Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- About pavanae
pavanae
Builder
Member since:
06-10-2015
05-21-2023
Community Statistics
| Posts | 381 |
| Solutions | 3 |
| Karma Given | 47 |
| Karma Received | 21 |
| Member Since | 06-10-2015 |
Activity Feed
- Posted How to split a field into two different fields using eval in Splunk? on Splunk Search. 05-12-2023 06:59 AM
- Posted How to combine 2 fields into 1 in Splunk in an alternate approach? on Splunk Search. 05-05-2023 07:50 AM
- Posted How to combine 2 fields into 1 in Splunk in an alternate approach? on Splunk Search. 05-05-2023 07:29 AM
- Posted Splunk time format conversions? on Splunk Search. 05-03-2023 08:39 AM
- Posted How to manually save a saved search which contains backslashes \ in the query to savedsearches.conf? on Splunk Search. 02-17-2023 08:10 AM
- Posted Re: How to extract some fields from an existing field which has backslashes? on Splunk Search. 02-10-2023 10:38 AM
- Karma Re: Struggling to extract some fields from an existing field which has backslashes for yeahnah. 02-10-2023 10:38 AM
- Posted How to extract some fields from an existing field which has backslashes? on Splunk Search. 02-08-2023 05:07 PM
- Karma Re: Can't I use backslashes in Splunk searches? for richgalloway. 02-08-2023 12:09 PM
- Posted Can't I use backslashes in Splunk searches? on Splunk Search. 02-08-2023 11:10 AM
- Tagged Fix Python Compatibility issues with Eventgen? on All Apps and Add-ons. 09-21-2022 07:28 AM
- Posted Fix Python Compatibility issues with Eventgen? on All Apps and Add-ons. 09-19-2022 08:11 AM
- Posted Extract a field from a field in splunk? on Splunk Search. 08-08-2022 01:06 PM
- Posted Re: How to convert the time and calculate the difference in a query? on Getting Data In. 07-12-2022 11:51 AM
- Posted How to convert the time and calculate the difference in a query? on Getting Data In. 07-12-2022 10:57 AM
- Posted How to apply replicationblacklist for a particular app in distsearch.conf? on Getting Data In. 06-27-2022 06:32 PM
- Got Karma for Splunk query to list all the knowledge objects that use splunk internal indexes(_*) ?. 05-24-2022 10:36 PM
- Karma Re: how to convert a field value of single line to displayed as multilines? for bowesmana. 04-11-2022 02:07 PM
- Karma Re: how to convert a field value of single line to displayed as multilines? for richgalloway. 04-11-2022 02:06 PM
- Posted How to convert a field value of single line to displayed as multilines? on Splunk Search. 04-10-2022 04:28 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
01-26-2018
08:21 AM
For example I have a query like below
index=ABC | stats count by host
Does stats is the word count of all the events or character count of all events or is it just the event count?
... View more
01-26-2018
06:18 AM
I have a query as follows
_index_earliest="01/20/2018:00:00:00" _index_latest="01/21/2018:00:00:00" index="ABC"......| stats count by x
And on the right ride of the search bar. I have chosen the date range from timerange picker as below
Now as per the above does the query pulls the results from the time I specified on the query _index_earliest="01/20/2018:00:00:00" _index_latest="01/21/2018:00:00:00" or is it going to pull the results from the timepicker I specified (01/18/2018 and 01/23/2018)
Can someone explain the difference and clarify me on which time frame the query will use?
... View more
01-22-2018
12:26 PM
1 Karma
I have a splunk query which ends as follows
my_query | stats count by field_A | eval field_A=field_A + "," + count
As per the above my results are as follows
field_A count
ABC,45 45
DEF,60 60
Now I have displayed the above in a pie chart so that I can see each slice name and their count like below
Now All I'm trying to do is assign some default colors to the pie chart but I only know how to assign a default color if the field values of field_A are default like below if they are default
But here the case is different the field values will get changed since the count will get changed like below since the count is not constant where ABC,DEF,GHI are constant.
ABC*,count*
DEF*,count*
GHI*,count*
Now here in this case how can I specify the constant colors to the non-constant field names in charting.fieldColors?
