About uagraw01

uagraw01 · ‎01-18-2024

Hello Splunkers!! I have pasted my dashboard code and in this text I am attaching screenshot of macro. When I am passing the below macros in dashboard it is not working fine. Please suggest how to proceed further ?

uagraw01 · ‎01-18-2024

<row> <panel> <title>General Filters</title> <input type="time" token="time" id="my_date_range" searchWhenChanged="true"> <label>Select the Time Range</label> <default> <earliest>-7d@h</earliest> <latest>now</latest> </default> <change> <eval token="time.earliest_epoch">if('earliest'="",0,if(isnum(strptime('earliest', "%s")),'earliest',relative_time(now(),'earliest')))</eval> <eval token="time.latest_epoch">if(isnum(strptime('latest', "%s")),'latest',relative_time(now(),'latest'))</eval> <eval token="macro_token">if($time.latest_epoch$ - $time.earliest_epoch$ > 2592000, "throughput_macro_summary_1d",if($time.latest_epoch$ - $time.earliest_epoch$ > 86400, "throughput_macro_summary_1h","throughput_macro_raw"))</eval> <eval token="form.span_token">if($time.latest_epoch$ - $time.earliest_epoch$ > 2592000, "d", if($time.latest_epoch$ - $time.earliest_epoch$ > 86400, "h", $form.span_token$))</eval> </change> </input> </panel></row> <row> <panel> <chart> <title>Total Pallet</title> <search> <query>|`$macro_token$(span_token="$span_token$")` |strcat "raw" "," location group_name | timechart span=1d count by location</query> <earliest>$time.earliest$</earliest> <latest>$time.latest$</latest> </search> <option name="charting.chart">column</option> <option name="charting.chart.stackMode">stacked</option> <option name="charting.drilldown">none</option> <option name="refresh.display">progressbar</option> </chart> </panel> </row> </form>

uagraw01 · ‎01-09-2024

@inventsekar The page below is likewise broken. I tried the URL you suggested. That indicates that the problem is with all the other folders where the macro is resistant, right?

uagraw01 · ‎01-09-2024

Hello Splunkers!! While accessing the advance search setting macro page is not visible anymore. We have a macro folder that is present under the app default folder but is not visible on the UI.

uagraw01 · ‎12-18-2023

Hello Splunkers !! I am getting below while executing the search . Please let me know why this error occurs and help me fix the issue.

uagraw01 · ‎12-06-2023

@ITWhisperer I have included _time in my search, and the results are still the same.

uagraw01 · ‎12-06-2023

@ITWhisperer Thats also not workng. See the below events from the search and want the expected visualization.

uagraw01 · ‎12-06-2023

@ITWhisperer group_name is the raw.location and in the visualisation they are using. I want the same Visualisation as mentioned earlier.

uagraw01 · ‎12-06-2023

@ITWhisperer No results, I think strcat is working together with location and group_name

uagraw01 · ‎12-06-2023

@ITWhisperer Below is the visualization I am getting after changing from stats to chart.

uagraw01 · ‎12-06-2023

Hello Splunkers!! index=messagebus "AsrLocationStatusUpdate.AsrLocationStatus.LocationQualifiedName"="ASR/Hb/*/Entry*" OR "AsrLocationStatusUpdate.AsrLocationStatus.LocationQualifiedName"="ASR/Hb/*/Exit*" | stats count by "AsrLocationStatusUpdate.AsrLocationStatus.LocationQualifiedName" |fields - _raw | fields AsrLocationStatusUpdate.AsrLocationStatus.LocationQualifiedName | rex field=AsrLocationStatusUpdate.AsrLocationStatus.LocationQualifiedName "(?<location>Aisle\d+)" | fields - AsrLocationStatusUpdate.AsrLocationStatus.LocationQualifiedName |strcat "raw" "," location group_name | stats count BY location group_name Current visualisation I am getting by above search in column chart: I want to obtain below visualization. Please guide me what changes I need to used in my current SPL to obtain below visualization.

