About Shan

Shan · ‎11-08-2018

Please let me know if anyone have idea about it .. Thanks..

Shan · ‎11-02-2018

Hai All, Need your help in adding a value before a panel. Please find the attached screen shot. Below image is a sample screen shot of how my current dashboard will look like. I need to add one more value(Service) before the panel Web data and Windows data. I know we can achieve it with the help of additional panel before Web data and Windows data. But i want to know is there anyother way to achieve it .. I don't want to go for the additional panel option, because for single name. i don't want to add a new panel for single name. Thanks

Shan · ‎11-01-2018

@ renjith.nair, Thank you .. It's working..

Shan · ‎10-31-2018

@ renjith.nair, Thanks for the reply :-).. Let me try from my end and update you .. Thanks ..

Shan · ‎10-30-2018

I have a problem in drilldown. Please help me out. When i click on the field(Ticket) value, it will open up the drilldown panel. When i click on the value in (index=_internal | table *) query. As i mention below, a Wikipedia url to web page will be navigated from the drilldown panel of the dashboard(working perfect). But, in the dashboard, the drilldown result is not showing up once i click the value in (index=_internal | table *) query and navigated to external url(wikipedia). Please let me know why the drilldown result is hiding when i click the value in (index=_internal | table *) and is moving to external url(wikipedia). I have provided sample drilldown below. <drilldown> <condition field="Months"> <set token="Month_depend">true</set> <set token="Months">$row.Months$</set> <set token="Notsolved">$row.Ticket$</set> <set token="Breached">$row.overdue$</set> <unset token="seconds"></unset> <unset token="Low"></unset> </condition> <condition field="Ticket"> <set token="Ticket">$row.Ticket$</set> <set token="seconds">true</set> <set token="Months">$row.Months$</set> <unset token="Month_depend"></unset> <unset token="Low"></unset> </condition> </drilldown> <row> <panel> <title>$Months$</title> <table depends="$seconds$"> <title> </title> <search> <query>index=_internal | table * </query> <earliest>-24h@h</earliest> <latest>now</latest> </search> <option name="count">10</option> <option name="dataOverlayMode">none</option> <option name="drilldown">cell</option> <option name="percentagesRow">false</option> <option name="refresh.display">progressbar</option> <option name="rowNumbers">false</option> <option name="totalsRow">false</option> <option name="wrap">true</option> <drilldown> <link target="_blank"> <![CDATA[https://en.wikipedia.org/wiki/Data]]> </link> <unset token="seconds"></unset> </drilldown> </table> </panel> </row> Thanks ..

Shan · ‎09-27-2018

@493669, No its not working.. [15330442604] DATA SHOW: Enter;LUV-127lE$131.CBE.data.com;CUP_Used; [15330744495] DATA Thing: SVR~1232.CBE.data.com;CUP_Used; [15380142481] DATA SHOW: Enter@FFDDEEF;s99vNN147.CBE.data.com;CUP_Used; [15380142481] DATA SHOW: Enter@FFDDEEF;s99vNN147.CBE.data.com;cup_used; [15380142481] DATA SHOW: En;cup_used; [15330442604] DATA SHOW: Enter;LUV-127lE$131.CBE.data.com;datat;Splunk; [15330744495] DATA Thing: SVR~1232.CBE.data.com En;min;max;splunk1 [15380142481] DATA SHOW: Enter@FFDDEEF;s99vNN147.CBE.data.com;working; [15380142481] DATA SHOW: Enter@FFDDEEF;s99vNN147.CBE.data.com;cup_used; [15380142481] DATA SHOW: En;cup_used;Retre; [15380142481] DATA SHOW: Enter@FFDDEEF;s99vNN147.CBE.data.com;working;data; [15380142481] DATA SHOW: Enter@FFDDEEF;s99vNN147.CBE.data.com;working;data;sdhgfsd;dshhd