... View more
01-19-2018
09:43 AM
Generally, In splunk the below is the way to open or display a lookup file
| inputlookup ABCD.csv
but what does the below lookup used in between my query
| inputlookup ABCD.csv | lookup dnslookup field_1 AS Field_one OUTPUT field_2 AS field_two
While trying to understand the above query. The first thing I tried is below to check what's inside the lookup dnslookup
| inputlookup dnslookup
which didn't displayed any results. Could someone explains what actually | lookup dnslookup does in my query and how to check what's inside that lookup?
... View more
01-17-2018
12:13 PM
thanks for the answer @somesoni2 HOST displays perfect but there isn't anything coming under the TYPE.
... View more
01-16-2018
11:31 AM
I'm trying to provide some tabulated fixed description on my Dashboard but I'm not sure how to insert a 2X2 table like below
HOST TYPE
A XX
B YY
Current XML I have is as below which gives me some listed information.
Could anyone suggest a better xml format with better customization to display them in tabullar format?
... View more
01-09-2018
12:02 PM
My splunk infrastructure is in Linux.
Suddenly One of my Splunk dashboard consumes almost 20 mins. Earlier it used to consume around 2 mins. I haven't increased the time span recently or modified the dashboard queries for sure.
Is there any way that I can check the cpu and memory usage for that particullar dashboard? If there is a way is it in the linux server or I can check that in splunk search head itself?
... View more
01-02-2018
01:06 PM
I have lookup file which contains a list of hosts around 500 as follows
host
A
B
C
d
Now, how to write a query to identify the top 10 hosts with event count spike compared to yesterday's event count ? Probably like below or any better way of presenting this would be helpfull.
host Yesterday Today
D 2.2 GB 8 GB
H 1.1 GB 3 GB
Y 0.5 GB 1.4 GB
... View more
12-26-2017
02:03 PM
Thanks for the response @mdsnmss. But I used the metadata to calculate the list of hosts from the lookup table which never reported to splunk based on the last reporting time from the metadata. Your query just given me the results based on the category field for whole hosts in the lookup.
for example if I have around 1000 hosts from the lookup only around 100 hosts are never reported to splunk. I got that 100 count by using my metadata query. Now I want to categorize those 100 hosts by category field. where category is a field only available in the lookup.
... View more
12-26-2017
08:11 AM
I have a lookup file "hosts.csv" as below with multiple fields
**category** **my_hostname** .. ... ...
A abc.com
B DEF.com
Now I have the below search that gives the total number of host count that were never reported to Splunk from a lookup table:
| metadata type=hosts | search [| inputlookup hosts.csv | eval host=lower(my_hostname) | fields host ] | eval host=lower(host) | append [| inputlookup hosts.csv | eval host=lower(my_hostname) | eval recentTime=0, lastTime=0, host=lower(host) | fields host recentTime lastTime ] | dedup host | where recentTime=0 | stats dc(host) AS total_hosts
Now I want to see those host count by a field"category" in a lookup file like below
(for example Assuming total dc(host) is 50)
Category count
A 30
B 20
Could anyone please suggest the modified search to get the desired result?
... View more
12-22-2017
12:51 PM
I have a bar graph as below
Now how can change my current colors to display like below constantly, like every time I want to see only the below colors.
The following is my current html code. Now exactly where should I have to specify the above three color names.
option name="charting.axisLabelsX.majorLabelStyle.overflowMode" ellipsisNone
option name="charting.axisLabelsX.majorLabelStyle.rotation" 0
option name="charting.axisTitleX.visibility">collapsed
option name="charting.axisTitleY.visibility">visible
option name="charting.axisTitleY2.visibility">visible
option name="charting.axisX.scale">linear
option name="charting.axisY.scale">linear
option name="charting.axisY2.enabled">0
option name="charting.axisY2.scale">inherit
option name="charting.chart">bar
option name="charting.chart.bubbleMaximumSize">50
option name="charting.chart.bubbleMinimumSize">10
option name="charting.chart.bubbleSizeBy">area
option name="charting.chart.nullValueMode">gaps
option name="charting.chart.showDataLabels">none
option name="charting.chart.sliceCollapsingThreshold">0.01
option name="charting.chart.stackMode">stacked
option name="charting.chart.style">shiny
option name="charting.drilldown">all
option name="charting.layout.splitSeries">0
option name="charting.layout.splitSeries.allowIndependentYRanges">0
option name="charting.legend.labelStyle.overflowMode">ellipsisEnd
option name="charting.legend.placement">top
... View more
12-08-2017
06:22 AM
Yes @woodcock. Still the same error which is below
"error in 'TsidxStats': WHERE clause is not an exact query"
I am using the following query and getting the above error not sure why
| tstats values(sourcetype) WHERE index=* AND [|inputlookup ABCD.csv | eval host_name=lower(host_name) | eval host_name=mvindex(split(host_name,"."),0) | table host_name | rename host_name AS host ] BY host
... View more
12-07-2017
01:18 PM
still the same. looks like tstats isn't working on our splunk.
