Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Are you a member of the Splunk Community?
Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- Find Answers
- :
- About NOUMSSI
NOUMSSI
Builder
Member since:
12-11-2014
08-05-2023
Community Statistics
| Posts | 126 |
| Solutions | 16 |
| Karma Given | 0 |
| Karma Received | 83 |
| Member Since | 12-11-2014 |
Activity Feed
- Got Karma for Re: Why am I getting error "Unknown search command 'sourcetype'" using a subsearch in a where command?. 06-05-2020 12:48 AM
- Got Karma for Re: Why am I getting error "Unknown search command 'sourcetype'" using a subsearch in a where command?. 06-05-2020 12:48 AM
- Got Karma for Re: Add results depending on different fields. 06-05-2020 12:48 AM
- Got Karma for Re: duplicate values causing conflict. 06-05-2020 12:47 AM
- Got Karma for Re: Why am I getting "No Results Found" when searching for tag I set on a field created with eval or inline field extraction?. 06-05-2020 12:47 AM
- Got Karma for Re: duplicate values causing conflict. 06-05-2020 12:47 AM
- Got Karma for Re: duplicate values causing conflict. 06-05-2020 12:47 AM
- Got Karma for Re: duplicate values causing conflict. 06-05-2020 12:47 AM
- Got Karma for Re: duplicate values causing conflict. 06-05-2020 12:47 AM
- Got Karma for Re: duplicate values causing conflict. 06-05-2020 12:47 AM
- Got Karma for Re: duplicate values causing conflict. 06-05-2020 12:47 AM
- Got Karma for Re: duplicate values causing conflict. 06-05-2020 12:47 AM
- Got Karma for Re: duplicate values causing conflict. 06-05-2020 12:47 AM
- Got Karma for Re: duplicate values causing conflict. 06-05-2020 12:47 AM
- Got Karma for Re: duplicate values causing conflict. 06-05-2020 12:47 AM
- Got Karma for Re: duplicate values causing conflict. 06-05-2020 12:47 AM
- Got Karma for Re: duplicate values causing conflict. 06-05-2020 12:47 AM
- Got Karma for Re: duplicate values causing conflict. 06-05-2020 12:47 AM
- Got Karma for Re: How do I optimize the performance of my search that is currently using a different time range per sourcetype?. 06-05-2020 12:47 AM
- Got Karma for Re: How to create a table that, when I click on a value, drills down to a pie chart in the same dashboard?. 06-05-2020 12:47 AM
Topics I've Started
No posts to display.
05-23-2016
05:03 AM
Dont forget to accept my answer if you were satisfied
... View more
05-23-2016
03:03 AM
2 Karma
Hi try this:
sourcetype=SplunkKafka_messaging | spath input=msg_body | where passenger_count > [search sourcetype=SplunkRabbitMQ_messaging | spath input=msg_body | stats avg(passenger_count)]
... View more
05-13-2016
08:15 AM
Try this workaround. (run anywhere sample, replace /app/search/seconddashboard with your app/dashboard name where you want to drilldown
<dashboard >
<label>Eval Tokens</label>
<row>
<panel>
<html>
<a href="/app/search/seconddashboard"><h3>Top sourcetypes for index=_internal</h3></a>
</html>
<chart>
<search>
<query>index=_internal | top sourcetype</query>
<earliest>-2h</earliest>
<latest>now</latest>
</search>
<option name="charting.chart">bar</option>
</chart>
</panel>
</row>
</dashboard>
... View more
05-12-2016
01:32 AM
Hi,
I do not think because splunk is proprietary software and we are only users. So until the current version, this feature does not exist
... View more
05-11-2016
08:20 AM
Hi;
Try this
<input type="checkbox" token="hosts" searchWhenChanged="true" depends="somethig">
<label>host filter</label>
<search>
<query>* myFilter...
| stats by host
| table host
| sort host</query>
<earliest>$time_tok.earliest$</earliest>
<latest>$time_tok.latest$</latest>
</search>
<fieldForLabel>host</fieldForLabel>
<fieldForValue>host</fieldForValue>
<default></default>
<choice value="*">All</choice>
<prefix>(</prefix>
<valuePrefix>host="</valuePrefix>
<valueSuffix>")</valueSuffix>
<delimiter> OR </delimiter>
<suffix>)</suffix>
</input>
... View more
05-02-2016
02:37 AM
1 Karma
Hi,
try this:
index=XXXX sourcetype="XXXXXX" type=ERROR errorType="*" OR errorType2="*" OR NPE="*" | stats count by errorType, errorType2, NPE
... View more
04-25-2016
12:41 PM
Hi,
verify that that saved searche has not a private. assure you that the saved searche has a good right
... View more
02-05-2016
04:06 AM
Don't forget to vote me
... View more
01-27-2016
02:50 AM
2 Karma
Hi
you must use functions that produce a statistical table with numerical values and then apply the rangemap order on the corresponding field.
