results.
Requirements: 1. Hide Panel1 & Panel2 when job result is 0. Show the Panel 3 2. Hide Panel 3 when job result is !=0. Show the Panel & Panel2
I have used the below code to hide the Panel1 & Panel2 when there are no results
<progress>
<condition match="$job.resultCount$ == 0">
<unset token="hide_panel2"></unset>
</condition>
<condition>
<set token="hide_panel2">true</set>
</condition>
</progress>
There is no issue with this. Its working fine.
But my Panel3 has to be hidden whenever the Panel1 & Panel2 are visible. As like above code, I have tried the similar set of code to hide Panel3 based on Panel1 & Panel2 values
<progress>
<condition match="$result.Usage_Count$ != 0">
<unset token="hide_panel3"></unset>
</condition>
<condition>
<set token="hide_panel3">true</set>
</condition>
</progress>
But still the panel3 is visible in all kind of conditions. I am not knowing where I am making the mistake. Could anyone please help me.
... View more
03-14-2019
03:54 AM
I am also facing similar kind of issue. I have a Timerange input and one more Multiselect input to select application. Whenever I refresh the page or I open it newly, still the previous value which I selected in the mutiselect is still showing.
My multiselect value is depend on the timerange which I select. Below is my sample code:
<input type="time" token="timerange" searchWhenChanged="true">
<label>Timerange</label>
<default>
<earliest>-15m</earliest>
<latest>now</latest>
</default>
</input>
<input type="multiselect" token="app" searchWhenChanged="true">
<label>Application</label>
<fieldForLabel>App</fieldForLabel>
<fieldForValue>App</fieldForValue>
<default></default>
<search>
<query>index=* |table app |dedup app</query>
<earliest>$timerange.earliest$</earliest>
<latest>$timerange.latest$</latest>
</search>
<choice value="*">All</choice>
<change>
<unset>token="form.timerange"</unset>
</change>
</input>
I am using the token $app$ in my further code. Could anyone please help me on this
... View more
01-31-2019
01:10 AM
Hi,
I guess both of your answers are similar. Instead of table command you are telling format command.
Actually I am aware that if I use those command, I can get the list of my values with their corresponding fields.
So the format you are suggesting is <basic search>|table <all fields> otherwise <basic search> | format "" "" ""
I am speaking about the indexed events, why it is not showing the field-value combination in each of the indexed event.
So if I run only my basic search like index=x souretype=y source=z , this will show the respective events.
So my events should look like
1. Server=prod_host_1,OS=Linux,Month=January,Total_size=650,avg_size=309.99,max_size=362.87
2. Server=prod_host_2,OS=Linux,Month=January,Total_size=700,avg_size=300.5,max_size=450
Why the events are not showing with this kind of field-value pairs by default.
... View more
01-31-2019
12:25 AM
Hi @chrisyoungerjds & @vishaltaneja07011993 ,
I understood the way which you guys are speaking about. I have already tried in the same way. I can see my field and their values, only if I use the "|table" command.
But we would like to see the same in the events too, as like "key-value" pair.
Any idea or way to achieve the same?
... View more
01-30-2019
11:22 PM
I have to add an input file to Splunk which is in csv format.
Example:
Server,OS,Month,Total_size,avg_size,max_size
prod_host,Linux,January,682.59,309.99,362.87
prod_host,Linux,January,682.59,309.99,362.87
I am trying to add the file through Add Data -> Upload. After selecting my input file, in the “ set Source Type” page, I am selecting source type as Structured -> csv. In the right hand side of the page, it show the headers as field names and the corresponding values under each field names. But after I finish with all the steps and start searching with the respective source and source type, my events contain only the values with comma separation.
prod_host,Linux,January,682.59,309.99,362.87,316.96
But how I need is
Server=prod_host,OS=Linux,Month=January,Total_size=682.59,avg_size=309.99,max_size=362.87
Could anyone please help me on this.
... View more
- Tags:
- csv
- splunk-enterprise
01-23-2019
02:34 AM
Hi @deepashri_123 ,
I can see the field sizeOnDiskMB have data in MB. So this field denotes the total size used by each indexes.
How about rawSize ? Is this also in MB? Is it denoting the total size allocated to each index? Right?
... View more
01-22-2019
10:25 PM
Okay thankyou
... View more
01-22-2019
02:30 AM
Hi @mayurr98,
Thankyou for your quick response. I have referred the above link which you shared.
In that post they have mentioned the below query to find the number of logins made to Splunk.
"index=_audit info=succeeded action="login attempt" | stats count by user"
This query is giving only the count of logins which are made by splunk users. It is good enough. But in addition to this, I need the login attempts made by other servers/databases also. For example, I have setup a forwarder in Host X. All the required log details from the host X is forwarded to my splunk instance and index over there. So while indexing also, my splunk is been accessed by the host/forwarder. I would like to have that information also.
How about the logs available in "sourcetype=WinEventLog:Security"? I have referred some posts, where people were discussing about the EventCode 4625 or 4624 (login success/failure).
Any idea where can I get those logs too?
... View more
01-22-2019
01:54 AM
I would like to fetch No. of logins on Splunk (how frequently my splunk is being accessed). It is basically, how many connections are made to splunk for indexing/searches.
I am unaware where this information will be available on Splunk. Could anyone please help me to know , how and where can I get this information.
... View more
01-21-2019
12:07 AM
Hi @all,
Thankyou so much for your quick responses.
I just wanted to know how the indexes in my splunk system are grown in each month of 2018, a kind of trend. So I have checked the license usage log (which contains the size of indexed data in each index) from my splunk master. But I can see only the last 30 days of index log events.
I just want to clarify that, the log data will be available only for the past 30 days? If that is the case, how can I know that how my index is grown in each month. Is there any other way to get the log details?
Could anyone please help me on this query.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
01-06-2025
05:52 AM
|