Shan · ‎09-26-2018

@493669, Sorry for inconvenience caused. There are many data patterns are there. please find below for the sample. [15330442604] DATA SHOW: Enter;LUV-127lE$131.CBE.data.com;CUP_Used; [15330744495] DATA Thing: SVR~1232.CBE.data.com;CUP_Used; [15380142481] DATA SHOW: Enter@FFDDEEF;s99vNN147.CBE.data.com;CUP_Used; [15380142481] DATA SHOW: Enter@FFDDEEF;s99vNN147.CBE.data.com;cup_used; [15380142481] DATA SHOW: En;cup_used; [15330442604] DATA SHOW: Enter;LUV-127lE$131.CBE.data.com;datat;Splunk; [15330744495] DATA Thing: SVR~1232.CBE.data.com En;min;max;splunk1 [15380142481] DATA SHOW: Enter@FFDDEEF;s99vNN147.CBE.data.com;working; [15380142481] DATA SHOW: Enter@FFDDEEF;s99vNN147.CBE.data.com;cup_used; [15380142481] DATA SHOW: En;cup_used; needed values : cup_used,CUP_Used,Splunk,splunk1,working. Thanks

Shan · ‎09-26-2018

Hi All, I Have data in below mentioned format. I need to extract value CUP_Used and cup_used using regex and store it as a separate filed. But in below mentioned pattern CUP_Used and cup_used is available in 2nd or 3rd place in unstructured data set. I need to extract only CUP_Used and cup_used . [15330442604] DATA SHOW: Enter;LUV-127lE$131.CBE.data.com;CUP_Used; [15330744495] DATA Thing: SVR~1232.CBE.data.com;CUP_Used; [15380142481] DATA SHOW: Enter@FFDDEEF;s99vNN147.CBE.data.com;CUP_Used; [15380142481] DATA SHOW: Enter@FFDDEEF;s99vNN147.CBE.data.com;cup_used; [15380142481] DATA SHOW: En;cup_used; I have used the below mentioned rex to extract CUP_Used and cup_used . But I'm getting values as mentioned below. But i don't need values like s,LUV etc . With single rex i need to extract the value CUP_Used and cup_used . LUV CUP_Used s s cup_used \d\d\]\s[^:]+:\s[^;]+;(?P<hard>[a-zA-Z_]+) \d\d\]\s[^:]+:\s[^;]+;(?P<hard>[^;]+); Thanks in advance..

Shan · ‎09-19-2018

@ kamlesh_vaghela, Hai Thanks for the reply. I have complete query in my macro. It's starting with index(macro query) .. when i use above suggestion its throwing error and also i have two multi-select field in query(macro). Above suggestion is not working...

Shan · ‎09-17-2018

Hi All, I need help from you. I have a macro with 4 arguments(ASSIGNEE,Branch,month,year). Out of those 4 arguments, 2 are multi value fields(ASSIGNEE,Branch). Both these "ASSIGNEE" and "Branch" arguments receive inputs from a multi-select field. But, when i select more than 2 values in multi-select, then it starts throwing an error. Please help me to achieve passing multiple values to the same arguments. Thanks ...

Shan · ‎09-03-2018

@kundanbisht, Do you got your expected answers from above points ..

Shan · ‎09-01-2018

@neermine, There was a error while python script running. check below answers. Might help you. https://answers.splunk.com/answers/152418/error-msga-script-exited-abnormally-statusexited-w.html https://answers.splunk.com/answers/406139/how-to-troubleshoot-error-a-script-exited-abnormal.html Thanks ..

Shan · ‎09-01-2018

@keishamtcs, Please check below simple and clear answers, why you need to go for summary index and how it works 🙂 .. https://answers.splunk.com/answers/435921/how-to-use-summary-indexing-in-dashboards.html https://answers.splunk.com/answers/494929/how-exactly-does-report-data-acceleration-and-summ.html https://answers.splunk.com/answers/221/how-can-summary-indexing-help-improve-the-performance-of-my-dashboards-and-reports.html Thanks..

Shan · ‎09-01-2018

@harishbenne2, upto my understanding. your trying to join the httpdmz.sessionid=appdmz.Session , sessionid of index=httpdmz with Session of index=appdmz. you want to fetch matching values of sessionid=Session and process further right.. Then you need to go for join condition. I have provided the sample example below. You need to replace your index and required field in below query. For getting matching data. Field name should be same in both the index. So only i have rename sessionid as Session | rename sessionid as Session . index=httpdmz (replace with ur tetsing index) | rename sessionid as Session | table Session url ipadd | join type=inner Session [ index=appdmz (replace with ur tetsing index) | table Session user ] | table ipadd Session user url Example to show how join works with sample data .. | makeresults | eval mytrimexaxis =mvappend("1531981800","1531982400","1531982700","1531983000","1531983600") | eval mysite =mvappend("alpha","beta","game","show","check") | mvexpand mytrimexaxis | rename mytrimexaxis as datajoin | table datajoin mysite | join type=inner datajoin [ | makeresults | eval datajoin="1531981800" ] | table datajoin mysite Thanks..

