Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About AshChakor
AshChakor
Path Finder
Member since:
08-31-2018
10-23-2021
Community Statistics
| Posts | 28 |
| Solutions | 0 |
| Karma Given | 4 |
| Karma Received | 2 |
| Member Since | 08-31-2018 |
Activity Feed
- Posted Splunk Add-on Builder Python script - duplicate entries per field in Index on All Apps and Add-ons. 10-22-2021 06:45 AM
- Posted Splunk Add on Builder - data input deletion on Knowledge Management. 09-27-2021 02:12 PM
- Tagged Splunk Add on Builder - data input deletion on Knowledge Management. 09-27-2021 02:12 PM
- Posted Sendemail "Invalid address" error while sending scheduled report via email after upgrading to 8.1.3 on Alerting. 05-14-2021 11:26 AM
- Tagged Sendemail "Invalid address" error while sending scheduled report via email after upgrading to 8.1.3 on Alerting. 05-14-2021 11:26 AM
- Posted Re: Error in 'dbxquery' command: External search command exited unexpectedly with non-zero error code 1. on All Apps and Add-ons. 05-14-2021 06:16 AM
- Got Karma for Re: How to compare counts on two different indexes on fields. 03-15-2021 01:54 PM
- Posted Re: How to display counts in the two weeks span for last two weeks and two weeks before on Splunk Search. 01-29-2021 10:57 AM
- Posted How to display counts in the two weeks span for last two weeks and two weeks before on Splunk Search. 01-29-2021 07:56 AM
- Tagged How to display counts in the two weeks span for last two weeks and two weeks before on Splunk Search. 01-29-2021 07:56 AM
- Karma Re: how to display week by week data with different colors for to4kawa. 01-21-2021 09:51 AM
- Posted how to display week by week data with different colors on Splunk Search. 01-20-2021 11:48 AM
- Posted Re: How to get the most recent event with search criteria on Splunk Search. 11-16-2020 11:27 AM
- Karma Re: How to get the most recent event with search criteria for richgalloway. 11-16-2020 11:27 AM
- Posted How to get the most recent event with search criteria on Splunk Search. 11-16-2020 09:04 AM
- Karma Re: Compare two indexes and report mismatching records for ITWhisperer. 09-21-2020 12:48 PM
- Posted Re: Compare two indexes and report mismatching records on Splunk Search. 09-21-2020 10:42 AM
- Posted Re: Compare two indexes and report mismatching records on Splunk Search. 09-21-2020 10:20 AM
- Posted Compare two indexes and report mismatching records on Splunk Search. 09-21-2020 09:12 AM
- Posted Re: How to compare counts on two different indexes on fields on Splunk Search. 09-15-2020 07:50 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
10-22-2021
06:45 AM
I have a python script which makes an API call and get the events . Number of events, its collecting are correct however its adding duplicate entries per field. Can you please assist, I am ? Here is my script response = helper.send_http_request(rest_url, 'GET' ,parameters=queryParam, payload=None,headers=headers, cookies=None,verify=False, cert=None, timeout=None, use_proxy=False) r_headers = response.headers r_json = response.json() r_status = response.status_code if r_status !=200: response.raise_for_status() final_result = [] for _file in r_json: responseStr='' fileid = str(_file["fileid"]) state = helper.get_check_point(str(fileid)) if state is None: final_result.append(_file) helper.save_check_point(str(str(fileid)), "Indexed") event=helper.new_event(json.dumps(final_result), time=None, host=None, index=None, source=None, sourcetype=None, done=True, unbroken=True) ew.write_event(event) response: [ { "fileid": "abc.txt", "source": "source1", "destination": "dest1", "servername": "server1", }, { "fileid": "xyz.txt", "source": "source2", "destination": "dest2", "servername": "server2", } ] Response after collecting data to Index looks as below: fileid source destination servername "abc.txt abc.txt source1 source1 dest1 dest1 server1 server1 xyz.txt xyz.txt source2 source2 dest2 dest2 server2 server2
... View more
Labels
- Labels:
-
other
-
troubleshooting
09-27-2021
02:12 PM
I created an input_type (data input type) to collect data from external REST API using Splunk Add-on Builder app. How do I delete it?
