Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About kabiraj
kabiraj
Path Finder
Member since:
11-06-2014
06-05-2020
Community Statistics
| Posts | 54 |
| Solutions | 1 |
| Karma Given | 1 |
| Karma Received | 5 |
| Member Since | 11-06-2014 |
Activity Feed
- Karma Re: Using Chart over two fields grouped by time for woodcock. 06-05-2020 12:47 AM
- Got Karma for Re: Ranking rows in a Table based on count using Transpose & Timechart. 06-05-2020 12:47 AM
- Got Karma for Re: Ranking rows in a Table based on count using Transpose & Timechart. 06-05-2020 12:47 AM
- Got Karma for How to color a table cell whose column name is dynamic. 06-05-2020 12:47 AM
- Got Karma for How to color a table cell whose column name is dynamic. 06-05-2020 12:47 AM
- Got Karma for While trying to color table cells based on values under dynamic columns with JavaScript, why is content no longer showing in the table?. 06-05-2020 12:47 AM
- Posted Splunk Query to get all configured DB Connections in splunk on Deployment Architecture. 06-18-2018 07:31 AM
- Tagged Splunk Query to get all configured DB Connections in splunk on Deployment Architecture. 06-18-2018 07:31 AM
- Posted Re: How to use return command in subsearch to return a multivalued field? on Splunk Search. 10-26-2017 04:00 AM
- Posted Re: How to use return command in subsearch to return a multivalued field? on Splunk Search. 10-25-2017 05:06 AM
- Posted Re: How to use return command in subsearch to return a multivalued field? on Splunk Search. 10-25-2017 05:03 AM
- Posted How to use return command in subsearch to return a multivalued field? on Splunk Search. 10-25-2017 03:25 AM
- Tagged How to use return command in subsearch to return a multivalued field? on Splunk Search. 10-25-2017 03:25 AM
- Tagged How to use return command in subsearch to return a multivalued field? on Splunk Search. 10-25-2017 03:25 AM
- Posted Re: Using Chart over two fields grouped by time on Splunk Search. 11-05-2015 09:50 PM
- Posted Re: Using Chart over two fields grouped by time on Splunk Search. 11-04-2015 09:56 PM
- Posted Using Chart over two fields grouped by time on Splunk Search. 11-04-2015 04:11 AM
- Tagged Using Chart over two fields grouped by time on Splunk Search. 11-04-2015 04:11 AM
- Posted Re: While trying to color table cells based on values under dynamic columns with JavaScript, why is content no longer showing in the table? on Splunk Search. 10-04-2015 11:05 PM
- Posted Re: How to append two fields extracted from different events having same ID field without using join? on Splunk Search. 09-22-2015 12:50 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 1 |
06-18-2018
07:31 AM
I am trying to figure out a splunk query to get all the database connections, inputs & the identitites in splunk. Does anyone knows the endpoint for this? Something similar to below with a different endpoint?:
| rest /servicesNS/-/-/saved/searches
The above search returns all the saved searches. Can i get a similar list for all DB inputs & connections?
... View more
10-26-2017
04:00 AM
@niketn No, This is not what i am looking for.
mysearch | eval field = [| inputlookup rest_of_search | return $fieldname]
in this spl, ideally the values under "fieldname" should be assigned to field "field", which i am getting fine but the problem is with the values. It copies the value of first row to all the rows & then assigns it to field "field" because of which i am getting the same value in all the rows in field "field" which is incorrect.
then i tried
mysearch | eval field = [| inputlookup rest_of_search | return 1000 $fieldname]
1000 is the count of rows which it should consider uniquely while copying. By default its 1 because of which only first row get copied to all rows.
But this spl gives me error in eval
... View more
10-25-2017
05:06 AM
here is some sample data for the field:
percent
80
0
0
0
100
0
0
50
7.692308
100
33.333333
17.391304
0
0
14.285714
percent is the column and rest are rows with values
... View more
10-25-2017
05:03 AM
@niketnilay basically the output is a table with single column & multiple rows. in this above example, data is the column & it has like 100 rows with different values in each row
... View more
10-25-2017
03:25 AM
I am trying to use return command to output a multivalued field from subsearch to main search. My search looks like below:
mysearch | eval field = [| inputlookup rest_of_search | return $fieldname]
Here, fieldname has multiple values in multiple rows but after running query it outputs only the value at first row to each of the rows because of which i am getting same value in each row. I also tried below but it showed error:
mysearch | eval field = [| inputlookup rest_of_search | return 1000 $fieldname]
where 1000 is the count of matched results.
Any Solution?
... View more
11-05-2015
09:50 PM
Works like a Charm! Thank you! I think the Combination & splitting of fields and *-* did the trick. Thanks for sharing your expertise.
