About JYTTEJ

JYTTEJ · ‎12-16-2014

I know that. I want to create a report in SPLUNK which contain a list of all views and the permissions which have been granted to that particular view. I need this list to make sure that I have granted the correct roles to each view.

JYTTEJ · ‎12-16-2014

I need to make a report/alert on the permissions granted to the views in SPLUNK. I am in particular interested in those situations where permission = read is granted to 'everyone' Is it possible to make such a report?

JYTTEJ · ‎11-26-2014

Hi - I need to calculate the mean(response time) for at complete month based on summary index. The summary index search has to run every 5 minutes - selecting last 5 minutes of data. The search will look like this: Search.... |sistats mean(response time) by xxx yyyy www ttt The monthly report search will look like this: index=summary REPORT=MEANRESP|timechart span=1month mean(response time) QUESTION: Will the search run on the summary index give the same result as if I made the search run on the actual transaction log?

JYTTEJ · ‎07-12-2013

This works fine! - but I also want to display on the same report how the total has been calculated. I.e. a report showing: CUSTOMER Trx Trx_Charge Amount XXX 10000 3.33 33300,00 XXX 10000 2.33 22200,00 XXX 1111 1.11 1234,00 Do you have more good ideas?

JYTTEJ · ‎06-24-2013

Hi, I need to make a report which need to calculate with two different prices. Price 3,33 USD for the first 10000 trx within a month Price 2,22 for 10001 - 20001 trx within same month Price 1,11 for 20001 + trx within the same month I have tried following: |accum Trx as Accum_trx |EVAL Charge=if(Accum_trx <10000,3.33, if(Accum_trx>10001 AND Accum_trx<20001,2.22, 1.11)) If Accum_trx are 3444 7000 9500 10500 the search will calculate 9500*3.33 and 10500 minus 9500 = 1000*2.22 I need to calculate 500 * 3.33 and 500 * 2.22 instead. How do I accomplish this?

JYTTEJ · ‎09-27-2012

Thks - so is the best way to enter this as an inline search string in APPx's dashboards:? | loadjob savedsearch="admin:APPy:MySavedSearch" ' or any smarter way?

JYTTEJ · ‎09-26-2012

I have created APPx. In APPx I have created a number of Dashboards which use the result of scheduled saved searches in APPy. or so I thought! When I log onto APPx Dashbords SPLUNK starts to run all saved searches in the dashboard. Why can't APPx read/get the result from the saved scheduled searches in APPy? Do you have any solution?

JYTTEJ · ‎06-12-2012

I have read through the above documentation - but I did not find anything about audit trail on change on saved searches/dashboards/macros etc. Does this mean that no such audittrail exist?

JYTTEJ · ‎06-06-2012

My customer want me to provide a change log on saved searches/dashboards/macros etc. I.e.: Change date, changed by user, old search content, new search content. The same apply to dashboards, macros etc. Where can I find this log?

JYTTEJ · ‎05-29-2012

I need to create a monthly report, which does not select events, which happens on Saturdays and Sundays. This report should be set up to run on a monthly basis (= select previous month) - but should exclude all Saturdays and Sundays in each month. How do I set up a monthly report to automatically exclude Saturdays and Sundays?

JYTTEJ · ‎04-17-2012

found the solution myself! Put a rename ELT AS YELT into the subsearch - then I can get both the ELT from x and ELT from y - and thereby calculate the difference between yELT and xELT host=x | JOIN F5I [ search host=y |rename ELT AS YELT ] |TABLE host SVC ELT YELT

JYTTEJ · ‎04-17-2012

host y contain name tag: ELT (Value: milliseconds) host x contain name tag: ELT (Value: seconds) Common identifier in the two hosts are F5I How do I calculate the difference between ELT in host Y and ELT in host X? I have tried this search: host=x | JOIN F5I [ search host=y ]|EVAL yELT=ELT/1000 |TABLE host SVC ELT yELT But the value of 'ELT' above is the value of ELT in host Y - and I want the value of ELT in host X - in order to calculate the difference - how do I do that? Thanks in advance for any help.