uagraw01 · ‎12-04-2023

@azteksites I am still confused for 00:00 (for last two pattern )

uagraw01 · ‎12-04-2023

Thanks for the answer . By the way have you missed %M ? should be like this: %Y-%m-%dT%H:%M:%S,%3Q+00:00

uagraw01 · ‎12-04-2023

Please help me to get the time format for the below string in props.conf. I am confused with the last three patterns (533+00:00) 2023-12-05T04:21:21,533+00:00 Thanks in advance.

uagraw01 · ‎11-30-2023

@richgalloway But why this messages occurs ? Any specific reason ?

uagraw01 · ‎11-30-2023

The Splunkd logs are sending me the messages listed below. Three days later, the alerts reappear once Splunkd has restarted. However, I've since made some adjustments to indexes.conf and added two attributes. maxHotBuckets = 5 minHotIdleSecsBeforeForceRoll = auto Please advise if both settings are sufficient to permanently remove the information messages. 11-04-2023 15:40:09.545 +0100 INFO HotBucketRoller - finished moving hot to warm bid=asr~308~34353497-7F2F-41CB-B772-DAF7007EA623 idx=abs from=hot_v1_308 to=db_1698249739_1698190953_308 size=786313216 caller=lru maxHotBuckets=3, count=4 hot buckets,evicting_count=1 LRU hots 11-03-2023 22:07:29.511 +0100 INFO HotBucketRoller - finished moving hot to warm bid=_internal~379~34353497-7F2F-41CB-B772-DAF7007EA623 idx=_internal from=hot_v1_379 to=db_1698211695_1698040811_379 size=1048535040 caller=lru maxHotBuckets=3, count=4 hot buckets,evicting_count=1 LRU hots 11-01-2023 07:31:25.596 +0100 INFO HotBucketRoller - finished moving hot to warm bid=_audit~69~34353497-7F2F-41CB-B772-DAF7007EA623 idx=_audit from=hot_v1_69 to=db_1696240764_1695536757_69 size=786419712 caller=lru maxHotBuckets=3, count=4 hot buckets,evicting_count=1 LRU hots 10-31-2023 19:58:48.033 +0100 INFO HotBucketRoller - finished moving hot to warm bid=messagebus~140~34353497-7F2F-41CB-B772-DAF7007EA623 idx=melod from=hot_v1_140 to=db_1696974841_1696841261_140 size=786358272 caller=lru maxHotBuckets=3, count=4 hot buckets,evicting_count=1 LRU hots 10-31-2023 17:23:48.700 +0100 INFO HotBucketRoller - finished moving hot to warm bid=asr~303~34353497-7F2F-41CB-B772-DAF7007EA623 idx=adr from=hot_v1_303 to=db_1697800494_1697727845_303 size=785281024 caller=lru maxHotBuckets=3, count=4 hot buckets,evicting_count=1 LRU hots 10-29-2023 00:03:30.635 +0200 INFO HotBucketRoller - finished moving hot to warm bid=_internal~376~34353497-7F2F-41CB-B772-DAF7007EA623 idx=_internal from=hot_v1_376 to=db_1673823600_1673823600_376 size=40960 caller=lru maxHotBuckets=3, count=4 hot buckets,evicting_count=1 LRU hots 10-27-2023 12:24:16.567 +0200 INFO HotBucketRoller - finished moving hot to warm bid=messagebus~138~34353497-7F2F-41CB-B772-DAF7007EA623 idx=melod from=hot_v1_138 to=db_1696587710_1696461161_138 size=786423808 caller=lru maxHotBuckets=3, count=4 hot buckets,evicting_count=1 LRU hots 10-25-2023 07:28:42.146 +0200 INFO HotBucketRoller - finished moving hot to warm bid=_internal~374~34353497-7F2F-41CB-B772-DAF7007EA623 idx=_internal from=hot_v1_374 to=db_1697476202_1697263512_374 size=1048510464 caller=lru maxHotBuckets=3, count=4 hot buckets,evicting_count=1 LRU hots 10-24-2023 06:36:55.716 +0200 INFO HotBucketRoller - finished moving hot to warm bid=asr~293~34353497-7F2F-41CB-B772-DAF7007EA623 idx=adr from=hot_v1_293 