Just wanted to ask can we show N number of fields in the table just by giving *-* in the query?
... View more
11-04-2015
09:56 PM
Hi Woodcock! Thanks for your prompt response but i want Channel & Popularity as two different fields instead of appending it into one delimited by ":".
Below is the example :
Channel Name Popularity 04-Nov-15 05-Nov-15
1 Sky Movies Premiere 1 78 74
2 Sky Movies Showcase 2 82 71
3 Sky Movies Greats 3 80 72
4 Sky Movies Disney 4 77 66
5 Sky Movies Family 5 81 75
6 Sky Movies Action & Adventure 6 79 60
Any other suggestions will be highly appreciated. 🙂
... View more
11-04-2015
04:11 AM
Hi Guys,
I am trying to pull up a table containing Time, Channel & Popularity as fields.
I am using : chart useother=f max(position) over Channel by Time
Above gives me only Channel & Time as fields in the table but i want Channel, Popularity & Time as fields.
I tried : chart useother=f max(position) over Channel Popularity by Time
But failed as it showed a syntax error.
Below is a sample of result
Channel 03-Nov-15 04-Nov-15
Watch 27 29
Universal 14 15
TLC HD 54 64
TLC 21 20
I want Popularity to be added besides the Channel field
Any Ideas?
... View more
- Tags:
- chart
10-04-2015
11:05 PM
Thank You piUek. Appreciate your answer but i got it long back. Thanks again for replying.
... View more
09-22-2015
12:50 AM
here is an example of multivalued event:
<RECORD><DATE>2015-09-22 08:23:14.594</DATE><LEVEL>INFO</LEVEL><SEVERITY></SEVERITY><CLASS>com.bt.vosp.webendpoint.impl.processor.MPlayCFIService</CLASS><METHOD>requestToPlayXML</METHOD><FILE>MPlayCFIService.java</FILE><LINE>742</LINE><CORRELATIONID>1442906598740:bt/30750517_76957</CORRELATIONID><TEXT>Response of RequesttoPlay call is:<?xml version="1.0" encoding="UTF-8"?>
<RequestToPlayResponse>
<errorCode>0</errorCode>
<errorMessage>Success</errorMessage>
<cid>1442906598740:bt/30750517_76957</cid>
<ContentInformationObjectResponse>
<ContentLicenseResponse>
</ContentLicenseResponse>
<errorCode>8016</errorCode>
<errorMessage>Error In Validating Entitlements</errorMessage>
<ReleasePID>Ce7UIXZodi7o</ReleasePID>
<SlotType>feature</SlotType>
</ContentInformationObjectResponse>
</RequestToPlayResponse></TEXT></RECORD>
... View more
09-22-2015
12:48 AM
hi woodcock,
the query i posted shows me results but the count is not correct. i changed the position of mvexpand in the query like below:
sourcetype="mplay" (((MP_Method="requestToPlayJSON" OR MP_Method="requestToPlayXML") MP_Response_Code=* MP_Correlation_Id=*) OR (("Product Info Content ::" OR "Response Code from Apache Server::") MP_Correlation_Id=* MP_TargetBandwidth="*")) | rex max_match=100 "(?im)errorCode(\":\"|\>)(?<error>\d+)" | mvexpand error | search error!=0 | stats values(error) as error values(MP_TargetBandwidth) as MP_TargetBandwidth by MP_Correlation_Id | where isnotnull(error) | eval error = if(isnull(MP_TargetBandwidth), error, error.":".MP_TargetBandwidth) | stats count by error
The above shows me the correct count but the bandwidth is not appending with error, infact i checked the bandwidth field was empty for all errors.
For 1st query i posted, bandwidth is appending with errors but only with single valued fields and thus returning incorrect count, Hence, if i remove 0 then other values along with 0 in the same event are also getting removed.
For the above query, all values(single & multi) only except 0 are showing(correct count) but the bandwidth is not getting appended to any of them.
Any suggestions?
... View more
09-22-2015
12:09 AM
Sorry Woodcock, It was working fine previously, I put the time timepicker as last 15 minutes, therefore, results were not coming. Anyway, thanks a lot for your reply.
Cheers!
