Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About manjunathmeti
manjunathmeti
Champion
Member since:
09-29-2015
10 hours ago
Community Statistics
| Posts | 810 |
| Solutions | 198 |
| Karma Given | 18 |
| Karma Received | 235 |
| Member Since | 09-29-2015 |
Activity Feed
- Posted Re: how to exclude several patterns by IN function? on Splunk Search. Thursday
- Posted Re: Search Query to trigger an email of the host is not reporting in Splunk for last 15 minutes on Splunk Search. Wednesday
- Got Karma for Re: Extract first 3 lines of raw logs and group. a week ago
- Got Karma for Re: How to dynamically compare and come up with new fields. a week ago
- Got Karma for Re: Need help removing the y-axis label from the charts in the trelis. 2 weeks ago
- Got Karma for Re: How to add multiple rows while creating Incident through splunk. 2 weeks ago
- Posted Re: summary Index on Splunk Search. 2 weeks ago
- Posted Re: Extract first 3 lines of raw logs and group on Splunk Search. 2 weeks ago
- Posted Re: How to add multiple rows while creating Incident through splunk on Dashboards & Visualizations. 2 weeks ago
- Got Karma for Re: Add-on installation on Search Head or on Indexer?. 2 weeks ago
- Posted Re: Add-on installation on Search Head or on Indexer? on Installation. 2 weeks ago
- Posted Re: How to add multiple rows while creating Incident through splunk on Dashboards & Visualizations. 2 weeks ago
- Posted Re: How to add multiple rows while creating Incident through splunk on Dashboards & Visualizations. 2 weeks ago
- Posted Re: How to add multiple rows while creating Incident through splunk on Dashboards & Visualizations. 2 weeks ago
- Posted Re: Extract first 3 lines of raw logs and group on Splunk Search. 2 weeks ago
- Posted Re: Alert report date range on Alerting. 2 weeks ago
- Posted Re: Linebreak on Splunk Enterprise. 2 weeks ago
- Posted Re: Linebreak on Splunk Enterprise. 2 weeks ago
- Tagged Re: Linebreak on Splunk Enterprise. 2 weeks ago
- Posted Re: How to count cumulative average by month? on Splunk Search. 2 weeks ago
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
Thursday
hi @cheriemilk, Filtering on *T# and *D# is not possible in IN function as fields as it only supports asterisk ( * ) character as a wildcard in field values. You can use the where command with the match function. https://docs.splunk.com/Documentation/Splunk/latest/Search/Wildcards index=index NOT CMID IN("*T", "*D") | where NOT match(CMID, "(T|D)\d+$") If this reply helps you, a like would be appreciated.
... View more
Wednesday
you need to provide a delimiter in the split function. | tstats count where index=xyz sourcetype=iis earliest=-15m by host
| append
[| makeresults
| eval host=split("abc,def,ijk,lmn,opq", ",")
| mvexpand host
| eval count=0]
| stats sum(count) as event_count by host
| where event_count=0
| mvcombine delim="," host
| nomv host
... View more
2 weeks ago
hi @vijaysri, Summary index events do have timestamps. if your saved search results contain a _time field then the timestamp will be set to this field values in the summary index. If _time is not there then timestamp is set to the CURRENT time(when data is parsed) in the summary index. Retention for the summary index is 5 years and the max data size is 500GB. If this reply helps you, a like would be appreciated.
... View more
2 weeks ago
1 Karma
Try this: ... | rex "exception\"\s?:\s?\"(?<ErrorMsg>[^\"]+)\"" | stats count by Application, ErrorMsg | sort -count | table count, Application, ErrorMsg
... View more
2 weeks ago
index=abc ns=blazegateway|stats count by app_name | eval f1="khushi" | streamstats count as temp | eval temp=floor(count/3) | stats list(*) as * by temp | fields - temp Post some data if you don't get result as you expect.
... View more
2 weeks ago
1 Karma
hi @b_chris21, Configurations and updates needed for the data model to normalize the data are done on search heads only. You need to deploy the add-ons on search head - Splunk ES (1). If this reply helps you, a like would be appreciated.
