Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Are you a member of the Splunk Community?
Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- Find Answers
- :
- About gauravepi
gauravepi
Path Finder
Member since:
06-28-2018
06-05-2020
Community Statistics
| Posts | 17 |
| Solutions | 1 |
| Karma Given | 1 |
| Karma Received | 0 |
| Member Since | 06-28-2018 |
Activity Feed
- Karma Re: How to get hourly stats into a graph? for somesoni2. 06-05-2020 12:49 AM
- Posted How do I make a Splunk query that reads all error code , it's message and count? on Getting Data In. 11-06-2018 08:34 AM
- Tagged How do I make a Splunk query that reads all error code , it's message and count? on Getting Data In. 11-06-2018 08:34 AM
- Tagged How do I make a Splunk query that reads all error code , it's message and count? on Getting Data In. 11-06-2018 08:34 AM
- Posted Re: In a table, how do I designate a default message that shows under a certain condition? on Splunk Search. 09-28-2018 09:45 AM
- Posted In a table, how do I designate a default message that shows under a certain condition? on Splunk Search. 09-27-2018 10:02 AM
- Tagged In a table, how do I designate a default message that shows under a certain condition? on Splunk Search. 09-27-2018 10:02 AM
- Tagged In a table, how do I designate a default message that shows under a certain condition? on Splunk Search. 09-27-2018 10:02 AM
- Tagged In a table, how do I designate a default message that shows under a certain condition? on Splunk Search. 09-27-2018 10:02 AM
- Posted Re: How do you sum all values of a field that has JSON data? on Getting Data In. 09-14-2018 09:59 AM
- Posted Re: How do you sum all values of a field that has JSON data? on Getting Data In. 09-13-2018 09:19 AM
- Posted Re: How do you sum all values of a field that has JSON data? on Getting Data In. 09-13-2018 08:58 AM
- Posted Re: How do you sum all values of a field that has JSON data? on Getting Data In. 09-13-2018 08:21 AM
- Posted Re: How do you sum all values of a field that has JSON data? on Getting Data In. 09-13-2018 08:19 AM
- Posted Re: How do you sum all values of a field that has JSON data? on Getting Data In. 09-13-2018 08:09 AM
- Posted How do you sum all values of a field that has JSON data? on Getting Data In. 09-13-2018 07:54 AM
- Tagged How do you sum all values of a field that has JSON data? on Getting Data In. 09-13-2018 07:54 AM
- Tagged How do you sum all values of a field that has JSON data? on Getting Data In. 09-13-2018 07:54 AM
- Tagged How do you sum all values of a field that has JSON data? on Getting Data In. 09-13-2018 07:54 AM
- Posted Re: Search by user request parameter in Splunk Dashboard on Dashboards & Visualizations. 08-29-2018 10:07 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
11-06-2018
08:34 AM
I have a JSON response now, and, from that, i want to create a table that will have all Unique Error Codes, Messages and Count . I am not able to read the JSON message in Splunk. How can we do this in Splunk? Below is one sample JSON response which i have
level: DEBUG
line: 43
logger: ErrorUtils
message: Error: {"ErrorCode":"201","Message":"Invalid User"}
I have created a query just to read the eventtype. i am not sure how i can proceed further on this.
eventtype="myevent"
... View more
09-28-2018
09:45 AM
Below query worked me , i did a string comparison
basic query |eval errMsg=if('status' == "411", "Length missing",errMsg) | table errMsg,status
... View more
09-27-2018
10:02 AM
I am checking the status code of the HTTP response. In one condition when HTTP code is 411, i don't get a message. So, in that condition, i want to have some default message in the table. But, i am unable to set a default message.
The below query is what I am using:
basic query |eval errMsg=if(status == "411", "Length missing",errMsg) | table errMsg,status
For other cases, I want to have the errMsg the same as what I am getting back in search.
