Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Are you a member of the Splunk Community?
Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- Find Answers
- :
- About lpolo
lpolo
Motivator
Member since:
05-10-2011
08-03-2021
Community Statistics
| Posts | 376 |
| Solutions | 17 |
| Karma Given | 73 |
| Karma Received | 137 |
| Member Since | 05-10-2011 |
Activity Feed
- Got Karma for Re: How to limit my search to return only the top 10 results based on the following search queries ?. 11-03-2024 04:54 AM
- Got Karma for How to merge two fields into one field?. 10-23-2024 09:31 AM
- Got Karma for Re: How to remove data from a bucket for a specified period of time?. 09-05-2024 08:26 AM
- Got Karma for Part 1: How to extract a json portion of an event then use spath to extract key=value pairs. 07-25-2023 01:43 AM
- Got Karma for How to merge two fields into one field?. 03-14-2023 09:50 AM
- Got Karma for Re: How to limit my search to return only the top 10 results based on the following search queries ?. 01-16-2023 05:13 PM
- Got Karma for Re: Filter values after timechart. 06-10-2022 08:59 AM
- Got Karma for How to merge two fields into one field?. 01-10-2022 05:59 AM
- Got Karma for Re: How to limit my search to return only the top 10 results based on the following search queries ?. 09-23-2021 06:18 AM
- Posted How to implement this Prometheus Query using Splunk Query Language on Splunk Enterprise. 08-03-2021 11:37 AM
- Posted Re: Source log events not forwarded after log rotation on Splunk Enterprise. 08-02-2021 08:59 AM
- Posted Re: Source log events not forwarded after log rotation on Splunk Enterprise. 07-26-2021 05:15 AM
- Posted Source log events not forwarded after log rotation on Splunk Enterprise. 07-23-2021 01:25 PM
- Got Karma for Re: How to limit my search to return only the top 10 results based on the following search queries ?. 02-08-2021 08:28 AM
- Posted Re: top 1000 by appiD on Splunk Enterprise. 07-15-2020 03:24 PM
- Posted top 1000 by appiD on Splunk Enterprise. 07-15-2020 12:41 PM
- Posted Re: Top n plus others on Splunk Enterprise. 07-06-2020 01:04 PM
- Posted Top n plus others on Splunk Enterprise. 07-06-2020 11:54 AM
- Karma Re: Regex that covers both cases for richgalloway. 06-05-2020 12:48 AM
- Karma Re: Regex that covers both cases for javiergn. 06-05-2020 12:48 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
01-31-2012
07:11 AM
2 Karma
You can use the upper() function. This function takes one string argument and returns the uppercase version. The lower() function also exists for returning the lowercase version.
Example:
|eval host=upper(host)
More information:
http://docs.splunk.com/Documentation/Splunk/4.3/SearchReference/CommonEvalFunctions
Cheers,
Lp
... View more
01-31-2012
05:47 AM
You can use roles for each set of users. By default you have these set of roles:
admin -- this role has the most capabilities assigned to it.
power -- this role can edit all shared objects (saved searches, etc) and alerts, tag events, and other similar tasks.
user -- this role can create and edit its own saved s
More information:
http://docs.splunk.com/Documentation/Splunk/latest/Admin/Addandeditroles
http://docs.splunk.com/Documentation/Splunk/latest/Admin/Aboutusersandroles
... View more
01-19-2012
10:28 AM
2 Karma
Splunk can do it without any problem.
In my case, Splunk was failing because my events were mal-form XML instances. As a result, I could not aggregate the result set with the stats function after the result set. Like for example:
| xpath "//Boolean_Filters/@* outfield="values"|stats count by values
so I used this work-around:
| xpath "//Boolean_Filters/@* outfield="values"|table linear non_linear offset
Or this one:
| xpath "//Boolean_Filters/@* outfield="values"|
stats sum(eval(if(linear="true",1,0))) as Linear_Count
sum(eval(if(non_linear="true",1,0))) as non_linear_Count
sum(eval(if(offset="true",1,0))) as offset_Count
Cheers,
Lp
Thanks,
Lp
Thanks,
Lp
... View more
01-18-2012
11:55 AM
I would like to create a Drop Down Menu using URL. How can I do it?