to=db_1697038969_1696983723_293 size=786386944 caller=lru maxHotBuckets=3, count=4 hot buckets,evicting_count=1 LRU hots 10-20-2023 13:15:13.165 +0200 INFO HotBucketRoller - finished moving hot to warm bid=asr~286~34353497-7F2F-41CB-B772-DAF7007EA623 idx=adr from=hot_v1_286 to=db_1696492029_1696421708_286 size=785948672 caller=lru maxHotBuckets=3, count=4 hot buckets,evicting_count=1 LRU hots 10-17-2023 08:50:44.494 +0200 INFO HotBucketRoller - finished moving hot to warm bid=_internal~373~34353497-7F2F-41CB-B772-DAF7007EA623 idx=_internal from=hot_v1_373 to=db_1697263511_1697083171_373 size=1048502272 caller=lru maxHotBuckets=3, count=4 hot buckets,evicting_count=1 LRU hots 10-16-2023 19:10:28.534 +0200 INFO HotBucketRoller - finished moving hot to warm bid=_internal~372~34353497-7F2F-41CB-B772-DAF7007EA623 idx=_internal from=hot_v1_372 to=db_1697083169_1696908238_372 size=1048461312 caller=lru maxHotBuckets=3, count=4 hot buckets,evicting_count=1 LRU hots 10-15-2023 18:10:43.940 +0200 INFO HotBucketRoller - finished moving hot to warm bid=_introspection~230~34353497-7F2F-41CB-B772-DAF7007EA623 idx=_introspection from=hot_v1_230 to=db_1683689783_1619379864_230 size=413696 caller=lru maxHotBuckets=3, count=3 hot buckets + 1 quar bucket,evicting_count=1 LRU hots 10-14-2023 21:26:48.653 +0200 INFO HotBucketRoller - finished moving hot to warm bid=_audit~67~34353497-7F2F-41CB-B772-DAF7007EA623 idx=_audit from=hot_v1_67 to=db_1694945963_1694438187_67 size=786403328 caller=lru maxHotBuckets=3, count=4 hot buckets,evicting_count=1 LRU hots 10-14-2023 08:06:09.886 +0200 INFO HotBucketRoller - finished moving hot to warm bid=_internal~369~34353497-7F2F-41CB-B772-DAF7007EA623 idx=_internal from=hot_v1_369 to=db_1696504588_1696317607_369 size=1047363584 caller=lru maxHotBuckets=3, count=4 hot buckets,evicting_count=1 LRU hots 10-14-2023 05:02:31.677 +0200 INFO HotBucketRoller - finished moving hot to warm bid=wmc~44~34353497-7F2F-41CB-B772-DAF7007EA623 idx=www from=hot_v1_44 to=db_1695949104_1695348831_44 size=786358272 caller=lru maxHotBuckets=3, count=4 hot buckets,evicting_count=1 LRU hots 10-12-2023 05:59:51.941 +0200 INFO HotBucketRoller - finished moving hot to warm bid=_internal~367~34353497-7F2F-41CB-B772-DAF7007EA623 idx=_internal from=hot_v1_367 to=db_1696102911_1695901400_367 size=1048420352 caller=lru maxHotBuckets=3, count=4 hot buckets,evicting_count=1 LRU hots 10-11-2023 17:43:09.179 +0200 INFO HotBucketRoller - finished moving hot to warm bid=asr~284~34353497-7F2F-41CB-B772-DAF7007EA623 idx=adr from=hot_v1_284 to=db_1696364124_1696299722_284 size=786280448 caller=lru maxHotBuckets=3, count=4 hot buckets,evicting_count=1 LRU hots 10-10-2023 23:54:56.050 +0200 INFO HotBucketRoller - finished moving hot to warm bid=messagebus~135~34353497-7F2F-41CB-B772-DAF7007EA623 idx=melod from=hot_v1_135 to=db_1696039435_1695914107_135 size=786350080 caller=lru maxHotBuckets=3, count=4 hot buckets,evicting_count=1 LRU hots

uagraw01 · ‎11-27-2023

@ITWhisperer I will try this by tommorow when I am on my machine as a workaround. I am still not figuring out from where two extra stash file created. Please help me to identify those things. What do I need to check? I have checked audit index logs and internal index logs but nothing I have found.

