Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- Find Answers
- :
- About markthompson
markthompson
Builder
Member since:
09-29-2014
06-05-2020
Community Statistics
| Posts | 243 |
| Solutions | 17 |
| Karma Given | 67 |
| Karma Received | 68 |
| Member Since | 09-29-2014 |
Activity Feed
- Got Karma for Re: Why am I getting error "The license signature is not a base64-encoded string" trying to add my license in Splunk 6.2?. 01-06-2025 02:27 AM
- Got Karma for How to round stats average to 2 decimal places?. 09-13-2023 03:01 PM
- Got Karma for Re: Can an input be enabled or disabled based on another input?. 03-10-2022 02:39 AM
- Got Karma for How to round stats average to 2 decimal places?. 12-23-2020 01:33 PM
- Got Karma for Re: How to make a drop-down form wider?. 06-05-2020 12:48 AM
- Karma Real time search, how to check if event doesn't exist and return something if it doesn't. for DavidHourani. 06-05-2020 12:47 AM
- Karma Re: Is there a URL Prefix variable in Simple XML? for LukeMurphey. 06-05-2020 12:47 AM
- Karma Re: How can I search and return only the first occurrence of a string? for musskopf. 06-05-2020 12:47 AM
- Karma Can I create a new field for each value contained in an existing field? for mrfredman. 06-05-2020 12:47 AM
- Karma How to search count trends by displaying a 3 column table with source name, count (last 10 min) and count (now)? for vikas_gopal. 06-05-2020 12:47 AM
- Karma Output first event and last event. for ferza. 06-05-2020 12:47 AM
- Karma How to search Splunk indexes' event count for the last one hour including zero counts? for dhavamanis. 06-05-2020 12:47 AM
- Karma Date not parsed if the hour is 24 for reggie_123. 06-05-2020 12:47 AM
- Karma Splunk Time Based Retention for nspatel. 06-05-2020 12:47 AM
- Karma How to edit my inputlookup subsearch to return field values from the csv only if the values were not found? for TobiasBoone. 06-05-2020 12:47 AM
- Karma Re: How to setup an alert if any index size goes over 90%? for MuS. 06-05-2020 12:47 AM
- Karma Re: Where can I find a complete list of data source types that can be indexed in Splunk? for MarioM. 06-05-2020 12:47 AM
- Karma Monitoring Active Directory groups, is it possible to send an email alert to the individual who was added or removed from the group? for 8i5. 06-05-2020 12:47 AM
- Karma Re: How do i file a Splunk Support Case/ contact Splunk Support? for vhallan_splunk. 06-05-2020 12:47 AM
- Karma Re: Using splunk to create and view table metadata for aweitzman. 06-05-2020 12:47 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 1 | |||
| 4 | |||
| 2 |
11-05-2014
03:49 AM
1 Karma
Hello,
Can somebody please tell me whether or not timechart has the below functionality, or suggest an alternative
I have a table of values, start time, end time & duration. i want to represent these on a graph so that we can see trends.
Any ideas?
... View more
10-22-2014
05:50 AM
5 Karma
Hello,
I have this:
stats count by opentime | stats avg(count)
and I want the average to be in 2dp.
Anyone have any suggestions?
... View more
10-22-2014
02:08 AM
This is an actual field in the data as submitted date & also Closed Date
And I've never used regex command before, so Don't have a clue how to use it.
... View more
10-22-2014
01:44 AM
1 Karma
Hi,
I have a field called Submit Date and it's format is like this: 10/21/2014 11:26:05 AM
I'm trying to separate this into 2 fields, to something like
Submit Date: 10/21/2014
Submit Time: 11:26:05 AM
I'm hoping to work out the average difference between the start and end of each event, so if I could also find a way to detect whether or not it's AM or PM and then convert to 24 hour clock, that would also be helpful.
If anyone has any suggestions as a way to deal with averaging the differences / response time, please let me know.
... View more
10-21-2014
05:00 AM
2 Karma
Yes, take a look on the Splunk 6.x dashboard examples - under Cascading Form Input or Post Process Search.
Hope this helps - please rate if it does.
... View more
10-16-2014
04:02 AM
There are no events in Today that have failed, so it should default to low (green). Any ideas why it's not doing so?
... View more
10-16-2014
03:13 AM
I've tried this and then it still says N/A on my dashboard.
Current string:
index=project_omega host=PersistUBS | transaction startswith="Targeting file BP_Comp_Summ_Pos*" endswith="Server returned an error: No such file or folder" OR "The file was downloaded successfully." | search "Error" OR "Attempt 3...unsuccessful."
| eval interval=relative_time(_time,"@d")
| eval isFailure=if(searchmatch("Error") OR searchmatch("Attempt 3...unsuccessful."),1,0)
| stats sum(isFailure) as failures
| eval failuresCategory = case(failures=0,"low",failures<3,"elevated",failures>=3,"severe")
| eval range = case(failures=0,"low",failures<3,"elevated",failures>=3,"severe")
... View more
10-16-2014
03:02 AM
Hey Martin, can you please give me an example of the string you would use and I'll mark it as answer if it works.
