Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Are you a member of the Splunk Community?
Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- Find Answers
- :
- About gokikrishnan198
gokikrishnan198
New Member
Member since:
06-02-2018
02-20-2025
Community Statistics
| Posts | 20 |
| Solutions | 0 |
| Karma Given | 0 |
| Karma Received | 0 |
| Member Since | 06-02-2018 |
Activity Feed
- Posted Re: Can you help me build a regex that extracts an IP Address from a log message? on Splunk Search. 11-20-2018 09:26 PM
- Posted Can you help me build a regex that extracts an IP Address from a log message? on Splunk Search. 11-15-2018 07:07 PM
- Tagged Can you help me build a regex that extracts an IP Address from a log message? on Splunk Search. 11-15-2018 07:07 PM
- Tagged Can you help me build a regex that extracts an IP Address from a log message? on Splunk Search. 11-15-2018 07:07 PM
- Posted Scheduled Search Alert Suppression on Reporting. 10-17-2018 10:39 PM
- Tagged Scheduled Search Alert Suppression on Reporting. 10-17-2018 10:39 PM
- Posted What is Search Head? Can it be seen in the UI? on Deployment Architecture. 09-19-2018 11:51 PM
- Tagged What is Search Head? Can it be seen in the UI? on Deployment Architecture. 09-19-2018 11:51 PM
- Posted What will be the best possible to perform the following scenario simpler? on Splunk Dev. 08-01-2018 11:22 PM
- Posted Re: Chart Overlay: How to sum and avg of a single field and apply it in chart overlay? on Dashboards & Visualizations. 07-22-2018 08:30 PM
- Posted Chart Overlay: How to sum and avg of a single field and apply it in chart overlay? on Dashboards & Visualizations. 07-19-2018 11:14 PM
- Tagged Chart Overlay: How to sum and avg of a single field and apply it in chart overlay? on Dashboards & Visualizations. 07-19-2018 11:14 PM
- Tagged Chart Overlay: How to sum and avg of a single field and apply it in chart overlay? on Dashboards & Visualizations. 07-19-2018 11:14 PM
- Posted How to use the time range in search query? on Splunk Search. 07-16-2018 09:46 PM
- Tagged How to use the time range in search query? on Splunk Search. 07-16-2018 09:46 PM
- Posted How to group values using wildcard on Splunk Search. 07-11-2018 12:14 AM
- Tagged How to group values using wildcard on Splunk Search. 07-11-2018 12:14 AM
- Tagged How to group values using wildcard on Splunk Search. 07-11-2018 12:14 AM
- Tagged How to group values using wildcard on Splunk Search. 07-11-2018 12:14 AM
- Tagged How to group values using wildcard on Splunk Search. 07-11-2018 12:14 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
11-20-2018
09:26 PM
Thanks. It was perfect.
... View more
11-15-2018
07:07 PM
How do I extract an IP address from a log message using regex? All the four octets need to be pulled at a time,
rex field=LogMsg "Ip Address :(?\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})"
Not sure, \d{1,3}, why 1 is being used here. But the above query did not work.
... View more
10-17-2018
10:39 PM
Is there a way to Suppress the Scheduled Alerts during the Maintenance Window?
... View more
- Tags:
- splunk-enterprise
09-19-2018
11:51 PM
In the Splunk Architeture, it is known that Splunk has major 3 components.
1. Forwarder - Instance installed at the log collection devices
2. Indexer - Virtual Instance installed with SPLUNK for parsing the collected logs
3. Search Head - Not very clear about where do we have it. Can somebody explain in non-technical words, what is a Search Head and Where can we find it?
... View more
- Tags:
- splunk-enterprise
08-01-2018
11:22 PM
Query1: index=IDX|stats count by ApplCode
Output:
ApplCode
1234567890
2345678901
3456789012
4567890123
Query2: index=IDX ApplCode=1234567890 | stats count by CustID ApplCode Status
ApplCode Status
1234567890 Submit
2345678901 Submit
3456789012 Complete
4567890123 Complete
In the above queries, Query1 output goes as input for Query2. For each value in the output of Query1 has to be checked with Query2 and its status has to be updated. What will be the best possible way make this step simpler?
... View more
- Tags:
- splunk-cloud
07-22-2018
08:30 PM
Hi @Adonio,
Apologies. I am unable to follow the code that was provided.
Let me explain the thing here again.
If there is a Service A . It takes time to run. Need to calculate average and total time elapsed for the service. Thanks,
... View more
07-19-2018
11:14 PM
index=source sourcetype=type|timechart sum(TotalTime) avg(TotalTime)
Getting a chart below
Unable to use the clause "over" in timechart command like "timechart sum(TotalTime) over avg(TotalTime) by EM"
Unable to calculate sum if I use stats command. Need assistance Please.
