Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- Find Answers
- :
- About sanjay_shrestha
sanjay_shrestha
Contributor
Member since:
05-10-2013
08-10-2020
Community Statistics
| Posts | 85 |
| Solutions | 9 |
| Karma Given | 2 |
| Karma Received | 39 |
| Member Since | 05-10-2013 |
Activity Feed
- Got Karma for Re: Where do I edit/delete reports in Splunk App for Windows Infrastructure. 06-05-2020 12:47 AM
- Got Karma for Re: Mapping an index to an app. 06-05-2020 12:47 AM
- Got Karma for Re: How to combine my two searches in Splunk?. 06-05-2020 12:47 AM
- Got Karma for Re: Is it possible to monitor whether there are any files in a folder without indexing them?. 06-05-2020 12:47 AM
- Got Karma for Re: Is it possible to monitor whether there are any files in a folder without indexing them?. 06-05-2020 12:47 AM
- Got Karma for Re: Why can't I log into the dashboard using the same credentials to log in to my account?. 06-05-2020 12:47 AM
- Got Karma for Re: embed a graphic on a dashboard, splunk 6.2. 06-05-2020 12:47 AM
- Got Karma for Re: embed a graphic on a dashboard, splunk 6.2. 06-05-2020 12:47 AM
- Got Karma for Re: Where do I edit/delete reports in Splunk App for Windows Infrastructure. 06-05-2020 12:47 AM
- Got Karma for Re: Mapping an index to an app. 06-05-2020 12:47 AM
- Got Karma for Re: How to combine my two searches pulling data from two different indexes into one search?. 06-05-2020 12:47 AM
- Got Karma for Re: How to combine my two searches pulling data from two different indexes into one search?. 06-05-2020 12:47 AM
- Got Karma for Re: Bulk Update recipient email addresses for alerts.. 06-05-2020 12:47 AM
- Got Karma for Re: Sum a series of values based on the distinctness of another column. 06-05-2020 12:47 AM
- Got Karma for Re: Sum a series of values based on the distinctness of another column. 06-05-2020 12:47 AM
- Got Karma for Re: Is it possible to have Splunk send a report email based on an external trigger?. 06-05-2020 12:47 AM
- Got Karma for Re: Search first 10 results by sourcetype. 06-05-2020 12:47 AM
- Got Karma for Re: How to work with timepicker in splunk using Database as back end.?. 06-05-2020 12:47 AM
- Got Karma for Re: Mapping an index to an app. 06-05-2020 12:47 AM
- Got Karma for Re: Mapping an index to an app. 06-05-2020 12:47 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 4 | |||
| 0 | |||
| 0 | |||
| 1 |
02-24-2015
09:33 AM
1 Karma
Can you post the result of
... | bucket _time span=1h | stats max(memory) by _time jobid state
Or you can try:
sourcetype=condor | bucket _time span=1h | stats max(memory) AS dist_memory by _time jobid state |stats sum(dist_memory) by _time state
... View more
02-24-2015
08:10 AM
1 Karma
You can try like this:
... | bucket _time span=1h | stats max(memory) by _time jobid state
... View more
02-23-2015
02:59 PM
you can try like this:
index=device_index... | join device_id [search index=yourdevicestatus_index|stats first(device_status) by device_id]
... View more
02-23-2015
02:41 PM
You can create a scheduled saved search to create a lookup file
| dbquery "YOURDATABASE" "select * from deviceinfo"|outputlookup device_status.csv
Then use it in your query
index=your_index .....|lookup device_status.csv device_id output device_status
... View more
02-23-2015
10:56 AM
1 Karma
Yes. It can be done modifying (globoal replacement) savedsearches.conf.
... View more
02-23-2015
10:48 AM
Is there any typo?
... View more
02-23-2015
10:47 AM
I tried similar query:
index=_audit|stats count AS C by user|eventstats sum(C) as tot
| eval res = C * [search index=_audit|stats dc(user) as result
| rename result as query | fields query | head 1]/tot
and it worked. You can refer to same idea.
