Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- Find Answers
- :
- About athorat
athorat
Communicator
Member since:
04-29-2015
06-24-2024
Community Statistics
| Posts | 180 |
| Solutions | 1 |
| Karma Given | 14 |
| Karma Received | 6 |
| Member Since | 04-29-2015 |
Activity Feed
- Posted SmartStore Retention not deleting data on Getting Data In. 10-03-2023 12:30 AM
- Posted Re: Does it make sense to use SmartStore for all data except hot and warm? on Getting Data In. 10-03-2023 12:25 AM
- Posted How to track scheduled search which are using "All Time" time window? on Knowledge Management. 06-29-2023 06:36 PM
- Posted Re: Splunk Indexer services admin bundle errors on Deployment Architecture. 08-13-2021 08:29 PM
- Got Karma for NOT Like function. 05-28-2021 12:00 AM
- Karma Re: how to find Number of files failed to ingest for a specific Index for richgalloway. 06-05-2020 12:50 AM
- Karma Re: Search head's authentication credentials rejected by peer. I've re-added peers 4 times and this keeps happening! for gozulin. 06-05-2020 12:48 AM
- Karma Re: How to find the oldest log indexed in the indexer instances ? for somesoni2. 06-05-2020 12:48 AM
- Karma Re: How to find the oldest log indexed in the indexer instances ? for woodcock. 06-05-2020 12:48 AM
- Got Karma for Re: Search head's authentication credentials rejected by peer. I've re-added peers 4 times and this keeps happening!. 06-05-2020 12:48 AM
- Karma Re: Applying Quarantine .... Removing quarantine for mmensch. 06-05-2020 12:47 AM
- Karma Re: Why is Splunk not starting on Linux with permission denied errors after upgrading to 6.2.0? for fabioportes. 06-05-2020 12:47 AM
- Karma Re: How to filter data in a search using the AND condition? for Richfez. 06-05-2020 12:47 AM
- Karma Re: How to calculate the difference between the counts from multiple searches? for somesoni2. 06-05-2020 12:47 AM
- Got Karma for How to change the ownership of dashboards to a specific user in the system?. 06-05-2020 12:47 AM
- Got Karma for How to change the ownership of dashboards to a specific user in the system?. 06-05-2020 12:47 AM
- Got Karma for Why is my inputlookup search not pulling a field from a CSV file needed to populate a timechart?. 06-05-2020 12:47 AM
- Got Karma for NOT Like function. 06-05-2020 12:47 AM
- Karma Re: indexing congestion consistenly happening for yannK. 06-05-2020 12:46 AM
- Karma Re: Merging two chart together for MuS. 06-05-2020 12:46 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
08-31-2015
11:51 AM
I would think of creating app first save the dashboard to that app.
Then create a role for that app and assigning the role to all the users who need access to the dashboard.
... View more
08-31-2015
11:42 AM
I tried using inputcsv but the same.
If I use, " | inputcsv test.csv |fields state " , this will give the State and its values
But when I use the queries
| inputcsv test.csv | timechart count AS Count BY state
| inputcsv test.csv |fields state| timechart count AS Count BY state
it does not return any data.
... View more
08-28-2015
03:05 PM
1 Karma
Requirement was to delete the contents of the index as soon as a new .csv file arrives and index the contents of the new .csv file to use in a dashboard until the next data arrives.
There is a key value pair called state, but that is not visible when I use:
| inputlookup test.csv
But when I index the data, I see the state field and can create a timechart.
This works:
index=input.csv | timechart count(state) as Count by state
The problem is when I use:
|inputlookup test.csv| timechart count(state) as Count by state
This does not work as its not able to find the state field, so I tried to use
|inputlookup test.csv|fields state | timechart count(state) as Count by state
but even this does not work.
However, when I used:
|inputlookup test.csv|fields state
it pulls the state field.
How to get the timechart working using inputlookup?
... View more
08-28-2015
01:17 AM
Ok,I see this error in the log files
and thats the source ip address.
Which is up and running and have the source files.
Able to resolve the IP.
Also tried using the fQDN in the inputs.conf instead of the ip no luck.
08-14-2015 11:32:59.636 -0700 INFO TcpInputConfig - No matching config for 172.26.95.7
08-14-2015 11:32:59.636 -0700 WARN TcpInputProc - Could not find matching host.