... View more
- Tags:
- Input_type
Labels
- Labels:
-
other
05-14-2021
11:26 AM
I have scheduled reports which sends pdf via sendemail. But After upgrading Splunk to 8.1.3 its not working, I am seeing "Invalid address" error as below 112 -0400 ERROR sendemail:522 - (501, b'5.1.7 Invalid address', 'SPLUNK@serverdomainname') while sending mail to: abc@xyz.com Is there any way that I can change the "From" address? Thanks in advance!
... View more
Labels
- Labels:
-
email
05-14-2021
06:16 AM
I am getting same error after upgrading to Splunk 8.1.3 version. we don't have commands.conf under local. Any suggestions please? Thanks in advance!
... View more
01-29-2021
10:57 AM
I found a solution but let me know if anyone has any better solution index="my index" | where <condition> | timechart span=1w@w6 count as eachwcount | eval latest_2weeks=relative_time(now(),"-1w@w6") | eval two_weeks_before = relative_time(now(),"-3w@w6") | eval four_weeks_before = relative_time(now(),"-5w@w6") | eval weeksAgo=case(_time < two_weeks_before, "Four_Weeks_Before", _time >= two_weeks_before and _time < latest_2weeks," Two_Weeks_Before",_time >= latest_2weeks,"Latest_Two_Weeks") | stats sum(eachwcount) as totalcount by weeksAgo
... View more
01-29-2021
07:56 AM
I want to display counts latest two weeks (last two weeks), two weeks before and everything else before 4 weeks starting week at Saturday For example. _time Count 2020-11-28 164 2020-12-05 488 2020-12-12 516 2020-12-26 5755 2021-01-02 482 2021-01-09 450 2021-01-16 1274 2021-01-23 33684 Expected Output is : With two weeks time span I want to display the counts as below Four weeks before (164+488+516+5755) Two weeks before (450+482) Latest two weeks 34958 ( which is count of 2021-01-16 and 2021-01-23 1274 + 33684)
... View more
01-20-2021
11:48 AM
I want to display counts by weeks . but current week's count in "green", last weeks counts in "Orange" and counts older than two weeks in "Red".
... View more
Labels
- Labels:
-
timechart
11-16-2020
11:27 AM
@richgalloway Thanks! It worked! I modified the query and added isnull(End_dt) before dedup. index=foo | where isnull(END_DT) | dedup Custom_ID | where Eligibility="Eligible" Thanks much!
... View more
11-16-2020
09:04 AM
I have the following resultset I want to get the most recent events Resultset A Custom_ID Eligibility Start_date End_Date Updated_date Code 1331931 Not Eligible 1/1/2011 0:00 11/12/2020 13:32 C 1331931 Eligible 1/1/2011 0:00 11/12/2020 13:07 C 1331931 Eligible 1/1/2011 0:00 11/12/2020 12:44 B 1331931 Eligible 1/1/2011 0:00 11/12/2020 12:33 B 1331931 Eligible 1/1/2011 0:00 11/12/2020 11:32 B 1331931 Not Applicable 1/1/2011 0:00 11/12/2020 10:52 B 1318156 Eligible 12/1/2017 0:00 12/31/2017 0:00 2/26/2020 13:36 B 1318156 Eligible 1/1/2018 0:00 2/26/2020 13:36 C 1319106 Eligible 9/9/2018 0:00 2/26/2020 13:36 D 1319106 Eligible 8/1/2016 0:00 9/8/2018 0:00 2/26/2020 13:36 B 1314052 Eligible 11/17/2016 0:00 2/26/2020 13:36 E 1314052 Eligible 1/1/2011 0:00 11/16/2016 0:00 2/26/2020 13:36 A I am looking for the most recent eligible events Expected output Custom_ID Eligibility Start_date End_Date Updated_date Code 1318156 Eligible 1/1/2018 0:00 2/26/2020 13:36 C 1319106 Eligible 9/9/2018 0:00 2/26/2020 13:36 D 1314052 Eligible 11/17/2016 0:00 2/26/2020 13:36 E I tried following query index=my_index | where isnull(END_DT)| table Custom_ID, Eligibility, Start_date, End_Date, Updated_date,Code Custom_ID Eligibility Start_date End_Date Updated_date Code 1331931 Not Eligible 1/1/2011 0:00 11/12/2020 13:32 C 1331931 Eligible 1/1/2011 0:00 11/12/2020 13:07 C 1331931 Eligible 1/1/2011 0:00 11/12/2020 12:44 B 1331931 Eligible 1/1/2011 0:00 11/12/2020 12:33 B 1331931 Eligible 1/1/2011 0:00 11/12/2020 11:32 B 1331931 Not Applicable 1/1/2011 0:00 11/12/2020 10:52 B 1318156 Eligible 1/1/2018 0:00 2/26/2020 13:36 C 1319106 Eligible 9/9/2018 0:00 2/26/2020 13:36 D 1314052 Eligible 11/17/2016 0:00 2/26/2020 13:36 E How do I eliminate events with 1331931 since the most recent activity is “Not Eligible”