... View more
2 weeks ago
Yes you can, try this: index=abc ns=xyz | stats count by app_name | eval f1="khus" | streamstats count as temp | eval temp=floor(count/5) | stats values(*) as * by temp | fields - temp
... View more
2 weeks ago
1 Karma
You can attach results as csv file OR make fields multivalued so that all the events fit into on erow. index=abc ns=xyz | stats count by app_name | eval f1="khus" | stats values(*) as *
... View more
2 weeks ago
hi @aditsss, You can set Trigger to For each result under Trigger Conditions on the alert edit page. If this reply helps you, a like would be appreciated.
... View more
2 weeks ago
hi @Engineer_Zen, Check this page for all available tokens for email alert action. https://docs.splunk.com/Documentation/Splunk/latest/Alert/EmailNotificationTokens
... View more
2 weeks ago
There is an app developed to consume Windows PowerShell transcript logs: Check this: https://github.com/HurricaneLabs/TA-powershell_transcript It is also there in Splunk base: https://splunkbase.splunk.com/app/4984/#/details If this reply helps you, a like would be appreciated.
... View more
2 weeks ago
hi @kmfpo, You can also use accum command to calculate the running total of duration values. | stats count, sum(duration) as duration, last(closed) as closed by closed_month
| eval closed=strptime(closed, "%b-%d")
| sort closed
| accum duration as total_duration
| accum count as total_count
| eval Avg=round(total_duration/total_count, 1), temp=1, closed_month="Avg ".closed_month
| xyseries temp, closed_month, Avg
| fields - temp If this reply helps you, a like would be appreciated.
... View more
2 weeks ago
1 Karma
hi @spammenot66, Try this: <row>
<html>
<style>
g.highcharts-axis-labels.highcharts-yaxis-labels {
display: none !important;
}
</style>
</html>
</row> If this reply helps you, a like would be appreciated.
... View more
2 weeks ago
Try this: LINE_BREAKER = (\*{22}\n\w+\s\w+\s\w+\sstart\n) Note that this will not add the below lines to your events: ********************* Windows PowerShell transcript start
... View more
2 weeks ago
1 Karma
hi @yoshilog, You can use foreach command with <<MATCHSTR>> instead of <<FIELD>>. You need to make sure that suffixes of fields a<SUFFIX> and q<SUFFIX> should be the same. Try this: | makeresults
| eval afield1=4, afield2=2, afield3=8, afield4=10, qfield1=1, qfield2=2, qfield3=3, qfield4=10
| foreach a*
[ eval r<<MATCHSTR>>=if(a<<MATCHSTR>>=q<<MATCHSTR>>, "EQUAL", "NOT EQUAL")] If this reply helps you, a like would be appreciated.
... View more
2 weeks ago
hi @uagraw01, The regex configured for LINE_BREAKER must contain a capturing group. Also, set SHOULD_LINEMERGE to false. Restart forwarder once you add these configurations in props.conf. LINE_BREAKER = (\*{22}\n)
TIME_PREFIX = \Start\stime\:\s
TIME_FORMAT= %Y%m%d%H%M%S
SHOULD_LINEMERGE = false If this reply helps you, a like would be appreciated.
... View more
2 weeks ago
1 Karma
hi @vinforever, You can configure a centralized Search head to search the data across multiple indexer servers or indexer clusters. Check below links to configure: https://docs.splunk.com/Documentation/Splunk/8.1.3/DistSearch/Configuredistributedsearch https://docs.splunk.com/Documentation/Splunk/8.1.3/Indexer/Configuremulti-clustersearch#:~:text=Configure%20the%20search%20head%20for,editing%20the%20search%20head's%20server. If this reply helps you, a like would be appreciated.
... View more
2 weeks ago
hi @alex5441, You can extract the values for the field ErrorMsg using rex command. ........| rex "(?<ErrorMsg>\"exception\"\s:\s\"\w+\s\w+\w\s\w+)" | stats count by Application, ErrorMsg | sort -count | table count, Application, ErrorMsg If this reply helps you, a like would be appreciated.
... View more