08-14-2015 11:33:11.126 -0700 INFO TcpInputConfig - No matching config for 172.26.95.7
08-14-2015 11:33:11.126 -0700 WARN TcpInputProc - Could not find matching host.
How do I identify if Splunk is not able to get connect and fetch the data or is it something else.
... View more
08-27-2015
05:22 PM
Yes there is a index named NWK on the indexer
And also it shows up in inex=NWK which is coming from some remote_searches.log file.
I will check from the log file in the mean time.
Thanks.
... View more
08-27-2015
04:35 PM
Its coming from a different server not from the heavy forwarder.
... View more
08-27-2015
02:16 PM
Yes makes sense, though what do we look at on the origin of Data.
Can you shed some light on it.
... View more
08-27-2015
02:06 PM
No there are multiple data sources which are working using this forwarder.
outputs.conf contains server = Servernanme:9997 and some other config (is there anything which I should be looking here)
... View more
08-27-2015
12:11 PM
We are trying to Index data from syslog and have the following configuration in the inputs.conf on the forwarder.
[tcp://IP:10514]
index = NWK
disabled = 0
#followTail = 0
sourcetype = NW:PROD:SYSLOG
From the search head, when we use index=NWK , it does not show any data.
What can be checked to see where the connection is breaking?
Thanks,
Anil.
... View more
08-19-2015
05:32 PM
We have a current Splunk Infrastructure in prod supporting most of the teams.
Ver 6.1.3
We would like to access Splunk using the Splunk Mobile App. What are all the server components that need to be installed? Do we need a separate physical server, or can this be installed on the existing machines?
... View more
08-12-2015
05:23 PM
Hi We are looking to get similar info for all .csv files in a specific folder and not the actual content of the files.
ver 6.1.3
I did not quite get the changes using fschange or the query above....
Thanks for looking into this.
... View more
08-12-2015
12:08 PM
We have a 3 node index cluster in prod and this will eventually be moved to prod.
by creating a report with delete option and scheduling the job to run on the last day, will that work in a cluster?
... View more
08-12-2015
10:56 AM
We want to clear the index on the last day of the month and load the index with new data on the first of every month.
What would be different ways to clear the index automatically on the last day of the month?
... View more
08-03-2015
02:08 PM
oh, Well I will stick to the original query for time being,
The original query solves the problem by creating two columns "TransactionStatus "and "count"
and wanted to add another column to this existing panel.
This one shows all transaction status instead of the count by correlation id.
I cannot add pictures here to make more sense to what I am trying to say.
... View more
08-03-2015
01:36 PM
I had tried a similar variation but and it gives the same error :
Error in 'stats' command. The argument 'stats' is invalid.
... View more
08-03-2015
12:46 PM
It does exist and the spelling is correct. It gets results into some of the other panels.
May be this is not the right way?
index="dpa" sourcetype="DP:PROD:SYSLOG" PROXYNAME="UBIAPI" URI="/vehicle/DeviceFullFillment" | stats latest(TransactionStatus) AS FinalStatus BY CorrelationId |stats avg(Latency) as Avg_Response_Time count by FinalStatus
... View more
08-03-2015
12:01 PM
@woodcock
a followup question based on the query which you suggested.
We have a panel with the following query and it shows the Avg_Response_Time column just fine
index="dpa" sourcetype="DP:PROD:SYSLOG" PROXYNAME="UBIAPI" URI="/vehicle/DeviceFullFillment" | chart avg(Latency) as Avg_Response_Time count over TransactionStatus
When I used the query which you suggested and try to add the column for Avg_Response_Time it shows a blank column, any suggestions about integrating/overlaying Avg_Response_Time.
Your Query:
index="dpa" sourcetype="DP:PROD:SYSLOG" PROXYNAME="UBIAPI" URI="/vehicle/DeviceFullFillment" | stats latest(TransactionStatus) AS FinalStatus BY CorrelationId | chart count BY FinalStatus
... View more
07-28-2015
04:09 PM
aaah, that query looks/sounds way to simple 😕
Well the logic was when the transaction for Insurance Device fails it is reprocessed manually and the same policy with the same corelationid turns to success
So we have two events with same policy and corelationid but 2 diff status. Hence we thought of joining data based on corelationid, filter the data out and list only the real/current failed status.
... View more
07-28-2015
03:10 PM
We have three statuses
Success, Success_Voucher_Invalid and Failed.
