About renjith_nair

renjith_nair

Try including the _time as well in your search Either using timechart or by _time bucket index=_internal source=*license_usage.log* type=Usage idx=*| eval GB=b/1024/1024/1024 |timchart span=1d sum(gb) by st or index=_internal source=*license_usage.log* type=Usage idx=*| eval GB=b/1024/1024/1024 |bin _time span=1d | stats sum(GB) by _time,st

renjith_nair · ‎02-09-2023

There could be multiple reasons including the connectivity , timestamp, field extraction , filtering etc. You may start with this documentation would find some common issues https://docs.splunk.com/Documentation/Splunk/9.0.3/Troubleshooting/Cantfinddata

renjith_nair · ‎10-14-2022

Hi @cheanaydoo , It's possible. Please find below a sample Cluster 1 { "name": "cluster1", "clustername": "cluster1_name", "version": "v123" } Cluster 2 { "name": "cluster2", "clustername": "cluster2_name", "version": "v321" } Search index="api" sourcetype="_json" | stats latest(version) as version by name,clustername | stats first(version) as version1,last(version) as version2 | eval result=if(version1 == version2,"yes","no") Output When you compare the result, it should be based on a parameter such as common keys, timestamp etc. In the above example, we compared based on time stamp, i.e. takes the latest from both outputs and compared them.

renjith_nair · ‎07-28-2022

Probably, you can start from https://docs.splunk.com/Documentation/Splunk/latest/SearchTutorial/GetthetutorialdataintoSplunk Also there free courses https://www.splunk.com/en_us/training.html?301=%2Fen_us%2Ftraining%2Fcourses.html&filters=filterGroup1FreeCourses Start practising from above and use our community forum to get more insights 🙂

renjith_nair · ‎07-28-2022

It's worth to check your email server settings and make sure they are valid servers Server settings » Email settings https://docs.splunk.com/Documentation/Splunk/9.0.0/Alert/Emailnotification

renjith_nair · ‎07-09-2022

you may use |eval duration=tostring(uptime,"duration") Reference : Conversion functions

renjith_nair · ‎06-17-2022

You may try index=myindex (search1 terms OR search2 terms) |table App,Size,Count|addcoltotals

renjith_nair · ‎06-11-2022

You have included both set and unset in the drill down and that might be the reason. Assuming that you have another detailed panel which is visible only when you click on the single value panel, try below run anywhere example <form> <label>test</label> <fieldset submitButton="false"> <input type="time" token="time_token2"> <label></label> <default> <earliest>-15m</earliest> <latest>now</latest> </default> </input> </fieldset> <row> <panel> <input type="checkbox" token="hide_details"> <label></label> <choice value="hide">Hide Details</choice> <change> <condition value="hide"> <unset token="hide_details"></unset> </condition> </change> <delimiter> </delimiter> </input> <single> <search> <query>index=_internal|stats count</query> <earliest>$time_token2.earliest$</earliest> <latest>$time_token2.latest$</latest> </search> <option name="drilldown">all</option> <option name="refresh.display">progressbar</option> <drilldown> <set token="form.hide_details">true</set> </drilldown> </single> </panel> </row> <row> <panel depends="$hide_details$"> <table> <search> <query>index=_internal|stats count by sourcetype</query> <earliest>$time_token2.earliest$</earliest> <latest>$time_token2.latest$</latest> </search> <option name="drilldown">none</option> <option name="refresh.display">progressbar</option> </table> </panel> </row> </form>

renjith_nair · ‎05-02-2022

The error mentioned shouldnt be the reason for missing the data. There could be multiple reasons and close look into the splunkd log should give you some hints. Please refer to this documentation for generic reasons https://docs.splunk.com/Documentation/Splunk/8.2.6/Troubleshooting/Cantfinddata

renjith_nair · ‎04-20-2022

Try the search without the "search" keyword. ie. 'search=|rest /servicesNS/-/-/saved/searches/ splunk_server=local ...