I guess you have a PercentFreeSpace field that contains numeric values , if not using the eval command with the corresponding formula for creating this field with its values
You can do this for example:
index=os sourcetype=df host=ttappalf03 "/dev/mapper/system-opt" |dedup filesystem|table filesystem PercentFreeSpace |rangemap field=PercentFreeSpace low=0-30 elevated=31-69 high=70-100 default=severe
... View more
01-11-2016
05:34 AM
2 Karma
Try this and change queries
<form>
<label>In-Page Drilldown with Perma-linking</label>
<fieldset submitButton="false">
<!--
Create an input to store the drilldown value. It will be hidden using custom javascript when
the dashboard is loaded.
-->
<input type="text" token="sourcetype" searchWhenChanged="true"></input>
</fieldset>
<row>
<table id="master">
<title>Master</title>
<searchString>index=_internal | stats count by sourcetype</searchString>
<earliestTime>-60m@m</earliestTime>
<latestTime>now</latestTime>
<!-- Set the type of of drilldown, since we will always consume the same field, use row-->
<option name="drilldown">row</option>
<drilldown>
<!-- Use set to specify the new token to be created.
Use any token from the page or from the click event to produce the value needed. -->
<set token="sourcetype">$row.sourcetype$</set>
<!-- If we also set the form.sourcetype the input will get updated too -->
<set token="form.sourcetype">$row.sourcetype$</set>
</drilldown>
</table>
</row>
<row>
<!-- depends is the way we tell the content to only show when the token has a value.
Hint: use comma separated values if the element requires more than one token. -->
<chart id="detail" depends="$sourcetype$">
<title>Detail: $sourcetype$</title>
<search>
<query>index=_internal sourcetype=$sourcetype$ | timechart count</query>
<earliest>-60m@m</earliest>
<latest>now</latest>
</search>
<option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
<option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
<option name="charting.axisTitleX.visibility">visible</option>
<option name="charting.axisTitleY.visibility">visible</option>
<option name="charting.axisTitleY2.visibility">visible</option>
<option name="charting.axisX.scale">linear</option>
<option name="charting.axisY.scale">linear</option>
<option name="charting.axisY2.enabled">0</option>
<option name="charting.axisY2.scale">inherit</option>
<option name="charting.chart">pie</option>
<option name="charting.chart.bubbleMaximumSize">50</option>
<option name="charting.chart.bubbleMinimumSize">10</option>
<option name="charting.chart.bubbleSizeBy">area</option>
<option name="charting.chart.nullValueMode">gaps</option>
<option name="charting.chart.showDataLabels">none</option>
<option name="charting.chart.sliceCollapsingThreshold">0.01</option>
<option name="charting.chart.stackMode">default</option>
<option name="charting.chart.style">shiny</option>
<option name="charting.drilldown">all</option>
<option name="charting.layout.splitSeries">0</option>
<option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
<option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
<option name="charting.legend.placement">right</option>
</chart>
</row>
</form>
... View more
01-06-2016
02:32 PM
when creating a dashboard , it has an permission "private" by default. This means that it is only visible in the application where it was created. To view and / or modify it , you must give it a "global" permission and assign read and write permissions to the desired users. YOU can also share the dashboard
For reassurance , you have to give permission "global" to the application in which you created the dashboard .
... View more
01-06-2016
02:10 PM
Once your tag creates , gives him permission "global" or shared ; then give write access and reading to all users . Reassure you also that the application in which you created the tag has permission "global" .
... View more
12-03-2015
05:17 PM
1 Karma
Hello,
Try this:
<form refresh="30">
<label>name</label>
.....
