Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- Find Answers
- :
- About vasanthmss
vasanthmss
Motivator
Member since:
12-06-2013
04-28-2022
Community Statistics
| Posts | 286 |
| Solutions | 55 |
| Karma Given | 407 |
| Karma Received | 358 |
| Member Since | 12-06-2013 |
Activity Feed
- Got Karma for Re: Why are there many duplicate events in the indexer cluster?. 03-27-2025 10:52 PM
- Got Karma for Re: Is there any way to list all the saved searches in Splunk?. 11-22-2024 11:07 PM
- Got Karma for Re: How to convert a timestamp field to epoch format?. 10-31-2024 05:53 PM
- Got Karma for Re: Is there any way to list all the saved searches in Splunk?. 07-06-2023 04:04 AM
- Got Karma for Re: How to add and parse XML data in Splunk?. 12-28-2022 07:24 AM
- Got Karma for Re: How to replace line breaks with delimiters?. 08-15-2022 12:49 PM
- Karma Re: Checklist before installing Splunk for sayaksplunk. 04-28-2022 12:17 AM
- Got Karma for Re: Why are there many duplicate events in the indexer cluster?. 04-15-2022 12:13 PM
- Got Karma for Re: Is there any way to list all the saved searches in Splunk?. 04-07-2022 04:49 AM
- Got Karma for Re: Is it possible to divide all individual values in field1 by the column total of field1?. 02-06-2022 06:07 PM
- Got Karma for Re: How to freeze ONLY first column in table when scrolling the table to right or left. 02-04-2022 08:05 AM
- Got Karma for Re: How to delete events from a summary-index?. 02-03-2022 06:40 AM
- Got Karma for Re: Is there any way to list all the saved searches in Splunk?. 01-07-2022 12:09 PM
- Got Karma for Re: Why is my search producing error "The eval expression has no fields: 'round(on/total*100)'"?. 09-30-2021 10:21 AM
- Got Karma for Re: Why are there many duplicate events in the indexer cluster?. 07-01-2021 06:46 AM
- Got Karma for Re: case and isnull for multiple fields. 02-19-2021 03:42 AM
- Karma Re: Help getting multiple columns from a chart for somesoni2. 06-05-2020 12:51 AM
- Karma Re: How to include another field into the visual for woodcock. 06-05-2020 12:51 AM
- Karma Re: How to include another field into the visual for somesoni2. 06-05-2020 12:51 AM
- Karma Re: List of top URLs with hourly count > 50 for somesoni2. 06-05-2020 12:51 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 2 | |||
| 1 | |||
| 1 | |||
| 1 | |||
| 1 | |||
| 1 | |||
| 2 | |||
| 0 | |||
| 1 | |||
| 2 |
02-23-2015
12:40 PM
2 Karma
Hi Skathpal,
Try This,
Report Start = $job.earliestTime$
Report End= $job.latestTime$
For more Info Read this Link
Cheers!!!
... View more
01-28-2015
07:57 PM
3 Karma
workaround of the issue to set appServerPorts=0 in web.conf
check the web.conf
FYI,
appServerPorts = <one or more port numbers>
* Port number(s) for the python-based application server to listen on.
This port is bound only on the loopback interface -- it is not
exposed to the network at large.
* If set to "0", this will prevent the application server from
being run from splunkd. Instead, splunkweb will be started as
a separate python-based service which directly listens to the
'httpport'. This is how Splunk 6.1.X and earlier behaved.
* Generally, you should only set one port number here. For most
deployments a single application server won't be a performance
bottleneck. However you can provide a comma-separated list of
port numbers here and splunkd will start a load-balanced
application server on each one.
* It is recommended that this be set to a non-zero value. Setting
this to "0" should only be done if you experience a compatibility
problem. The new separate application server configuration is faster
and supports more configuration options. Also, setting this to
"0" may cause problems when using the Search Head Clustering feature
(see the [shclustering] stanza in server.conf)
* Defaults to 8065.
... View more
01-28-2015
11:42 AM
1 Karma
Hi splunkers,
Before upgrade there was no such errors,. From 6.1 to 6.2.1 upgrade I am getting the following error,
Here is the error I'm getting in the browser,
Proxy Error
The proxy server received an invalid response from an upstream server.
The proxy server could not handle the request GET /en-US/app/<app_name>/search.
Reason: Error reading from remote server
Apache/2.2.26 (Amazon) Server at <domain_name> Port 443
... View more
Labels
- Labels:
-
upgrade
01-16-2015
10:25 AM
Enjoy. Cheerrss!
... View more
01-16-2015
10:22 AM
I have deleted and re posted the answer.
... View more
01-16-2015
10:20 AM
1 Karma
Hi,
I have tried the field extraction from host in 6.2. Here is the sample of mine,
Host: ip-192-168-169-32
Extracted value: 169
Rex: ip-.*-.*-(?<newfield>.*)-.*
Search : index=_internal | head 10 | stats count by host | rex field=host "ip-.*-.*-(?.*)-.*" | table host, newfield
Guess this will help you,
|stats count | eval host="BUSINESS_PRODUCTION_NYC_ST06" | rex field=host "BUSINESS_PRODUCTION_(?<City>.*)_.*" | table host, City
... View more
12-19-2014
06:12 AM
8 Karma
This behaviour is because of this issue http://answers.splunk.com/answers/204021/limitation-in-relative-time-function.html
... View more
12-18-2014
11:25 PM
2 Karma
Hi Splunkers,
when i'm running first Search returns getting zero value where as second Search giving correct value. Explain me how its working,
Search 1:
|stats count | eval next_time=relative_time(now(),"-45y")
Search 2:
|stats count | eval next_time=relative_time(now(),"-45y")| convert ctime(*_time)
... View more
12-18-2014
11:19 PM
3 Karma
Hi Splunkers,
Why the relative_time function is not converting +24y? any reason? Any way to achieve this?
|stats count | eval next_time=relative_time(now(),"+24y")
Is there any limitation in relative_time function?
