Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- About rnowitzki
rnowitzki
Builder
Member since:
05-29-2020
04-17-2024
Community Statistics
| Posts | 241 |
| Solutions | 56 |
| Karma Given | 15 |
| Karma Received | 90 |
| Member Since | 05-29-2020 |
Activity Feed
- Got Karma for Re: Data visualization over the day (by hours). 01-31-2025 07:01 AM
- Got Karma for Re: Fill null values with field values from previous line/event (conditional fillnull values). 09-11-2024 05:21 AM
- Got Karma for Re: Trigger alert on multiple events. 05-07-2024 11:37 AM
- Got Karma for Re: Trigger alert on multiple events. 05-07-2024 11:37 AM
- Got Karma for Re: Trigger alert on multiple events. 05-07-2024 11:37 AM
- Posted Re: HTTP Event Collector- Is there something wrong with this curl command? on Splunk Cloud Platform. 05-31-2023 01:26 AM
- Posted Re: How to write query to get count of total volume and system errors in a single query on Splunk Search. 05-12-2023 12:31 AM
- Posted Re: Drop 9 of 10 Events (Sampling) on Getting Data In. 03-10-2023 05:16 AM
- Posted Re: Where can I find info from Splunk wiki (props attributes)? on Deployment Architecture. 01-06-2023 04:43 AM
- Posted Re: How to achieve to _time filter with transpose? on Splunk Enterprise. 11-21-2022 12:57 PM
- Got Karma for Re: Why is Windows Event Log Whitelist not working?. 11-21-2022 09:21 AM
- Posted Re: How to achieve to _time filter with transpose? on Splunk Enterprise. 11-21-2022 07:13 AM
- Posted Re: How to achieve to _time filter with transpose? on Splunk Enterprise. 11-21-2022 01:42 AM
- Posted Re: Why is Windows Event Log Whitelist not working? on Getting Data In. 11-18-2022 01:43 AM
- Posted Re: How to achieve to _time filter with transpose? on Splunk Enterprise. 11-18-2022 12:58 AM
- Got Karma for Re: Send mail to user in search results. 06-10-2022 03:00 PM
- Got Karma for Re: Average of values of duplicate entries. 05-22-2022 11:27 PM
- Posted Re: Average of values of duplicate entries on Splunk Search. 05-18-2022 06:29 AM
- Posted Re: How do you map value from inputlookup to another search on Splunk Search. 05-12-2022 02:22 AM
- Karma Re: How do you map value from inputlookup to another search for johanhakim. 05-12-2022 02:22 AM
Topics I've Started
No posts to display.
08-13-2020
04:47 AM
Hi @priya0709 , Can you share an/some example(s) what the subject might look like? BR Ralph
... View more
08-13-2020
12:25 AM
1 Karma
Hi @edfigue, If the string looks similiar all the time, you could do it on searchtime with rex: | rex field=Description "\/localhost\_(?<new_field>\S*)\)" If it is not everytime "localhost_" in front of the data you need you would have to change it to something more generic. Hope it gives you an idea. BR Ralph -- Karma and/or Solution tagging appreciated.
... View more
08-12-2020
04:30 AM
1 Karma
Hi @ramyaashok , If you can't set/change the type to real time, you probably don't have the permission to use real time alerts. Talk to your Splunk Admin. BR Ralph
... View more
08-10-2020
07:44 AM
Hi @Snehaan , There are several ways to achieve this, search for compare time frames etc, in the community to get some inspiration. This is one way to do it: Put the search time to from:-2h@h to @h so that you have 2 full hours to compare. |timechart span=1h count by systemcode
| delta A1
| delta A2
| delta A3
| fields delta* Now you have the difference between the last and current hour. Now you could use the "foreach" logic again to find the minimum value and fire the alarm if there is anything <0. It's a not very dynamic solution. There will be better ones, but should work with your systems (A1-A3) are not changing. BR Ralph
... View more
08-10-2020
12:51 AM
Hi @Snehaan , You could probably solve it with an eval/if statement, that checks all the values. eval alert = if(system1_value >= 2 OR system2_value >= 5 OR system3_value >= 6 ..., 1 , 0) So, when any of the checks is true, that "alert" field will have "1" as value, if none of the systems reached its threshold, it will have 0. You can then base the trigger for the alert on this "alert" field. This is not dynamic, meaning you will have to know which systems are expected and set the thresholds accordingly. Hope it helps. BR Ralph
... View more
08-07-2020
03:39 AM
Glad I could help. You could mark my answer with the "foreach *" as Solution, so that it's visible for others that it was solved. I would recommend doing at least the (free) Fundamentals I training as a starter. https://www.splunk.com/en_us/training/courses/splunk-fundamentals-1.html Cheers Ralph -- Karma and/or Solution tagging appreciated.
... View more
08-07-2020
03:25 AM
Hi @Snehaan , yes, exactly. That should do it. BR Ralph -- Karma and/or Solution tagging appreciated.
... View more
08-07-2020
03:19 AM
Ah ok, that's what I assumed. So there is no prefix that catches them all. So my last SPL, with the "foreach *" should work for you. BR Ralph -- Karma and/or Solution tagging appreciated.
