Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- About xvxt006
xvxt006
Contributor
Member since:
09-25-2012
06-05-2020
Community Statistics
| Posts | 246 |
| Solutions | 1 |
| Karma Given | 9 |
| Karma Received | 22 |
| Member Since | 09-25-2012 |
Activity Feed
- Karma FEATURE REQUEST: Splunk Alert: All Clear Notification for bandit. 06-05-2020 12:48 AM
- Got Karma for Re: To Get sum of hosts. 06-05-2020 12:48 AM
- Karma Re: Getting the counts for woodcock. 06-05-2020 12:47 AM
- Karma Re: chart over date for metrics for somesoni2. 06-05-2020 12:47 AM
- Karma Re: Can we add specific text in Alerts for stephane_cyrill. 06-05-2020 12:47 AM
- Karma Re: How to set missing data values to zero? for ppablo. 06-05-2020 12:47 AM
- Got Karma for chart with missing values. 06-05-2020 12:47 AM
- Got Karma for Can I rename the Week value from strftime(_time," %W")?. 06-05-2020 12:47 AM
- Got Karma for Re: How to subtract times for different events. 06-05-2020 12:47 AM
- Got Karma for Re: How to set missing data values to zero?. 06-05-2020 12:47 AM
- Got Karma for Re: How to set missing data values to zero?. 06-05-2020 12:47 AM
- Got Karma for Re: How to set missing data values to zero?. 06-05-2020 12:47 AM
- Got Karma for Re: How to set missing data values to zero?. 06-05-2020 12:47 AM
- Got Karma for How to set missing data values to zero?. 06-05-2020 12:47 AM
- Got Karma for How to get percentage from stats count on http statuses?. 06-05-2020 12:47 AM
- Got Karma for chart with missing values. 06-05-2020 12:47 AM
- Got Karma for How to speed up the dashboards. 06-05-2020 12:47 AM
- Got Karma for How to filter my search and only return results if response time is greater than median time?. 06-05-2020 12:47 AM
- Karma Re: Different format data for bmacias84. 06-05-2020 12:46 AM
- Karma Re: Regex for ending with a particular pattern for rsennett_splunk. 06-05-2020 12:46 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
06-01-2014
02:06 PM
i have tried the query and it is giving me all the value but it is not separating by each key. Meaning for q these are all the values, account these are all the values, index these are all the values, etc
... View more
06-01-2014
01:45 PM
Hi, if i understand it correctly, you are getting the query string into q and i did not get why you have eval q="a=".q and then you are taking that result and you are trying to separate the values using & and you have max_match=0 as it has multi value field?
... View more
05-29-2014
01:26 PM
Hi,
I have below variations of uri patterns for a particular functionality. i want to list out query string parameters and their values separately (in a tabular format or any other format).
Say for example
For q
value count
XXX 5
YYY 3
i tried to use rex and extract fileds (q, Index, items, country, lan) but as the uri formats are in different right boundaries (for example q has right boundary & in 1st and 2nd uri pattern but i the 3rd it has no &). So how do we deal with these kind of situations?
Uri formats:
/perform?q=XXX&Index=XXX&items=XXX
/perform?q=XXX&Index=XXX&items=XXX&account=&country=XXX&lan=XXX
/perform?q=YYY
/perform?q=YYY&account=XXX
/perform?q=YYY&Index=XXX&items=XXX&account=XXX&country=XXX&lan=XXX
/perform?q=XXX&account=XXX&items=XXX
/perform?q=XXX&account=XXX&country=XXX
/perform?q=XXX&Index=XXX&items=XXX
/perform?q=XXX&account=XXX&Index=XXX&items=XXX
... View more
- Tags:
- rex
05-29-2014
01:08 PM
i see that you are using eval for the acutal uri i gave. But I just gave an example to show you what i want. I have lot of events like that. I cannot put all of those in my search query right?
... View more
05-29-2014
09:50 AM
Hi,
i am using this expression - base search | rex field=uri "better\?q=(? [^&]+)$"
and i was expecting to return events which ends with having only q value but not having others as shown below.
better?q=GARAGE+DOOR+9+FT+WIDE
but it is showing all the events which have values after & (startIndex=000041&itemsperpage=0030)
better?q=GARAGE+DOOR+9+FT+WIDE&startIndex=000041&itemsperpage=0030
Any idea what i am missing here?
... View more
- Tags:
- regex
05-29-2014
06:55 AM
Thank you. So it will just remove the first character only?
so if i have uri as testuri?query=something, it will be esturi?query=something
... View more
05-29-2014
06:52 AM
Even without eval uri = substr(uri,2) i am still getting the same results
... View more
03-24-2014
08:29 PM
Dave,
i tried sourcetype=access_combined_wcookie | lookup uas_lookup http_user_agent and i see the events but when i added sourcetype=access_combined_wcookie | lookup uas_lookup http_user_agent | stats count by ua_family i am not getting any results (even though it has matching events). our user agent field name is useragent. Do i need to change anything in the lookup table to match our field names, etc?