The query which you modified appears to be correct but it was adding Failed and Success Count
I have changed the query to the following and this appears to bring the correct count with status.
index="dpa" sourcetype="DP:PROD:SYSLOG" PROXYNAME="UBIAPI" URI="/vehicle/DeviceFullFillment" | stats values(*) AS * dc(TransactionStatus) AS numTS latest(TransactionStatus) AS FinalStatus BY CorrelationId | eval myStatus=case(numTS==1 AND FinalStatus="FAIL", "FAILED", FinalStatus="SUCCESS_VOUCHER_INVALID", "SUCCESS_VOUCHER_INVALID", FinalStatus="SUCCESS", "SUCCESS", 1==1, "Fail") | stats count by myStatus
Would be great if you can explain how that ditching join was worked out...
... View more
07-28-2015
02:29 PM
Hi @MuS
We are using Join to filter the data as the query further got enhanced.
index="dpa" sourcetype="DP:PROD:SYSLOG" PROXYNAME="UBIAPI" URI="/vehicle/DeviceFullFillment" TransactionStatus=FAIL | join type=left CorrelationId [search index="dpa" sourcetype="DP:PROD:SYSLOG" PROXYNAME="UBIAPI" URI="/vehicle/DeviceFullFillment" TransactionStatus !=FAIL] | search TransactionStatus=FAIL TransactionStatus=FAIL | append [search index="dpa" sourcetype="DP:PROD:SYSLOG" PROXYNAME="UBIAPI" URI="/vehicle/DeviceFullFillment" TransactionStatus !=FAIL]
... View more
07-28-2015
02:17 PM
We have a query which is using join condition to filter data and we have a graph resulting into three columns
Fail|Succcess| Success_v_Invalid
When I click on the Fail bar it should display the events only for Failed Results.
Right now it shows the entire list of events.
How can we restrict or narrow it down.
Query Used
index="dpa" sourcetype="DP:PROD:SYSLOG" PROXYNAME="UBIAPI" URI="/vehicle/DeviceFullFillment" TransactionStatus=FAIL | join type=left CorrelationId [search index="dpa" sourcetype="DP:PROD:SYSLOG" PROXYNAME="UBIAPI" URI="/vehicle/DeviceFullFillment" TransactionStatus !=FAIL] | search TransactionStatus=FAIL TransactionStatus=FAIL | append [search index="dpa" sourcetype="DP:PROD:SYSLOG" PROXYNAME="UBIAPI" URI="/vehicle/DeviceFullFillment" TransactionStatus !=FAIL]
... View more
07-27-2015
09:27 PM
Well as I was mentioning earlier we have 4 out of 121 policy numbers who has transaction status failed and success. If I use OR it returns all of the 121 events
... View more
07-27-2015
08:11 PM
@MuS, no those are two different events.
TransactionStatus=FAIL|TransactionDesc=AAA_RUNTIME_ERROR|EventCreationDate=2015-07-27T18:26:51Z|Latency=2.119|RiskState=AZ|PolicyNumber=AZSS203728899|ClubCode=002|RespData=ERROR|ErrorVINs=1G1JC6SH8F4157755|ErrorCode=UNEXPECTED_EXCEPTION|ErrorDesc=Octo did not retrurn voucher number and vin. - PolicyNumber:AZSS2
Second Event
TransactionStatus=SUCCESS|TransactionDesc=UBI Device Enrollment Response is sent to Reply Queue for all the requested vehicles|EventCreationDate=2015-07-27T18:26:53Z|Latency=6.782|RiskState=AZ|PolicyNumber:AZSS2
... View more
07-27-2015
07:20 PM
Thanks for the reply @Mus
Well that some how does not return any results.
If I use PolicyNumber=ABC prefix TransactionStatus=* before the pipe it shows both the status
Anything which you can think of?
... View more
07-27-2015
05:35 PM
I have a search where the transaction status of a policy was set to FAIL.
It was processed manually and now it has changed to SUCCESS.
I get the failed policies by the below search.
index="prod" sourcetype="PRD:syslog" PROXYNAME="UAPI" URI="/vehicle/DeviceFullFillment" (TransactionStatus=Fail)| fields PolicyNumber by TransactionStatus
There are couple of policies which both have TransactionStatus=FAIL and TransactionStatus=SUCCESS.
How do I use "AND" operator or any other way to list all the policies which has both the status (FAIL and SUCCESS)
... View more
