Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- Find Answers
- :
- About Mike6960
Mike6960
Path Finder
Member since:
10-10-2017
03-21-2023
Community Statistics
| Posts | 192 |
| Solutions | 0 |
| Karma Given | 12 |
| Karma Received | 2 |
| Member Since | 10-10-2017 |
Activity Feed
- Posted Re: How to use values from outputlookup file on Splunk Search. 03-21-2023 11:39 AM
- Posted Re: How to use values from outputlookup file on Splunk Search. 03-21-2023 10:33 AM
- Posted Re: How to use values from outputlookup file on Splunk Search. 03-21-2023 08:53 AM
- Posted Re: How to use values from outputlookup file on Splunk Search. 03-21-2023 08:32 AM
- Posted Re: How to use values from outputlookup file on Splunk Search. 03-21-2023 08:31 AM
- Posted Re: How to use values from outputlookup file on Splunk Search. 03-21-2023 08:31 AM
- Posted How to use values from outputlookup file? on Splunk Search. 03-20-2023 04:02 PM
- Karma Re: How to create alternative for subsearch for gcusello. 12-14-2022 06:23 AM
- Posted Re: How to create alternative for subsearch on Splunk Search. 12-13-2022 06:56 AM
- Posted Re: How to create alternative for subsearch on Splunk Search. 12-13-2022 05:39 AM
- Posted Re: How to create alternative for subsearch on Splunk Search. 12-13-2022 04:40 AM
- Posted How to create alternative for subsearch? on Splunk Search. 12-13-2022 03:28 AM
- Karma Re: How to make a field extraction with field with and without ':'? for ITWhisperer. 12-07-2022 05:18 AM
- Posted Re: How to make a field extraction with field with and without ':'? on Splunk Search. 12-06-2022 07:01 AM
- Posted Re: How to make a field extraction with field with and without ':'? on Splunk Search. 12-06-2022 06:51 AM
- Posted How to make a field extraction with field with and without ':'? on Splunk Search. 12-06-2022 04:51 AM
- Posted Is it possible to achieve a column chart with timechart showing days in every column? on Dashboards & Visualizations. 11-10-2022 02:51 AM
- Posted Re: How to create a single value withe panel_depends? on Dashboards & Visualizations. 11-06-2022 06:38 AM
- Posted Re: How to create a single value withe panel_depends? on Dashboards & Visualizations. 11-04-2022 11:22 AM
- Posted How to create a single value with panel_depends? on Dashboards & Visualizations. 11-04-2022 09:24 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
02-06-2020
03:24 AM
Hi @PavelP ,
In console I get this when I open the dashoboard, in the tab which opens by the drilldown I dont get anything
common.js:1103 [Deprecation] document.registerElement is deprecated and will be removed in M80, around February 2020. Please use window.customElements.define instead. See https://www.chromestatus.com/features/4642138092470272 and https://developers.google.com/web/updates/2019/07/web-components-time-to-upgrade for more details.
... View more
02-06-2020
02:46 AM
I configured a drilldown through the GUI. The search is something like this:
index=* "message.Origin"=TEST
source="/opt/mulesoft/logs/something.log"
OR source="/opt/mulesoft/logs/somethingelse.log"
OR source="D:\\Log\\anything.json"
| stats values(a.b) AS ab ,values(c.d) as cd count(eval('logger' ="nl.logger,answers")) as "Start ",count(eval(logger ="n.questions. HTTP status: 200.")) as "questions" by message.MessageId,
| where ‘questions’ <1
when i click the panel to drilldown chrome opens a blank page and nothing else happens. When I look in the source I see this:
<drilldown>
<link target="_blank">search?q=index=*%20%22message.Origin%22=TEST%20source=%22/opt/mulesoft/logs/ something.log %22%20OR%20source=%22/opt/mulesoft/logs/ somethingelse.log %22%20OR%20source=%22D:%5C%5CLog%5C%5Canything.json %22%20%0A%7C%20stats%20%20values(a.b)%20AS%ab%20,values(c.d)%20as%20cd%20count(eval('logger'%20=%22 nl.logger,answers........... ( etc etc etc)
I anomised the search due to security reasons, in IE the drilldown works just fine, also other drilldowns work in Chrome. I dont understand what is going wrong
... View more
- Tags:
- splunk-enterprise
12-09-2019
07:37 AM
Thanks, it works.I think I made an error before, I did not get any options in the 'Split By' in the trellis menu before
... View more
12-09-2019
07:37 AM
Thanks, it works.I think I made an error before, I did not get any options in the 'Split By' in the trellis menu before
... View more
12-09-2019
05:25 AM
I am trying to get an single value visualisation with trellis. Somehow I get only one value, while when I use e.g. an Column chart i do get multiple values
My search | stats count by BNK|table count BNK
What am I doing wrong?
... View more
09-30-2019
04:23 AM
Thanks, almost what I need, due to the lack of me supplying an example not quite everything I need.
this is a fragment of the events:
: Get file ABC_6_2019-09-30_VK-161.2285507.pdf from /opt/mulesoft/
I would like to extract the values: ABC_6_2019-09-30_VK-161.2285507.pdf
It always ends with .PDF but the first part can differ, in my example it starts with ABC but this can also be ZZ for example
... View more
09-30-2019
04:21 AM
this is a fragment of the events:
: Get file ABC_6_2019-09-30_VK-161.2285507.pdf from /opt/mulesoft/
I would like to extract the values: ABC_6_2019-09-30_VK-161.2285507.pdf
It always ends with .PDF but the first part can differ, in my example it starts with ABC but this can also be ZZ for example
... View more
09-20-2019
06:13 AM
Is it possible to use regex to extract values in events that always end with .PDF ? I have got a chain of events, somewhere in this process a PDF doucment is generated, So the name of the PDF is not in all the events.
