About javiergn

javiergn

Hi @mani , See if the following helps: | makeresults | fields - _time | eval my_date = strptime("07/13/2020", "%m/%d/%Y") | eval my_date_week = strftime(my_date, "%V") | eval my_date_month = relative_time(my_date, "@mon") | eval my_date_month_week = strftime(my_date_month, "%V") | eval my_date_weekNumber_inMonth = my_date_week - my_date_month_week | eval my_date_previous_month = relative_time(my_date, "-1mon@mon") | eval my_date_previous_month_week_start = relative_time(my_date_previous_month + (7 * my_date_weekNumber_inMonth * 86400), "@w0") | eval my_date_previous_month_week_end = my_date_previous_month_week_start + (7 * 86399) | fieldformat my_date = strftime(my_date, "%m/%d/%Y") | fieldformat my_date_previous_month_week_start = strftime(my_date_previous_month_week_start, "%m/%d/%Y") | fieldformat my_date_previous_month_week_end = strftime(my_date_previous_month_week_end, "%m/%d/%Y") | table my_date, my_date_previous_month_week_start, my_date_previous_month_week_end Output: Couple of things: * I am assuming your week starts on Sunday * 1 day has 86400 seconds but I am subtracting 1 second on line 9 to ensure your date ends on the last second of that week. That is, 06/20/2020 at 23:59:59, instead of ending at 06/21/2020 at 00:00:00 and therefore displaying 21 instead of 20. Let me know if that helps. Regards, J

javiergn · ‎06-22-2020

Hi, I think Monday is correct too. Look:

javiergn · ‎06-19-2020

Hi, I wasn't aware start and end time could span more than 1 day so I have reviewed my answer from 2016 and proposed the following for you: | eval start_time_epoch = strptime(reported_time,"%b %d %Y %H:%M:%S") | eval start_time_second = strftime(start_time_epoch,"%S") | eval start_time_epoch_rounded = start_time_epoch - start_time_second | fields - start_time_epoch, start_time_second | eval close_time_epoch = strptime(processed_time,"%b %d %Y %H:%M:%S") | eval close_time_second = strftime(close_time_epoch,"%S") | eval close_time_epoch_rounded = close_time_epoch - close_time_second | fields - close_time_epoch, close_time_second | eval minute = mvrange(0, (close_time_epoch_rounded - start_time_epoch_rounded), 60) | mvexpand minute | eval _time = start_time_epoch_rounded + minute | eval myHour = strftime(_time,"%H") | eval myMinute = strftime(_time,"%H") | eval myDay = strftime(_time,"%A") | where myDay != "Saturday" AND myDay != "Sunday" AND (myHour >= 13 OR myHour < 1) | stats count as durationInMinutes by reported_time, processed_time | eval duration = tostring(durationInMinutes*60, "duration") And it seems to work fine in calculating the duration up to the minute: Let me know if that works. If not please provide examples (text always better than screenshots).

javiergn · ‎06-18-2020

Ok, based on what you described I would do something like (PLEASE DOUBLE CHECK THE SYNTAX): | eval start=strptime(reported_time,"%b %d %Y %H:%M:%S") | eval end=strptime(processed_time,"%b %d %Y %H:%M:%S") | eval startAt1pm = relative_time(start, "@d+13h") | eval endAt1am = relative_time(end, "@d+1h") | eval newStart = if(start > startAt1pm, start, startAt1pm) | eval newEnd = if(end < endAt1am, end, endAt1am) | eval durationInSecs = newEnd - newStart | eval durationHours = floor(durationInSecs/3600) | eval durationMins = floor((durationInSecs - (durationHours*3600))/60) | eval durationString = if(durationHours<10, "0" . toString(durationHours), toString(durationHours)) . ":" . if(durationMins<10, "0" . toString(durationMins), toString(durationMins)) | stats first(durationString) as durationString by ticket, reported_time, processed_time If you also need seconds you can proceed with the same logic and build that into the durationString. Let me know if that works.

