About nqjpm

nqjpm · ‎05-08-2023

Had the same issue and going back through these steps AzmathShaik gave resolved it for me. A little more detail... systemctl daemon-reload the run the boot start command ( if already enabled it should say file exists). ---###File is located at /etc/systemd/system/Splunkd.service. Might want to check who owns it with ls -la run the old method for starting and stopping splunk ( start should fail asking the system password) ### run $SPLUNK_HOME/bin/splunk <start/stop> run systemctl start Splunkd ( should start splunk)

nqjpm · ‎02-05-2019

When I use | chart dc(UniqueIdentifier) by _time ComputerPlatform Reply It now gives me an error "Error in 'chart' command: The argument 'Reply' is invalid." Not sure why _time kills the search.

nqjpm · ‎02-05-2019

I'm unfortunately limited by our security policy. I cant be very specific.

nqjpm · ‎02-05-2019

Have a working query, but the boss has now asked me to timechart for SuccessRateByPlatformPCT per week and I am having a bear of a time getting it from here to there. Any insights appreciated. index=foo | eval date=strftime(_time, "%x") | eval ComputerPlatformString=len(AssetID) | eval ComputerPlatform=case(ComputerPlatformString=0, "Unknown/Multiple_LVDI_and_Desktop", ComputerPlatformString=3, "Laptop/Desktop", ComputerPlatformString=8, "Laptop/Desktop", ComputerPlatformString=9, "LVDI", ComputerPlatformString=10, "PSI/VSI", ComputerPlatformString=11, "AppSphere", ComputerPlatformString=12, "AppSphere", ComputerPlatformString=13, "AppSphere", ComputerPlatformString=14, "WorkStation", ComputerPlatformString=15, "VSI", ComputerPlatformString=18, "VDesk Terminal", ComputerPlatformString=20, "VDesk") | where ComputerPlatform="AppSphere" OR ComputerPlatform="LVDI" OR ComputerPlatform="Laptop/Desktop" OR ComputerPlatform="VDesk" | transaction UniqueIdentifier | chart dc(UniqueIdentifier) by ComputerPlatform Reply | eval SuccessRateByPlatformPCT = round((RESOLVED) / (RESOLVED + NOTRESOLVED)*100, 2) | eventstats sum(RESOLVED) as TOTALRESOLVED , sum(NOTRESOLVED) AS TOTALNOTRESOLVED, sum(NORESPONSE) AS TOTALNORESPONSE | addtotals NORESPONSE NOTRESOLVED RESOLVED fieldname=TotalUses | addcoltotals NORESPONSE NOTRESOLVED RESOLVED TotalUses labelfield=ComputerPlatform label=Total | table ComputerPlatform NORESPONSE NOTRESOLVED RESOLVED SuccessRateByPlatform TotalUses resulting chart | ComputerPlatform | NORESPONSE | NOTRESOLVED | RESOLVED | SuccessRateByPlatformPCT | TotalUses | LVDI | 1 | 2 | 8 | 80.00 | 11 | Laptop/Desktop | 3 | 3 | 7 | 70.00 | 13

nqjpm · ‎08-31-2018

index=foo | eval Compliant=case(like(AppVersion,"14.12%"), "OK", like(AppVersion,"14.11%"),"OK" , like(AppVersion,"14.10%"),"OK" , like(AppVersion,"14.9%"),"OK" , like(AppVersion,"14.8%"),"OK"...) | table User, Platform, AppVersion, Compliant Right now table looks like this. I have only checked if an AppVersion is on the Compliant list. 12345| Windows | 14.8 | Ok 56789| Mac | 12.8 | 03468| iOS | 18.0 | 97621| Android | 18.8 | However, I need to check certain AppVersions against the Platform. I imagine it would need multiple if statements and multiple cases but not sure how to do this. One of my failures looked something like: index=foo | eval Compliant=if(Platform=Windows, case(like(AppVersion,"14.12%"), "OK", like(AppVersion,"14.11%"),"OK" , like(AppVersion,"14.10%"),"OK" , like(AppVersion,"14.9%"),"OK" , like(AppVersion,"14.8%"),"OK"...),"NO") | table foo The goal would be to show something like this. User | Platform | AppVersion | Compliant 12345| Windows | 14.8 | Ok 56789| Mac | 12.8 | Ok 03468| iOS | 18.0 | Ok 97621| Android | 18.8 | Ok 97423| Windows | 13.8 | No 32638| Mac | 11.0 | No 08346| iOS | 17.0 | No 43835| Android | 18.2 | No Thank you in advance, if you can help.