This is an example using time. Rather than time I need a URL.
Time span for charts
span=4h
5 Minute
10 Minutes
1 hour
4 hours
24 hours
7 days
Real-time
... View more
01-09-2012
07:37 AM
1 Karma
Is this possible in Splunk?
I have a log event with XML format. One of the XML nodes has more than one attribute. Example:
My xpath expression to get all the attributes will be:
| xpath "//Boolean_Filters/@*"
but I am unable to get the value of all the attributes. How can I do it with Splunk?
I can get the value one by one example:
| xpath "//Boolean_Filters/@linear" outfield=linear.
Thanks.
... View more
- Tags:
- xpath
01-04-2012
11:32 AM
so provide the events samples and query so we can help....
... View more
01-04-2012
08:12 AM
You might be facing a sub-search limitation. To help you let's know how many events your sub-search has...
... View more
12-08-2011
07:13 AM
I think that workflow actions will solve this problem.
http://docs.splunk.com/Documentation/Splunk/4.2.4/Knowledge/CreateworkflowactionsinSplunkWeb
... View more
12-06-2011
07:32 PM
I have the following result set:
seed
rovi$7389938
rovi$18133562
rovi$12759261
From this result set I need to make a REST API call for each row of the result set.
REST API Call:
http://rovi.com:8080/rex/select/?q=ids:seed&version=2.2&start=0&rows=10&indent=on&fl=title
For this result set example I have 3 REST API calls:
http://rovi.com:8080/rex/select/?q=ids:rovi$7389938&version=2.2&start=0&rows=10&indent=on&fl=title
http://rovi:8080/rex/select/?q=ids:rovi$18133562&version=2.2&start=0&rows=10&indent=on&fl=title
http://rovi:8080/rex/select/?q=ids:rovi$12759261&version=2.2&start=0&rows=10&indent=on&fl=title
So, the final result will be:
title seed
Parking Wars rovi$7389938
Staunton Hill rovi$18133562
Deadline rovi$12759261
Is there any particular document that I can read so I can integrate my script in Splunk?
Regards,
Lp
... View more
- Tags:
- scripted-lookups
11-29-2011
07:16 AM
Is the index _time equal to the RequestActual time?
if so you could narrow your time like for example:
earliest=-2d@d latest=-1d@d "your search query".
earliest=-2d@d latest=-1d@d sourcetype="ABC"|stats count(RequestActual) as Number_of_Request.
If you need more information read the following document:
http://docs.splunk.com/Documentation/Splunk/latest/User/ChangeTheTimeRangeOfYourSearch
... View more
11-28-2011
07:51 AM
I have the same problem but only with hot buckets. It will be nice to find out if it possible to move hot buckets without restarting splunk.
I have been able to move cold or warm buckets form one server to another server where the index name is the same on both servers.
... View more
11-28-2011
07:13 AM
1 Karma
I have the following result set:
_time Visits
Sunday, November 27, 2011 667044
Saturday, November 26, 2011 659234
Sunday, November 20, 2011 648686
Saturday, October 29, 2011 640808
Is there a way to format the Visits' number as follow?
_time Visits
Sunday, November 27, 2011 667,044
Saturday, November 26, 2011 659,234
Sunday, November 20, 2011 648,686
Saturday, October 29, 2011 640,808
Regards,
Lp
... View more
- Tags:
- results-formatting
11-28-2011
07:02 AM
It will be nice to find out it this is possible. I have the same problem.
... View more
11-23-2011
10:20 AM
If your sampling rate is hourly, your summary index in a year will have a total number of samples equal to 24 samples_per_day * 365 = 8760 events. Your summary index should be able to handle this. So, I do not see any problem.
... View more
11-22-2011
08:56 AM
Yes. props.conf does not report any other string after the ",". This is an example:
index=main sourcetype="rex-srch-qen-solr-rest_request" | top limit=3 available_zip_area
available_zip_area count percent
1 20016 81691 90.898065
2 20008 8077 8.987326
3 20045 91 0.101256
Now with rex:
index=main sourcetype="rex-srch-qen-solr-rest_request" | rex "available.zip.area=(? .*?)[&|<|?]" | top limit=3 available_zip_area
available_zip_area count percent
1 20016,20015 81691 90.898065
2 20008,20815,20816 8077 8.987326
3 20045,20016 91 0.101256
Thanks,
... View more
11-22-2011
08:30 AM
D,
It partially worked. I escaped the dots and equal signs but Splunk refuses to report consistently. For example:
In the logs:
available_zip_area=20016,20008.
