Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Are you a member of the Splunk Community?
Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- Find Answers
- :
- About vasanthmss
vasanthmss
Motivator
Member since:
12-06-2013
04-28-2022
Community Statistics
| Posts | 286 |
| Solutions | 55 |
| Karma Given | 407 |
| Karma Received | 358 |
| Member Since | 12-06-2013 |
Activity Feed
- Got Karma for Re: Why are there many duplicate events in the indexer cluster?. 03-27-2025 10:52 PM
- Got Karma for Re: Is there any way to list all the saved searches in Splunk?. 11-22-2024 11:07 PM
- Got Karma for Re: How to convert a timestamp field to epoch format?. 10-31-2024 05:53 PM
- Got Karma for Re: Is there any way to list all the saved searches in Splunk?. 07-06-2023 04:04 AM
- Got Karma for Re: How to add and parse XML data in Splunk?. 12-28-2022 07:24 AM
- Got Karma for Re: How to replace line breaks with delimiters?. 08-15-2022 12:49 PM
- Karma Re: Checklist before installing Splunk for sayaksplunk. 04-28-2022 12:17 AM
- Got Karma for Re: Why are there many duplicate events in the indexer cluster?. 04-15-2022 12:13 PM
- Got Karma for Re: Is there any way to list all the saved searches in Splunk?. 04-07-2022 04:49 AM
- Got Karma for Re: Is it possible to divide all individual values in field1 by the column total of field1?. 02-06-2022 06:07 PM
- Got Karma for Re: How to freeze ONLY first column in table when scrolling the table to right or left. 02-04-2022 08:05 AM
- Got Karma for Re: How to delete events from a summary-index?. 02-03-2022 06:40 AM
- Got Karma for Re: Is there any way to list all the saved searches in Splunk?. 01-07-2022 12:09 PM
- Got Karma for Re: Why is my search producing error "The eval expression has no fields: 'round(on/total*100)'"?. 09-30-2021 10:21 AM
- Got Karma for Re: Why are there many duplicate events in the indexer cluster?. 07-01-2021 06:46 AM
- Got Karma for Re: case and isnull for multiple fields. 02-19-2021 03:42 AM
- Karma Re: Help getting multiple columns from a chart for somesoni2. 06-05-2020 12:51 AM
- Karma Re: How to include another field into the visual for woodcock. 06-05-2020 12:51 AM
- Karma Re: How to include another field into the visual for somesoni2. 06-05-2020 12:51 AM
- Karma Re: List of top URLs with hourly count > 50 for somesoni2. 06-05-2020 12:51 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 2 | |||
| 1 | |||
| 1 | |||
| 1 | |||
| 1 | |||
| 1 | |||
| 2 | |||
| 0 | |||
| 1 | |||
| 2 |
12-10-2014
08:51 PM
2 Karma
Hi all,
I would like to index JSON data like this, My ultimate aim is to move the fields(college, university, examdate) to the individual array element and index.
college=college1 studentname=name1 mark=98 subject=science university=university1 examdate=10-12-14
college=college1 studentname=name2 mark=99 subject=science university=university1 examdate=10-12-14
college=college2 studentname=name21 mark=80 subject=science university=university1 examdate=10-12-14
college=college2 studentname=name22 mark=100 subject=science university=university1 examdate=10-12-14
Sample JSON,
{
"studentsmarks": {
"subject": "science",
"university": "university1",
"examdate": "10-12-14"
},
"students": [
{
"college": "college1",
"studentname": "name1",
"mark": "98"
},
{
"college": "college1",
"studentname": "name2",
"mark": "99"
},
{
"college": "college2",
"studentname": "name21",
"mark": "80"
},
{
"college": "college2",
"studentname": "name22",
"mark": "100"
}
]
}
Cheeerrss!
... View more
12-10-2014
08:22 PM
2 Karma
Hi Henry,
try this,
sourcetype=x,as_log ID | table _time ID mcn begin_action Desc _raw | outputcsv [ | stats count | eval filename=strftime(now(), "%Y%m") | return $filename]
The above query will help you to get the today's date. your can change the sub search based on your requirement like instead of now() you can use any date param.
Cheersss!
... View more
12-10-2014
07:17 PM
Check this answer,
http://answers.splunk.com/answers/88638/xml-viewer-for-splunk-pretty-xml.html
... View more
12-08-2014
03:25 PM
Check this answer,
http://answers.splunk.com/answers/88638/xml-viewer-for-splunk-pretty-xml.html
... View more
12-08-2014
03:02 PM
Try the following steps,
check the extracted fields - [ what are the fields got extracted?]
Validate you JSON by copy and paste the _raw - http://jsonviewer.stack.hu/ or any
share the sample JSON and Extracted fields. May be like, events.{}
I guess there is some issue with the data. JSON object was not be formed correctly. Ensure that members / Objects are separated by comma(,).
... View more
12-08-2014
02:54 PM
Read this,
Docs
Output.conf
... View more
12-08-2014
02:48 PM
3 Karma
Here are the few suggestions,
Move the searches to admin / nobody level.
Use search template to create dashboards - It will ensure the res-usability.
If the above two steps not helps then increasing number of concurrent searches will be the only option.
