Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- Find Answers
- :
- About akarivaratharaj
akarivaratharaj
Communicator
Member since:
07-11-2017
01-06-2025
Community Statistics
| Posts | 186 |
| Solutions | 1 |
| Karma Given | 21 |
| Karma Received | 4 |
| Member Since | 07-11-2017 |
Activity Feed
- Got Karma for Re: How to fetch only the top x rows for each category in the same search query?. 09-23-2025 06:23 PM
- Posted Re: Unexpected results with field values - Splunk Enterprise on Getting Data In. 01-05-2025 08:45 PM
- Posted How to pass tokens to a dashboard created with Java script? on Splunk Enterprise. 01-05-2025 08:41 PM
- Tagged How to pass tokens to a dashboard created with Java script? on Splunk Enterprise. 01-05-2025 08:41 PM
- Tagged How to pass tokens to a dashboard created with Java script? on Splunk Enterprise. 01-05-2025 08:41 PM
- Tagged How to pass tokens to a dashboard created with Java script? on Splunk Enterprise. 01-05-2025 08:41 PM
- Posted Re: Unexpected results with field values - Splunk Enterprise on Getting Data In. 05-23-2024 04:24 AM
- Posted Re: Unexpected results with field values - Splunk Enterprise on Getting Data In. 05-23-2024 04:02 AM
- Posted Re: Unexpected results with field values - Splunk Enterprise on Getting Data In. 05-23-2024 03:53 AM
- Posted Re: Unexpected results with field values - Splunk Enterprise on Getting Data In. 05-23-2024 03:41 AM
- Posted Unexpected results with field values - Splunk Enterprise on Getting Data In. 05-23-2024 02:10 AM
- Posted Re: why the DB Connect input fetch the same data twice in a single run? on Splunk Enterprise. 05-08-2024 03:17 AM
- Posted Re: why the DB Connect input fetch the same data twice in a single run? on Splunk Enterprise. 05-06-2024 04:24 AM
- Posted Re: why the DB Connect input fetch the same data twice in a single run? on Splunk Enterprise. 05-05-2024 10:08 PM
- Posted why the DB Connect input fetch the same data twice in a single run? on Splunk Enterprise. 05-03-2024 04:24 AM
- Posted How to extract a field value which have combination of number and special characters? on Splunk Search. 01-17-2024 12:26 AM
- Posted Re: How to get the history of modifications made to a lookup file? on All Apps and Add-ons. 12-18-2023 03:29 AM
- Posted Re: How to get the history of modifications made to a lookup file? on All Apps and Add-ons. 12-12-2023 10:09 PM
- Posted How to get the history of modifications made to a lookup file? on All Apps and Add-ons. 12-12-2023 02:25 AM
- Posted Re: How to forward the data from AWS S3 to Splunk Enterprise? on Splunk Enterprise. 11-22-2023 02:11 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
10-25-2017
10:05 PM
Hi @Gupta,
First I have saved my search query as Report. After saving, it asked me "do you want to schedule the report" and I gave the option yes. Then it redirects me to the page where the report schedule with timing options are available. So I scheduled the report to run for everyday at 10:00 AM.
Now my requirement is whenever, the report runs at the scheduled time, I want to log those as events. In the current version of Splunk 7.0.0, I could see the options as Log Events, Run a Script, send email, etc.,
But in the 6.4.1 version, I could see only the Send Email and Run a script options.
So whenever my schedule report runs, I could either do Send Email or Run a script. But I need those also should be logged as events in the summary index. So please help me to achieve this.
If required, I can provide the screenshots also.
... View more
10-25-2017
09:56 AM
Hi,
I am working on creating Reports in Splunk Search & Reporting app 6.4.1. When I schedule for a report, it gave me alert actions choice and only with two options as Send Email and Run a Script.
Instead of this, I want to log events from this report. But I could not find that option anywhere in the report settings section.
Could anyone please help me on this.
... View more
10-05-2017
11:53 PM
Hi Flynt,
Thanks for your response.
The issue has been resolve and I got the results during last week itself. My Jira configuration details were wrong, so Splunk gave no results. Now everything is working fine.