... View more
Labels
- Labels:
-
other
09-21-2020
10:42 AM
Since both values(ID and status_code) exist in both indexes it doesn't mismatch, it's 0. If it was a db query I would have joined two tables on ID columns and checked in the where clause if IDs are same but status_code are different to find mismatch. I am looking something like that kind of query in Splunk. when I join two indexes on common ID, I get all the matching records and I want exactly opposite to that.
... View more
09-21-2020
10:20 AM
Sorry for not being clear, id and static code makes a unique row. so there could be duplicate IDs as with different status code.
... View more
09-21-2020
09:12 AM
I have two indexes Index A and Index B and it has a common key “ID” and I want to compare two indexes and need to report which status code are not matching with each other and any missing record. Index A ID status_code 101 A01 102 A11 103 B10 104 M01 105 D01 101 A02 Index B ID status_code 101 A01 102 B10 103 B10 104 M01 101 Z01 Expected output – Mismatched records: ID Index A code Index B Code 102 A11 B10 105 D01 101 A02 Z01
... View more
Labels
- Labels:
-
other
09-15-2020
07:50 AM
@gcusello Thank you!!
... View more
09-15-2020
07:23 AM
1 Karma
@gcusello Your solution is working now I tweaked a little to get the category definition index=indexA OR index=indexB | rename status_code AS category_code1 | eval category = case( (category_code1 IN(, "m", "p") OR like(category_code1, "n%")) , CategoryA, like(category_code1, "s%"), CategoryB, (like(category_code1, "^%") OR like(category_code1, "h%"), CategoryC )) | stats count(eval(index=indexA)) AS "Index A count" count(eval(index=indexB)) AS "Index B count" BY category| eval difference="Index A count"-"Index B count" | table category "Index A count" "Index B count" difference
... View more
09-14-2020
12:36 PM
@gcusello I tried the suggestions but rename field and the query didn't work. Sorry that I didn't display my eval experssions earlier. Here is my basic query which results into two rows and 6 columns. index=indexA OR index=indexB | eval indexA_CategoryA = if( (IN(status_code, "m", "p") OR like(status_code, "n%")) , 1, 0) | eval indexA_CategoryB = if( like(status_code, "s%") , 1, 0) | eval indexA_CategoryC = if( (like(status_code, "^%") OR like(status_code, "h%")) , 1, 0) | eval indexB_CategoryA = if( (IN(category_code1, "m", "p") OR like(category_code1, "n%")) AND isnull(TO_DT), 1, 0) | eval indexB_CategoryB = if( like(category_code1, "s%") AND isnull(TO_DT), 1, 0) | eval indexB_CategoryC = if( (like(category_code1, "^%") OR like(category_code1, "h%")) AND isnull(TO_DT), 1, 0) | stats sum(indexA_CategoryA) as indexA_CategoryA, sum(indexA_CategoryB) as indexA_CategoryB, sum(indexA_CategoryC) as indexA_CategoryC, sum(indexB_CategoryA) as indexB_CategoryA, sum(indexB_CategoryB) as indexB_CategoryB, sum(indexB_CategoryC) as indexB_CategoryC by index index indexA_CategoryA indexA_CategoryB indexA_CategoryC indexB_CategoryA indexB_CategoryB indexB_CategoryC IndexA 45 201 75 0 0 0 IndexB 0 0 0 45 189 76
... View more
09-14-2020
08:04 AM
