Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- Find Answers
- :
- About athorat
athorat
Communicator
Member since:
04-29-2015
06-24-2024
Community Statistics
| Posts | 180 |
| Solutions | 1 |
| Karma Given | 14 |
| Karma Received | 6 |
| Member Since | 04-29-2015 |
Activity Feed
- Posted SmartStore Retention not deleting data on Getting Data In. 10-03-2023 12:30 AM
- Posted Re: Does it make sense to use SmartStore for all data except hot and warm? on Getting Data In. 10-03-2023 12:25 AM
- Posted How to track scheduled search which are using "All Time" time window? on Knowledge Management. 06-29-2023 06:36 PM
- Posted Re: Splunk Indexer services admin bundle errors on Deployment Architecture. 08-13-2021 08:29 PM
- Got Karma for NOT Like function. 05-28-2021 12:00 AM
- Karma Re: how to find Number of files failed to ingest for a specific Index for richgalloway. 06-05-2020 12:50 AM
- Karma Re: Search head's authentication credentials rejected by peer. I've re-added peers 4 times and this keeps happening! for gozulin. 06-05-2020 12:48 AM
- Karma Re: How to find the oldest log indexed in the indexer instances ? for somesoni2. 06-05-2020 12:48 AM
- Karma Re: How to find the oldest log indexed in the indexer instances ? for woodcock. 06-05-2020 12:48 AM
- Got Karma for Re: Search head's authentication credentials rejected by peer. I've re-added peers 4 times and this keeps happening!. 06-05-2020 12:48 AM
- Karma Re: Applying Quarantine .... Removing quarantine for mmensch. 06-05-2020 12:47 AM
- Karma Re: Why is Splunk not starting on Linux with permission denied errors after upgrading to 6.2.0? for fabioportes. 06-05-2020 12:47 AM
- Karma Re: How to filter data in a search using the AND condition? for Richfez. 06-05-2020 12:47 AM
- Karma Re: How to calculate the difference between the counts from multiple searches? for somesoni2. 06-05-2020 12:47 AM
- Got Karma for How to change the ownership of dashboards to a specific user in the system?. 06-05-2020 12:47 AM
- Got Karma for How to change the ownership of dashboards to a specific user in the system?. 06-05-2020 12:47 AM
- Got Karma for Why is my inputlookup search not pulling a field from a CSV file needed to populate a timechart?. 06-05-2020 12:47 AM
- Got Karma for NOT Like function. 06-05-2020 12:47 AM
- Karma Re: indexing congestion consistenly happening for yannK. 06-05-2020 12:46 AM
- Karma Re: Merging two chart together for MuS. 06-05-2020 12:46 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
01-11-2016
12:21 PM
@sundareshr
It shows as 83671.278000
Does it mean anything?
Thanks.
... View more
01-11-2016
11:08 AM
@sundareshr
The question is because when I use the query I see that chart with avg value of 23
and If remove the toString(x, "duration") function it shows the value upto 83k
The values in seconds would not be that high.
Where as the start and event has a difference of
Start Event : 2016-01-10 07:00:10,825
End Event : 2016-01-10 07:45:39,005
Not sure if that makes sense...
Thanks.
... View more
01-08-2016
05:06 PM
@sundareshr
The JobRunTime=tostring(JobRunTime, "duration") function, does it assign the value JobRunTime in seconds?
The document says tostring(X,"duration") converts seconds X to readable time format HH:MM:SS
... View more
01-08-2016
03:11 PM
@sundareshr
Thanks for the ans. i have posted another thread based on the same query. When I try to display a chart based on avg of JobRunTime for a specific jobname , the values shows way to high which does not match with the ones which we get from the above table.
is there a way I can display the correct values of JobRunTime for a specific job in a bar chart or a line for last 7 days or 30 days.
... View more
01-08-2016
11:54 AM
aljohnson_splunk When I highlight the bar graph, it shows values starting from 5k to 70k depending upon the job name.
Actual runtime of that job shows 00:00:00.677.
On the bar graph when I highlight a bar for that date it shows 73,998. Not sure if that makes sense.
... View more
01-08-2016
11:12 AM
Using this search to show the average runtime by a jobname selected from a drop-down menu.
