Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About sushmitha_mj
sushmitha_mj
Communicator
Member since:
01-08-2015
03-05-2021
Community Statistics
| Posts | 103 |
| Solutions | 0 |
| Karma Given | 37 |
| Karma Received | 8 |
| Member Since | 01-08-2015 |
Activity Feed
- Posted Re: Passing 3 values to drilldown on Dashboards & Visualizations. 02-22-2021 12:39 PM
- Posted Re: Passing 3 values to drilldown on Dashboards & Visualizations. 02-22-2021 10:45 AM
- Posted Passing 3 values to drilldown on Dashboards & Visualizations. 02-22-2021 06:22 AM
- Karma Re: Unable to pass the correct timevalue for drilldown for bowesmana. 02-17-2021 12:38 PM
- Posted Unable to pass the correct timevalue for drilldown on Dashboards & Visualizations. 02-15-2021 03:51 PM
- Karma Re: How do I write the regex to extract all instances of this field from unstructured data? for sundareshr. 06-05-2020 12:48 AM
- Karma Re: Why am I getting no results found when creating and searching my field lookups? for sundareshr. 06-05-2020 12:48 AM
- Karma Re: Using mvexpand to get multiple fields from XML data, why am I getting incorrect values for a field? for somesoni2. 06-05-2020 12:48 AM
- Karma Re: How to edit my search to match fields from indexed data with a field in a CSV file to output another corresponding field? for sundareshr. 06-05-2020 12:48 AM
- Karma Re: How to edit my search to match fields from indexed data with a field in a CSV file to output another corresponding field? for sundareshr. 06-05-2020 12:48 AM
- Karma Re: How to configure a universal forwarder to monitor a log file in a certain drive on a Windows machine? for skoelpin. 06-05-2020 12:48 AM
- Got Karma for How to configure a universal forwarder to monitor a log file in a certain drive on a Windows machine?. 06-05-2020 12:48 AM
- Got Karma for Re: Drill down cell level does not work. 06-05-2020 12:48 AM
- Karma Re: How to search the most recent value for 2 fields and plot them in a pie chart? for stephane_cyrill. 06-05-2020 12:47 AM
- Karma Re: How to write a search to check the amount of data indexed by my app each day for a certain time range? for lguinn2. 06-05-2020 12:47 AM
- Karma Re: How to search the most recent value for 2 fields and plot them in a pie chart? for Gilberto_Castil. 06-05-2020 12:47 AM
- Karma Re: How to edit my search to filter and populate an input field only with host names with ABC in the value? for gyslainlatsa. 06-05-2020 12:47 AM
- Karma Re: How to edit my search to filter and populate an input field only with host names with ABC in the value? for sideview. 06-05-2020 12:47 AM
- Karma Re: Splunk Dashboard 6.x Examples Source Code: Where do I place or write .js scripts? for stephanefotso. 06-05-2020 12:47 AM
- Karma Re: Splunk Dashboard 6.x Examples Source Code: Where do I place or write .js scripts? for tom_frotscher. 06-05-2020 12:47 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 1 | |||
| 0 | |||
| 0 | |||
| 0 |
02-22-2021
12:39 PM
Oops.. Worked Thanks
... View more
02-22-2021
10:45 AM
Here is the drilldown <drilldown> <set token="Time_Range">$click.value$</set> <set token="host_name">$click.value2$</set> <eval token="e">relative_time($click.value$,"-48h"</eval> <eval token="l">$click.value$</eval> <eval token="Start_Time">strftime($e$,"%Y-%m-%d %H:%M:%S")</eval> <eval token="End_Time">strftime($l$,"%Y-%m-%d %H:%M:%S")</eval> <eval token="user">$row.<fieldname>$</eval> </drilldown> It is working fine without the user token... <eval token="user">$row.<fieldname>$</eval> And when I click... on the parent panel.. only 2 fields are getting selected instead of 3... So I am not sure, how to get 3 parameters passed..
... View more
02-22-2021
06:22 AM
I have a table with 5 columns. Currently, I am passing 2 values First value is in the first column(clickvalue) and second field is in the second column(clickvalue2) . So far it is working fine. When I add another input it does not take the input. It takes the the first column as clickvalue and where ever I click as clickvalue 2, so I an mot able to select the 3 rd input by clicking . I have tried to change the 3 rd input into $row.<fieldname>$ , clickvalue3, but none of this works.