Cheers.
... View more
12-08-2014
02:40 PM
could you provide supportive sample data?
... View more
12-08-2014
08:55 AM
1 Karma
Hi Try this,
your search...| chart count over events by _time
... View more
12-04-2014
12:46 PM
2 Karma
_raw = {"studentsmarks":{"subject":"science","university":"university1","examdate":"10-12-14"},"students":[{"college":"college1","studentname":"name1","mark":"98"},{"college":"college1","studentname":"name2","mark":"99"},{"college":"college2","studentname":"name21","mark":"80"},{"college":"college2","studentname":"name22","mark":"100"}]}
JSON Format
{
"studentsmarks": {
"subject": "science",
"university": "university1",
"examdate": "10-12-14"
},
"students": [
{
"college": "college1",
"studentname": "name1",
"mark": "98"
},
{
"college": "college1",
"studentname": "name2",
"mark": "99"
},
{
"college": "college2",
"studentname": "name21",
"mark": "80"
},
{
"college": "college2",
"studentname": "name22",
"mark": "100"
}
]
}
Expected results,
college studentname mark subject university examdate
college1 name1 98 science university1 10-12-14
college1 name2 99 science university1 10-12-14
college2 name21 80 science university1 10-12-14
college2 name22 100 science university1 10-12-14
... View more
12-02-2014
01:01 PM
Try this,
search.... | eventstats count | where count < 50 | do the rex...
... View more
12-02-2014
10:56 AM
1 Karma
Hi There,
Identify the transaction duration based on individual field, field3,fiel4 values. Events may not be same as below sample, events may be indexed like a,b,a,a,a,b,b,c.
Transaction Rule,
Transaction starts when the events field1, field2 has 1,0 with continuous field1,fiel2 has 1,1 then pick the first event time.
Transaction ends with either field1,fiel2 has 8,0 or 9,0.
Sample Events,
time field field1 field2 field3 field4
. a 1 0 xx xx *
. a 1 1 xx xx
a 1 0 xx xx
a 2 1 xx xx
a 1 0 xx xx
a 9 0 xx xx *
a 1 0 xy xx *
a 1 1 xy xx
a 1 0 xy xx
a 2 1 xy xx
a 1 0 xy xx
a 8 0 xy xx *
b 1 0 xx xx *
b 1 0 xx xx
b 1 0 xx xx
b 1 1 xx xx
b x x xx xx
.
.
.
b 9 8 xx xx
b 8 0 xx xx *
Expected Results,
field fiele2 field3 duration
a xx xx 10:00
a xy xy 5:00
b xx xx 15:00
... View more
- Tags:
- complex
- transaction
12-01-2014
07:23 PM
Hi Mahmudomer,
You can monitor any local / Remote directory from command line by running command with required parameter.
Local,
./splunk add monitor <log path>
In-Case the files are in remote then you can use TCP/UDP. Read Splunk documentation Link
Mount filesystem / soft link may help you .
... View more
11-25-2014
10:06 AM
Try this,
search source=C:\Users\risingh\Desktop\qtree\dfsback.txt | [index=qt | stats count by Qtree | table Qtree | rename Qtree as search | format ]
Sub search will gives you the list of Qtree's from 'qt'.
Overall search will gives you the _raw data from the sourcefile which are matching Qtree from qt index.
... View more
11-21-2014
12:22 PM
1 Karma
Try this,
index=<your index> sourcetype=<sourcetype> | stats count as vulnerabilities by ip,vuln_type,source | sort -count | table vuln_type,vulnerabilities
... View more
11-20-2014
09:33 PM
Hi Nidet,
Share some some sample logs / details which are available in the files, and kindly share what you want to compare exactly.
... View more
11-19-2014
10:04 PM
1 Karma
Hi Splunkers,
How to connect catalog database using dbconnect application?
Is there any app provides support to load data from catalog database?
Give some sample config or share some thoughts on this.
Thanks!
... View more
11-19-2014
09:02 PM
You can put your custom field filter into "search time restrictions" on the Roles. Go to Settings-> Access controls » Roles -> YOur Role for each user -> Search Restrictions -> Restrict search terms"
Or create some lookup with following details user roles and required fields. Use the lookup in youe search.
you can retrieve the logged in user details by using this query,
| rest /services/authentication/current-context splunk_server=local | table username,realname,roles
Check this post http://answers.splunk.com/answers/28633/current-user-in-search.html
... View more
11-18-2014
09:48 PM
Config are populated in splunk? What is the error while connecting
... View more
11-18-2014
09:42 PM
Splunkd is running as root or other user. Check the splunk path has been assigned for that user
... View more
11-18-2014
09:24 PM
Ensure the splunk home variable is set properly.
Is it first time you are installing? Or was it previously running and giving this error?
If its first time installing means try to re install and do step by step config.
If Existing connection or suddenly ur getting this error means you need to check the state.xml
... View more
11-18-2014
05:04 PM
Do you have any auto increment field or other constraints? Check your constrain fields.you can query the table fields desc. Compare it wit your qry. It should work.
If possible desc your table and query.
... View more
11-18-2014
04:40 PM
Add a transaction command next to earlier one based on your req.
... View more