Cheers!!!
... View more
12-18-2014
10:32 PM
Hi,
you can select what are all the fields required to display in your table using fields command. for more read this Doc
sourcetype="data.newIndex.stats" clientId="100" | fields ColumnA, ColumnB ....
coming back to your second query, search by Column A: you can use the inputtype to define the list of Column A values and user can choose any of the values. More details read this Doc
it will be,
Define your available list of Column A values in a dropdown by writing one search like, [sourcetype=.... clientId="100" | stats count by ColumnA]. here you can mention label field and value field from your query(here both are ColumnA). user selection will be hold by a token. say for example your token name is "columnA" that holds the user selection.
Your search query will take the token as input and will return the results as per user selection. like [sourcetype=... clientid="100" ColumnA="$columnA$" | fields columnA, columnB]
Accept this answer if its helpful to you.
Cheers!
... View more
12-18-2014
10:11 PM
Hi,
If you are exporting something like csv in regular interval (like report) then you can use outputcsv command to export instead of outputlookup.
In other scenario, Assuming that you are comfortable with exported 1G and using output lookup in your search queries without any problem and replication is causing issue means then you can use either blacklist(not to take part of replication) /white list(by default all lookup will take part of replication bundle) to protect your huge lookups take part of replication bundle.
Considering this scenario, if you are using the outputlookup csv to lookup with some events and facing limitation issue then you can try with summary index. it would be easier.
Hope this will help you.
Cheers!
... View more
12-16-2014
11:02 AM
Hey,
How this will help me? are you ask me to index twice? then what happen to the license?
I would like to handle it in index time.
... View more
12-15-2014
05:40 AM
you can mention the field order using fields command,
your search .. | fields field1, field2, field3, field4....
... View more
12-12-2014
10:46 AM
is it working?
... View more
12-12-2014
10:44 AM
try to add earliest and latest in your query as explained below. is it working?
... View more
12-12-2014
10:42 AM
is it working?
... View more
12-12-2014
10:39 AM
Is it working?
... View more
12-12-2014
08:53 AM
Try this,
Populate Appid search,
| inputlookup abc.csv |dedup appid,appname | sort appid,appname | eval applabel=appid + "-" + appname
Populate Host based on Appid search, [ Assuming you have ";" as your delimiter in host field ]
| inputlookup abc.csv | eval host=split(host,";") | mvexpand host | search appid=$appid$ | stats count by host | fields host
Hope this will help you,
Cheers!
... View more
12-12-2014
05:50 AM
Hi,
As you said you want a report that will summarize hourly events(as of now 24h) you want specific duration like 00:00 to 8:00. Suppose you have scheduled your report at 9.00 AM then you can calculate your required time duration like this earliest=-9h@h latest=-1h@h . Like the above calculation you can change the earliest and latest as per your scheduled timing.
the search will be,
index=_internal earliest=-9h@h latest=-1h@h | timechart span=1h count
Cheers!
... View more
12-11-2014
09:34 PM
Hi James,
May be whenever you are delivering / after testing, manually you can move all the search to no owner / admin in the local.metadata file. Its one time activity. after changing you can use either admin / nobody based on your configuration.
$Splunk_Home$/etc/apps/<appname>/metadata/local.metadata
So don't worry about the user name, always the loadjob will work. 🙂
Cheers!
... View more
12-11-2014
08:40 PM
If its useful please accept the answer. Cheers!
... View more
12-11-2014
02:30 PM
2 Karma
Hi James,
I faced the same scenario once, Where as the index is not available in search head.(I am not sure why/how this happen).
you will came to know the same by any of the below options,
Option 1: Go to search head Settings-> Data -> Indexes and check your index is available or not.
Option 2:
1. create a search
2. schedule it based on your requirement
3. check the summary indexing check box
4. you can see the list of indexes available for summary. I guess the index which you are referring will not be available.
In that case you need create a same index in search head that will work.
Give a try.
Cherrs!
... View more
12-11-2014
01:58 PM
3 Karma
Hi,
Try this rex,
| rex field=_raw "image=(?<field1>.*)&"
to extract the "image" field and use urldecode() function to remove the url decode chars.
Sample search:
|stats count| eval _raw=" 0.0.0.0 - - [12/Dec/2014:07:43:56 +1100] \"GET /pdf.cfm?handle=pra&image=ImageName%20&src=Direct HTTP/1.1\" 302 69 \"-\" \"Mozilla/5.0 (compatible; bingbot/2.0; +http://www.bing.com/bingbot.htm)\"" | rex field=_raw "image=(?<field1>.*)&" | eval field1= urldecode(field1)
Cheeerrrsss!
... View more
12-11-2014
01:17 PM
check the above answer
... View more
12-11-2014
01:14 PM
1 Karma
Hi,
if you are getting epoch time in your output csv you can convert the _time like this,
| eval time=strftime(_time,"%Y-%m-%d %H:%M:%S")
So your search would be like this,
sourcetype=csms_log date_month=December ID begin.action | join type=outer ID [ search sourcetype=tony ID detail.identity| stats values(detail_identity) as mcn by ID|fields ID mcn] | eval time=strftime(_time,"%Y-%m-%d %H:%M:%S") | table time ID mcn begin_action _raw | outputcsv [ | stats count | eval filename=strftime(_time, "%Y%m") | return $filename]
Accept this answer if its solves your query.
Cheerrs!
... View more