... View more
02-15-2021
03:51 PM
I am passing the timevalue and hostname from table 1 in panel1 to another query/panel in the same dashboard Here is a sample time format : 2021-02-14 19:04:34 I first had the time as column 2 and tries all combinations of eval <eval token>="e">strptime($click.value2$,"%Y-%m-%d %H:%M:%S.%3N")</eval> <eval token="l">strptime($row._time$,"%Y-%m-%d %H:%M:%S.%3N")+1200</eval> When I printed $e$ and $l$ said NaN Then I made it column 1 and used this combination of eval <eval token>="e">$click.value$-600</eval> <eval token>="l">relative_time($click.value$,"+5m")</eval> When I printed $e$ it said 1421 and $l$ said NaN Ideas?
... View more
09-21-2016
10:23 AM
Okay..... the output has the following fields
country_code Branch_name values(type) values(desc) values(server_name)
And the type, desc and server_name fields have 2 values in one row.
The _time field is missing. That is probably why I am not getting one value per row.
... View more
09-21-2016
09:15 AM
Okay...... I checked the field match is perfect.
The location_table_v2.csv has Host_names,Country,Location_Information,number_code
From the indexed data, the fields I am using are _time,server_name,desc,type
If I get a substr of Host_names field in lookup and a substr of server_name field in the indexed data they match.
So, ideally, I just want to add the location_information in addition to the existing fields in each of the rows without affecting the existing output. And the field I would use to match then is the substr(Host_names) and substr(server_name)
The existing query is :
| index="logs" | table _time, server_name, country_code, desc, type
... View more
09-21-2016
08:50 AM
This is my latest query for reference
index="logs" | eval country_code=substr(server_name,1,5) | append [inputlookup location_table_v2.csv | fields Location_Information, Host_names | eval country_code=substr(Host_names,3,5) ] | stats values(Location_Information) as Branch_name, values(type), values(desc), values(server_name) by country_code
... View more
09-21-2016
08:47 AM
I think the problem is there is no _time value in the csv(lookup) so, I am not able to match it. I get the location_info and country code. If I add the other fields it gives me multiple values . That is because, only if I group by time will it give me one entry per server. But if I group by time along with country code then there are no results
Isn't there a simple way of doing this?
For example in SQL if I have 2 tables I can simply use a where to match the common fields and extract different fields from each table. This is exactly the same but I am stuck with it for days...
... View more
09-21-2016
08:46 AM
I think the problem is there is no _time value in the csv(lookup) so, I am not able to match it. I get the location_info and country code. If I add the other fields it gives me multiple values . That is because, only if I group by time will it give me one entry per server. But if I group by time along with country code then there are no results
Isn't there a simple way of doing this?
For example in SQL if I have 2 tables I can simply use a where to match the common fields and extract different fields from each table. This is exactly the same but I am stuck with it for days...
... View more
09-21-2016
06:52 AM
It returns all values in the indexed data but the location_information and country_code rows are empty.
... View more
09-20-2016
01:34 PM
Here is a slightly refined query
index="logs" | eval compare=substr(server_name,1,5) | append [ inputlookup location_table_v2.csv | eval compare=Country.number_code ] | stats first(Location_Information) as Branch_name by compare
This query works but it displays all the rows in the csv.
Here is my parent query /dashboard query
| index="logs" | eval country_code=substr(server_name,1,2) | table _time, server_name, country_code, desc, type
I want to add the location detail to this query.
... View more
09-20-2016
01:34 PM
Here is a slightly refined query
index="logs" | eval compare=substr(server_name,1,5) | append [ inputlookup location_table_v2.csv | eval compare=Country.number_code ] | stats first(Location_Information) as Branch_name by compare
This query works but it displays all the rows in the csv.
Here is my parent query /dashboard query
| index="logs" | eval country_code=substr(server_name,1,2) | table _time, server_name, country_code, desc, type
I want to add the location detail to this query.
... View more
09-20-2016
01:25 PM
Where should I add the rest of the fields I want to see?
... View more
09-20-2016
01:25 PM
Where should I add the rest of the fields I want to see?
... View more
09-20-2016
12:48 PM
I have a set of fields like Servername, type, Country, desc,_time. These fields have been indexed and I already have a dashboard in place displaying these fields.