javiergn · ‎06-18-2020

Ok, so assuming I understood your question correctly, this is what I would do: | eval start=strptime(reported_time,"%b %d %Y %H:%M:%S") | eval end=strptime(processed_time,"%b %d %Y %H:%M:%S") | eval startAt1pm = relative_time(start, "@d+13h") | eval newStart = if(start > startAt1pm, start, startAt1pm) | eval durationInHours = round((end - newStart)/3600) | stats first(durationInHours) asdurationInHours by ticket, reported_time, processed_time Lines 3 to 5 are basically creating a new time field rounded to 1pm, if the actual start time is greater than 1pm then use it, otherwise use the one that starts at 1pm. Then calculate the difference in seconds between the new start and end and round it to the hour. Let me know if that works. It should also be a lot faster than the solution I proposed in 2016 for your particular use case.

javiergn · ‎06-18-2020

Hi @Wheresmydata , First of all thank you for referencing one of my answers from ages ago. I probably need to review what I did first ha ha. In any case, while I'm reviewing your question, could edit the post and format the table accordingly as it is very hard to read otherwise? Thanks, J

javiergn · ‎06-16-2020

Hi @priyaramki16 , I made a typo on my answer as I didn't have a lab to check my syntax. See the answer above again. By the way, make sure your sort is working fine as there seems to be a trailing space in your query between "Calendar" and "Week"

javiergn · ‎06-16-2020

Hi @priyaramki16 , Take a look at streamstats: https://docs.splunk.com/Documentation/Splunk/8.0.4/SearchReference/Streamstats In your case, something like the following should do the trick: your query here | sort limit=0 "Calendar Week" | streamstats sum(count) as Cumulative_Count Hope that helps

javiergn · ‎06-16-2020

Hi @shashank_24 , have you tried with append instead of appendpipe? https://docs.splunk.com/Documentation/Splunk/8.0.4/SearchReference/Appendpipe https://docs.splunk.com/Documentation/Splunk/8.0.4/SearchReference/Append

javiergn · ‎06-15-2020

Hi @nesa246, sorry but I don't fully understand your last question. Could you try to reformat your code and tables and perhaps provide an example of what you are expecting VS what you are seeing? Thanks, J

javiergn · ‎06-15-2020

Hi @nesa246 , Try using stats the following way: | stats count(eval(testResult=0)) as totalTestPassed, count(eval(testResult=1)) as totalTestFailed, count(eval(testResult=2)) as totalTestInconclusive by guid, startTime, endTime Hope that helps. Regards, J

javiergn · ‎05-28-2020

Sorry what didn't get anything parsed? This? | makemv delim="\\\\n" yourfield What's your fieldname? Is it _raw? If so then use it like: | makemv delim="\\\\n" _raw You can also extract our JSON fields first with spath, as in the second screenshot, and then use makemv against the one containing the new lines (log in this case). In any case, it always helps if you paste query here.

javiergn · ‎05-28-2020

Hi @skirven, If you just want to present that JSON in a nicer format then your only option is probably the makemv command: | makemv delim="\\\\n" yourfield As in the following screenshot. I know is not ideal, as you are creating a multivalue field, but it is presented in a much more readable way so hopefully it'll help. Or you could also use spath to extract the fields and then apply makemv to log: Let me know if that helps. Thanks, J

javiergn · ‎04-23-2020

Hmm, that's interesting. I have tested both your samples on regex101 and my regex works fine with them. Look: https://regex101.com/r/cjjSHZ/1

javiergn · ‎04-22-2020

Sure, good luck. By the way, do not forget accept the answer if it solved your problem so that others can benefit from it in the future. If not, please post what your remaining issue is and we'll try to help. Regards, J

javiergn · ‎04-22-2020

Hi @mehrdad_2000, If you just want whatever is between square brackets but ensuring it only contains letters and not numbers, you can do something like: | rex max_match=1 "^\d{4}\-\d{2}\-\d{2} \d{2}:\d{2}:\d{2}\,\d{3} \w+ [\w\-\.]+ \[(?<myField>[a-zA-Z]+)\]" For instance, if I use your sample data:

javiergn · ‎04-21-2020

Then you could do something like: | inputcsv test.csv | sort limit=0 time | streamstats reset_on_change=t count(eval(available="time_out")) as time_out_count by available | sort limit=0 - time | streamstats window=3 reset_on_change=t max(time_out_count) as time_out_max by available | eval isFailure = if(time_out_max >= 3, 1, 0) | stats count as total_count count(eval(isFailure=1)) as failure_count by DATABASE_NAME | eval success_count = total_count - failure_count | eval percentage=(success_count/(success_count+failure_count))*100 Or whichever filter expression you want to include within the stats eval.

