Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- Find Answers
- :
- About zacksoft
zacksoft
Contributor
Member since:
09-13-2017
06-11-2021
Community Statistics
| Posts | 336 |
| Solutions | 0 |
| Karma Given | 47 |
| Karma Received | 5 |
| Member Since | 09-13-2017 |
Activity Feed
- Karma Re: Where is the Location of knoweldge objects in the Backened? for richgalloway. 04-07-2021 10:45 AM
- Posted Where is the Location of knoweldge objects in the Backened? on Knowledge Management. 04-07-2021 08:43 AM
- Posted Subsearch append question !! on Splunk Enterprise. 11-18-2020 04:11 AM
- Posted How to I save my search query output as a lookup ? on Splunk Enterprise. 10-08-2020 04:11 AM
- Posted Re: How do I get search start time and end time value ? on Splunk Search. 09-24-2020 09:32 AM
- Posted Re: How do I get search start time and end time value ? on Splunk Search. 09-24-2020 08:58 AM
- Posted How do I get search start time and end time value ? on Splunk Search. 09-24-2020 01:10 AM
- Posted Re: How to transpose a table? (without using Transpose command) on Splunk Search. 09-09-2020 07:50 AM
- Posted How to transpose a table? (without using Transpose command) on Splunk Search. 09-09-2020 06:31 AM
- Posted Re: What is the permissible field value length ? on Splunk Search. 09-01-2020 07:03 AM
- Posted What is the permissible field value length ? on Splunk Search. 09-01-2020 06:36 AM
- Posted Re: How to match for a condition for main menu ? on Dashboards & Visualizations. 08-28-2020 04:11 AM
- Karma Re: How to match for a condition for main menu ? for richgalloway. 08-27-2020 07:19 PM
- Posted How to match for a condition for main menu ? on Dashboards & Visualizations. 08-27-2020 08:52 AM
- Posted Re: How to create an overview/menu dashboard? on Dashboards & Visualizations. 08-27-2020 04:59 AM
- Posted Re: How to create an overview/menu dashboard? on Dashboards & Visualizations. 08-27-2020 04:56 AM
- Posted Re: How to refer to a column value ? on Dashboards & Visualizations. 08-14-2020 06:31 AM
- Posted Re: How to refer to a column value ? on Dashboards & Visualizations. 08-14-2020 06:28 AM
- Karma How do you highlight a table cell based on a field of the search result? for florianduhme. 08-14-2020 05:50 AM
- Posted How to refer to a column value ? on Dashboards & Visualizations. 08-14-2020 05:23 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
06-07-2018
07:55 AM
Also when tried this
| xyseries _time jra_conn
Error generates and says "Error in 'xyseries' command: At least one data field must be specified"
... View more
06-07-2018
07:44 AM
Thanks @DalJeanis ♦ for the suggestion.
I think (not sure) the timechart or scatterplot works when when we deal with splunk fields. Mine are custom fields generated as a result of eval statements .
I tried all the plots, But the visualization won't generate.
I think the fields(jra_conn etc.) needs to be converted to multivalued and then splitted or something similar before we make it work.
... View more
06-07-2018
07:38 AM
Tried the following . Still I won't get a visualization
| table _time jra_conn
| stats values(jra_conn) by _time
... View more
06-07-2018
07:35 AM
I tried that.
| table _time jra_conn
still there won't come any visualization.
added | timechart span=1m values(jra_conn)
still no solution.
... View more
06-07-2018
07:03 AM
I have a query that end with
| table jra_conn bam_conn bib_conn
jra_conn, bam_conn, bib_conn are not Splunk fields. They are custom fields created using eval statements.
Example : jra_conns have values like
34
12
22
45
etc...
I want to be able to chart these values over time (individually for all three *_conns .)
But | timechart span=1m values(jra_conn)
won't work for me. I am thinking if I convert jra_conn to a multivalue field then may be timechart or something similar will work.
Any suggestions?
... View more
06-07-2018
04:10 AM
Every time there is a 'build' performed on our code a new log is created in the tool which is fed to Splunk and in Splunk that comes under as a new 'source'.
