Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- Find Answers
- :
- About ssadanala1
ssadanala1
Contributor
Member since:
12-28-2017
08-24-2020
Community Statistics
| Posts | 95 |
| Solutions | 2 |
| Karma Given | 17 |
| Karma Received | 17 |
| Member Since | 12-28-2017 |
Activity Feed
- Got Karma for Re: How do I "merge" events?. 06-08-2021 03:47 AM
- Posted Search using MAP COMMAND on Splunk Search. 07-13-2020 09:22 AM
- Karma Splunk Security Essential not loading correctly for promisingbank. 06-05-2020 12:51 AM
- Got Karma for Re: how can I display threshold values when hover over single value visualization in dashboard ?. 06-05-2020 12:51 AM
- Karma Microsoft Office 365 Reporting Add-on for Splunk not pulling data - exiting with 500 Internal Server Error for nmadhok. 06-05-2020 12:50 AM
- Karma Re: How do I get the lower and upper bound of a timechart and use these in an eval? for woodcock. 06-05-2020 12:50 AM
- Got Karma for Re: Calculate max TPS over period of time (2 months) everyday. 06-05-2020 12:50 AM
- Karma Re: data rebalance progresses is very poor or getting stuck for rbal_splunk. 06-05-2020 12:49 AM
- Karma Re: How to break events in this scenario for woodcock. 06-05-2020 12:49 AM
- Karma Re: Timechart Volume per hour same day over several weeks...Seeking alternative way. for woodcock. 06-05-2020 12:49 AM
- Karma Why is answers not working for tkwaller_2. 06-05-2020 12:49 AM
- Karma Re: How to create a field with more complicated values to be extracted? for woodcock. 06-05-2020 12:49 AM
- Karma Re: How to create a field with more complicated values to be extracted? for richgalloway. 06-05-2020 12:49 AM
- Karma Re: How to filter out results based on 2 values in an event? for kmaron. 06-05-2020 12:49 AM
- Karma Re: How to create a query for below scenarios? for woodcock. 06-05-2020 12:49 AM
- Karma Re: How to create a query for below scenarios? for damien_chillet. 06-05-2020 12:49 AM
- Karma Re: Help with Line Break for log for somesoni2. 06-05-2020 12:49 AM
- Got Karma for Re: Renaming field name having #. 06-05-2020 12:49 AM
- Got Karma for Re: splunk license. 06-05-2020 12:49 AM
- Got Karma for Re: Is there a way to look at CSV files in the lookup ?. 06-05-2020 12:49 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 |
06-20-2018
09:40 PM
In the serverclass.conf
what is the value for stateonClient parameter ?
... View more
06-19-2018
12:20 PM
@niketnilay what can you please specify the
field values for 😞 for | eval icon="smile-o"
Thanks
... View more
05-08-2018
08:50 AM
posting the xml code will help the community to troubleshoot your problem
Happy Splunking !!
... View more
05-08-2018
08:41 AM
1 Karma
Yeah Thats because cluster is waiting for one more indexer to join , that is the reason you are seeing those message .
... View more
05-03-2018
09:46 AM
You need to structure you query like the below
In your case modifications would be
base search resourceName=resource-name operationName=operation-name code=UPDATE_SUCCESS |table _time USER_NAME resourceName operationName code | eval epoch=strptime(_time, "%Y-%m-%d %H:%M:%S,%3N")
| sort _time USER_NAME
| streamstats current=f window=1 last(epoch) as lastts by USER_NAME
| eval timediff = epoch - lastts | fieldformat timediff = tostring(timediff, "duration")| where timediff < 60*60*24*30
Below is the query I used for generating data testing the query
| makeresults
| eval raw = "01/01/2018 17:00:00%2%hi%21%#02/03/2018 17:00:12%3%hi%39%#02/21/2018 17:12:00%1%man%3%#02/23/2018 17:12:00%2%hi%6%"
| makemv raw delim="#"
| mvexpand raw
| rex field=raw "(?P[^\%]+)%(?P[^\%]+)%(?P[^\%]+)%(?P[^\%]+)"
| table time customers name amount
| eval begin_epoch=strptime(time, "%m/%d/%Y %H:%M:%S")
| sort name _time
| streamstats current=f window=1 last(begin_epoch) as lastts by name
| eval timediff = begin_epoch - lastts | fieldformat timediff = tostring(timediff, "duration")| where timediff < 60*60*24*30
Happy Splunking !!
... View more
05-02-2018
11:19 PM
If you are in situation " receiving events for an index that doesn't exist then it shows in splunk messages."
Means you are trying to send the data to unconfigured index , so you need to create the index .