... View more
08-02-2019
01:19 AM
In a earlier question I asked a question about an eval, this was luckily solved by Mus. Now I wonder how i can present the results in one line per ID
This is my search:
<my search>
| eval Start=if('message.information'=="Start",_time,null())
| eval End =if('message.information'=="End",_time,null()) |eval dur= Start-End
What I am searching for is how to get one line per ID , this is unique for all the events I want the duration for.
... View more
- Tags:
- splunk-enterprise
07-31-2019
04:10 AM
Ok, thank you for your help with my initial question
... View more
07-31-2019
04:04 AM
@MuS , also the field Test3 remains empty...
... View more
07-31-2019
04:01 AM
@MuS Thanks, this works. I now only have to convert to normal time, because I get a number as result. Is there a way to show one line per ID? What I mean is that in the example I gave there are always tow events per ID. Ik want one line per ID.
... View more
07-31-2019
03:15 AM
I am trying to use eval to calculate the time between events. Those events have a unique ID.
This is the sarch that I have now:
<my search>
| eval Test =if(message.information=="some_data",_time,null())
| eval Test2=if(message.information="some_data_2" ,_time,null())
| eval Test3 = Test - Test2
| table _time Test Test2 Test3
I am doing something wrong I guess because I only see values in the _time column, the rest is empty.
... View more
- Tags:
- splunk-enterprise
06-19-2019
06:31 AM
absolutely no idea why this works but it does 🙂
The append command only kicks in when there are no results I guess?
... View more
06-19-2019
06:27 AM
No, thats also not the solution....
... View more
06-19-2019
06:24 AM
I think I found it, the table count has to be after the brackets
index=captiva
|chart count by message.messageid
| search count < 2
|stats sum(count)| append [ | makeresults | eval count=0 ]| head 1| table count
... View more
06-19-2019
06:19 AM
@DavidHourani , strange thing is also when I do ....eval count= 1 , the value keeps being 0
... View more
06-19-2019
06:14 AM
When I try only the makeresults then it does work, strange...
... View more
06-19-2019
06:08 AM
No results found
... View more
06-19-2019
05:58 AM
I am going mad, its not working. This is the xml I have now:
<single>
<search>
<query>index=captiva
| chart count by message.messageid
| where count < 2
| stats sum(count)
| append
[| makeresults
| eval count=0
| table count ]
| head 1
</query>
<earliest>-15m</earliest>
<latest>now</latest>
<sampleRatio>1</sampleRatio>
</search>
<option name="colorBy">value</option>
<option name="colorMode">block</option>
<option name="drilldown">none</option>
<option name="numberPrecision">0</option>
<option name="rangeColors">["0x65a637","0xd93f3c"]</option>
<option name="rangeValues">[0]</option>
<option name="refresh.display">progressbar</option>
<option name="showSparkline">1</option>
<option name="showTrendIndicator">1</option>
<option name="trellis.enabled">0</option>
<option name="trellis.scales.shared">1</option>
<option name="trellis.size">medium</option>
<option name="trendColorInterpretation">standard</option>
<option name="trendDisplayMode">absolute</option>
<option name="unitPosition">after</option>
<option name="useColors">1</option>
<option name="useThousandSeparators">1</option>
</single>
... View more
06-19-2019
05:20 AM
@DavidHourani . I was to soon with my cheering...It still displays a red color when the value is 0.
... View more
06-19-2019
04:50 AM
@DavidHourani , it worked already with your first suggestion. I only thought I needed to use fillenull but i understand that the append does the same trick?
My xml is now
<single>
<title></title>
<search>
<query>index=captiva
|chart count by message.messageid
| search count < 2
|stats sum(count)
| append [ | makeresults | eval count=0 | table count ]
| head 1</query>
<earliest>@d</earliest>
<latest>now</latest>
<sampleRatio>1</sampleRatio>
</search>
<option name="colorBy">value</option>
<option name="colorMode">block</option>
<option name="drilldown">all</option>
<option name="numberPrecision">0</option>
<option name="rangeColors">["0x65a637","0x65a637","0xd93f3c"]</option>
<option name="rangeValues">[0.99]</option>
<option name="refresh.display">progressbar</option>
<option name="showSparkline">1</option>
<option name="showTrendIndicator">1</option>
<option name="trellis.enabled">0</option>
<option name="trellis.scales.shared">1</option>
<option name="trellis.size">medium</option>
<option name="trendColorInterpretation">standard</option>
<option name="trendDisplayMode">absolute</option>
<option name="underLabel">niet aangekomen in ESB</option>
<option name="unitPosition">after</option>
<option name="useColors">1</option>
<option name="useThousandSeparators">1</option>
... View more
06-19-2019
04:31 AM
@DavidHourani Thanks, I get a 0 value now. I edited the xml like you suggested in your first answer and also this works great!. Thank You very much. I dont think i will ever accomplish using splunk without asking for help ....
... View more
06-19-2019
03:28 AM
@DavidHourani , i got it working. I had the fillnull not at the end. But I have another search where te fillnull does not work at all. Maybe you see why?
index=captiva
|chart count by message.messageid
| search count < 2
|stats sum(count)
| fillnull count value=0
... View more
06-05-2019
11:40 PM
Version 7.0.0
value
block
all
0
["0x65a637","0xd93f3c"]
[1]
progressbar
1
1
0
1
medium
standard
absolute
Niet aangekomen Verint
after
1
1
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
03-21-2023
02:13 PM
|
