Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- Find Answers
- :
- About jiaqya
jiaqya
Builder
Member since:
11-20-2017
12-20-2020
Community Statistics
| Posts | 316 |
| Solutions | 7 |
| Karma Given | 4 |
| Karma Received | 19 |
| Member Since | 11-20-2017 |
Activity Feed
- Got Karma for Re: Search factor vs Replication factor. 08-03-2022 06:58 AM
- Got Karma for Why is there a 10000 rows limit?. 07-15-2022 05:30 AM
- Posted Re: Drilldown to a specific panel on another dashboard. on Dashboards & Visualizations. 12-20-2020 08:21 PM
- Got Karma for Re: Search factor vs Replication factor. 11-08-2020 10:50 AM
- Got Karma for Search factor vs Replication factor-If I change my SF=2 , does this mean 2 copies are changed to primary?. 11-08-2020 10:50 AM
- Posted Re: Splunk server migration to another server on Installation. 10-12-2020 12:02 AM
- Posted Re: Splunk server migration to another server on Installation. 10-11-2020 11:44 PM
- Karma Re: Splunk server migration to another server for inventsekar. 10-11-2020 11:44 PM
- Posted Splunk server migration to another server on Installation. 10-09-2020 03:41 AM
- Got Karma for Re: Can you help me with my conditional search query involving a token?. 10-02-2020 08:54 AM
- Got Karma for Re: Eval field based on similar events or single event. 09-28-2020 10:02 AM
- Posted Re: Eval field based on similar events or single event on Splunk Search. 09-26-2020 12:09 AM
- Posted Re: Eval field based on similar events or single event on Splunk Search. 09-26-2020 12:08 AM
- Posted Re: Eval field based on similar events or single event on Splunk Search. 09-25-2020 10:25 AM
- Posted Re: Eval field based on similar events or single event on Splunk Search. 09-25-2020 09:49 AM
- Posted Eval field based on similar events or single event on Splunk Search. 09-25-2020 09:26 AM
- Posted Trellis and PDF delivery on Dashboards & Visualizations. 09-17-2020 09:22 AM
- Posted Need help with search based on values that are duplicated but have different status levels. on Splunk Search. 09-02-2020 11:31 AM
- Posted Re: increment count in a field based on field values.. on Splunk Search. 09-02-2020 11:22 AM
- Posted increment count in a field based on field values.. on Splunk Search. 08-27-2020 12:30 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
01-13-2020
02:18 AM
tstat works great when there is at least 1 event per day( span=1d).
but when there is no data inserted, it completely ignores that date .
but with timechart we do get a 0 for dates missing data.
how can i get similar output with tstat.. output should show 0 for missing dates..
... View more
- Tags:
- splunk-enterprise
01-12-2020
10:32 PM
I see it was answered to be done using timechart, but how to do the same with tstats.
tstats does not show a record for dates with missing data...
the fillnull_value option also does not work on 726 version.
... View more
09-09-2019
12:47 AM
I have a table like below
A B C
1 2,3,4 Hello
Need a query for which output will be like below
A B C
1 2 Hello
1 3 Hello
1 4 Hello
Split 1 row into different rows based on values in column B
any help ?
... View more
- Tags:
- splunk-enterprise
09-05-2019
03:34 AM
Is there a way to determine where all an index is being used.
can we at least identify the app/dashboard using a particular index.
is it possible in splunk, or we have a write a custom code...
... View more
08-18-2019
11:12 PM
Thank you Gaurav. Just another query,. Is it possible to restrict indexes by search head.
since this user could login to another search head and query the indexes. ( we do not have SH clustering )
... View more
08-16-2019
03:21 AM
We have peers added to search heads, but users are able to search all the indexes on the peers.
We want to restrict some users so that they can access only certain indexes.
Is it possible with enterprise version of 7.2.6 ?
... View more
08-06-2019
12:10 AM
I have a case where an index failed to index due to some network issue.
But was not aware of it and the dashboard went blank the next day.
what is the best way to identify an ingestion failure other than the alert/notification ?
... View more
- Tags:
- splunk-enterprise
07-03-2019
06:55 AM
Thanks for the idea, the below query did the trick for me..
SELECT t.FILESYSTEM,t.KBYTES,t.LAST_UPDATE,t.LOG_DATE,t.MOUNTED_ON,t.SERVER_NAME,t.S_NAME,O.GROUPNAME FROM (SELECT TO_CHAR(D.SYS_DATE,'YYYY-MM-DD HH24:MI:SS') AS LOG_DATE,
TO_NUMBER(TO_CHAR(D.ROLLUP_DATE, 'yyyymmddhh24miss')) AS LAST_UPDATE,
S.SERVER_NAME AS S_NAME,
S.SERVER_NAME,D.FILESYSTEM,
D.MOUNTED_ON, D.KBYTES
FROM SERVER_DATA.SERVER S, SERVER_DATA.SERVER_DFK_CURRENT D
WHERE D.SERVER_NAME = S.SERVER_NAME) t
LEFT OUTER JOIN SERVER_DATA.ORACLE_INFO O ON t.SERVER_NAME = O.SERVER_NAME
... View more
07-03-2019
05:51 AM
Hi Paul, thanks for input, but im not too good at sql . so need help.
could you suggest on what i should be doing based on example ..