</form>
... View more
12-03-2015
04:14 PM
Hi,
try this
| multisearch [search index=websphere CPUStarvation
| rex "delay is\s+(?P<Value>\d+)\s+seconds"
| eval Value=Value . " Seconds"
| eval AlertName = "APM WAS: CPU Starvation detected"
| eval Severity="Critical"
| eval Details = "APM WAS: Error HMGR0152W. Value Field represent thread scheduling delay"
| table AlertName,Details,Severity,Value,host
| collect index=alerts sourcetype=Alerts:APM
]
[search index=websphere OutOfMemoryError
| rex mode=sed field=_raw "s/\n.*//g"
| rex mode=sed field=_raw "s/^\[.*PDT\]\s+.{8}\s+//g"
| eval ts=round(_time,0)
| stats count as Value list(_raw) as msg by ts,host
| convert ctime(ts) as dt
| eval AlertName = "APM WAS: OutOfMemoryError"
| eval Severity="Critical"
| eval Details = "OutOfMemoryError"
| table AlertName,Details,Severity,Value,host
| collect index=alerts sourcetype=Alerts:APM
]
[search index=websphere HangingThreat
| rex "active for\s+(?P<Value>\d+)\s+milliseconds.*are\s+(?P<threads>\d+)\s+thread"
| eval Value=round(Value/1000,2)
| eval Value=Value . " Sec"
| eval AlertName = "APM WAS: WAS Hanging Threads"
| eval Severity="Critical"
| eval Details = "APM WAS: Error WSVR0605W (".threads." Threads hang). Field 'Value' represent thread activity time"
| table AlertName,Details,Severity,Value,host
| collect index=alerts sourcetype=Alerts:APM
]
... View more
12-03-2015
03:42 PM
1 Karma
Ok! please dont forget to vote me
... View more
11-25-2015
03:44 AM
Hi,
Try this:
<savedsearch>"Test Extract" | search inFullName="$username$"</savedsearch>
<savedsearch>"Test Extract" | where inFullName="$username$"</savedsearch>
... View more
11-24-2015
07:14 AM
Hi,
Try this for your the second one:
(index=[index1] sourcetype=[sourcetype1]) OR (index=[index2] sourcetype=[sourcetype2 earliest=-24h latest=now])
... View more
11-24-2015
05:56 AM
Hi,
Try to do it manually. decompress The app, copy his folder and paste it in /opt/splunk/etc/apps/
After, restart splunk server.
... View more
11-24-2015
05:17 AM
Ok, Please don't forget to vote me so that it can be helpfull for others who can have the same problem
... View more
11-23-2015
08:10 AM
Hi,
Try this
Splunk add monitor C:\Windows\System32\winevt\Logs -index indexName
... View more
11-23-2015
06:50 AM
Hi,
It can't work because, It's not possible for you to install splunk on your computer and you him send mail to another server because your computer is a local server and it's not know by others.
It can work if your splunk is install on the cloud. Once it's done, the atribute server must be equals to tha adress of your splunk on cloud.
For example:
index=_internal | head 1 | sendemail to="my_email_account" format="html" server=mail.example.com:2500
Or
index=_internal | head 1 | sendemail to="my_email_account" format="html" server=192.168.1.9:2500
... View more
11-23-2015
06:24 AM
31 Karma
Hi,
I think your problem is in your input settings. try to change values of "fields for value" and "field for label". If in you 've rename field in your populating search, make sure that values of "fields for value" and "field for label" have the new name
... View more
11-06-2015
04:16 AM
Hi,
If Iunderstand you very well, you want that once you've check save box, you want that selected TicketNumbers become automatically uncheck. Is it so?
... View more
06-30-2015
09:14 AM
hi try this:
index=http status=200 src_ip!=10.0.0.0/8 src_ip!=192.168.0.0/16 src_ip!=172.16.0.0/12 | dedup src_ip| join [search index=snort | dedup signature | table src_ip,signature]
... View more
06-30-2015
08:48 AM
hi try this:
index=... source=you_source sourcetype=you_sourcetype host=same_host| stats c(ip_source) as count_ip_source c(ip_destination) as count_ip_destination|where ip_source=ip_destination | eval total= count_ip_source + count_ip_destination | table ip_source count_ip_source ip_destination count_ip_destination total
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
08-05-2023
11:30 AM
|
Karma from