JYTTEJ · ‎02-13-2012

All my Dashboards are based on results of scheduled saved searches, so why does it look as if the user is performing a search just by logging on to the Dashboard? - ref below from audit log. Audit:[timestamp=02-13-2012 12:49:02.848, user=testsearch, action=search, info=granted , search_id='testsearch_testsearch_xxxxxDKXP_UFM2UFNES1hQIFBTX1RJTUUgQ2hlY2tvdXRTdGFydFNlc3Npb24_1329137342.204', search='search = bla bla bla', autojoin='1', buckets=0, ttl=600, max_count=10000, maxtime=0, enable_lookups='1', extra_fields='', apiStartTime='Mon Feb 13 11:49:00 2012', apiEndTime='Mon Feb 13 12:49:02 2012', savedsearch_name="xxxxxxDKXP"][n/a]

JYTTEJ · ‎02-06-2012

I found the reason why I was getting a negative value. this is because the search calculates the difference in time between 20:00 to 07:00 - how do I avoid that? I only want to calculate any difference in time between 07:00 to 20:00 - how do I accomplish that?

JYTTEJ · ‎02-06-2012

Hi I have created following search to measure availability per day (24 hours) host=xxxxxp* | delta _time AS timeDeltaS p=1 | eval timeDeltaS=abs(timeDeltaS) | eval timeDelta=tostring(timeDeltaS,"duration")|where timeDeltaS >15 |RENAME timeDeltaS as Sec_unavailable |APPEND [SEARCH host=xxxxxp* PRJ=PRJABC| eval Sec_unavailable=0 ]|bucket _time span=1d |stats sum(Sec_unavailable) by _time| RENAME sum(Sec_unavailable) as sec_unavail |eval avail=86400-sec_unavail|eval AvailPct = round((avail/86400)*100,2)|timechart span=1d sum(AvailPct)|RENAME sum(AvailPct) as "Avail.Pct" This calculates availabilty % per day round((avail/86400)*100,2) Now I want to calculate the availability within the service hours (07 to 19 GMT) per day. I know how to select the service hours (date_hour >07 AND date_hour <19) - and I have changed the 86400 (24 hours) seconds to 46800 (=13 hours) - but I am getting negative availabilty... I believe this is due to the *bucket _time span=1d* - but I am very most lost as to which bucket command I should use?

JYTTEJ · ‎02-06-2012

Thank you both - I look forward to try it out -but I can at least let my customer know now that his requirement is possible 🙂

JYTTEJ · ‎02-03-2012

Hi, I have a new customer where a number of saved searches have been set up. These searches are measuring response times, CPU load etc.etc. Now the customer wants to be able to run these searches in "one click": Choose start and end time which shall apply to all searches, click run - and then all searches are run and produces a nice chart for each of these. The reason is that the customer is doing benchmark testing - and wants to see the same measurements before and after e.g. an upgrade or relase installation. So a Dashboard is not really a solution - is it? Have any of you brilliant people out there ever done a thing like this? and what is the solution?

JYTTEJ · ‎01-27-2012

User role get following error message when trying to give read/write permission on look-up table: Splunk could not update permissions for resource data/lookup-table-files Client is not authorized to perform requested action User has created the lookup file in an app where permission = read and write to everyone. So why can't the user give permission on look-up table?

JYTTEJ · ‎12-19-2011

I am lost! I get this errormessage in the Dashboard. The saved search has been running for a couple of days - Was added to Dashboard1, and worked beautifully. Then I deleted the saved search from Dashboard1 and added the same saved search to another dashboard - and THEN I got the above error message. Why? - anybody got any good ideas? Thanks in advance for your help

JYTTEJ · ‎12-14-2011

Great! thank you so much!

JYTTEJ · ‎12-14-2011

Hi. I am going to set up the same search - for a lot of different hosts.(20) The result of the search is displayed on 2 different dashboards. The search is running every 30 minutes - thus updating the dashboard every 30 minutes. I would like to use the same search - and just reference the different hosts - instead of having 20 saved searches which are the same - only difference is the host name. How do I accomplish this?