Shan · ‎08-31-2018

@kundanbisht, Let me tell you what exactly happens here. eval age = (now() - _time ) now() is a splunk function gives you current time in epoc format(Unix time, data eg =1535779569).epoc time will be in seconds. _time is your splunk indexing time (data eg=2018-09-01 07:26:09) your trying to minus epoc time from datetime format it's possible . please find the sample example below. If your now and _time is same you will get zero at age field.. | makeresults | eval epoctime=now()+1800 | eval age = epoctime-_time | eval age1 = now()-_time | eval epoc_to_Datetime_format=strftime(epoctime,"%Y-%m-%d %H:%M:%S") | eval Datetime_to_Epoc_format=round(strptime(strftime(_time,"%Y-%m-%d %H:%M:%S"),"%Y-%m-%d %H:%M:%S"),0) | table epoctime epoc_to_Datetime_format _time Datetime_to_Epoc_format age age1 Thanks 🙂 ...

Shan · ‎08-31-2018

@nqjpm, Try below query.. I have created with sample data . You can us the last eval with your main query. | makeresults | eval AppVersion=mvappend("14.12%","14.11%","14.10%","14.16%","14.00%") | mvexpand AppVersion | eval Platform= case(AppVersion == "14.00%", "Windows",AppVersion == "14.12%", "Windows",AppVersion == "14.16%","Mac",AppVersion == "14.12%", "iOS",AppVersion == "14.11%", "Windows",AppVersion == "14.11%", "Mac",AppVersion == "14.10%", "Windows",AppVersion == "14.10%", "Android") | eval Compliant=if(Platform="Windows" AND (AppVersion="14.12%" OR AppVersion="14.11%" OR AppVersion="14.10%" OR AppVersion="14.9%" OR AppVersion="14.8%"), "OK","NO" ) | table AppVersion Platform Compliant Thanks ..

Shan · ‎08-29-2018

@sangs8788, Please try below query.. index=data earliest=-1w@w latest=now | eval requestcount=1 | timechart per_second(requestcount) AS RequestPerSec | eventstats max(RequestPerSec) as peakRequestPerSec | timechart span=1w avg(RequestPerSec) as avgRequestPerSec max(RequestPerSec) as peakRequestPerSec p99(RequestPerSec) as p95RequestPerSec | fieldformat peakTime=strftime(peakTime,"%m/%y %H:%M") | eval avgRequestPerSec=round(avgRequestPerSec,2) | eval peakRequestPerSec=round(peakRequestPerSec,2) | eval p95RequestPerSec=round(p95RequestPerSec,2) | eval group=avgRequestPerSec."#".peakRequestPerSec | chart Count as check over group by p95RequestPerSec | rex field=group "(?<avgRequestPerSec>[^#]+)#(?<peakRequestPerSec>[^#]+)") | fields - group | table avgRequestPerSec peakRequestPerSec p95RequestPerSec refer below answer also https://answers.splunk.com/answers/467941/how-to-convert-partial-rows-into-columns-1.html Thanks ..

Shan · ‎08-29-2018

@nmohammed, Yes you can achieve it. If you have Started at as a separate field then by extracting the Hours separately and compare with epoc time. Else you need to write a regex to extract Started at filed and achieve it . Example: If this job need to start at 4 am but it started at 6 am. lets see how we can check it and trigger a alert. started at : 8/29/2018 6:00:00 AM. You can write an alert. | makeresults | eval data=strftime(strptime("8/29/2018 6:00:00 AM","%m/%d/%Y %H"),"%H") | eval calc=if(data=04,1,0) | table data calc

Shan · ‎08-29-2018

@ahuihou, I think then you need to go for 4 different alert setup. I don't think you can achieve all condition in same cron schedule. Please try below option.. “At minute 0 past hour 16, 17, 18, 19, 20, 21, 22, 23, 0, 1, 2, 3, 4, 5, and 6 on Monday, Tuesday, Wednesday, Thursday, and Friday.” 00 16,17,18,19,20,21,22,23,00,1,2,3,4,5,6 * * Mon,Tue,Wed,Thu,Fri “At minute 0 past every hour on Saturday and Sunday.” 00 */1 * * Sat,Sun “At minute 0 past every hour on Monday.” 00 */1 * * Mon “At minute 0 past every hour on Thursday.” 00 */1 * * Thu Thanks ..

