Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Are you a member of the Splunk Community?
Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- Find Answers
- :
- About Deepz2612
Deepz2612
Explorer
Member since:
10-22-2017
06-07-2023
Community Statistics
| Posts | 81 |
| Solutions | 0 |
| Karma Given | 2 |
| Karma Received | 0 |
| Member Since | 10-22-2017 |
Activity Feed
- Posted How to get spl to look for the latest timestamp for all the sourcetypes? on Dashboards & Visualizations. 06-07-2023 03:41 AM
- Posted Re: Question on stats command on Splunk Search. 01-04-2021 08:29 AM
- Posted Question on stats command on Splunk Search. 01-02-2021 08:00 AM
- Tagged Question on stats command on Splunk Search. 01-02-2021 08:00 AM
- Posted Re: Unset multiple tokens on Splunk Search. 01-02-2021 07:27 AM
- Posted Unset multiple tokens on Splunk Search. 01-02-2021 04:53 AM
- Posted Single value chart on Splunk Search. 01-02-2021 02:49 AM
- Tagged Single value chart on Splunk Search. 01-02-2021 02:49 AM
- Posted Use the result of one query as input to the next query on Splunk Search. 12-22-2020 11:54 PM
- Posted Re: Analysis using lookup file on Splunk Search. 12-22-2020 01:44 AM
- Posted Re: Analysis using lookup file on Splunk Search. 12-09-2020 04:01 AM
- Posted Re: Analysis using lookup file on Splunk Search. 12-08-2020 11:22 PM
- Posted Analysis using lookup file on Splunk Search. 12-08-2020 09:51 PM
- Karma Re: Is there a way to check if a field value is present in a transaction? for jluo_splunk. 06-05-2020 12:47 AM
- Karma Re: What variables can you use in email subject? for bmunson_splunk. 06-05-2020 12:45 AM
- Posted Regex generation on Splunk Search. 10-25-2019 04:56 AM
- Posted Can an HTML button with value be done without using JS and CSS scripts? on Dashboards & Visualizations. 10-24-2019 11:19 PM
- Tagged Can an HTML button with value be done without using JS and CSS scripts? on Dashboards & Visualizations. 10-24-2019 11:19 PM
- Posted Question on how to use lookup file on Splunk Search. 10-24-2019 09:53 PM
- Tagged Question on how to use lookup file on Splunk Search. 10-24-2019 09:53 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
06-19-2019
12:14 AM
I'm not sure why is my left join not working.
I'm sure that my results will be than 50000 records.
kindly assist me!!
... View more
06-19-2019
12:10 AM
In the logs I wanted to include events that has the string "uri=https://www.bikerace.com" and if it is not present I wanted to include events with string "BAD_REQUEST_EXCEPTION".
But at times the case is that both the strings are present and when I write a query condition with "OR" statement both gets selected.
But I wat either of it only..If the 1st string is present,only that event..If the first string is not present then i wanted to have the event with second string.
Kindly help me with it.
Thanks!
... View more
- Tags:
- splunk-enterprise
06-18-2019
06:49 AM
Hi,help me in writing regex to extract field between two hyhpens.
Eg: S-STRA-32
F-FIDR-67
Thanks!
... View more
05-09-2019
02:23 AM
Hi I have category for my all applications and would like to know the indexes present in each application
... View more
05-08-2019
08:37 AM
Hi,
How could I find the list of indexes under a particular application.
Is there any query for it
... View more
- Tags:
- splunk-enterprise
05-03-2019
04:58 AM
Hi,
Could you kindly help please
... View more
05-02-2019
04:01 AM
Thanks..
But my requirement is to put in a tabular format.
In the above code that i have share,whatever search query that i give is getting printed as as table value rather than printing the result of the query.
Could you kindly help
... View more
04-30-2019
08:35 AM
Hi,
My requirement is to:
Create a table with two columns with left column having static data and right having dynamic value
The right dynamic value - meaning I wanted to see only the result of a Splunk query.