... View more
10-16-2014
02:38 AM
Hi MuS Thanks for this answer.
However, I wish to use the rangemap command as it's configured on the dashboard to create a traffic light based on the level (low, elevated or severe)
... View more
10-15-2014
02:57 AM
1 Karma
Hi,
i have the following search query:
index=project_omega host=PersistUBS | transaction startswith="Targeting file BP_Comp_Summ_Pos*" endswith="Server returned an error: No such file or folder" OR "The file was downloaded successfully." | search "Error" OR "Attempt 3...unsuccessful." | eval interval=relative_time(_time,"@d") | eval isFailure=if(searchmatch("Error") OR searchmatch("Attempt 3...unsuccessful."),1,0) | stats sum(isFailure) as failures | rangemap field=failures low=0-0 elevated=1-2 severe=3-15 default=15
But it's showing as N/A instead of a number, please can someone suggest why this is?
... View more
10-08-2014
03:35 AM
Use a class such as
.size {
font-size: 56px;
}
and then for the h3 put h3 class="size" and it will change just thsoe that have class="size" applied.
... View more
10-08-2014
01:46 AM
Can you post the HTML it's giving for the legend, or you could right click and inspect element and see what CSS classes are on the legend, and adapt those with your embedded css.
... View more
10-08-2014
01:12 AM
1 Karma
You can always convert dashboard to HTML and then change it using HTML code. Embedded CSS.
... View more
10-07-2014
08:17 AM
1 Karma
There are some examples of this in the apps for version 6 if you want to try those.
By using a form etc.
Might be a useful idea.
... View more
10-07-2014
02:13 AM
You might be able to use the transaction and use transaction startswith="<" endswith=">".
... View more
10-07-2014
02:10 AM
Are your events inside of that search? for * ?
If so, click on their host and it should narrow it down for you.
... View more
10-07-2014
01:03 AM
Did you set it up as having a specific host?
Try running index=* and see if it pops up with any of your events
... View more
10-06-2014
04:18 AM
1 Karma
Solution found; Splunk data inputs are case sensitive. Was missing a capital letter.
... View more
10-03-2014
02:42 AM
You can use the transaction command.
Your search | transaction startswith="login_id='loginA'" endswith="Whatever the last bit of it is"
This will join the string together as one event.
... View more
10-03-2014
12:52 AM
1 Karma
Hi,
I have added a data input that uses variables as the host name, so /opt/mark/home/.../.../logs
It uses segment 5 as the host, and it's picking up 12 of them, but it's missing a few of them.
Any ideas?
... View more
10-02-2014
07:44 AM
The problem appears to be something to do with the count as it seems to default back to the default value (520 in this case). So i don't think the rangemap is picking up any counts of errors. Any ideas?
... View more
10-02-2014
07:06 AM
And the XML:
<panel>
<single>
<title>FullUBS-Pos</title>
<searchString>index=project_omega host=PersistUBS | transaction startswith="Targeting file BP_Comp_Summ_Pos*" endswith="Server returned an error: No such file or folder" OR "The file was downloaded successfully." | search "Error" OR "Attempt 3...unsuccessful." | eval interval=relative_time(_time,"@d") | eval isFailure=if(searchmatch("Error") OR searchmatch("Attempt 3...unsuccessful."),1,0) | stats sum(isFailure) as failures | rangemap field=failures low=0-0 elevated=1-2 severe=3-15 default=520</searchString>
<earliestTime>@d</earliestTime>
<latestTime>now</latestTime>
<option name="classField">range</option>
<option name="field">value</option>
<option name="additionalClass">icon-only</option>
<option name="linkView">search</option>
<option name="drilldown">none</option>
</single>
</panel>
It's working on other files, that don't use the OR
... View more
10-02-2014
07:06 AM
Won't let me upload the code, will have to do it in 2 parts
Hi,
The CSS:
.single-value:before {
font-family: "Splunk Icons";
font-style: normal;
font-weight: normal;
text-decoration: inherit;
font-size: 48px;
}
.severe.single-value:before {
content: "\2297";
color: #ff1f24;
}
.high.single-value:before {
content: "\ECD4";
color: #ff7e00;
}
.elevated.single-value:before {
content: "\26A0";
color: #ffb800;
}
.low.single-value:before {
content: "\ECD3";
color: #00b932;
}
.guarded.single-value:before {
content: "\0049";
color: #4da6df;
}
.icon-only.single-value:before {
font-size: 65px;
}
.icon-only .single-result {
display: none;
}
... View more
10-02-2014
05:50 AM
Hi, I'm still getting the same error when it says N/A. here's code;
| transaction startswith="Targeting file BP_Comp_Summ_Pos*" endswith="Server returned an error: No such file or folder" OR "The file was downloaded successfully." | search "Error" OR "Attempt 3...unsuccessful." | eval interval=relative_time(_time,"@d") | eval isFailure=if(searchmatch("Error") OR searchmatch("Attempt 3...unsuccessful."),1,0) | stats sum(isFailure) as failures | rangemap field=failures low=0-0 elevated=1-2 severe=3-15 default=520
... View more
- « Previous
- Next »