@gcusello Thanks for the reply. I have to determine Categories based on the following values for example | eval CategoryACount = if( (IN(category_code1, "a", "m") OR like(category_code1, "q%")) AND isnull(TO_DT), 1, 0) | eval CategoryBCount = if( (like(category_code1, "?%") OR like(category_code1, "b%")) AND isnull(TO_DT), 1, 0) | stats count(CategoryACount ) as CategoryA, count(CategoryBCount ) as CategoryB . Also one more problem is TO_DT doesn’t apply on Index A. I am not sure how to include the above into the above query you mentioned
... View more
09-14-2020
06:54 AM
I have two indexes and it has similar fields and need to compare counts on these two indexes. For example Index A Id status_code 1 b 2 a 3 a 4 m 5 b 6 c Index B ID category_code1 from_dt To_dt 101 p 01/01/2019 09/14/2018 102 b 01/01/2019 null 103 a 01/01/2019 null 104 m 01/01/2019 null 105 a 01/01/2019 null Expected output Index A count Index B Count difference Category A 2 2 Category B 2 1 1 Category C 1 0 How do I get this count by categories on two different indexes.
... View more
Labels
- Labels:
-
other
04-30-2019
06:42 AM
Hi SloshBurch ,
I followed all the examples and its working fine with the node server.
How do I configure it on IIS server to work as a Proxy for connecting to Splunk Web from outside? Can you please share settings on IIS server, if i need to add proxy-pass in web.conf, if there is any snippet that you can share?
Thanks in advance.
... View more
04-29-2019
01:56 PM
I have the same issue, did you find out the answer for how to configure IIS to work as a Proxy for connecting to Splunk Web from outside? Can you please share the settings on IIS server
... View more
04-25-2019
01:04 PM
I am able to setup proxy on NGINX as per the instructions on http://dev.splunk.com/view/javascript-sdk/SP-CAAAEWQ.
How do I set up the same proxy setup on IIS server?
... View more
04-25-2019
05:54 AM
Ok I found a work around for this. I used regex expression to extract fields and its producing the same output just as in splunkUI with extracted or transformed fields.
Splunk UI Extracted field : EXTRACT-TransUID Inline ^[^[\n]*[(?P [^]]+)
SplunkUI search: index="myindex" host="myhost" | transaction TransUID
When I used the above search in my webapplication uisng SplunkJS, it wouldn't work.
So I used regex as below in the search and its working just as it did in SplunkUI
'index="myindex" host="myhost" | rex field=_raw "^[^[\n]*\[(?P<TransUIDTest>[^]]+)" | transaction TransUIDTest'
... View more
04-24-2019
11:11 AM
Thanks acharlieh.
It's working after I changed it to *\[(?P[^]]+)".
index="appIndex*" host="somehost" | rex field=_raw "^[^[\n]*\[(?P[^]]+)" | transaction TransUID
... View more
04-24-2019
10:14 AM
I have similar error. My following search in splunkUI works fine
index="appIndex*" host="somehost" | fields TransUID | rex field=_raw "^[^[\n]*[(?P[^]]+)"| transaction TransUID
But when I use the same query in javascript (SplunkJS) in my webapp I get following error.
Error in 'rex' command: Encountered the following error while compiling the regex '^[^[ ]*[(?P[^]]+)': Regex: unmatched closing parenthesis
... View more
04-23-2019
01:31 PM
Hi I have extracted few fields using Regex from logs in Splunk. I can do search on those fields successfully in Splunk WebUI. I want to use the same queries uisng SplunkJS in my Webapp. Every time I add the extracted fields in the SearchManager's search query on my page, I get No result found.
How can I resolve this issue and continue to use SplunkJS in my webapp?
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
10-23-2021
02:23 AM
|
