Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Are you a member of the Splunk Community?
Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- About luislema
luislema
Path Finder
Member since:
07-21-2015
06-05-2020
Community Statistics
| Posts | 26 |
| Solutions | 0 |
| Karma Given | 6 |
| Karma Received | 4 |
| Member Since | 07-21-2015 |
Activity Feed
- Karma Re: Datetime to Date for sbbadri. 06-05-2020 12:49 AM
- Karma Re: What SPL syntax do I use to represent "Beginning and end of current date" to filter my search results? for gokadroid. 06-05-2020 12:48 AM
- Karma Re: Why is Splunk DB Connect not indexing all the records when using the Rising Column Input Type? for nabeel652. 06-05-2020 12:48 AM
- Got Karma for What SPL syntax do I use to represent "Beginning and end of current date" to filter my search results?. 06-05-2020 12:48 AM
- Got Karma for Re: What SPL syntax do I use to represent "Beginning and end of current date" to filter my search results?. 06-05-2020 12:48 AM
- Got Karma for Re: What SPL syntax do I use to represent "Beginning and end of current date" to filter my search results?. 06-05-2020 12:48 AM
- Got Karma for Why is Splunk DB Connect not indexing all the records when using the Rising Column Input Type?. 06-05-2020 12:48 AM
- Karma Re: Where is splunk installed on Linux? for aljohnson_splun. 06-05-2020 12:47 AM
- Karma Re: Splunk DB Connect 2: How to search using DB Inputs? for mtevenan_splunk. 06-05-2020 12:47 AM
- Karma Re: Splunk DB Connect 2: How to search using DB Inputs? for ChrisG. 06-05-2020 12:47 AM
- Posted Re: Datetime to Date on Splunk Search. 07-27-2017 09:12 PM
- Posted Re: Datetime to Date on Splunk Search. 07-27-2017 08:44 PM
- Posted Re: Datetime to Date on Splunk Search. 07-27-2017 11:19 AM
- Posted Re: Datetime to Date on Splunk Search. 07-27-2017 11:14 AM
- Posted Re: Datetime to Date on Splunk Search. 07-27-2017 10:14 AM
- Posted Re: Datetime to Date on Splunk Search. 07-27-2017 08:47 AM
- Posted Datetime to Date on Splunk Search. 07-26-2017 03:43 PM
- Tagged Datetime to Date on Splunk Search. 07-26-2017 03:43 PM
- Posted How do I auto-refresh my dashboard? on Dashboards & Visualizations. 12-21-2016 12:27 PM
- Tagged How do I auto-refresh my dashboard? on Dashboards & Visualizations. 12-21-2016 12:27 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 1 | |||
| 1 | |||
| 0 |
07-27-2017
09:12 PM
Never mind. I figured it out:
my search
| rex field=Date "(?P\d+-\d+-\d+)\s\d+:\d+:\d+"
| eval n=relative_time(now(), "-7d@d")
| eval newtime=strptime(Date, "%Y-%m-%d")
| where newtime >= n
| chart sum(Revenue) AS Revenue by Day
... View more
07-27-2017
08:44 PM
If you have time please answer my new question:
https://answers.splunk.com/answers/558724/last-7-days-based-on-field.html?minQuestionBodyLength=80
Thanks.
... View more
07-27-2017
11:19 AM
my search | table Date Revenue
Date Revenue
2017-07-27 18:14:37.65 19.0000
... View more
07-27-2017
08:47 AM
Hi, I am trying to group by the newtime, and it's not working:
my search| eval newtime=strftime(Date, "%Y-%m-%d")
| chart sum(Revenue) by newtime
... View more
07-26-2017
03:43 PM
I have a field called Date like this 2017-07-26 22:34:09.383 and I need to strip out the time and keep just the date (2017-07-26). After that I need to group by Date. How do I do that? I have tried this but it's not working:
source=mysource
| eval newtime=strftime(Date, "%Y-%m-%d")
| chart sum(Revenue) by newtime
Thanks.