Shan · ‎08-29-2018

@ahuihou, As per ur comment. I look like u need alert for all whole calendar year .. so u don't wanna specify any day ...

Shan · ‎08-29-2018

@ahuihou, It's always best to go for cron schedule for your scenario. Try below cron cmd to schedule for 4pm-6am runs at “At minute 0 past hour 16, 17, 18, 19, 20, 21, 22, 23, 0, 1, 2, 3, 4, 5, and 6.” of ever on everyday. Take cron from 00. 00 16,17,18,19,20,21,22,23,00,1,2,3,4,5,6 * * *

Shan · ‎08-29-2018

@knalla, Please refer to previous answers. Let me know if it helps you or not. https://answers.splunk.com/answers/141957/blacklist-file-form-inputs-conf.html https://answers.splunk.com/answers/134091/inputs-conf-whitelist-blacklist-question.html https://answers.splunk.com/answers/542588/how-to-edit-inputsconf-to-blacklist-an-eventcode.html http://docs.splunk.com/Documentation/SplunkCloud/latest/Data/Whitelistorblacklistspecificincomingdata

Shan · ‎08-29-2018

@jip31, Could you confirm to me that there is a match between the “host” field in my CSV and the SPLUNK “host” field? As I work actually in local, I am unable to confirm that the match with the field “host” works fine. For above question. With out sample data we cannot say exactly whether your host field value in lookup and index are matching or not. But based on the query, i can say if matching data is there in index and lookup for sure above query will fetch the data. (index="perfmon" sourcetype="winhostmon") OR (index="windows-wmi" sourcetype="WMI:LastLogon" OR sourcetype="WMI:LastReboot" LastBootUpTime OR sourcetype="wmi:MemorySize" OR sourcetype="WMI:PeriphIssue" Caption=Mobile ConfigManagerErrorCode OR sourcetype="WMI:MonitorSN" SerialNumberID) OR (index=windows sourcetype=winregistry earliest=-120d key_path="\\registry\\machine\\software\\wow6432node\\xx\\master\\ConfigurationCountry" OR key_path="\\registry\\machine\\software\\wow6432node\\xx\\master\\WindowsVersion" OR key_path="\\registry\\machine\\software\\microsoft\\windows nt\\currentversion\\ReleaseId" OR key_path="\\registry\\machine\\software\\wow6432node\\xx\\master\\PatchLevel") OR (index=windows sourcetype=tools:flags filename=*ABDM-TOUPDATE*) Above query will work. But it will be slow.

Shan · ‎08-29-2018

Hi Friends, Is there any update on above process.. Thanks ..

Shan · ‎08-28-2018

Posts	170
Solutions	10
Karma Given	10
Karma Received	8
Member Since	‎07-14-2015

Online Status	Offline
Date Last Visited	‎10-10-2024 01:34 AM

how to write value in center of semicircle donut

Why is field missing in piechart?

How to split multiple lines of data into a single ...

How to use foreach with search filter?

Dropdown Question?

Need help of rex?

Query to bring the macro dependency?

Send a mail using sendemail command from search?

Moving data from newrelic to splunk(using splunk a...

Grouping panels from different rows into one panel...

Re: Need to add a value before a panel?

Need to add a value before a panel?

Re: Can you help me with my drilldown issue invol...

Re: Can you help me with my drilldown issue invol...

Can you help me with my drilldown issue involving...

Re: How to extract data using regex?

Re: How to extract data using regex?

How to extract data using regex?

Re: How to pass multiple values to one argument in...

How to pass multiple values to one argument in a m...

Re: What's the output of the following eval and no...

Re: Will someone help me understand the following ...

Re: Why do Summary Indexing commands help improve ...

Re: How do you correlate data from multiple indexe...

Re: What's the output of the following eval and no...

Re: Comparison and condition function help. Multip...

Re: How to rewite a query to change the columns to...

Re: How do you create an alert for different cron...

Re: Alert suppression

Re: Alert suppression

Re: Alert suppression

Re: How to use blacklist in inputs.conf?

Re: Lookup matching question

Re: How to collect and continuously monitor Excel ...

Re: How to join two searches that both have subsea...

Are you a member of the Splunk Community?