uagraw01 · ‎11-27-2023

@ITWhisperer Thanks, for sharing that valuable video. I have question, consider my below search which I am using to append the result in summary index. But here I am not using any subsearches, so where I can use your suggested workaround here ? index=ABC (sourcetype=DepTsuEventTrackingUpdate DepTsuEventTrackingUpdate.LocationQualifiedName=Tray* DepTsuEventTrackingUpdate.TsuSuspect.TsuSuspectReason!=null AND DepTsuEventTrackingUpdate.TsuSuspect.TsuSuspectReason!="TsuUnknownContent") OR (sourcetype=DepTsuEventContentMove) | foreach *.OrderId [| eval OrderId=coalesce('OrderId','<<FIELD>>')] | replace ProtrusionFront with Protrusion , ProtrusionBack with Protrusion , ProtrusionLeft with Protrusion , ProtrusionRight with Protrusion , ProtrusionTop with Protrusion | rename DepTsuEventTrackingUpdate.TsuSuspect.CheckResult.CheckType as Error DepTsuEventTrackingUpdate.TsuSuspect.TsuSuspectReason as TsuSuspectReason DepTsuEventContentMove.SenderFmInstanceName as Location DepTsuEventTrackingUpdate.TsuId as TsuId DepTsuEventContentMove.TsuContent.Quantity as Quantity DepTsuEventContentMove.LocationQualifiedName as TrayLoad DepTsuEventContentMove.TsuContent.CaseTypeId as CaseTypeId | eval OrientationError=if(Error="Orientation","1","0") , ProtrusionError=if(Error="Protrusion","1","0") , LengthError=if(Error="Length","1","0") , WidthError=if(Error="Width","1","0") , HeightError=if(Error="Height","1","0") , OffCentreError=if(Error="OffCentre","1","0") | eval DimensionError=if(LengthError>0 OR WidthError>0 OR HeightError>0, "1","0") | eval ErrorQty=(OrientationError+ProtrusionError+DimensionError+OffCentreError) , TrayError=(OrientationError+ProtrusionError+LengthError+WidthError+HeightError+OffCentreError) , TrayError=if(TrayError>0,"1",null) | eval Dimension=if(DimensionError>0 AND ErrorQty="1" ,"1","0") , Orientation=if(OrientationError="1" AND ErrorQty="1","1","0") , Protrusion=if(ProtrusionError="1" AND ErrorQty="1","1","0") , Length=if(LengthError="1" AND ErrorQty="1","1","0") , Width=if(WidthError="1" AND ErrorQty="1","1","0") , Height=if(HeightError="1" AND ErrorQty="1","1","0") , OffCentre=if(OffCentreError="1" AND ErrorQty="1","1","0") , Mixed=if(Dimension="0" AND ErrorQty>1,"1","0") | eval Layer=if(TrayLoad="PalletInPosition","1",null) , CaseQty=if(TrayLoad="TrayLoad1" OR TrayLoad="TrayLoad2",Quantity,null) , Tray=if(TrayLoad="TrayLoad1" OR TrayLoad="TrayLoad2","1",null) | stats min(_time) as _time values(Location) as Location sum(Layer) as PalletLayers sum(Tray) as TrayQty sum(CaseQty) as CaseQty sum(TrayError) as TrayError sum(Orientation) as OrientationError sum(Length) as LengthError sum(Width) as WidthError sum(Height) as HeightError sum(Protrusion) as ProtrusionError sum(OffCentre) as OffCentreError sum(Dimension) as Dimension sum(Mixed) as Mixed values(CaseTypeId) as CaseTypeId by OrderId | eval reporttype="DepTrayCaseQty" | eval foo=Dimension+Mixed+OrientationError+ProtrusionError+OffCentreError | table _time reporttype OrderId CaseTypeId Location PalletLayers TrayQty CaseQty TrayError foo Dimension Mixed OrientationError LengthError WidthError HeightError ProtrusionError OffCentreError | where isnotnull(CaseQty) | collect index=analyst