The time right now shows up to 40k+ is there a way to convert the JobRunTime to Seconds?
index=aap_prod sourcetype="HDP:PROD:OOZIE" (":start:] with user-retry state" OR "@end***]Action updated in DB!") | rex "TOKEN\[\] APP\[(?<JobName>[^\]]*)" | search JobName=$Job_Name$| rex "ACTION\[[^\@]*(?<Action>[^\d\]]*)" | rex "JOB\[?(?<jobid>[\d-]+)-" | streamstats current=f window=2 range(_time) as JobRunTime latest(_time) as end earliest(_time) as start | timechart avg(JobRunTime) by JobName
... View more
01-08-2016
09:20 AM
@aljohnson_splunk
after updating the settings on universal forwarder
the events started splitting up, but the error messages , as well are split on every line.
so for example the following error message is split as each event.
at org.jbpm.graph.def.Transition.take(Transition.java:151)
at org.jbpm.graph.def.Node.enter(Node.java:319)
at org.jbpm.graph.node.TaskNode.execute(TaskNode.java:168)
at org.jbpm.taskmgmt.exe.TaskMgmtInstance.createTaskInstance(TaskMgmtInstance.java:154)
at org.jbpm.taskmgmt.exe.TaskInstance.assign(TaskInstance.java:204)
at org.jbpm.taskmgmt.exe.TaskMgmtInstance.performAssignment(TaskMgmtInstance.java:216)
Caused by: org.jbpm.graph.def.DelegationException: Policy must have an agent!
... View more
01-07-2016
01:13 PM
Hi
I am displaying a table which shows:
table JobName, jobid, start, end ,diff
using the following search. How do I get unique values based on Job name or Job Id?
stats values(JobName) does not yield results.
index=aap_prod sourcetype="HDP:PROD:OOZIE" (":start:] with user-retry state" OR "@end***]Action updated in DB!") | rex "TOKEN\[\] APP\[(?<JobName>[^\]]*)" | rex "ACTION\[[^\@]*(?<Action>[^\d\]]*)" | rex "JOB\[?(?<jobid>[\d-]+)-" | streamstats current=f window=2 range(_time) as diff latest(_time) as end earliest(_time) as start| table JobName, jobid, start, end ,diff| eval start=strftime(start, "%c")|eval end=strftime(end, "%c")|eval diff=tostring(diff, "duration")| search diff!=0
Thanks for looking into this.
... View more
01-07-2016
11:01 AM
@sundareshr is there a way we can we convert the range-> diff to seconds or minutes?
... View more
01-07-2016
09:30 AM
Thanks for the update @jkat54 that did not work though.
props.conf is updated on the heavy forwarder only.
... View more
01-06-2016
01:41 PM
@jkat54
Thanks for the reply will try this and update you if it works.
... View more
01-06-2016
01:40 PM
@aljohnson_splunk yes thats because the server clock changes as part of the testing process
So you suggesting to use???
SHOULD_LINEMERGE=false
NO_BINARY_CHECK=true
TIME_FORMAT=%m/%d/%y %H:%M:%S:%3N %Z
TIME_PREFIX=^s+[
... View more
01-06-2016
01:02 PM
@sundareshr
I tired | search diff!=0.0 and it worked.
How can I add the Start and the end dates, can you throw some light on it ?
Thanks,
... View more
01-06-2016
12:43 PM
@sundareshr
I tired | search diff!=0.0 and it worked.
How can I add the Start and the end dates, can you throw some light on it ?
Thanks,
... View more
01-06-2016
12:04 PM
Events should be split for each date, which is not happening for one of the forwarders:
The following is the part of a single event:
[6/28/16 11:28:37:500 MST] 00000028 Resource W org.richfaces.resource.ResourceHandlerImpl getResourcePathFromRequest
[6/28/16 11:28:37:657 MST] 00000028 HtmlLabelRend W Attribute 'for' of label component with id chgLanguageForm:j_id_1o_2u is not
[6/28/16 11:28:37:658 MST] 00000028 HtmlLabelRend W Attribute 'for' of label component with id chgLanguageForm:j_id_1o_2x is not
[6/28/16 11:28:37:790 MST] 00000028 HtmlLabelRend W Attribute 'for' of label component with id tasksForm:j_id_1o_9y_2_1 is not
[6/28/16 11:28:37:791 MST] 00000028 JbpmPageableD I com.exigen.ipb.base.dataload.impl.PageableDataProviderService fetchDataSize
[6/28/16 11:28:37:792 MST] 00000028 JbpmPageableD I com.exigen.ipb.base.dataload.impl.PageableDataProviderService fetchDataSize
Props.conf on the heavy forwarder:
[PASAPP:PP1:SYSTEMOUT]
SHOULD_LINEMERGE = false
LINE_BREAKER = ([\r\n]+)\s*Date
Anything which I am missing here?
Anil.
... View more
01-06-2016
11:26 AM
thanks for the reply @jka154 @sundareshr
I am using the following query to extract job name and Action=:start: or Action=@end
index=aap_prod sourcetype="HDP:PROD:OOZIE" ("@:start:" OR "@end") | rex "TOKEN\[\] APP\[(?[^\]]*)" | rex "ACTION\[[^\@]*(?[^\d\]]*)"
If I append rex "JOB\[?(?[\d-]+)-" | streamstats window=2 current=f range(_time) as diff by jobid | table jobid diff
I get the table but there are jobid's with the same id with value = 0 and then there is one value with the actual duration.
How do we filter only the values with actual duration.
tried using | stats values(jobid) which does not work.