... View more
05-02-2018
11:14 PM
As mentioned as a small set of data , ideal way is to save as a lookup which wont expire 🙂
Happy Splunking !!
... View more
05-02-2018
11:02 PM
settings --> Caluclated fields is the solution for this .
The documentation is pretty straight forward
https://docs.splunk.com/Documentation/Splunk/latest/Knowledge/definecalcfields
Happy Splunking !!
... View more
05-02-2018
10:59 PM
The only evidence I can say is referring to https://crontab.guru/
You can find about the time modifiers supported by a cron scheduler .
Happy Splunking !!
... View more
05-02-2018
10:58 PM
Is weird scenario
If you are looking at the license usage per index please run this search
index=_internal source=*license_usage.log type="Usage" | eval indexname = if(len(idx)=0 OR isnull(idx),"(UNKNOWN)",idx) | eval sourcetypename = st | eval host=h | bin _time span=1d | stats sum(b) as b by _time, host, indexname, sourcetypename | eval GB=(b/1024/1024/1024) | fields _time, indexname, sourcetypename, host, GB | stats sum(GB) as GB by indexname, sourcetypename, host
Once all the values are populated , search if there are any index=devices populated and let us know so that it helps our community with more insight what actually happening ..
Happy Splunking !!
... View more
05-02-2018
08:46 PM
As per splunk documentation here is the difference
The xmlkv command automatically extracts fields from XML-formatted data. For example, if the XML contains the following in its _raw data . xmlkv command needed to be invoked by the user to get the fields.
KV_MODE = xml is a search time field extraction that happens before the results are fetched to the user .This setting automatically bring the field extractions automatically.
Hence KV_MODE =xml is the best practice and performance wise there wont be much difference (not sure)
... View more
05-02-2018
08:41 PM
I think this post answers your question
https://answers.splunk.com/answers/4279/timezone-and-timestamp-modification-at-search-report-time.html
Happy Splunking !!
... View more
05-02-2018
08:24 PM
Its not possible using cron scheduler because splunk considers cron format and the least time modifier in cron format is minutes .
Another work around is specifying * * * * * so that the it keeps running or setting the alert time to real time
Happy splunking !!
... View more
05-02-2018
12:19 PM
You can install the event gen app as any other app from GUI
https://splunkbase.splunk.com/app/1924/
For Tutorials and further info
https://github.com/splunk/eventgen/tree/master
Happy Splunking !!
... View more
05-01-2018
07:35 PM
You cant specify both INDEXED_EXTRACTIONS and KV_MODE in the props .
You need to specify either of one .
Try this
[myblob]
DATETIME_CONFIG =
KV_MODE = json
AUTO_KV_JSON = true
NO_BINARY_CHECK = true
category = Structured
description = my blob description
disabled = false
TIME_PREFIX=\"EventInfo.Time\":\s*
TIME_FORMAT=%Y-%m-%dT%H:%M:%S.%7NZ
... View more
05-01-2018
03:14 PM
1 Karma
To view the content of the csv please run
|inputlookup lookupname.csv in the search bar .
If you want to add the contents to the existing lookup table you can do it multiple way by using append if the lookup is written by a search or you can use lookup editor to edit the lookup manually .
https://splunkbase.splunk.com/app/1724/
... View more
04-30-2018
12:08 PM
Can you post your props looks like ?
... View more
04-30-2018
12:04 PM
Is your base search ending with a transformation command or can you post how your base search looks like ?
... View more
04-30-2018
12:01 PM
Please try this and can let us know whether stats.hypervisor_cpu_usage_ppm has field values populated
index=nutanix sourcetype=nutanix_arch stats.hypervisor_cpu_usage_ppm=* |dedup host |table stats.hypervisor_cpu_usage_ppm |eval number = 1000 |eval divide = stats.hypervisor_cpu_usage_ppm/number
... View more
04-30-2018
11:50 AM
Can you try the below
index=nutanix sourcetype=nutanix_arch stats.hypervisor_cpu_usage_ppm=*
| dedup host
| eval usage=tonumber(stats.hypervisor_cpu_usage_ppm) / 10000
| table host, 'stats.hypervisor_cpu_usage_ppm', usage
Thanks
... View more
04-30-2018
09:32 AM
1 Karma
The thread below answers your query
https://answers.splunk.com/answers/180028/how-to-change-the-width-of-two-dashboard-panels-in.html
... View more
04-30-2018
07:32 AM
does your props has KV_MODE = xml or INDEXED_EXTRACTIONS = xml for field extraction
... View more
04-30-2018
06:43 AM
Please post a snippet of your xml data
... View more
04-29-2018
01:36 PM
You need to get well with evengen app which generates example data
https://splunkbase.splunk.com/app/1924/
... View more