... View more
07-16-2018
09:46 PM
I would like to find a error occurs in the past 30, 60 and 90 days. How to do that?
... View more
- Tags:
- splunk-enterprise
07-11-2018
12:14 AM
index=**** Name=GOKI|stats count by SK SO
This is the result that I get now.
SK SO COUNT
d.e.f B3 2
a.b.c.1 A1 4
a.b.c.2 A2 6
a.b.c.3 A1 8
Expected Result:
d.e.f B3 2
a.b.c.* A1 12
a.b.c.* A2 6
How do I get the expected result?
... View more
07-04-2018
09:28 PM
Example:
I am having a search in my view code and displaying results in the form of table.
small example result:
custid Eventid
10001 200
10001 300
10002 200
10002 100
10002 300
I got the answer for grouping of the custid's by using the query "stats values(custID) by eventID". I also need to count the custID that has occurred for every Customer. Can anyone suggest me the query for the same? Whatever I use apart from the above query to count the number of custid's I could not get the answers for the same.
... View more
06-12-2018
04:08 AM
Thank you. It worked.
... View more
06-11-2018
12:56 AM
I am able to get the few indexes from the code '|tstats count by sourcetype where index=* |fields - count' you gave. But I am unable to get the source types for the corresponding indexes. Can you help me on that part?
... View more
06-09-2018
10:18 PM
I am given an app to work within SPLUNK.
I have neither Power User nor ** User role*. Rather I have **Elevated User* role.
I would like to know the DataSummary from where the data is getting pulled.
I would like to know the list of available Indexes and SourceTypes that are used in my app.
Do we have any query to search that information? Please assist me on the same.
... View more
06-08-2018
05:37 AM
Can anybody help me on this?
... View more
06-06-2018
10:32 PM
Our Client uses splunk. All the teams have their own app available in it. We are one of the team as well. In this situation, I could like to know the steps to identify the INDEX and SOURCETYPE?
... View more
06-06-2018
10:28 PM
Thanks for the clarification provided. I made the modification in the dashboard form which worked. Further to add in this question, I mentioned like real-time monitoring which means refreshing the screen at every equal interval. Do we need mention the time range picker even during real-time monitoring? Can't we skip it?
... View more
06-06-2018
06:10 AM
I have a different kind of access called ELEVATED ACCESS in splunk enterprise which is below the POWER USER but higher than the USER, with different apps installed. I have only one app in that. Is there a way to identify the list of available indexes and source types that is used in my app?
... View more
06-03-2018
12:38 PM
I feel there is no contradiction. When there is a need demand comes and when demand comes we change the refresh rate of the dashboard.
I also gave an example in the previous answer which is chrome extension, “Easy Auto-Refresh”. I request you to have a look at it if you don’t mind.
As Splunk is mainly used for monitoring, we from SOC team needs a real-time monitoring which is a very important factor. In that case, following are the reasons,
1) You cannot expect me to Press F5 Key all the times.
2) I can think of another option which is updating the Form of the dashboard.
3) Also, I can go ahead with writing a JS Query as mentioned in the link given.
I accept these can be performed. But these are all work-around. Don’t Splunk have an option available in-built? Please suggest if available.
... View more
06-03-2018
08:31 AM
@niketnilay,
Do you want to apply Refresh on dashboard level or script level?
I would like to have the refresh at the dashboard level.
Is the refresh Interval supposed to be same or different for different dashboards?
Yes, I would like to change the refresh rate for the dashboard. It can be the same dashboard or different.
Within a single dashboard can the refresh interval be different?
No, I am not asking for the refresh of the different panels in the same dashboard.
Do you want to refresh Dashboard/Panel/s on demand or set some interval like every 5 min?
I would like to have the refresh of Dashboard on demand. Example: Chrome Extension, Easy Auto-Refresh.
What is the window of Real-Time interval you need? Or are you planning real-time searches on your dashboard?
Not real-time searches. If the dashboard refreshes automatically that might look like a real-time view of the dashboard.
... View more
06-02-2018
11:20 PM
I need an option to auto-refresh the dashboard using the application than doing it in scripts. If I need to do it in scripts, I need to modify each and every query I search in. Do I have an option to include the auto-refresh command in the query itself? This will help us in the real-time monitoring? I tried with the previously asked questions, which gave answers only to the scripts but not the application. Request you to update asap.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
02-20-2025
07:49 AM
|