I used the follow code but unable to achieve it.
<row>
<panel>
<title>Sample Template</title>
<html>
<table border="1" width="1000" padding="10px">
<th>
<tr>
<th width="200" align="left">Impacted time window(in EST)</th>
<th width="800" align="left">
<panel>
strptime($search_earliest$, "%Y-%m-%d %H:%M:%S.%3N") to strptime($cmd_time.latest$, "%Y-%m-%d %H:%M:%S.%3N")
</panel>
</th>
</tr>
<tr>
<th width="200" align="left">Success rate(Total and Regionwise) during Impact Window </th>
<th width="800" align="left">
<row>
<panel>$country$</panel>
</row>
</th>
</tr>
<tr>
<th width="200" align="left">Impact to Customer</th>
<th width="800" align="left">Row - 3 - 2nd column</th>
</tr>
<tr>
<th width="200" align="left">Error code(incase of IOT)</th>
<th width="800" align="left">Row - 2 2nd column</th>
</tr>
<tr>
<th width="200" align="left">Analysis</th>
<th width="800" align="left">Enter your analysis details</th>
</tr>
<tr>
<th width="200" align="left">Action taken</th>
<th width="800" align="left">SMS delay has been added in Canada RTS ticket</th>
</tr>
<tr>
<th width="200" align="left">Next Steps</th>
<th width="800" align="left">will continue to monitor for next 1 hour</th>
</tr>
<tr>
<th width="200" align="left">Advisory</th>
<th width="800" align="left"> N/A </th>
</tr>
<tr>
<th width="200" align="left">L1POE bridge opened(Yes/No)</th>
<th width="800" align="left">Row - 3 - 2nd column</th>
</tr>
<tr>
<th width="200" align="left">L1POE bridge detail</th>
<th width="800" align="left">Row - 2 2nd column</th>
</tr>
</th>
</table>
</html>
</panel>
</row>
<row>
<panel>
<html>
<div align="right">
<b>Dashboard Version 3.7</b>
</div>
</html>
</panel>
</row>
</form>
In the above - if you could see,my out is not displaying the time for Impacted time window(in EST) instead it is displaying the entire string I have given ( strptime($search_earliest$, "%Y-%m-%d %H:%M:%S.%3N") to strptime($cmd_time.latest$, "%Y-%m-%d %H:%M:%S.%3N")).
Kindly help me with it.
Note : I do not have permissions and access to use Splunk dashboard app.
... View more
04-24-2019
03:39 AM
Hi,
I tried the above and receiving the error as below.
Error rendering Horseshoe Meter visualization: This visualization cannot render non-numeric results. To build a horseshoe meter visualization, use a search that returns numeric values.
... View more
04-11-2019
04:03 AM
Hi all,
I have a query such as below for the input drop down
<input type="dropdown" token="country" searchWhenChanged="true">
<label>Country</label>
<fieldForLabel>Country</fieldForLabel>
<fieldForValue>Country</fieldForValue>
<default>*</default>
<initialValue>*</initialValue>
<search>
<query>{search}|stats count by Country_Code Country</query>
<earliest>0</earliest>
<latest></latest>
</search>
</input>
I'm able to pass only the value of Country using the token "country" to the panel.
At times I wanted to make use of Country Code value.
How to set token for Country Code also.
i.e.,when a country is selected from the dropdown its corresponding country codes I wanted to use it for the few panels in the dashboard.
... View more
- Tags:
- splunk-enterprise
04-04-2019
10:53 PM
Hi I have a query to see the success and failure rate.
The query will give the fields success and failure rate as output.
I wanted to use horse shoe meter visualization but the meter shows both the rates but the numeric value being displayed is either success rate or the failure rate but not both.
Could you please help.
... View more
- Tags:
- splunk-enterprise
04-01-2019
06:40 AM
I'm sorry..
Begin time and End time will have the date as well. I missed to add it.