Example : If in Splunk there are 6 sources now and a new build is performed on our server then you see the source count will become 7. Every 5 days the build logs are deleted from the server , hence it gets automatically vanished from Splunk sources as well.
The question is, Is it possible to know the size of each source (build log) in MB/Gb (not linecount).
The sources look like,
/bsahare/bsassian/application-data/rambo/xml-data/builds/1
/bsahare/bsassian/application-data/rambo/xml-data/builds/2"
/bsahare/bsassian/application-data/rambo/xml-data/builds/234"
/bsahare/bsassian/application-data/rambo/xml-data/builds/45"
etc...
So the query starts like ,
| index=rambo host=GA20htkram001 source="/bsahare/bsassian/application-data/rambo/xml-data/builds/*"
And I am not a Splunk Administartor so my privileges are limited as a User.
... View more
- Tags:
- splunk-enterprise
06-07-2018
03:47 AM
Thanks .. This is exactly what I wanted.
... View more
06-07-2018
03:30 AM
| metadata type=sources where index=rambo
In the above command how do I put condition so that in only searches the sources that are of format "/bsahare/bsassian/application-data/rambo/xml-data/builds/*" . Currently it gives me all the sources from index rambo.
... View more
06-07-2018
03:24 AM
And in the second suggestion, | metadata type=sources | table source totalCount
It gives me all the sources of all the indexes. How do I make sure it only gives me data of index=rambo and 'source' that are of the format "/bsahare/bsassian/application-data/rambo/xml-data/builds/*" And no duplicate sources .
... View more
06-07-2018
03:14 AM
I'm applying the first suggestion.
In the visualization I'm trying column graph. How do I make sure that the source names come in X-axis and the Line Count shows in Y-axis?
Using the suggestion the visualization look weird.
Is it possible to get the top 20 sources with highest linecount?
... View more
06-07-2018
02:16 AM
I am trying to write a code where I should be able to count how many 'Sources' are there and the size/linecount of each sources.
This is what I have composed so far.
| index=rambo host=GA20htkram001 source="/bsahare/bsassian/application-data/rambo/xml-data/builds/*" | stats dc(source) as distinct_sources
... View more
06-06-2018
07:06 AM
The existing output is,
There is One row and Nine columns
And the column headers are left to right specified as a_snake a_cat a_dog b_snake b_cat b_dog .....
... View more
06-06-2018
06:15 AM
| base query with some eval commands
| table a_snake, a_cat, a_dog, b_snake, b_cat, b_dog, c_snake, c_cat, c_dog
However, I want the values to be arranged like this with the column header as SNAKE, CAT, DOG
SNAKE CAT DOG
a_snake a_cat a_dog
b_snake b_cat b_dog
c_snake c_cat c_dog
... View more
06-06-2018
06:05 AM
Is |sort _time necessary ?
Won't |head 1 alone will do the job?
Just confirming.
... View more
06-06-2018
05:52 AM
I have my query ready which essentially extracts some fields and displays in a table.
But I want to work on the latest event only.
How do I put condition so that my query only works on the latest one event?
... View more
- Tags:
- splunk-enterprise
06-06-2018
04:26 AM
Type: VIP Status | Target: /Common/phutan.mayhem.com-80-int-llb | Status: The children pool member(s) either don't have service checking enabled, or service check results are not available yet | Current Conns: ;
Type: VIP Status | Target: /Common/phutan.mayhem.com-443-int-llb | Status: The virtual server is available | Current Conns: ;
Type: Pool Status | Target: /Common/phutan.mayhem.com-443-int-llb | Status: The pool is available | Current Conns: 902;
Type: Pool Member Status | Target: 31.129.119.201:8443 | Status: Forced down | Current Conns: 0;
Type: Pool Member Status | Target: 31.129.118.245:8343 | Status: Pool member is available | Current Conns: 213;
Type: Pool Member Status | Target: 30.128.179.243:8343 | Status: Forced down | Current Conns: 0;
Type: Pool Member Status | Target: 30.128.209.65:8343 | Status: Pool member is available | Current Conns: 211;
Type: Pool Member Status | Target: 30.128.409.66:7443 | Status: Pool member is available | Current Conns: 216;
Type: Pool Member Status | Target: 30.128.209.67:7343 | Status: Pool member is available | Current Conns: 247;
Above is how one of my sample events look like.