Thanks for looking into this.
Anil.
... View more
01-06-2016
09:48 AM
Hi
I have to extract start date, end date, and the duration of a job based on the following two events:
Started:
2016-01-06 07:00:10,314 INFO ActionStartXCommand:543 - SERVER[redacted.redacted.redacted.com] USER[hdfs] GROUP[-] TOKEN[] APP[BOB_CAS_WF_IM_DataStore] JOB[0018443-150810162217214-oozie-oozi-W] ACTION[0018443-150810162217214-oozie-oozi-W@:start:] [***0018443-150810162217214-oozie-oozi-W@:start:***]Action updated in DB!
End:
2016-01-06 08:10:50,301 INFO ActionStartXCommand:543 - SERVER[redacted.redacted.redacted.com] USER[hdfs] GROUP[-] TOKEN[] APP[BOB_CAS_WF_IM_DataStore] JOB[0018443-150810162217214-oozie-oozi-W] ACTION[0018443-150810162217214-oozie-oozi-W@end] [***0018443-150810162217214-oozie-oozi-W@end***]Action updated in DB!
How do I extract the date and time and then calculate the difference.
... View more
12-22-2015
10:59 AM
@dcarmack one followup question
When I do a stats count of @:start: and @end I get a count of 360+ for both of them
index=aap_prod sourcetype="HDP:PROD:OOZIE" | rex "TOKEN\[\] APP\[(?<JobName>[^\]]*)" | rex "ACTION\[[^\@]*(?<Action>[^\d\]]*)" | search Action="@:start:"| stats count(Action)
but when I use the query which you suggested it returns around 118.
also when I try to use stats values(JobName) and group by Action it does not return anything...
... View more
12-22-2015
10:19 AM
I modified the Field Names but that works (Y).
Thank You so much.
index=aap_prod sourcetype="HDP:PROD:OOZIE" ("@:start:" OR "@end") | rex "TOKEN\[\] APP\[(?<JobName>[^\]]*)" | rex "ACTION\[[^\@]*(?<Action>[^\d\]]*)"
| fields Action JobName
| stats values(Action) AS Action by JobName
| where isnotnull(mvfind(Action,"@:start:")) AND isnotnull(mvfind(Action,"@end"))
... View more
12-22-2015
09:28 AM
@dcarmack thanks for the reply
I get an error : Error in 'where' command: The expression is invalid. The result of a 'where' expression must be boolean.
... View more
12-21-2015
11:51 AM
I think I was not clear in explaining the requirement.
This is my regex
index=aap_prod sourcetype="HDP:PROD:OOZIE" ("@:start:" OR "@end") | rex "TOKEN\[\] APP\[(?[^\]]*)" | rex "ACTION\[[^\@]*(?[^\d\]]*)" | stats count(JobName) by Action
And I want to calculate the JobNames which has Action-Start AND Action=END
... View more
12-18-2015
04:22 PM
This is the event
2015-12-17 23:25:17,487 INFO ActionStartXCommand:543 - SERVER[p01bdl841.aap.csaa.com] USER[hdfs] GROUP[-] TOKEN[] APP[WF_danlaw_journey_hive] JOB[0015832-150810162217214-oozie-oozi-W] ACTION[0015832-150810162217214-oozie-oozi-W@:start:] [***0015832-150810162217214-oozie-oozi-W@:start:***]Action updated in DB!
I get the Start Action, End Action and the Incremantal Action
So just need to get the jobnames which has action as started and End.
... View more
12-18-2015
02:23 PM
index=aap_prod sourcetype="HDP:PROD:OOZIE" | rex "TOKEN\[\] APP\[(?<JobName>[^\]]*)" | rex "ACTION\[[^\@]*(?<Action>[^\d\]]*)"
Extracting two fields JobName and Action.
The field called Action has values 1>@:start: 2> @end and 3> @Incremental
I have to calculate total number of JobNames which have values start and end which will be considered as successful jobs, and the count of JobNames which have different Start and End.
... View more
12-10-2015
03:35 PM
Thanks for the suggestion, but that did not work.
... View more
12-10-2015
03:02 PM
We see some events with timestamps clubbed together in one event.
Changing the props.conf did not help to resolve the issue.
Sample:
12/8/15
12:07:53.000 AM
[4/20/15 0:07:53:255 MST] 00000017 SystemOut O File modification detected
[4/20/15 0:07:53:255 MST] 00000017 SystemOut O Reading data from file '/opt/Jenkins/was_deploy/jvmDateCalculator.properties'
[4/20/15 0:07:53:255 MST] 00000017 SystemOut O Date format is 'yyyy-MM-dd'
[4/20/15 0:07:53:255 MST] 00000017 SystemOut O Base date from file is 2015-04-21
[4/20/15 0:07:53:255 MST] 00000017 SystemOut O Base date was incremented on 0 days with result: 2015-04-21
... View more