... View more
02-23-2015
10:43 AM
2 Karma
It might have gone to different app context than where you are looking. You can check in
settings>>Searches, reports, and alerts
App Context>> All
Owner >> Any
You should see your saved search somewhere..
... View more
02-23-2015
10:38 AM
2 Karma
aha.. add "search" keyword...
so... it would be like..
index="idxweblog" source="/opt/apache2/logs/idxapi.nbcuni.com-access_log" BRAND_NAME="*" | stats count as apicount by BRAND_NAME |sort + BRAND_NAME
|eventstats sum(apicount) as apicountsum
|eval brand_Cost = apicount * [search index=aws-bill Subscription="shared-identity" | stats sum(UnBlendedCost) as idxcost| rename idxcost as query | fields query | head 1 ]/apicountsum
... View more
02-23-2015
10:03 AM
You can try like this:
index="idxweblog" source="/opt/apache2/logs/idxapi.nbcuni.com-access_log" BRAND_NAME="*" | stats count as apicount by BRAND_NAME |sort + BRAND_NAME
|eventstats sum(apicount) as apicountsum
|eval brand_Cost = apicount * [index=aws-bill Subscription="shared-identity" | stats sum(UnBlendedCost) as idxcost| rename idxcost as query | fields query | head 1 ]/apicountsum
... View more
02-17-2015
07:45 AM
Thanks Michael.
... View more
02-16-2015
12:02 PM
We have a situation where we need to join two child objects of a data model. Both child objects have separate index and host.
e.g.
ProjectInformation (Datamodel Object)
_time
host
..........
ProjectId (Extracted Field)
FromIndexOne (Datamodel Child Object)
_time
host
ProjectId (Inherited Field)
............
CalculatedField1
CalculatedField2
FromIndexTwo (Datamodel Child Object)
_time
host
ProjectId (Inherited Field)
............
CalculatedField3
CalculatedField4
We would like to have result with following fields:
_time; ProjectId; CalculatedFiled1; CalculatedFiled2; CalculatedFiled3; CalculatedFiled4
... View more
02-13-2015
11:53 AM
2 Karma
Can you try:
src="{{SPLUNKWEB_URL_PREFIX}}/static/logo.jpg"
... View more
02-13-2015
10:25 AM
When toto3 was used; splunk looks for single word toto3.
... View more
02-13-2015
10:24 AM
I think toto3 is not a complete word. So you can try
index=abc "*toto3*"
... View more
02-13-2015
10:13 AM
Can you try:
index=abc "toto3"
... View more
02-11-2015
09:45 AM
Can you correlate with time?
... View more
02-09-2015
12:58 PM
1 Karma
Check the permission for that dashboard.
... View more
02-09-2015
07:30 AM
2 Karma
If you do not prefer to ingest file then you can write a script and run in desired interval (via cron or scheduler), which will continuously monitors a folder and write a log with one event with file count information.
e.g.
04/02/2015 10:20:30.00 - File Count = 2
then you can create an alert for this event.
... View more
02-06-2015
12:36 PM
settings >> System settings >> System Logging
... View more
02-06-2015
11:52 AM
Can you try adding following:
User name attribute >> samaccountname
Real name attribute >> cn
Group mapping attribute >>dn
Group name attribute >> cn
Static member attribute >> member
P.S. I tried in my system and able to pull only one user. I had these extra parameters set.
... View more
02-06-2015
11:44 AM
Can you post User Settings & Group Settings?
... View more
02-06-2015
11:38 AM
It is possible if you add constraint in the User Settings:
User Base Filter
(&(objectClass=user)(cn=someone))
And check in the Group Settings:
Static group search filter should have constraint for the group where someone exists.
e.g.
(&(objectClass=group)(cn=Splunk-Someones-Group))
... View more
02-05-2015
01:45 PM
Wondering after changes, if you have added more json files in monitored folder. Changes will apply to new events only.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
08-10-2020
10:53 AM
|
Karma from
| User | Karma Count |
|---|---|
| 1 | |
| 1 | |
| 4 | |
| 1 | |
| 1 |
