Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- About Abilan1
Abilan1
Path Finder
Member since:
05-08-2015
06-05-2020
Community Statistics
| Posts | 144 |
| Solutions | 0 |
| Karma Given | 19 |
| Karma Received | 5 |
| Member Since | 05-08-2015 |
Activity Feed
- Got Karma for Re: Why is the "map" command not working in dashboard and the corresponding panel displays "Waiting for inputs"?. 09-21-2020 06:46 AM
- Karma Re: Splunk Universal Forwarder monitoring for gcusello. 06-05-2020 12:48 AM
- Karma Re: Splunk Universal Forwarder monitoring for gfreitas. 06-05-2020 12:48 AM
- Karma Re: Splunk upgrade for TStrauch. 06-05-2020 12:48 AM
- Karma Re: How to fetch the before event of the search field for woodcock. 06-05-2020 12:48 AM
- Karma Re: Indexes bucket settings for yannK. 06-05-2020 12:48 AM
- Got Karma for Is there any way to have the below query without map command?. 06-05-2020 12:48 AM
- Karma Re: How do I find which host is using the most data in Splunk 6.2.2 and causing a license violation? for MuS. 06-05-2020 12:47 AM
- Karma Re: Is there a way to delete data on an indexer from Splunk Web to free up disk space? for lguinn2. 06-05-2020 12:47 AM
- Karma Re: Is there a way to delete data on an indexer from Splunk Web to free up disk space? for lguinn2. 06-05-2020 12:47 AM
- Karma Re: How do I migrate alerts and dashboards from a search head to an indexer? for somesoni2. 06-05-2020 12:47 AM
- Karma Re: Do we need to purchase any license for the Oracle WebLogic App for Splunk? for lguinn2. 06-05-2020 12:47 AM
- Karma Re: How to create a dashboard to show how many events took 4 seconds, 5 seconds, 7 seconds, etc. from my sample log data? for jeffland. 06-05-2020 12:47 AM
- Karma Re: How to search two different strings from the same source, but different timestamps? for diogofgm. 06-05-2020 12:47 AM
- Karma Re: How to exclude some specific files in a monitored Source folder from being indexed? for jensonthottian. 06-05-2020 12:47 AM
- Karma Re: How to use rex command to extract this field from my sample log? for Richfez. 06-05-2020 12:47 AM
- Karma Re: How to use rex command to extract this field from my sample log? for MuS. 06-05-2020 12:47 AM
- Karma Re: Using colours Drill down option is not working? for MuS. 06-05-2020 12:47 AM
- Karma Re: How to setup an alert if any index size goes over 90%? for MuS. 06-05-2020 12:47 AM
- Karma Re: How to setup an alert if any index size goes over 90%? for MuS. 06-05-2020 12:47 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 0 | |||
| 0 |
05-11-2016
02:41 AM
Hi ,
I have a scheduled alert which runs every 5 minutes and it was working perfectly (triggered e-mail) till last week. Not sure what happened. It stopped working from yesterday. We have had the error message in the log, but Splunk didn't trigger the alert for this one. When I checked the Splunk scheduler log, I see the below error message.
ERROR SavedSplunker - savedsearch_id="nobody;search;Hungalert", message="Unable to read the job status.". No actions executed
Please let me know the reason for this issue and how to avoid this in future.
Thanks!
... View more
04-05-2016
08:13 AM
It is not working on search, not sure I didn't try for dashboard. am looking for a query which works in both dashboard as well as search.
... View more
04-02-2016
02:21 PM
Hi,
I would like to capture the seconds which is highlighted on the below logs and only for the table ABNUM (which is on next event).
Note: There are other tables like EmpID,USER,etc..will also be a part of the source file. But I need only for ABNUM table's query time. Please let me know if you need any additional information.
Log File:
Sun Mar 27 13:07:28.654666 doQueryDiagnostics: The following SQL query took 4 seconds which is equal to or greater than QueryExecutionTimeThreshold (4 seconds)
Sun Mar 27 13:07:28.654975 SELECT * FROM ABNUM WHERE ( RPAN8 = 68537110.000000 )
... View more
03-31-2016
12:32 AM
1 Karma
Hi ,
With the below query, am facing issue while creating dashboard, as it is having a map command.
index=Test host=XXX "ABNUM" | map search="search source=$source$ | streamstats current=f last(_raw) AS next_line | search \" took \" next_line=\"ABNUM\"" | dedup _raw next_line | rex "query took (?\d+).*((?\d+) seconds)"
is there any other way to make the same without map command.
... View more
03-30-2016
11:54 PM
1 Karma
I am also facing the same issue, If I use $$ am getting zero results and with $ am getting proper results. did you get any solution for this. Thanks!
... View more
03-30-2016
12:51 PM
It's not working for me. If I try with single $, am getting proper result in search but with $$source$$. am getting zero result only.
... View more
03-30-2016
12:21 PM
Hi,
It's not working If I use $$source$$. am getting zero results...