SELECT * FROM (SELECT TO_CHAR(D.SYS_DATE,'YYYY-MM-DD HH24:MI:SS') AS LOG_DATE,
TO_NUMBER(TO_CHAR(D.ROLLUP_DATE, 'yyyymmddhh24miss')) AS LAST_UPDATE,
S.SERVER_NAME AS S_NAME,
S.SERVER_NAME,D.FILESYSTEM,
D.MOUNTED_ON, D.KBYTES
FROM SERVER_DATA.SERVER S, SERVER_DATA.SERVER_DFK_CURRENT D
WHERE D.SERVER_NAME = S.SERVER_NAME)
LEFT OUTER JOIN SERVER_DATA.ORACLE_INFO O ON S_NAME = O.SERVER_NAME
... View more
07-02-2019
04:54 AM
Below is the query, trying to join output of a query to a table, it worked in 1.1.5 but not working with 3.1.4
SELECT * FROM (SELECT TO_CHAR(D.SYS_DATE,'YYYY-MM-DD HH24:MI:SS') AS LOG_DATE,
TO_NUMBER(TO_CHAR(D.ROLLUP_DATE, 'yyyymmddhh24miss')) AS LAST_UPDATE,
S.SERVER_NAME AS S_NAME,
S.SERVER_NAME,D.FILESYSTEM,
D.MOUNTED_ON, D.KBYTES
FROM SERVER_DATA.SERVER S, SERVER_DATA.SERVER_DFK_CURRENT D
WHERE D.SERVER_NAME = S.SERVER_NAME)
LEFT OUTER JOIN SERVER_DATA.ORACLE_INFO O ON S_NAME = O.SERVER_NAME
error : java.lang.IllegalStateException: Column name conflicted, please set shortnames option to false and retry
No results found.
... View more
06-27-2019
06:00 AM
The output of my search has weekly count collected on Monday + another bar for current date count ( no nulls ).
Before upgrading to 726 from 652, I used to see only weekly bars + current date bar on the visualization chart.
But now after the upgrade, I am seeing weekly bars + current bar + null bars,
i.e for all days without any bars on them, even though the output of the query shows non-null values.
How do I get rid of these blank values so that I can only see the bars?
... View more
06-20-2019
09:55 PM
2 Karma
How about the font color ?
... View more
05-29-2019
08:09 AM
3 Karma
I hear "The Splunk ODBC Driver is not supported on Splunk platform versions 7.x"
We are running splunk 7.2.6 on RHEL 7.4
Is this a sure "not supported" by splunk app , or could it also work if tried..
... View more
- Tags:
- splunk-enterprise
05-22-2019
10:18 PM
i configured index cluster with 3 peers. ( rf=2 sf=1)
i see that only new data is getting replicated , the older or existing buckets/data on the index peers i added is not getting replicated .
is this by design ? or is it possible to replicate all the older buckets already indexed ?
version 7.2.6
... View more
- Tags:
- splunk-enterprise
05-10-2019
07:39 AM
yes correct, i have used it the same same.
i get results for some records from the file and some i do not..
... View more
05-10-2019
07:18 AM
csv files has 70k entries and when i join it with index which has 30k rows, it fails to join random records even when data is available.
when i specify the record before and after join it picks up the value.
any idea if this is due to any kind of limitation.
... View more
05-07-2019
03:04 AM
Never mind, got it to work by doing below code.
|rex field=raw_data mode=sed "s/([\d-]+)\s([\d:.]+)/\1 \2;/g"
|makemv delim=";" raw_data
|rex field=raw_data mode=sed "s/;/\n/g"
First 2 lines are from what you gave, then i changed the ; delimiter back to new line on the 3rd line.
this ensures, i can see the records in new line on the report page and also shows as new lines when i export them to xls/csv
thanks
... View more
05-07-2019
02:12 AM
Koshyk , thank you, using this code, i am able to see the data in a new line within the column. ( leaving the last line of code , ie |mvexpand raw_data as i want all data to be in single row )
But when i export, i dont see new line in the row, but all in same line with ; as delimiter.
can the same format be there when we export the file ?
... View more
05-06-2019
11:46 PM
i have a field with dates in single line ( could be many dates )
ex: 2019-04-11 23:15:58.547 2019-05-02 10:11:22.833 2019-05-03 10:21:27.0
need help to replace every 2nd space with carriage, so each date shows on a separate line when exported. right now they show on single line when exported.
... View more
- Tags:
- splunk-enterprise
05-02-2019
03:32 AM
Thanks for helping David, i was having trouble evaluating the fields.
the field is maxCPU
after predict i get a field called prediction(maxCPU)
i was not able to eval this field due to the nature of function in it, due to brackets.
i was trying below, didnt work, see if you can help.
eval prediction(maxCPU)=if(prediction(maxCPU)>100,100,prediction(maxCPU))
... View more
05-02-2019
02:58 AM
Thanks David, but it does not tell much about limiting the prediction value.
in my case , im trying to get prediction for max cpu, and it seems with 3 months of data, its predicting over 100% of cpu, which is not true, so anything over 100% i would like to eval it to 100.
is there a way to do it via predict function, else would it be ok to do it with eval..
... View more