javiergn · ‎04-21-2020

Hi @xiro, Let me know if the this helps. I have replicated your sample on a csv and tested with the following SPL. NOTE: Keep in mind your time only displays hours and minutes and therefore duplicates will occur when it spans more than 24 hours. Please ensure your time values are unique for the defined time span and also double check they can be sorted accordingly (use strptime function for instance). If you find any issues please post a more detailed sample perhaps. | inputcsv test.csv | sort limit=0 time | streamstats reset_on_change=t count(eval(available="time_out")) as time_out_count by available | sort limit=0 - time | streamstats window=3 reset_on_change=t max(time_out_count) as time_out_max by available | where time_out_max >= 3 | table time Output: Thanks, J

javiergn · ‎04-20-2020

Hi, Running spath against the JSON block you included here seems to extract everything: | makeresults | eval myJSON = " [ { \"BIOS\": { \"manufacturer\": \"INSYDE Corp.\", \"SystemBiosMajorVersion\": 0, \"SystemBiosMinorVersion\": 41, \"SMBIOSBIOSVersion\": \"0.99\" } }, { \"Checkpoint\": { } }, { \"ClusterName\": null }, { \"CPUType\": { \"NumberOfCores\": 16 } }, { \"HBA\": [ { \"active\": true, \"drivername\": \"elxfc\", \"driverversion\": \"12.2.207.0\", \"firmwareversion\": \"11.4.204.25\", \"optionromversion\": \"11.4.204.25\", \"manufacturer\": \"Emulex Corporation\", \"model\": \"LPe32002-AP\", \"serialnumber\": \"FC83980875\" }, { \"active\": true, \"drivername\": \"elxfc\", \"driverversion\": \"12.2.207.0\", \"firmwareversion\": \"11.4.204.25\", \"optionromversion\": \"11.4.204.25\", \"manufacturer\": \"Emulex Corporation\", \"model\": \"LPe32002-AP\", \"serialnumber\": \"FC83980875\" } ] }, { \"HPE\": [ ] }, { \"HPEDiskCount\": 0 }, { \"HPELogicalDisks\": { \"Status\": null, \"RaidLevel\": null, \"ID\": null, \"Capacity\": null } }, { \"HPEPhysicalDisks\": [ ] }, { \"Mig\": { \"VirtualMachineMigrationEnabled\": true, \"VirtualMachineMigrationPerformanceOption\": 2, \"VirtualMachineMigrationAuthenticationType\": 1, \"MaximumVirtualMachineMigrations\": 2, \"MaximumStorageMigrations\": 2 } }, ] " | spath input=myJSON | fields - myJSON, _time Output: Can you give us an example of a field that Splunk is not making available and the SPL you are using?

javiergn · ‎04-19-2020

Hi @khalid7assan, Did any of the answers below help with your problem? If so please don't forget to accept one so that other users can benefit from this answer in the future. Thanks, J

Posts	1062
Solutions	273
Karma Given	78
Karma Received	550
Member Since	‎06-03-2014

Online Status	Offline
Date Last Visited	3 weeks ago

Re: How to find the week number of a date in a mon...

Re: Count working hours after midnight

Re: Count working hours after midnight

Re: Count working hours after midnight

Re: Count working hours after midnight

Re: Count working hours after midnight

Re: How to create A new field which creates accumu...

Re: How to create A new field which creates accumu...

Re: How to display matched and non matched content...

Re: Compare two different rows and count values fr...

Re: Compare two different rows and count values fr...

Re: In a JSON Payload, parse out \n to newline

Re: In a JSON Payload, parse out \n to newline

Re: extract content of brackets

Re: SPLUNK search for only 3 continuous resulst

Re: extract content of brackets

Re: SPLUNK search for only 3 continuous resulst

Re: SPLUNK search for only 3 continuous resulst

Re: Parsing of highly nested JSON events with arra...

Re: Multiple json events coming as one