... View more
03-30-2016
12:02 PM
Hi ,
I am trying to create the dashboard for the below query, but it is showing no results in dashboard. Am able to get the result when I do the search.
index=Test host=XXX "ABNUM" | map search="search source=$source$ | streamstats current=f last(_raw) AS next_line | search \" took \" next_line=\"*ABNUM*\"" | dedup _raw next_line | rex "query took (?\d+).*\((?\d+) seconds\)"
X-axis querySeconds and Y-axis Count of event
... View more
03-30-2016
11:46 AM
Thank you so much!
... View more
03-30-2016
09:07 AM
Hi ,
am able to see the querySeconds field in search fields, when I try to put the dashboard it is giving me no results found.
... View more
03-30-2016
08:47 AM
Thank you.. I've to use "query seconds" in my dashboard right? and is there any threshold value we have here?
... View more
03-30-2016
08:28 AM
Hi ,
am not able to see your answers, can you please post it again..Thanks!
... View more
03-29-2016
01:20 AM
Hi,
Thanks, I've one more problem here, actually there are other tables also in the log like EmpID, etc..so the above query is fetching the "took" from those entries as well..sample below.
Log:
Sun Mar 27 13:07:28.654666 doQueryDiagnostics: The following SQL query took 4 seconds which is equal to or greater than QueryExecutionTimeThreshold (4 seconds)
Sun Mar 27 13:07:28.654975 SELECT * FROM ABNUM WHERE ( RPAN8 = 68537110.000000 )
Sun Mar 27 13:17:08.654666 doQueryDiagnostics: The following SQL query took 15 seconds which is equal to or greater than QueryExecutionTimeThreshold (4 seconds)
Sun Mar 27 13:17:08.654975 SELECT * FROM EMPID Where ABC=1
... View more
03-28-2016
08:46 PM
Hi ,
I am looking for two different search on the single log file and am using below command to search.
index=Test host=XXX "ABNUM" | map search="search source=$source$ "took""
I wanted to take the seconds which is highlighted on the below field only for the table ABNUM (which is on next event). The problem with the above search I've multiple table which is also having this second deatils. So It is giving me the output of that one as well. I would like to restrict this search only to the before event not on the entire source file.
Log File:
Sun Mar 27 13:07:28.654666 doQueryDiagnostics: The following SQL query took 4 seconds which is equal to or greater than QueryExecutionTimeThreshold (4 seconds)
Sun Mar 27 13:07:28.654975 SELECT * FROM ABNUM WHERE ( RPAN8 = 68537110.000000 )
... View more
- Tags:
- splunk-enterprise
03-14-2016
09:16 PM
Hi ,
I would like to check how many hot/cold/warm buckets on my instance? and also about from when to when that buckets were created?
could someone please help me here?
... View more
- Tags:
- splunk-enterprise
03-14-2016
10:19 AM
So it means all hot, warm, cold buckets will be only 750 MB? After 750 MB filled in Cold db what will happen? data will be deleted?
... View more
03-14-2016
09:18 AM
Hi ,
It means hot bucket size is 750 MB right? And what about Warm and cold bucket size? And where I can find this settings?
... View more
03-14-2016
09:06 AM
Hi ,
I see that "Max size (MB) of hot/warm/cold bucket = auto" under my one of index, I would like to know about this setting, like how long data will be in hot/warm/cold buckets? also If we have this setting for index, then frozenTimePeriodInSecs will not work?
... View more
- Tags:
- splunk-enterprise
03-01-2016
12:20 PM
Hi ,
Do you want me to add the new entries on those files in different location? Whenever we create the new index, it updates indexes.conf file with details right? I am seeing the entries under splunk_management_console folder indexes.conf file. so I've updated frozen time details there. I am scared to add all the entries to those indexes.conf file, in case if it creates any other issues. Please advise.
Thanks!
... View more
02-29-2016
07:31 AM
Hi,
I have verified the path which you have given and I don't see any entries on that..Can you please confirm the entry(frozenTimePeriodInSecs = 31556926) which I've added into indexes.conf is enough to cleanup 1 year old data? Or any other related fields needs to be added to that?
... View more
02-29-2016
06:10 AM
Hi ,
When I see my Index though Splunk Web, I can see it is in "splunk_management_console" not in system. (Settings > Indexes). I have checked $ SPLUNK_HOME / etc / system / local location, I don't see any entries on that indexes.conf file.
So when I checked in $ SPLUNK_HOME/splunk_management_console/system/local, I found my index related entry in indexes.conf file and I've updated frozen time here.
... View more
02-29-2016
03:26 AM
Hi ,
I would like to cleanup the 1 year old files, so I have updated the settings as like below in Indexes.conf file and restarted splunk, but it didn't clean up my old data. Please find my indexes.conf below
[test]
coldpath = $SPLUNKDB/test/colddb
homepath = $SPLUNKDB/test/db
thawedpath = $SPLUNKDB/test/thaweddb
maxTotalDataSizeMB = 500000
frozenTimePeriodInSecs = 31556926
Let me know if I need to add any other entries or any modification this indexes.conf file.
... View more
- Tags:
- splunk-enterprise