I now have additional info, which is the location details in a CSV along with Server name. I have uploaded this and I can access this CSV using the command:
| inputlookup location_table_v2.csv
to my existing dashboard which displays Servername, type, Country, desc,_time. I want to add the location details as well. The location detail CSV as well as the indexed data has a common field that is Server name. So I can match the fields in CSV and indexed data using the server name field.
I want my final output to display Servername, type, Country, desc,_time, location_name.
I am using a subsearch for this purpose, but I am not get all the fields in the output. Also, it displays all the rows in the CSV, while it should be restricted to the just the server names shown in my dashboard now.
| index="logs" | eval country_code=substr(server_name,3,3) | append [inputcsv location_table.csv | rename "Host names" as host_name , "Location Information" as Location_Information | eval country_code= substr(host_name, 5,3) ] | stats values(Location_Information) as Location_Information by country_code
I have been trying to get the desired result for a while, but I just get one step closer.
... View more
09-16-2016
01:09 PM
Hey @sundareshr
I have been using the above query, it is working, I wanted to add a couple of more fields to the result set like Server_name, type etc. These fields are present in the indexed data . But when I add those fields the result set is giving me all the fields in the csv and not restricting the result set to the time filter. How can I enhance the query ?
... View more
09-16-2016
01:05 PM
I used this document to create my lookup table and define fields
http://docs.splunk.com/Documentation/Splunk/6.4.3/SearchTutorial/Usefieldlookups
Then I saw how to search on the document below
http://docs.splunk.com/Documentation/Splunk/6.4.3/SearchTutorial/Searchwithfieldlookups
But I get no results found. I went through the steps several times. Why would it be ?
... View more
08-30-2016
06:37 AM
Awesome.. thanks
... View more
08-29-2016
10:43 AM
It actually works 🙂
I also created a lookup table (Just added the csv files as a lookup table). Just curious, how can I extract the same info using the lookup table?
I checked the doc you sent me, but I did not get it.
... View more
08-29-2016
10:21 AM
The CSV does not change. I did not consider using a lookup. Is that the only option. Can I not do it with a simple query connecting the two sources?
... View more
08-29-2016
10:17 AM
I am trying to match the fields countrycode (An eval field extracted from indexed data) with a field "Code" in a CSV file, get the corresponding "branch_name" from the CSV, and display it along with certain fields that are indexed. Here is my current search:
inputcsv sample_csv.csv [ search index="logs" | eval country_code=substr(server_name,3,3) | table country_code ] | eval Branch=if(Code,country_code,Branch_name) | table Branch, ...
But it is not working.
... View more
08-10-2016
10:23 AM
1 Karma
I had row already in my code. But the document helped. It worked. Thanks
... View more
08-10-2016
09:04 AM
I am trying to pass two values from one form to another.
Here is my query :
...| timechart span=1h count by country_code
I want to pass the time value and the individual country code to the drill down dashboard. The time value gets passed but not the country code value. Here is my drill down link
<link>
<![CDATA[/app/Timeout_Reports/time_details?form.country_code=$country_code$&form._earliest=$e$&form._latest=$le$]]>
<option name="dataOverlayMode">none</option>
</link>
On the drilldown dashboard I have a input fieldset for the country code.
<input type="dropdown" token="country_code" searchWhenChanged="true">
<label>Country Code</label>
<search>
<query>... | eval country_code=substr(server_name,1,2) | where country_code=$country_code$ |stats count by country_code </query>
</search>
<fieldForLabel>country_code</fieldForLabel>
<fieldForValue>country_code</fieldForValue>
</input>
I am then passing it to the search query in the drilldown dashboard.
... | eval country_code=substr(server_name,1,2)| where country_code=$country_code$ | table _time, server_name, country_code, desc, type
$form._earliest$
$form._latest$
The time value is passed but not the country code. Not sure what is wrong
... View more
08-05-2016
12:10 PM
It worked... Thank you
... View more
08-05-2016
08:13 AM
1 Karma
Hi,
I have configured a Windows universal forwarder on one of my Windows server. I do not want any of the event logs or performance monitoring on this machine, so I did not select any of that while configuring the universal forwarder.
There is a log file in the c: drive of this Windows machine which I want Splunk to source for me to search. Which inputs.conf file should I edit to configure Splunk to pick the log files? and what changes should I make? This is the first time I am doing the config on a Windows machine.
Thanks
... View more