... View more
12-07-2017
01:02 PM
ABCD.csv lookup contains only the hostname, ip_address with the values as below
host_name ip
sajdhd.edf.com 10.32.43.23
HDFGV 11.22.33.44
So I have tried the below query
| tstats values(sourcetype) WHERE index=* AND [|inputlookup ABCD.csv | eval host=lower(host_name) | eval host=mvindex(split(host,"."),0) | table host ] BY host
... View more
12-07-2017
12:11 PM
Thanks for the response @woodcock but it throws an error as below
Error in 'TsidxStats': WHERE clause is not an exact query
... View more
12-07-2017
11:47 AM
I have a list of hosts on a lookup around 40 hosts. For the list of hosts I want to check the list of sourcetypes like below
search 1 :-
host="host1" | stats count by sourcetype
search 2 :-
host="host2" | stats count by sourcetype
and so on upto search 40 which contains the host 40 which is a long process and time consuming one. Instead is there any way to use all the hosts from the lookup tables in a query and display the available sourcetypes for each host?
The lookup file name is ABCD.csv
Also I dont want the stats count I just want the list of sourcetypes for each host like below
host sourcetypes
host1 sourcetype_1
host2 sourcetype2a
sourcetype2b
and so on.
... View more
11-29-2017
06:05 PM
I have defined a field extraction in a macro as below
my_search | eval field_A="EventCode: " + EventCode + "; EventType: " + EventType + "; Message: " + substr(Message,1,100)
iseval = 0
What is meant by that? could anyone explain please.
... View more
11-27-2017
04:21 PM
I'm trying to understand the usage of rangemap and metadata commands in splunk. I have gone through some documentation but haven't got the complete picture of those commands. It would be really helpfull if anyone can provide some information related to those commands.
... View more
11-10-2017
12:59 PM
Thanks @niketnilay. That's what I'm looking for. Thanks again.
... View more
11-10-2017
11:15 AM
Thanks for the response @cmerriman. As you can see on by second panel picture you can see the color partitions(3 different field values) of field_B for each field_A value in a 100% bar graph format. Instead I want to see the same partions on my first picture. Imagine my first picture with 2nd picture color partitions but here I want to see the same uneven bar graph lines with the 3 partitions.
Sorry If its still confusing.
... View more
11-10-2017
09:03 AM
I have a query 1 as follows
My_Query1 | stats count by field_A
In which It displays the result as follows in the bar graph with count on x-axis and field_A values on Y-axis
Now I have another query as follows
My_Query2..... | chart count by field_A, field_B
In which it displays the result as follows in a bar graph
Here field_A is same on both the queries
Now how to modify my query to combine both the searches and display the a single bar graph like the query_1's dashboard but it should also contains the color slices that have for Query_2 dashboard.
What I am trying to say that I only need one dashboard panel which covers both the above panels but instead of having a query_2 panel. I want to see those color slices on query_1 panel
... View more
11-09-2017
11:32 AM
Thanks for the response @cmerriman.
... View more
11-09-2017
11:31 AM
Thanks for the response @mayurr98. It worked great.
... View more
11-08-2017
12:28 PM
1 Karma
I had a pie-chart and I have added the following line on the source to display the percentage on the piechart But the percentage is displaying as xx.xyz. Now, how can I round it to single digit likle xx.y
option name="charting.chart.showPercent" as true
Is there any way to round the percentage from the xml?
... View more
11-01-2017
11:54 AM
thanks for the answer @elliotproebstel. what if I want to display the "Systems reported to Splunk in last 24 hours"?
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
05-21-2023
05:23 PM
|
Karma given to