Begin time : 04/01/2019 4:43:55:336 AM
End time : 04/01/2019 4:53:00:00 AM
... View more
04-01-2019
06:23 AM
Hi,
I have the Begin time and End time as below for an event (which is again extracted using another query)
Begin time : 4:43:55:336 AM
End time : 4:53:00:00 AM
I wanted to pass this earliest and latest time for another panel in the dashboard.
Could you kindly help
... View more
03-22-2019
01:16 AM
Hi,
Is there a way to get the list of Splunk alert mails being sent and the mail body content pls.
... View more
- Tags:
- splunk-enterprise
03-15-2019
05:17 AM
Hi nick,
Thanks!
But my requirement is to list "only" the vins which occurs more than once in logs but with different response code.
... View more
03-14-2019
11:08 PM
Hi Team,
I would like to know if there is any way to extract/find only the values that is present in more than one event with different values associated.
To explain further on the scenario,below are the logs.
msg: for-service - [2019-03-15T06:01:05.554+0000] "GET /api/for*&byr=**12355**" 404
Please help!!
Thanks in advance!
... View more
- Tags:
- splunk-enterprise
02-25-2019
10:02 PM
Hi Nike,
The above solution works good.
But I have will have to have two drop downs inside the panel "Search Based on Lookup".
as Name and Subname and the corresponding query has to be executed.
This is because the Name has many subnames under it.
Could you kindly help me with it.
... View more
02-25-2019
05:55 AM
Hi,
I want a help where I have to create a dashboard where I click on a service A it should display a panel based on query.
Similarly when I click on service B the results should be displayed in the same panel based on a different query.
And i have N no of services like that..
Kindly help me with it
... View more
- Tags:
- splunk-enterprise
02-25-2019
01:58 AM
I wanted to extract a field to capture the data before the question mark as below.
api_call "Get \search\ip\6789\?=number\90"
where api_call is an already extracted field.
I wrote it as a rex field = api_call "/"(?[^/?])" ---- result required is Get \search\ip\6789\
but it doesn't seem to work.
... View more
02-15-2019
01:00 AM
How do you write a regular expression to extract a field which has characters, numbers and also special characters? There are sometimes spaces in between.
I tried this. rex "(?\w+[A-Z0-9][^-])" --- to include characters and hyphen,
but it doesnt work
Thanks in advance!!
... View more
02-12-2019
11:38 PM
Hi,
The above doesnt seem to work.It returns me 0 results.
... View more
02-12-2019
03:58 AM
I have events like below with Job name and Incident number
Index= abc
Job: scdefgh_tal1080_d_b
App: YSC
Incident_Create_Number: INC0000XXXXXXXX
So I wrote a query to extract them as below:
index=abc |rex field=notes "Job:(?.*)\nApp" |table Job Incident_Create_Number Incident_Create_Assigned_Group
I have events where like below having Job name and its status
Index= xyz
CAUAJM_I_40245 EVENT: CHANGE_STATUS STATUS: TERMINATED JOB: iascamdsp_tal1080_d_b
So I wrote a query to extract them as below:
index=xyz | rex "]\s+(?\S+)\s+(?:((EVENT:)?\s(?\S+)\s+(STATUS:)?\s+(?\S+)\s+(JOB:)?\s+(?\S+)(\s+(MACHINE:)?\s+(?\S+))?(\s+(EXITCODE:)?\s+(?\S+))?))" |search event_1="CHANGE_STATUS" |table Job Job_Status
Now I wanted to combine both.For the Job name in the first query I want its status from the second query.
I tried using Join but its not returning any results.
Kindly help!
... View more
02-12-2019
03:02 AM
Hi,
My 1st query returns 3 fields output.Out of which one filed has to be given as input to the second query which fetches 3 fields along with this result value.
Kidnly help
... View more
- Tags:
- splunk-enterprise
02-12-2019
03:02 AM
Hi,will the above works if the search results more than one value
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-07-2023
07:01 AM
|