Splunk just reports the first zip:
Just reports: available_zip_area=20016.
If I use the regular expression with "rex" command I can get all the zips:
available_zip_area=20016,20008.
Any idea?
Thanks,
... View more
11-22-2011
07:26 AM
I did try |extract reload=t. It did not work. The props.conf is basically what you recommended. I think that the problem is that Splunk is dealing with the "." character and it conflicts with my props.conf.
If I remove props.conf Splunk tries to extract the fields but with some inconsistencies. When I use "rex" command to test my regular expression works fine.
... View more
11-22-2011
06:09 AM
It works if you run it via "rex" search command. If you configure it in $SPLUNK_HOME/etc/system/local/props.conf it does not work. I have never been able to configure REST API logs in Splunk.
... View more
11-21-2011
11:06 AM
The content of the log is basically API REST calls. I am facing the issue of not being able to extract the fields of the API calls correctly because the order of some fields changes.
This is an example:
2011-11-21 15:03:59,926 <query id=d2f98492-94c3-48dc-bb06-525de5ca60c9>/abc/find?house.types=condo,apt,townhome,house&avail.zip.area=area-whitelist&results.limit=7&avail.db1.location=20008|X&results.start=1&q=homes&user.account=1&avail.db.device=ipad&avail.resources=mris,lf&fields=usa,ca$id,wfi,lf$id,best.worst,time.endYear,releaseYear</query>
2011-11-21 15:03:29,995 <query id=d2f98492-94c3-48dc-bb06-525de5ca60A9>/abc/find?house.types=condo,apt,townhome,house&results.limit=7&avail.db1.location=20008|X&results.start=1&q=homes&user.account=1&avail.db.device=ipad&avail.resources=mris,lf&fields=usa,ca$id,wfi,lf$id,best.worst,time.endYear,releaseYear&avail.zip.area=area-whitelist</query>
In this case field "avail.zip.area" moved its position. Any field can move to any valid position.
How can I address this issue?
Thanks,
Lp
... View more
- Tags:
- field-extraction
11-16-2011
12:06 PM
3 Karma
I have the following data indexed:
initialTime Purchase_Time
2011-11-04T13:17Z 2011-11-04 09:18:20
2011-11-04T21:08Z 2011-11-04 14:08:28
2011-11-04T15:16Z 2011-11-04 16:38:16
2011-11-04T15:15Z 2011-11-04 10:18:12
2011-11-04T21:25Z 2011-11-04 14:26:40
2011-11-04T13:35Z 2011-11-04 09:36:45
2011-11-04T20:01Z 2011-11-04 16:03:02
2011-11-04T19:31Z 2011-11-04 20:28:55
I tried to get the following result set with a splunk query:
|eval Time_Diff = initialTime - Purchase_Time
But I have not been able to...
Thanks.
... View more
11-14-2011
11:25 AM
Thanks for your help
... View more
11-14-2011
08:31 AM
1 Karma
I have the following summary index
_time Type Number
11/14/11 3:00:53.000 PM New 56802
11/14/11 2:00:44.000 PM New 56581
11/14/11 1:01:00.000 PM New 56459
11/14/11 12:00:51.000 PM New 56327
11/14/11 11:00:42.000 AM New 56187
11/14/11 10:00:58.000 AM New 55998
11/14/11 9:01:08.000 AM New 55724
11/14/11 8:01:12.000 AM New 55282
I have been not able to find a query that substract the last event "Number" with the previous one. For example
Events:
_time Type Number
11/14/11 3:00:53.000 PM New 56802
11/14/11 2:00:44.000 PM New 56581
New Number = 56802 - 56581
Result set:
New Number = 301
Thanks,
... View more
- Tags:
- stats
- streamstats
- « Previous
- Next »
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
08-03-2021
02:58 PM
|
Karma given to