... View more
- Tags:
- splunk-enterprise
12-21-2016
12:27 PM
I need to auto-refresh my dashboard every 5 minutes. What code do I need to add? This is the source code:
<form>
<label>Revenue</label>
<fieldset submitButton="false" autoRun="true">
<input type="time" token="field1" searchWhenChanged="true">
<label>Select a time frame</label>
<default>
<earliest>@d</earliest>
<latest>now</latest>
</default>
</input>
</fieldset>
<row>
<panel>
<single>
<search>
<query>source=revenue | eval dateInField=strptime(Date,"%Y-%m-%d %H:%M:%S.%3N") | where dateInField >= relative_time(now(), "@d") AND dateInField < relative_time(now(), "@d+24h") | chart sum(Revenue)</query>
<earliest>$field1.earliest$</earliest>
<latest>$field1.latest$</latest>
<sampleRatio>1</sampleRatio>
</search>
<option name="colorBy">value</option>
<option name="colorMode">none</option>
<option name="drilldown">none</option>
<option name="numberPrecision">0.00</option>
<option name="rangeColors">["0x65a637","0x6db7c6","0xf7bc38","0xf58f39","0x65a637"]</option>
<option name="rangeValues">[0,30,70,100]</option>
<option name="showSparkline">1</option>
<option name="showTrendIndicator">1</option>
<option name="trendColorInterpretation">standard</option>
<option name="trendDisplayMode">absolute</option>
<option name="underLabel">Today's Authorized Sales</option>
<option name="unit">$</option>
<option name="unitPosition">before</option>
<option name="useColors">1</option>
<option name="useThousandSeparators">1</option>
</single>
</panel>
</row>
</form>
... View more
12-19-2016
08:15 PM
Right, timestamp data type is unique. I was getting it confused with the datetime data type.
... View more
12-19-2016
08:02 PM
Yes, unless you have 2 events with the same timestamp.
... View more
12-19-2016
07:58 PM
Can you add this as an answer so I can accept it?
... View more
12-19-2016
07:53 PM
Yes, for the rising column to work the data can't be on a secondary replica, and the rising column needs to be an identity column.
... View more
12-19-2016
07:47 PM
It seems you were right. It was because the rising column was not an identity column. I got confused because I was trying on 2 different databases, one had the identity column but it was a secondary replica so the data was being synchronized from the primary server. This is where I originally had the issue and assumed it was because of the replication. Therefore, I did the same test on another database without replication but I didn't set the primary key as an identity. After you commented I set it up as identity and so far it has been running fine without skipping any records. Can you add an answer so I can select it as a solution?
... View more
12-19-2016
06:49 PM
Yes, it's an identity column so it auto increments.
... View more
12-19-2016
06:44 PM
Yes, the rising column is a Primary Key Identity column. You can also see the Checkpoint Value if you go to the DB Connect app, then Operations -> DB Inputs, click on your Input, then go to step 2 of 4 "Choose and Preview Table". At the bottom of that step it will show the Checkpoint Value.
... View more
12-16-2016
09:20 AM
If you are having the same issue you should up vote my post.
... View more
12-15-2016
02:54 PM
No, I am currently contacting Splunk support.
... View more
12-11-2016
01:01 PM
1 Karma
I am using Splunk 6.5.1 and the DB Connect App to index data from SQL Server databases. I use the rising column on a primary key so the indexer will only load new records. The first time it runs fine, but in subsequent runs, the indexer is not loading all the columns. It usually skips 1-2 records when it runs, some runs don't skip any records though. I've tried it with a couple of databases on different servers and had the same result. I also tried the Advanced Input Type with a Checkpoint value, and it loads duplicate records. I am not sure what the issue is. I've used Splunk DB Connect 2 before and I've never had any issues like this.
... View more
12-09-2016
06:16 PM
My "Date" field is formatted like this "2016-12-10 02:10:39.973". I tried this:
eval dateInField=strptime(Date,"%m-%d-%Y") and it didn't create another field "dateInField". I've tried this before, but it's not evaluating my Date. I think it's because of the date format.
... View more
12-09-2016
04:34 PM
1 Karma
I tried but I received this message: "You are only allowed to submit 2 posts per day until you reach 40 points of reputation level." I will do it tomorrow.
... View more
12-09-2016
02:59 PM
1 Karma
Unfortunately the events are not indexed at the time they occur, sometimes there's a delay of up to 5 minutes. That's why I need to rely on my date instead of the the index date.
... View more
12-09-2016
02:26 PM
1 Karma
I have a field called Date where I store the event dates, and I need to filter on that field to display records only for the current date. This is my search:
source=revenue Date >= "BeginningOfDay" Date <= "EndOfDay".
What expressions do I use for "BeginningOfDay" and "EndOfDay"?
My Date is formatted like this: "2016-12-10 17:00:38.967"
... View more
07-28-2015
10:30 AM
You need to open your firewall for port 1433.
... View more
07-28-2015
10:30 AM
You need to open your firewall for port 1433.
... View more
07-24-2015
04:02 PM
Thanks, I had already figured it out myself, but this will be helpful for other people that are starting to use DB Connect 2.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:04 AM
|
Karma given to