... View more
09-14-2018
09:59 AM
No it's name is different i have just added as an example
... View more
09-13-2018
09:19 AM
eventtype=mytest |eventstats sum(mainrate) AS TotalMinRate by PrimaryKey | rename date AS "datetime" | table datetime, TotalMinRate
Above is the full query but it is not doing the sum of all the json key it has for PrimaryKeyField
... View more
09-13-2018
08:58 AM
Yes it is working for numeric values ,
Those are Json values might possible splunk is considering them as a String
... View more
09-13-2018
08:21 AM
I have tried both stats and eventstats but both are helping me to sum all the key values.
... View more
09-13-2018
08:19 AM
Yes I am trying to create a table that will have totalMinrate field and that field will have the sum of all mainrate.It is showing the TotalMinRate in rate but it is not doing the sum for each minrate present in the Json array.
... View more
09-13-2018
08:09 AM
I tried that as well but it is not working , can we use foreach to get this done?
... View more
09-13-2018
07:54 AM
I have some JSON data , in that i want to sum all values of a key in a Splunk query. Below is the sample data :
data":[{"abc":"1234","mainrate":12},{"abc":"186","mainrate":222},{"abc":"633","mainrate":121},]}],
Tried using sum but that is not giving me sum of all minrate. I'm using the below query to get this done :
eventtype=mytest| eventstats sum(mainrate) AS TotalMinRate
... View more
- Tags:
- json
- splunk-cloud
- sum
08-29-2018
10:07 AM
Yes i was looking for this . How we can do this from UI panel. Do you have information regarding that.
... View more
08-29-2018
08:47 AM
I have a event created which is returning Jason data after search :
eventtype="my_new"
Data returned after this search :
data: {"Id":2001373223232214,"SerialNumber":6773737,"Unique":"200000","messageType":"READY","activeStartTime":"2018-08-29T09:30:00.000-0500","activeEndTime":"2018-08-30T11:00:00.000-0500","additional":["fitness","pool","public"],}
Now i want to give a feature on dashboard to the user if to search whole message by passing Unique number in a search box. I have no clue how we can do this in Splunk . Please help me in this
... View more
- Tags:
- splunk-enterprise
08-09-2018
10:35 AM
I am creating a query to get message type count but i want to skip some the message that are not valid . Some of the messages are starting like "-100" or "Data ...". I want to skip them while i counting the messages count.
TO get the count i am using below query :
eventtype=logs | stats count as Total by message | rename message AS "Type"
Message field has below data :
Data nprops 5 1
Data props 0
-102
1432
sql error
I want to skip all message which are starting from positive ,negative number and those as well which start from Data.
... View more
- Tags:
- splunk-enterprise
07-18-2018
11:53 AM
For 13 hours : Total d_in 427 if there is data-set for hour 13 having d_in = 12
Then total d_in is 427+12 = 439
So total d_in in 13th hour is 439 likewise for each field
... View more
07-18-2018
11:19 AM
I have some fields in my Splunk search now i want to use them to create a search query so that i can pull those information into a graph. On splunk i want to show hourly(hour field) how many d_in , d_to d_up ,err and p_to are there . Below are the field which i have
d_in = 4027
d_to = 336210
d_up = 332183
hour = 12
err = 0
p_to = 264749
d_in = 427
d_to = 3210
d_up = 2183
hour = 13
err = 2
p_to = 249
I am new in Splunk please help me in this . I am using below query to in the search to get above fields :
eventtype="abc"
... View more
06-28-2018
12:20 PM
I want to access the values of the events that are coming after splunk search .
Data is coming in below format on the event
18/06/28 14:12:07 250 219561 711914 72864 0 784778 - 18-06-28 14:08:43
I want to access certain values from this list like i want to access : 18/06/28 14:12:07 , 784778 and 18-06-28 14:08:43
Please suggest how we can do this in splunk ?
... View more
- Tags:
- splunk-cloud