My query:
sourcetype="mplay" (((MP_Method="requestToPlayJSON" OR MP_Method="requestToPlayXML") MP_Response_Code=* MP_Correlation_Id=*) OR (("Product Info Content ::" OR "Response Code from Apache Server::") MP_Correlation_Id=* MP_TargetBandwidth="*")) | rex max_match=100 "(?im)errorCode(\":\"|\>)(?<error>\d+)" | stats values(error) as error values(MP_TargetBandwidth) as MP_TargetBandwidth by MP_Correlation_Id | mvexpand error | search error!=0 | where isnotnull(error) | eval error = if(isnull(MP_TargetBandwidth), error, error.":".MP_TargetBandwidth) | stats count by error
... View more
09-21-2015
11:29 PM
Hi woodcock,
Thanks for the solution. It worked but in my case i have multivalued "error" field. So if want to exclude lets say 1 value from a 3 multivalued field, then the solution is not working.
e.g. error=0,8002,8003(all in one event) bandwidth=SD(in another event). According to your solution, SD is appending only with 0 like 0:SD and not with 8002 or 8003. So if i exclude 0 by putting error!=0, solution is not working.
... View more
09-20-2015
11:38 PM
Hi All,
I have three fields error, Bandwidth & ID. error & Bandwidth are fields for two different events while both the events have same or different ID field. I want to append error with Bandwidth, something like error:Bandwidth only for those events which have same ID field. How will i do it without using join or append command?
Below is a sample of the two events:
<RECORD><DATE>2015-09-21 07:19:37.865</DATE><LEVEL>INFO</LEVEL><SEVERITY></SEVERITY><CLASS>com.bt.vosp.webendpoint.impl.processor.MPlayCFIService</CLASS><METHOD>requestToPlayJSON</METHOD><FILE>MPlayCFIService.java</FILE><LINE>440</LINE><CORRELATIONID>1442816367016:prod-trusted/28574451_42274</CORRELATIONID><TEXT>RequestToPlay Response :{"RequestToPlayResponse":{"errorCode":"0","errorMessage":"Success","ContentInformationObjectResponse":[{"ContentLicenseResponse":{},"ContentURL":"http:\/\/csp1-1.cdd.bt.net\/content\/enc_BBJ877667A_CAR.wmv?SIGV=2&IS=0&ET=1442902777&CIP=81.151.236.213&KO=1&KN=1&US=296d49cd5782d1cca21d832011cecb533f70282e","ReleasePID":"_5E_7oFAqz7_","ReleaseID":"http:\/\/bt.data.media.theplatform.eu\/media\/data\/Release\/17686597485","IsMediaDRMProtected":"true","FileSize":"6871900","Duration":"32080","SlotType":"Trailer"}],"cid":"1442816367016:prod-trusted\/28574451_42274"}}</TEXT></RECORD>
<RECORD><DATE>2015-09-21 07:19:37.818</DATE><LEVEL>INFO</LEVEL><SEVERITY></SEVERITY><CLASS>com.bt.vosp.daa.storefront.impl.helper.PortalHttpServerHelper</CLASS><METHOD>readXml</METHOD><FILE>PortalHttpServerHelper.java</FILE><LINE>91</LINE><CORRELATIONID>1442816367016:prod-trusted/28574451_42274</CORRELATIONID><TEXT>Response Code from Apache Server:: 200 - Response Message from Apache Server :: <asset targetBandwidth="SD" LinkedTitleID="" TitleID="877667" xmlSource="TV_BT_Scheduled" schedulerChannel="TV" subGenre="" subtitles="" keywords="" productOfferingType="Promotion" type="Promotion" External_CP_ID="" ClassicAssetId="BBJ877667A" CountryOfOrigin="" category_id="TV" hd="0" duration="PT00H00M32S" rating="U" language="English" genre="All" availability="2015-09-16T00:00:00~2015-09-28T23:59:00" ClientAssetId="BBJ877667A" id="17686597339"> <TOV artist="" music="0" episodeNumber="" episodeTitle="" seriesNumber="" seriesTitle="" year="0" synopsis="It's time to Man Up on BT with some testosterone filled shows that require more than a little stiff upper lip.From mountain summits with Bear Grylls to icy Norwegian highways to deep undercover work in notorious biker gangs, you'd better strap in because things are about to get rough. Running Wild With Bear Grylls. Ice Road Rescue. Gangland Undercover" title="Man Up" id=""/> <subscription scode="S0115263"/> <media> <release targetBandwidth="SD" aspectratio="16:9" encodingformat="WM" dur="PT0H00M32.080S" scheme="wmDrm" protected="1" updated="2015-09-14T03:48:56" filename="http://csp1-1.cdd.bt.net/content/enc_BBJ877667A_CAR.wmv" filesize="6871900" exclude="0" HD="0" service="CAR" serviceFormat="Cardinal-SD" releaseid="http://bt.data.media.theplatform.eu/media/data/Release/17686597485" PID="_5E_7oFAqz7_"> <subtitle path="" track="" lang=""/> <audio type="" purpose="" track="" mix="" lang=""/> </release> <release targetBandwidth="SD" aspectratio="16:9" encodingformat="MPEG" dur="PT0H00M32.844S" scheme="marlin" protected="1" updated="2015-09-14T03:46:49" filename="http://csp1-1.cdd.bt.net/content/enc_BBJ877667A_YOU.bbts" filesize="5607476" exclude="0" HD="0" service="YOU" serviceFormat="Youview-SD" releaseid="http://bt.data.media.theplatform.eu/media/data/Release/17687621034" PID="amz0IIIKOE_o"> <subtitle path="" track="" lang=""/> <audio type="" purpose="" track="" mix="" lang=""/> </release> </media> <contentProvider name="BT Vision PVODS" id="BTV"/></asset></TEXT></RECORD>
Here if you can see both the events have CORRELATIONID field. I want to append "errorCode" value in 1st event with "targetBandwidth" value from asset tag in 2nd event like "errorCode:targetBandwidth" if both the events have matching CORRELATIONID fields without using join or append command. e.g. "0:SD". can it be done?