JYTTEJ · ‎11-10-2011

Hi, I have indexed an NMON file on SPLUNK - just for test purpose as we would like to keep all measurements in one place. It did not quite work the way I had hoped, as the data records were logged like this without a header: 5:59:47.050 AM DISKBUSY,T2880,11.6,0.0,0.0,0.0,0.0,0.1,11.6,0.0,0.0,0.0,0.0,0.0,0.0,0.0,0.0,0.0,0.0,0.0,0.0,0.0,0.0,0.0,0.0,0.0,0.0,0.0,0.0,0.0,0.0,0.0,0.0,0.0,0.0,0.0,0.0,0.0,0.0,0.0,0.0,0.0 2 questions: 1) Can I set up SPLUNK to index the file in another way (with headers) 2) Can I use this record in any way?

JYTTEJ · ‎10-07-2011

GREAT - thank you! I did try something similar with the earliest=-10m and earliest=-20 minutes - but got stuck with an error message. You have solved my problem.

JYTTEJ · ‎10-06-2011

I have created this SPLUNK alert, which is logged as below: Oct 4 19:03:46 psdkxs01 alert-splunk: MID=SxxI002E;DAT="xxxxxxxx timeout" The alert is triggered when x number of MID=CxxI002W has been issued within the last 10 minutes. Now I want to create an 'OK' alert on following conditions: If MID=CxxI002W has not been issued for the last 10 minutes - AND MID=SxxI002E has been issued within the last 20 minutes - the OK alert has to be issued. The logs for MID=CxxI002W looks like this: Oct 4 19:06:01 psdkxp05 MID=CxxI002W;;STM=2011-10-04 19:06:01,475 How do I accomplish this?

JYTTEJ · ‎08-02-2011

By help of SPLUNK support I got this to work i simple XML: (Replace the ( ) with < >) (option name="charting.axisY")numeric(/option) (option name="charting.axisY.minimumNumber")96.00(/option) (option name="charting.axisY.maximumNumber")100.50(/option) (option name="charting.axisY.includeZero")true(/option) (option name="charting.axisLabelsY.integerUnits")false(/option) (option name="charting.axisLabelsY.majorUnit")0.5(/option) This works in*advanced XML:* (Replace the ( ) with < >) These will go under the (module name="HiddenChartFormatter") line in the advanced xml view. (param name="charting.chart")column(/param) (!-- Define Min and Max Range of Y axis --) (param name="charting.axisY")numeric(/param) (param name="charting.axisY.minimumNumber")96.00(/param) (param name="charting.axisY.maximumNumber")100.50(/param) (param name="charting.axisY.includeZero")true(/param) (!-- Define Unit --) (param name="charting.axisLabelsY.integerUnits")false(/param) (param name="charting.axisLabelsY.majorUnit")0.5(/param)

Posts	52
Solutions	2
Karma Given	2
Karma Received	17
Member Since	‎10-21-2010

Online Status	Offline
Date Last Visited	‎06-05-2020 02:02 AM

List of views and roles permitted to the view

Using mean(x) in summary search run every 5 minute...

Calculate w different prices based on cliplevels

Can APPx not read result of scheduled saved search...

Change log on searches/dashboards/macros etc.?

Create monthly report which excludes Saturdays and...

Calculate difference between TIME in host x and TI...

Looks as if user is performing a search when loggi...

Measure availablity in during certain hours during...

Run x number of searches with one click

Re: List of views and roles permitted to the view

List of views and roles permitted to the view

Using mean(x) in summary search run every 5 minute...

Re: Calculate w different prices based on clipleve...

Calculate w different prices based on cliplevels

Re: Can APPx not read result of scheduled saved se...

Can APPx not read result of scheduled saved search...

Re: Change log on searches/dashboards/macros etc.?

Change log on searches/dashboards/macros etc.?

Create monthly report which excludes Saturdays and...

Re: Calculate difference between TIME in host x an...

Calculate difference between TIME in host x and TI...

Looks as if user is performing a search when loggi...

Re: Measure availablity in during certain hours du...

Measure availablity in during certain hours during...

Re: Run x number of searches with one click

Run x number of searches with one click

Not able to give read/write permissin on lookup-...

Module HiddenSavedSearch_1_0_0: Could not find a s...

Re: Using variable in same search

Using variable in same search

Has anybody tried to index NMON files?

Re: How to create an "OK" alert - after an alert h...

How to create an "OK" alert - after an alert has b...

Re: set majorUnit to 0.5 on Yaxis