... View more
09-27-2017
10:54 PM
Yeah... wish you the same.
... View more
09-27-2017
10:53 PM
Thankyou Sukisen1981 for your response
... View more
09-27-2017
10:51 PM
Thankyou inventsekar for your response.
... View more
09-27-2017
10:50 PM
1 Karma
Sorry I was trying the eval clause for addition along with the function "round". so it didnot returned me results. Now I got the answer with eval only.
Thankyou all for the help.
... View more
09-27-2017
07:43 PM
Hi DalJeanis,
If I use eval for adding all the fields and continue with my delta operation, it is showing no results found. I tried this already.
... View more
09-27-2017
11:01 AM
I guess I am unable to upload the screenshot.
... View more
09-27-2017
10:50 AM
Hi Sukisen,
Basically, I am trying to add all the above mentioned fields' values into one field and that I call as "Size". Then I want to find size difference i.e., delta between two time intervals. For example, Delta = July month's size value - June month's size value.
As per below query I am getting the attached screenshot 1:
index=main|timechart span=1w sum(DATA_MB) as datamb, sum(INDEX_MB) as indexmb, sum(DB2_DATA_MB) as db2datamb, sum(DB2_INDEX_MB) as db2indexmb, sum(DB2_LOB_MB) as db2lobmb, sum(DB2_LONG_MB) as db2longmb, sum(DB2_XML_MB) as db2xmlmb by DOMAIN limit=25
Analytic Platform and Financial are the Domains which I used. my query is giving me the size value of each DB for each Domain.
For calculating the delta value of consolidated size details of all db, I have to add the below query into my current query:
| untable _time DOMAIN sum | streamstats current=false window=1 global=false sum(sum) as p_sum by DOMAIN | eval delta=sum-p_sum |stats sum(delta) as Delta by DOMAIN
Before adding this query, I should have a field which holds the summed up value of all the 7 fields which I mentioned earlier.
i.e., var = datamb+indexmb+db2datamb+db2indexmb+db2lobmb+db2longmb+db2xmlmb
So that I could change my delta query accordingly and add into my old query. My final answer I would get is as per attached example screenshot 2:
... View more
09-27-2017
02:10 AM
The above query is giving me addition of all "datamb" field values, all "indexmb" field values (& other fields too) for a particular domain. It is showing the results as below:
_time datamb: Domain1 datamb: Domain2 indexmb: Domain1 indexmb: Domain2 etc.....
2017-06 24 45 20.8 40
2017-07 30.05 56.4 25 60
Total 54.05 101.4 45.8 100
But how I need is a variable should hold the sum of all the field values
var = datamb+indexmb+db2datamb+db2indexmb+db2lobmb+db2longmb+db2xmlmb
then at last the sum of that variable should be displayed according to the Domain as below
|timechart span=1mon sum(var) as Size by DOMAIN
_time Size Domain
2017-06 40 Domain1
2017-07 100 Domain2
etc.,
... View more
09-27-2017
12:26 AM
I am using the below search query which contains multiple fields. All the fields (DATA_MB, INDEX_MB, DB2_INDEX_MB, etc.,) contains size values of a particular DB.
index=main|timechart span=1w sum(DATA_MB) as datamb, sum(INDEX_MB) as indexmb, sum(DB2_DATA_MB) as db2datamb, sum(DB2_INDEX_MB) as db2indexmb, sum(DB2_LOB_MB) as db2lobmb, sum(DB2_LONG_MB) as db2longmb, sum(DB2_XML_MB) as db2xmlmb by DOMAIN limit=25
I want all these 7 fields such as datamb, indexmb, db2datamb, etc., to be summed up together and display it in a single field name without using "foreach" clause. Is it possible? (Because I need that final field to be used in another query as a main source value)
Could anyone please help me on this.