... View more
08-07-2020
03:16 AM
Hi @sanjeevreddy , You need the Splunk Add-on for BMC Remedy https://splunkbase.splunk.com/app/3087/ And then follow the steps here https://docs.splunk.com/Documentation/AddOns/released/Remedy/Usecustomalertactions BR Ralph -- Karma and/or Solution tagging appreciated.
... View more
08-07-2020
03:05 AM
Can you paste how your table looks like after your timechart command. I guess you don't see a new column, because the field/columns are not titled with TradeCountsomething. Is the title maybe just A1, A2, A3? Should also work with just "*", so like: index=qrp STAGE IN (TRADE_EVENT)
| bucket _time span=1h
| timechart useother=f span=1h sum(TRADES) as "TradeCount" by ODS_SRC_SYSTEM_CODE
| fillnull value=0
| foreach * [eval Min=case(Min<<<FIELD>>,Min,true(),<<FIELD>>)] If not, please copy the result table as you see it in Splunk. Maybe even as Screenshot. BR Ralph -- Karma and/or Solution tagging appreciated.
... View more
08-07-2020
02:35 AM
Hi @Snehaan , Do you know the possible values for ODS_SRC_SYSTEM_CODE? Is it dynamic, or a pretty set range of values? If you know them, and it's not like hundreds, you could add a custom trigger and put it like. TradeCountA1=0 OR TradeCountA2=0 OR TradeCountA3=0 ... Another option is to add a Column that gets the smallest value of all TradeCount* fields for each row. If this new field=0 you can trigger the alert, because at least one of them has "0". | foreach TradeCount*
[eval Min=case(Min<<<FIELD>>,Min,true(),<<FIELD>>)] Hope it helps. BR Ralph -- Karma and/or Solution tagging appreciated.
... View more
08-07-2020
02:08 AM
2 Karma
Hi @wu_weidong , I came up with something that seems to work. | makeresults
| eval ID = "1 2 3 4 5 6 7 8 9 10"
| makemv ID
| mvexpand ID
| eval country = case(ID=1,"US",ID=2,"Australia",ID=3,"Japan",ID=4,"China",ID=5,"Canada",ID=6,"US",ID=7,"Australia",ID=8,"Japan",ID=9,"China",ID=10,"Canada")
| eval count = case(ID=1,"10",ID=2,"4",ID=3,"5",ID=4,"0",ID=5,"4",ID=6,"10",ID=7,"5",ID=8,"4",ID=9,"2",ID=10,"0")
| eval _time = case(ID=1,_time,ID=2,_time,ID=3,_time,ID=4,_time,ID=5,_time,ID=6,_time-700000,ID=7,_time-700000,ID=8,_time-700000,ID=9,_time-700000,ID=10,_time-700000)
| timechart span=7d sum(count) as EventCount by country
| eval Period=if(_time < relative_time(now(), "-7d@d"), "LastWeek", "ThisWeek")
| transpose header_field=Period
| eval PercentChange= if(LastWeek!=0,(ThisWeek-LastWeek)/LastWeek*100,ThisWeek*100)
| where column!="_time" AND column!="_span" AND column!="_spandays"
| rename column as country
| fields - LastWeek, ThisWeek
| geom geo_countries featureIdField=country The first 7 rows are just to create some sample data that I could work with. You need the stuff beginning with the timechart command. I used transpose instead of streamstats. so that you can work with the LastWeek and ThisWeek columns to calculate the PercentChange. You will have to play around with the coloring of the map. Maybe make the ones where the LastWeek is 0 default to 100, so you have an expected range (-100 to +100) that you can work with. Hope it helps. BR Ralph -- Karma and/or Solution tagging appreciated.
... View more
08-06-2020
06:09 AM
Ok, that note is true, it takes a while. It depends if you want your Environment and the data in it to be available during the maintenance. If you have a change window, and the Environment is not in use anyways you'd be faster with just stopping and removing the peer, but I'd not recommend it. Best Regards Ralph
... View more
08-06-2020
05:19 AM
Like I wrote earlier, "stop" is not recommended. Independent from SF. Use "offline" instead. BR Ralph
... View more
08-06-2020
05:09 AM
Hi @jiaqya , Yes, also use "offline" in that case. It does not make a difference if use "stop" or "offline" looking at data that is available/searchable or not. It's just a smoother procedure in terms of closing bucket/idx activity. Assuming you have RF>1, what happened when you took the one peer down, is that the Buckets on that node that were "primary" (=searchable) are now "primary" on another node, which took probably some time as there was no metadata (idx files) for these buckets on the other node(s). I would recommend to set SF to at least 2. Also see https://docs.splunk.com/Documentation/Splunk/latest/Indexer/Bucketsandclusters When you add the peer back to the cluster, the Buckets will be spread again even across the available nodes until RF and SF is met again. Should not cause any harm to the data. -- Karma and/or Solution tagging appreciated.