uagraw01 · ‎11-27-2023

11/06/2023 23:57:02 +1100, info_min_time=1699189200.000, info_max_time=1700571600.000, info_search_time=1700625838.094, foo=3, Mixed=0, CaseQty=64, OrderId=52128969634, TrayQty=35, Location="DEP/AutoDep03", Dimension=2, TrayError=3, OrientationError=1, ProtrusionError=0, CaseTypeId=6210, WidthError=2, reporttype=DepTrayCaseQty, OffCentreError=0, HeightError=0, LengthError=0, PalletLayers=4 OrderId = 52128969634host = MSRDC-BPIsource = D:\Splunk\var\spool\splunk\d0d3783e41cf130c_events.stash_newsourcetype = stash ===================================================================== 11/06/2023 23:57:02 +1100, search_name="File Collector: DepTrayCaseQty", search_now=1699279200.000, info_min_time=1699189200.000, info_max_time=1699275600.000, info_search_time=1699279202.226, foo=2, Mixed=0, CaseQty=29, OrderId=52128969634, TrayQty=17, Location="DEP/AutoDep03", Dimension=2, TrayError=2, OrientationError=0, ProtrusionError=0, CaseTypeId=6210, WidthError=2, reporttype=DepTrayCaseQty, OffCentreError=0, HeightError=0, LengthError=0, PalletLayers=4 OrderId = 52128969634host = MSRDC-BPIsource = File Collector: DepTrayCaseQtysourcetype = stash ================================================================= 11/06/2023 23:57:02 +1100, info_min_time=1699189200.000, info_max_time=1700398800.000, info_search_time=1700618994.511, foo=3, Mixed=0, CaseQty=64, OrderId=52128969634, TrayQty=35, Location="DEP/AutoDep03", Dimension=2, TrayError=3, OrientationError=1, ProtrusionError=0, CaseTypeId=6210, WidthError=2, reporttype=DepTrayCaseQty, OffCentreError=0, HeightError=0, LengthError=0, PalletLayers=4 OrderId = 52128969634host = MSRDC-BPIsource = D:\Splunk\var\spool\splunk\adb0f8d721bf93e3_events.stash_newsourcetype = stash

uagraw01 · ‎11-27-2023

@ITWhisperer Below are screenshot in which you can see from 6th of November we are receiving 3 sources. and before that the source was only one.

uagraw01 · ‎11-27-2023

@ITWhisperer Let me understand correctly, if more than one source is generating that means, more than one summary index ? Multiple source “/var/spool*” file generation on the same time frame means ?

uagraw01 · ‎11-27-2023

@ITWhisperer Can I check those details in _audit index ?

uagraw01 · ‎11-27-2023

@ITWhisperer No only one report Triggering the events

uagraw01 · ‎11-27-2023

@ITWhisperer Number of events are thripled. As well as duplicated data ingested in splunk

uagraw01 · ‎11-27-2023

@isoutamo For now simple restart of splunkd fixed my issue.

Posts	403
Solutions	1
Karma Given	107
Karma Received	6
Member Since	‎06-03-2020

Online Status	Offline
Date Last Visited	a week ago

Splunk Visualization is not giving below results

Splunk web to work on https

Field Alias issue in props.conf

Removal of the confidential data

Splunk Query issue

Multiple stats file from summary index

Splunk HEC token is not working

Summary index use in dashboard

Discrepancy in scheduled search and generic serach

Splunk performance issue

Re: Splunk dashboard

Splunk dashboard

Re: macro not found

macro not found

Splunk search

Re: Splunk SPL & visualisation

Re: Splunk SPL & visualisation

Re: Splunk SPL & visualisation

Re: Splunk SPL & visualisation

Re: Splunk SPL & visualisation

Splunk SPL & visualisation

Re: Time format

Re: Time format

Time format

Re: Splunk info messages

Splunk info messages

Re: splunk summary index

Re: splunk summary index

Re: splunk summary index

Re: splunk summary index

Re: splunk summary index

Re: splunk summary index

Re: splunk summary index

Re: splunk summary index

Re: How to fix "Percentage of small buckets is hig...