... View more
03-12-2014
02:07 PM
Thank you. I will try this. it looks much simpler (we have splunk 6).
sourcetype=x earliest=-3mon@mon date_hour=20 date_wday="friday"|.....
if i want to use lookup table approach..i need to have 2 columns where one column has all the dates of Friday and other column would be dayoftheweek as Friday for all of them?
... View more
03-12-2014
12:23 PM
Hi,
is it possible to specify a timeframe so that i get data for every Friday 8 PM to 9 PM for the last 3 months?
... View more
- Tags:
- time
02-21-2014
11:47 AM
Thx..here is the log...
Files\Splunk\etc\apps\search\bin\sendemail.py': ERROR:root:(535, 'Authentication failed. Too many invalid logon attempts.') while sending mail to: [email protected]
02-21-2014 13:21:38.076 -0600 ERROR ScriptRunner - stderr from 'C:\Program Files\Splunk\etc\apps\search\bin\sendemail.py': ERROR:root:Connection unexpectedly closed while sending mail to: [email protected]
02-21-2014 13:32:38.088 -0600 ERROR ScriptRunner - stderr from 'C:\Program Files\Splunk\etc\apps\search\bin\sendemail.py': ERROR:root:Connection unexpectedly closed while sending
... View more
02-21-2014
11:35 AM
Hi,
i have installed splunk on my local which is windows 7. i have installed hmail server and i see that it has host name as localhost and it has username/pwd. I gave those details in the "Email Alert settings" host as localhost and corresponding username password. But i am not getting any emails. Do i need to do anything else?
... View more
- Tags:
02-19-2014
06:43 AM
that will give me top referers but i want to get top uris for 404s and then for those uris i need top referers
... View more
02-19-2014
06:28 AM
Hi, i have a report where i show top 50 404s by uri as shown below. Now i want to get the top referer for each URI in the same report. is it possible?
URI COUNT %
XXX 50 50%
YYY 25 25%
ZZZ 25 25%
output should have
URI COUNT % Referer Referercount REferer%
XXX 50 50%
YYY 25 25%
ZZZ 25 25%
... View more
- Tags:
- top
01-27-2014
04:23 PM
Thx. Since column and row 1 are not the fields i have added, i was thinking we cannot rename them. I tried and it worked fine.
... View more
01-24-2014
07:34 AM
Hi,
Can we rename row, column when we use transpose function
... View more
- Tags:
- function
01-20-2014
02:03 PM
Thank you so much Marti. This is what i wanted.
... View more
01-19-2014
01:13 PM
1 Karma
Hi,
I am getting requests by host (if we have 20 hosts) then i have 20 values. Now i want to calculate the percentage delta for each host with the average number of requests for all the host. So i got the average hosts for all the hosts and using stats i got the requests per each host. But now how do i calculate percentage delta for each host. Here is the query i have.
i have eval RequestsPctDelta = ((RequestPerHost-AverageRequests)/AverageRequests)*100
but i need somekind of for loop so that i get the RequestsPctDelta for each host? any suggestions would help a lot. Thank you.
| stats count as requests | eval AverageRequests= requests/20 | stats count as RequestPerHost by host | eval RequestsPctDelta = ((RequestPerHost-AverageRequests)/AverageRequests)*100 | table RequestsPctDelta
... View more
- Tags:
- multi
01-17-2014
10:12 AM
Hi,
we have scheduled a report and getting an email using Splunk. But we don't want to display the header info but we want just the actual data. For example below info we don't want to display. Is there an easy way not to display this info while getting an email.
Name: 'OrdersRevenueByHour'
Query Terms: ' OrdersRevenue '
Link to results: http://ap506:8000/app/search/@go?sid=scheduler__xv__search__RMD5051b14c56cfffbdc_at_1389981720_195885
Alert was triggered because of: 'Saved Search [OrdersRevenueByHour]: number of events(23)'
... View more
- Tags:
- reporting
01-14-2014
11:58 AM
Thank you. one question is, as i want to compare today vs last week by hour, how can i specify time so that every hour when i run the scheduled search it runs for this hour last week. Meaning if it is 1 pm today, it will get the numbers till 1 pm today and last week same day it should run till 1 pm. After another hour it should run till 2 pm, etc. is it possible to specify the time interval in such a way?
... View more
01-14-2014
11:15 AM
Thank you. I will try. Does this work even for numbers for same time last week?
... View more