... View more
08-06-2020
03:44 AM
Hi @jiaqya , You better use "splunk offline" on the Peer where the maintenance is going on. https://docs.splunk.com/Documentation/Splunk/8.0.5/Indexer/Takeapeeroffline "Caution: Do not use splunk stop to take a peer offline. Instead, use splunk offline. It stops the peer in a way that minimizes disruption to your searches" BR Ralph
... View more
08-05-2020
01:54 AM
Hi @saireddy , Is the tracking id the same in all backends, or would you have to resolve it first with another ID? If you know the tracking id and it's unique across all Backends, you could just work with transaction or even stats. Can you share some example events? Maybe change some wording/IDs/IPs to anonymize it. BR Ralph
... View more
08-04-2020
01:55 AM
Hi @ksharma7 , This is the "Single Value" Visualization. You can select it for the panel, when you put your Dashboard in edit mode (=> "select visualization" button). Hope this answers your question. BR Ralph
... View more
08-04-2020
01:06 AM
Hi @Sunjux , Ugh, that is strange, I don't know what kind of data would result in "invalid" for the typeof() function. Is there no visible difference between query and csv_query? Maybe one of them in quotes and the other not or something like that? What you could try is to transform both of them to string. But I am not sure if it works with the csv_query in that case. See if the "confirmation" SPL works like that: sourcetype="isc:bind:query"
| stats count(query) by query
| sort - count
| fields query
| eval query=tostring(query)
| appendcols
[| inputlookup DnsQueryLog.csv | eval query=tostring(query) | rename query as csv_query]
| eval compare=if(query==csv_query, "equal", "not_equal")
| eval type_of_query=typeof(query)
| eval type_of_csv_query=typeof(csv_query) If that works, you might want to try the initial SPL again like this: sourcetype="isc:bind:query"
| stats count(query) by query
| sort - count
| fields query
| eval query=tostring(query)
| search NOT
[| inputlookup DnsQueryLog.csv | eval query=tostring(query) | fields query]
... View more
07-31-2020
12:32 AM
Hi @srikanth88infy, Another option, when you to look at the last week as a "full week", and not -7days | <search to get this weeks durations>
|appendcols [search earliest=-1w@w latest=@w <search to get last weeks durations> ] "-1w@w" means: Beginning of last week (by default sunday). "@w" means beginning of this week. If you want to start monday, you could put earliest to "-1w@w+1d" and latest "@w+1d" But it uses a subsearch, so from a performance perspective @gcusello's approach is better.
... View more
07-30-2020
06:28 AM
Hi @inayath_khanin , As "latest" is working against the _time field, you will have to work with max() And before that, convert the patch_date to epoch: base search
| eval patch_date_epoch=strptime(patch_date,"%Y-%m-%d %H:%M:%S")
| stats max(patch_date_epoch) as patch_date_epoch by patch_date,region,server,os_type,location
| fields - patch_date_epoch Hope it works. BR Ralph -- Karma and/or Solution Tagging appreciated.
... View more
07-30-2020
05:55 AM
Hi @inayath_khanin , Can you please share the format/an example of "patch_date"? You probably have to transform it to a date field in order to work with it. I assume it is treated as a string. Check strptime() : https://docs.splunk.com/Documentation/Splunk/8.0.5/SearchReference/DateandTimeFunctions BR Ralph
... View more
07-30-2020
03:36 AM
1 Karma
Hi @Sunjux , Interesting. Maybe there is something different to the query fields. Could be data type e.g. Try this to confirm: sourcetype="isc:bind:query"
| stats count(query) by query
| sort - count
| fields query
| appendcols
[| inputlookup DnsQueryLog.csv | rename query as csv_query]
| eval compare=if(query==csv_query, "equal", "not_equal")
| eval type_of_query=typeof(query)
| eval type_of_csv_query=typeof(csv_query) It should show equal in the "compare" field, if the fields are really equal, looking at content and type. In type_of_query/type_of_csv_query it will show probably string in both cases...but just make sure it is the same. If that does not solve the riddle, can you maybe show one/some examples of "query" in that case? You could change some characters to anonymize the data. BR Ralph
... View more
07-30-2020
03:18 AM
Hi @chookp , I think it is because you assign something to _time in the line just above the | chart by command. I assume that this removes the default time/date fields like date_wday. As you don't seem to work with the "new" _time field afterwards, you should be good with just removing (or renaming to something different) that "AS _time" part of the line. Not related, but in your last line you should remove the "by" in sort by. No "by" needed. And in addition add a zero "0", because by default the sort command is limited to 10.000 events. | sort 0 - Operation_Time(Mins) BR Ralph
... View more
07-30-2020
02:54 AM
1 Karma
Hi @Sunjux , I made some tests and my assumption is that it does not work as you expect due to additional fields (other than "query") in your csv. Is that the case - do you have more fields in that csv? So, you might want to try: sourcetype="isc:bind:query"
| stats count(query) by query
| sort - count
| fields query
| search NOT
[| inputlookup DnsQueryLog.csv | fields query] Hope it helps BR Ralph -- Karma and/or Solution Tagging appreciated.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
04-17-2024
10:29 AM
|
Karma given to