... View more
09-26-2017
03:30 AM
Hi vpham,
I am also facing the same issue. If I run any simple jql query also I am getting the results as "no results found". When I check the libs_jira.log, I am getting the below error:
2017-09-26 15:53:24,792 INFO pid=10288 tid=MainThread file=base_modinput.py:init:50 | Can not import package:libs_setup_util
2017-09-26 15:53:24,795 ERROR pid=10288 tid=MainThread file=base_modinput.py:log_error:69 | Get error when collecting events.
Traceback (most recent call last):
File "C:\Users\akarivarathara\Documents\SRE\Splunk\etc\apps\jira\bin\libs\modinput_wrapper\base_modinput.py", line 173, in stream_events
self.collect_events(inputs, ew)
File "C:\Users\akarivarathara\Documents\SRE\Splunk\etc\apps\jira\bin\jira.py", line 307, in collect_events
self.extract(inputs)
File "C:\Users\akarivarathara\Documents\SRE\Splunk\etc\apps\jira\bin\jira.py", line 249, in extract
self.protocol = self.input_items['protocol']
KeyError: 'protocol'
But I gave correct protocol only as "https". As this is showing the error, I changed it to "http". Even that setting also throwing the same error.
Can you please help me in this case.
... View more
09-22-2017
03:05 AM
Hi @Flynt,
Any idea on the above issue. I am unable to retrieve the data from Jira at all.
Could you please help me on this.
... View more
09-21-2017
11:04 AM
Hi cmerriman,
The first query of renaming has worked. Thanks for the help
... View more
09-21-2017
05:46 AM
I am trying to execute the below query in Splunk Enterprise.
index=x sourcetype=y|join TABLE_NAME [|inputlookup Domain_Module_List.csv |search (Domain ="Inventory")] |eval DATA_MB =round(DATA_KB/1024,2) |eval INDEX_MB = round(INDEX_SIZE_KB/1024,2) |timechart span=1mon limit=25 sum(DATA_MB) as datamb,sum(INDEX_MB) as indexmb by Domain|foreach indexmb* datamb* [eval size<>='datamd<>'+'indexmd<>']|fields - datamd* indexmd*
Below is the result which I am getting:
_time size: Inventory size: Platform size:Financial
2017-08 1546672397.67 22240.14 745
2017-09 991610023.13 4040.69 603
Time and Domain name are the two fields which I am trying to fetch. Ideally the Domain name display should be Inventory, Platform, Financial but it is showing as size: Inventory size: Platform and size:Financial.
Could anyone please help me to get rid of "size:" from the above results.
... View more
09-21-2017
02:49 AM
I am very new to Add-on for JIRA. I have referred the website "https://splunkbase.splunk.com/app/1438/" and installed the Add-on for JIRA with the current version 2.2.1 locally. The Splunk Enterprise version which I am using is "6.4.2"
When I try to fetch the details of JIRA from Splunk, it gives me no results found. The JQL query which I am trying is below:
| jira jqlsearch "issue = xxx"
Below is the settings which I provided in "bin" folder "config.ini"
[jira]
hostname = jira.example.com
username = xxx
password = xxx
jira_protocol = https
jira_port = 443
Settings in "default" and "local" folder "inputs.conf"
[jira://example]
sourcetype = jira
interval = 60
server = jira.example.com
protocol = https
port = 443
jql = issueType in (epic, story)
fields = *
username = xxx
password = xxx
disabled = 1
Settings in "default" folder "jira.conf"
[jira]
default_project = IT OperationsMax = 1000
keys = link,project,key,summary,type,priority,status,resolution,assignee,reporter,created,updated,resolved,fixVersion,components,labels/label
Fields containing durations, force them to return seconds instead of something human-readable. Optional.
time_keys = timeestimate, originalestimate, timespent
Custom fields to display. Optional.
custom_keys =
Settings in "README" folder "inputs.conf.spec"
[jira://example]
# JIRA server, e.g., jira.example.com
server = jira.example.com
# username is used to query REST API
username = xxx
# password is used to query REST API
password = xxx
# REST API protocol, e.g., https
protocol = https
# REST API port, e.g., 443
port = 443
# JQL query to filter tickets which are indexed, e.g., issueType in (epic, story)
jql = issueType in (epic, story)
# Fields to index, a comma separated field list, e.g., key, summary, type. Default is * all fields
fields = *
I am unaware, still I need to configure anything else in the above configuration files. Not sure where the issue is lying with or any other additional settings are needed to be configured. We need this for our new project and without setting up with JIRA, we could not proceed further.