... View more
07-23-2015
04:41 AM
Hi all I am trying to sort dynamic columns in a table where the column names are in datetime format
e.g something like 30-Jun-2015 01-Jul-2015 02-Jul-2015 & so on.
My query
sourcetype=shmapplogs "getMS3SAS ended for - deviceId" "EncryptedChannelKey" | bucket span=1d _time | stats count by _time channelId | sort count desc | lookup youview_channels.csv service_id_truncated AS channelId OUTPUT channel_name_letter | streamstats count AS position by _time | fields channel_name_letter position _time | convert timeformat="%d-%b-%Y" ctime(_time) As Time | chart useother=f max(position) over channel_name_letter by Time limit=1000 | sort - Time | rename channel_name_letter as "Channel"
Form the above search i am getting the column names in the order like 01-Jul-2015 02-Jul-2015 30-Jun-2015 i.e they are being sorted based on day of the date and not based on the entire date. I want to sort the column names based on the entire date.
Please help.
... View more
07-23-2015
03:04 AM
Hi woodcock! Do you know any way to sort the above column names based on the dates mentioned in the column names e.g 30-May-2015 should come first followed by 31-May-2015 & 01-Jun-2015 and so on. Currently it's showing 01-Jun-2015 30-May-2015 31-May-2015 for my query. Its sorting automatically based on the day of the date mentioned in the column. I want it to sort based on the entire date and not just the day.
... View more
07-13-2015
11:31 PM
I want to pass a token value from a dashboard Simple XML page to the js file which is attached with the XML.
e.g.
<form script="abc.js">
<input type="text" token="def" searchWhenChanged="true">
<label>DEF</label>
</input>
.
.
.
.
</form>
I want to pass the value of "def" to "abc.js". Is it possible to do?
... View more
07-09-2015
10:33 AM
2 Karma
Hi All,
I figured out below way to do this.
sourcetype=shmapplogs "getMS3SAS ended for - deviceId" | bucket span=1d _time | stats count by _time channelId | sort count desc | lookup youview_channels.csv service_id_truncated AS channelId OUTPUT channel_name_letter | streamstats count AS position by _time | fields channel_name_letter position _time | convert timeformat="%d-%b-%Y" ctime(_time) As Time | chart max(position) over channel_name_letter by Time
The above query is giving me a priority view per day
... View more
07-08-2015
11:28 PM
No, actually all the above are hardcoded values which i cannot use. I figured out another way to do this.
... View more
07-08-2015
10:59 PM
Thanks laserval!
... View more
07-08-2015
12:44 AM
Hi All,
I am facing some problem with my below search:
sourcetype="clientevents" event_error_code=RB_VOD_BUFFER_UNDERFLOW eventItemID="*" | stats count(eval(eventItemID="*BT*")) as "BT_VOD_buffer_underrun_count" count(eval(eventItemID!="")) as "Total_VOD_buffer_underrun_count"
Here the "BT_VOD_buffer_underrun_count" is always returning zero. The problem lies with count(eval(eventItemID="*BT*")) . I have also tried searchmatch, but every time it returns an error.
I want to count all events with "eventItemID" field containing "BT" in its value.
Please help.
Please help.
... View more
06-29-2015
10:00 PM
Thank you chimell. Figured it out yesterday. Only a mvexpand and then mvcombine did the trick. Anyways, sorry for the dumb question.
... View more
06-29-2015
09:59 PM
Thank you woodcock. Figured it out myself but thanks for the answer and sorry for the dumb question.
... View more
06-29-2015
09:58 PM
Thank You guys for replying. Figured it out myself yesterday. Just a simple mvexpand did the trick. Since woodcock replied first so i m gonna accept his answer. Once again sorry for asking such a dumb question.
... View more
