About chimell

chimell · ‎02-15-2023

How can I created dashboard for my entities like image belong in IT Essentials work app. I download the manuel named: - Entity Integrations Manual - Overview of Splunk IT Essentials Work But i can not find my answer Thank you for your help

chimell · ‎11-15-2022

window 10 splunk 9.0.2 thank you

chimell · ‎11-12-2022

Rollback during Installation Splunk Enterprise in Windows 64 bit Please i need the help.

chimell · ‎06-06-2019

Thanks you to up vote my answer, therefore i want you to accept it.

chimell · ‎05-09-2017

Hi ankithreddy777 Try this search |set union[search index=index1|fields a b c][search index=index2|fields c d]

chimell · ‎05-05-2017

Hi To remove duplicate data : use ............ |dedup field1 field2

chimell · ‎01-05-2017

Hi Try this search code : index=xxx|transaction transid startswith="Request" endswith="Response" Keeporphans=t |timechart avg((count(eval(Result="FAILURE"))/count(eval(OperationName)))) as TotalCount , count(eval(Result="SUCCESS")) as SuccessCnt , count(eval(Result="FAILURE")) as FatalCnt by OperationName |eval FailurePercentage= (FatalCnt/TotalCount)*100

chimell · ‎01-05-2017

Hi Verify if loadAvgIni field is well extracted . And try using this search code : index=os host=PC2 sourcetype=vmstat |timechart avg(loadAvgIni)

chimell · ‎12-28-2016

Hi Try this search code : index=xyz sourcetype=123 Message ="*"|stats count by host , Message |fields - count |appendcols[search index=xyz sourcetype=123 Message ="*"|stats count as Total ]

chimell · ‎12-21-2016

Hi try something like this index="price" |chart limit=0 count by productId , product_name

chimell · ‎12-12-2016

Hi Try this search code .........................|rex field=_raw "1min\=(?<one_min>[^\;])\;5min\=(?<five_min>[^\;])\;60min\=(?<sixty_min>[^\;])\;24hr\=(?<twenty_four_hr>[\d+])"|table one_min five_min sixty_min twenty_four_hr

chimell · ‎12-12-2016

Hi Try this search code index=prd sourcetype="nodecheck"|rex field=_raw "System\s+(?<SystemStatus>[^\$|^\!]+)"|chart count by SystemStatus

chimell · ‎12-11-2016

hi try this search code : ...................................|rex field=_raw "count$domain$\=(?<count_domain>[^\,]+)"|table count_domain

chimell · ‎12-11-2016

Hi anoopambli This search code work well ...................................|rex max_match=0 field=_raw "\[Linux\]\[[a-zA-Z\s+]+\]\[(?<monitor_name>[^\]]+)\]"|mvexpand monitor_name|table monitor_name Look at my result

chimell · ‎12-05-2016

Hi In gokadroid answer, replace (?<license>[^"]+) with (?<license>[^\"]+) to have a good answer. He forgot to escape " character

chimell · ‎12-03-2016

Hi jhusum Try the following search code : .............................. | rex field=_raw "Read:\s+(?<read>[0-9]+)\s+Imported:\s+(?<imported>[0-9]+)\s+Failed:\s+(?<failed>[0-9]+)"|stats dc(read) as read_count , dc(imported) as imported_count , dc(failed) as failed_count

chimell · ‎11-23-2016

Hi ASISH_9 Use the search like this with appendcols command : search 1 |appendcols [search 2] example : index=_internal |stats count by source |appendcols[index=_audit |stats count by sourcetype]

chimell · ‎11-23-2016

Hi Try the following search code using dedup command : where acc="Inc" AND Stage = "NewBusiness" |dedup quoteNumber | stats count(quoteNumber) AS Quotes count(eval(processStatus="ManualRatingRequired")) as Referrals |eval perc=round(Referrals/Quotes*100, 1)."%"

chimell · ‎11-21-2016

i need to see well before extracting

chimell · ‎11-21-2016

Please can you extend your sample logs , for permitting me to see well your events ?

Posts	348
Solutions	22
Karma Given	9
Karma Received	90
Member Since	‎12-11-2014

Online Status	Offline
Date Last Visited	‎05-03-2023 10:55 AM

How can I created dashboard for my entities like ...

Rollback during Installation Splunk Enterprise in...

How to hide a panel in a dashboard?

Using rex to extract multivalue fields from events...

How can I created dashboard for my entities like ...

Re: Rollback during Installation Splunk Enterprise...

Rollback during Installation Splunk Enterprise in...

Re: Copy Dashboard from one App to another

Re: Join data from two indexes

Re: about removal duplication and lookup

Re: how to calculate percentage in timechart by?

Re: Cannot find remote data using timechart

Re: How to get the no of rows in a table without c...

Re: How can I show all values in a pie chart inste...

Re: help with rex

Re: rex usage in splunk

Re: rex error help

Re: rex field extraction

Re: How to extract multiple values for multiple fi...

Re: Searching and adding values in stats counter

Re: How can i limk 2 reports into one within a sin...

Re: distinct count using stats and eval

Re: Rex for extracting OS types

Re: Rex for extracting OS types