renjith_nair · ‎04-20-2022

It would be really helpful if you could provide more details like sample events etc to formulate a search. In general Define the off business hours Search for logged in events Create alerts for the events which falls in the time frame defined For e.g. if you are off business hours are between 6PM to 8AM, then select the time range between these time limit and search for the logged in events

renjith_nair · ‎11-24-2021

You can combine using another eval for group. For e.g index=A sourcetype=Server | fillnull value="" | eval OS=case(like(Operating_System,"%Windows%"),"Windows",like(Operating_System,"%Linux%"),"Linux",like(Operating_System,"%Missing%"),"Others",like(Operating_System,"%Solaris%"),"Solaris",like(Operating_System,"%AIX%"),"AIX",1=1,"Others") | eval Environment=case(like(Environment,"%Prod%"),"Prod",like(Environment,"%Production%"),"Prod",1=1,Environment) | search (Environment="PSE" OR Environment="Prod") AND Eligibility="Upper" AND Status="Installed" | eval group = case(OS="Windows","Windows",OS="Linux" OR OS="Solaris","Unix Server",1=1,"Unknown") | stats count by group

renjith_nair · ‎10-20-2021

Yes, try this Threshold values are set in input for demonstration. It could be replaced with other search based tokens as well <form> <label>Color Palette Token</label> <fieldset submitButton="false"> <input type="dropdown" token="threshold" searchWhenChanged="true"> <label>Threshold</label> <choice value="100">100</choice> <choice value="200">200</choice> <choice value="300">300</choice> <choice value="500">500</choice> <choice value="800">800</choice> <choice value="1000">1000</choice> <default>100</default> <initialValue>100</initialValue> </input> </fieldset> <row> <panel> <title>$threshold$</title> <table> <search> <query>| makeresults count=10|eval threshold=$threshold$ | eval value=(random() % 1000) + 1</query> <earliest>-15m</earliest> <latest>now</latest> </search> <option name="drilldown">none</option> <option name="refresh.display">progressbar</option> <format type="color" field="value"> <colorPalette type="expression">if(value > $threshold$, "#DC4E41", "#53A051")</colorPalette> </format> </table> </panel> </row> </form>

renjith_nair · ‎10-19-2021

You can set the scaling threshold directly in the table visualization. Try this run anywhere example and see if it fits. <dashboard> <label>Color Palette Token</label> <row> <panel> <table> <search> <query>| makeresults count=10 | eval value=(random() % 1000) + 1</query> <earliest>-15m</earliest> <latest>now</latest> </search> <option name="drilldown">none</option> <option name="refresh.display">progressbar</option> <format type="color" field="value"> <colorPalette type="list">[#53A051,#DC4E41]</colorPalette> <scale type="threshold">100</scale> </format> </table> </panel> </row> </dashboard>

renjith_nair · ‎09-02-2021

Try index="stage*" source="*record service*" | eval type=case(like(message, "%successful generated account%"),"Success Accounts", like(message, "%Granting failed Accounts%"),"Granting failed Accounts", like(message, "%Inbound setup failed accounts%"),"Inbound failed Accounts") |stats count as Results by type |append [|stats count as Results|eval type="Success Accounts,Granting failed Accounts,Inbound failed Accounts"|makemv type delim=","|mvexpand type] |stats sum(Results) by type

Posts	2440
Solutions	633
Karma Given	50
Karma Received	912
Member Since	‎01-08-2015

Online Status	Online
Date Last Visited	an hour ago

Why all indexes are not available to select from "...

What are the reasons for buckets with name duplica...

Re: sourcetypes size trend

Re: Events not shown in Splunk

Re: API request and comparison

Re: Are there Splunk Beginner walkthrough exercise...

Re: Why can't I send emails via alerting?

Re: Help needed with eval expression

Re: Merge two query resultsets

Re: Why do I have to click on the data twice for h...

Re: Getting data in

Re: Error while using the |rest in the splunk rest...

Re: How to put query to trigger alert if user acco...

Re: how to differentiate single sourcetype based o...

Re: How to use a variable in colorpalette expressi...

Re: How to use a variable in colorpalette expressi...

Re: Zero count not displaying when stats count is ...