nqjpm · ‎07-24-2018

1) The dedup command is throwing away some results. Realize now this is not the appropriate location to use this. Thanks good catch. 2) It makes no sense to sort on "TIME" since your date format is not sortable. Changed to sort on _time 3) Sort has a limit on how many records it will return. Use | sort 0 to eliminate the limit. When I tried | sort 0 it errors out to "You must specify fields to sort." 4) Can an IncidentId be in more than one Queue? If so, did you want only the final one? Yes it can be in more than one Queue and I am seeking the final one as you surmised.

nqjpm · ‎07-20-2018

The CSV has over 100k entries. When I timechart this search I see about 6800 results. I receive values for all 3 months I searched. However, when I table the same search and I click the GUI sort on TIME I am only seeing Jan and Feb. The results from the search shows the same number 6800. Is there some limitation to populating tables I am unaware of when dealing with CSV's? or Is there possibly something wrong with my WHERE statement? | inputlookup foo.csv | eval output=toString(Date) + " " + (CreatedHour) | eval _time=strptime(output,"%b %d,%Y %I:%M%p") | eval TIME=strftime(_time, "%b-%d-%Y %I:%M %p") | dedup IncidentId | where like(TIME, "Jan%") OR like(TIME, "Feb%") OR like(TIME, "Mar%") | where like(Queue, "In-Country%") | sort -_time | table Queue IncidentId TIME

nqjpm · ‎04-25-2018

Updated. I should have thought to add that.

nqjpm · ‎04-25-2018

This is a working search that charts Volume per hour for the same day (Current day) over multiple weeks. The search time from the Timepicker is set at Today. I was experimenting with timewrap to solve this issue but |timewrap 1week wasn't doing what I needed. I am trying to avoid using more appends as the my search is becoming long and expensive since I am being asked for multiple panels showing more weeks, month and YTD. index= foo |fields incidentId _time | dedup incidentId | eval ReportKey="1. Current day" |append [search index=foo earliest=-7d@d latest=-6d@d |fields incidentId _time | eval _time=_time+86400*7 | dedup incidentId | eval ReportKey="2. Last week"] |append [search index=foo earliest=-14d@d latest=-13d@d |fields incidentId _time |eval _time=_time+86400*7*2 | dedup incidentId | eval ReportKey="3. Two weeks ago"] |append [search index=foo earliest=-21d@d latest=-20d@d |fields incidentId _time |eval _time=_time+86400*7*3 | dedup incidentId | eval ReportKey="4. Three weeks ago"] | timechart span=1h count(incidentId) by ReportKey Thanks in advance Here is the failed attempt that removes the hourly component in the visualization in linechart index=foo |fields incidentId _time | timechart span=1h dc(incidentId) | timewrap 1week I don't yet have enough karma to post an image unfortunately. It removes me from the Hourly view and put the time chart into a weekly view. changing timewrap to 1d shows everyday. Not sure what I am missing here.

nqjpm · ‎04-20-2018

This also works. Two great working answers in less than an hour. I love this community!

nqjpm · ‎04-20-2018

That works great! Thanks!

nqjpm · ‎04-20-2018

Description field parsing data from has some unnecessary survey data that I would like to ignore and NOT count. That data is denoted by ##Survey##. All data after this denotation can be ignored but I have not been able to determine a good way to do this. Can this be done without regex? Example of the what the user input field looks like (since its text input the length and words change): description="My outlook wont opena as a i keep getting an error message. ##Survey## Which of the following best describes your needs?: My Outlook is slow or not launching - Please clarify your issue further:: Outlook is slow or unable to launch OR description="I tried to login via * a few days ago and I kept getting the message that my password and/or token information was incorrect. I reset my token PIN and it still wouldn't work (PIN first, token key second). Does this happen often? I need to login this weekend and would like to have the issue resolved as soon as possible. Thank you! ##Survey## Please choose the option which best describes your problem.: ASSISTANCE WITH * TOKEN - Do you need assistance with your * token?: yes - Which best describes your request?: Other My search counts words in the description field to see what issues may be trending. However, the words in the survey are skewing my data. index=foo | fields description | makemv delim=" " description | mvexpand description | eval LowerCase=lower(description) | eval length=len(LowerCase) |search length > 2 |top limit=20 LowerCase

Posts	12
Solutions	0
Karma Given	6
Karma Received	1
Member Since	‎04-04-2018

Online Status	Offline
Date Last Visited	‎08-01-2023 02:07 PM

Did some math on a chart but need to take results ...

Comparison and condition function help. Multiple I...

Multiple "where like" on a CSV file

Timechart Volume per hour same day over several we...

What would be the strategy to extract relevant dat...

Re: Receiving the following error: "failed to star...

Re: Did some math on a chart but need to take resu...