So please give me some suggestions for making Splunk-JIRA to work asap.
... View more
09-20-2017
02:57 AM
To access JIRA from Splunk, does indexing is necessary? If so can I know the procedure for that please.
... View more
09-17-2017
11:14 PM
Hi @Azeemering,
I have referred the manual but I feel it is not clear. Nowhere I could find the exact steps for setting up of JIRA Add-on.
... View more
09-14-2017
11:57 PM
Hi,
I am new to the application "Add-on for JIRA". I am unaware what are the things to be installed and set up with applications to work on or fetch details from JIRA environment through Splunk.
Could anyone please help me in the basic procedures what are all need to be done to start working with JIRA from Splunk. If it is step by step procedures it would be helpful to any beginners who searches in answers.splunk.com.
... View more
08-31-2017
04:39 AM
Hi rjthibod,
Thankyou so much for your response.
It is working now.
... View more
08-31-2017
04:05 AM
1 Karma
I am trying to make drill down in the same dashboard of Splunk Enterprise 6.4.2 version.
In the panel1, there is a pie chart with two options namely FileInspector and UMB. I am taking the input of clicked value, token as "feature" from panel1 and passing it to panel2.
In the condition part if my token $feature$ = "FileInspector", then I am setting a Query1 itself as a token called "$querytocall$". If the token $feature$ = "UMB", then setting other Query2 to the same token "$querytocall$".
At last I am passing that token "$querytocall$" itself as a search query for the Panel2. But this is not working. My panel2 is showing as "waiting for the input". Below is the code
<drilldown>
<set token="feature">$click.value$</set>
</drilldown>
</chart>
</panel>
<panel depends="$feature$">
<title>$feature$ - Exception From Hosts Details</title>
<chart>
<change>
<condition match="$feature$ == "FileInspector" ">
<set token="querytocall">index=x | rex "Caused by: (?P<exception>[^\"](.+?)(.+?):)" |stats count(exception) as "No of Occurences" by host | table host, "No of Occurences"</set>
</condition>
<condition match="$feature$ == "UMB" ">
<set token="querytocall">index=y |stats count as "No of Occurences" by host | table host, "No of Occurences"</set>
</condition>
</change>
<search>
<query>$querytocall$</query>
<earliest>$field1.earliest$</earliest>
<latest>$field1.latest$</latest>
</search>
Could anyone please help me on this.
... View more
08-30-2017
11:57 PM
I am also facing the similar kind of issue. Below is the part of my code.
I am trying to make drill down in the same dashboard. From the panel1, I am taking the token input of click value as "feature" and passing to panel2.
In the condition part if my token $feature$ = "FileInspector", then I am setting a Query itself as a token called "querytocall". if the token $feature$ = "UMB", then setting other query to the same token "querytocall".
At last I am passing that token "querytocall" itself as a search query for the Panel2. But this is not working. My panel2 is showing as "waiting for the input"
<drilldown>
<set token="feature">$click.value$</set>
</drilldown>
</chart>
</panel>
<panel>
<title>$feature$ - Exception From Hosts Details</title>
<chart depends="$feature$">
<change>
<condition match=" $feature$ == "FileInspector" ">
<set token="querytocall">index=a source=b | eval....</set>
</condition>
<condition match=" $feature$ == "UMB" ">
<set token="querytocall">index=c source=d | eval....</set>
</condition>
</change>
<search>
<query>$querytocall$</query>
<earliest>$field1.earliest$</earliest>
<latest>$field1.latest$</latest>
</search>
Could anyone please help me on this.
... View more
08-17-2017
10:27 PM
@rvany... could you suggest me on the above concept.
... View more
08-17-2017
06:42 AM
@rvany.. Yes exactly
... View more
- « Previous
- Next »
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
01-06-2025
05:52 AM
|