I need help in parsing the events so that the output should look like in a table format like the following with four columns Target,Status,Current_Conns, Total_Connection fetched from the event.
Target Status Current_Conns Total_Connection
31.129.119.201:8443 Forced down 0 902
31.129.118.245:8343 Pool member is available 213
30.128.179.243:8343 Pool member is available 0
30.128.209.65:8343 Pool member is available 211
30.128.409.66:7443 Pool member is available 216
30.128.209.67:7343 Pool member is available 247
... View more
- Tags:
- splunk-enterprise
06-05-2018
03:32 AM
yes, |search request_id!="i*" works when I present the output with a table command.
But I intend to present the output in a timechart average format like below. And I am not sure where to apply the search fitering in that scenario
host=A OR B or C
| eval headers=split(_raw,"|")
| eval request_id=mvindex(headers,2)
| eval rtim=mvindex(headers,11)
| eval req_time_seconds=rtim*0.001
| timechart span=1d eval(round(avg(req_time_seconds),2)) as Average_Response_Time
... View more
06-05-2018
03:01 AM
Yes, I am.
The 'rtim' field contains "-" if reqeust_id starts with i*
I want to calculate average (i.e. | timechart span=1d eval(round(avg(rtim),2)) as Average_Response_Time) of rtim, But I am not able to do it as some of its values contain '-'.
That's why it is imperative to remove the events with request_id value with i*.
... View more
06-05-2018
02:33 AM
o*1N0FIQQx329x15798006x3 37
i*1N0FIQQx329x15798006x3 -
o*1N0FIQQx329x15798005x3 5
i*1N0FIQQx329x15798005x3 -
o*1N0FIQQx329x15798004x3 58
i*1N0FIQQx329x15798004x3 -
o*1N0FIQQx329x15798002x5 281
o*1N0FIQQx329x15798003x4 8
Above is how the output looks like.
the first column is 'request_id' and second one(mentioned in bold) is 'rtim'.
I want to remove the request_id starting with i* , because the corresponding rtim value is ' -' if reqeust_id is i*
After removing rtim with value '-' I want to be able to find the average of the column.
something like this
sourcetype="rocket:access" (host="rocket0.painpoint.com" OR host="rocket5.painpoint.com") date_wday!=saturday AND date_wday!=sunday
| eval headers=split(_raw,"|")
| eval request_id=mvindex(headers,2)
| eval rtim=mvindex(headers,11)
| eval req_time_seconds=rtim*0.001
| timechart span=1d eval(round(avg(req_time_seconds),2)) as Average_Response_Time
Could you help here ?
Because of the presence of '-' in the rtim , the timechart command won't give any result.
... View more
06-05-2018
02:18 AM
I tried adding that | where condition at the end , But after adding the search won't give me any output.
... View more
06-05-2018
01:59 AM
sourcetype="rocket:access" (host="rocket0.painpoint.com" OR host="rocket5.painpoint.com") date_wday!=saturday AND date_wday!=sunday
| eval headers=split(_raw,"|")
| eval request_id=mvindex(headers,2)
| eval rtim=mvindex(headers,11)
| table request_id,rtim
request_id contains fields such as,
o*1N0FIQQx292x15786665x0,
i*1N0FIQQx292x15786665x0
o*1N0FIQQx292x15786664x0
i*1N0FIQQx292x15786664x0
I want to exclude the field values that starts with i and their corresponding rtim value as well.
... View more
05-29-2018
04:35 AM
@niketnilay What I essentially want is, "Check for the field after second pipebar and if it starts with 'i' then exclude that event from the base search itself".
All the events where the item after second pipebar begins with i (example i*1N0HIQQx434x12481145x1) in unnecessary for me
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-11-2021
07:35 AM
|
Karma given to
