Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- Find Answers
- :
- About emaccaferri
emaccaferri
Communicator
Member since:
07-11-2013
06-05-2020
Community Statistics
| Posts | 43 |
| Solutions | 2 |
| Karma Given | 4 |
| Karma Received | 9 |
| Member Since | 07-11-2013 |
Activity Feed
- Got Karma for Re: Lookup error: Could not find all of the specified lookup fields. 02-05-2024 05:42 AM
- Karma Re: Timestamp separeted by many field/character for grijhwani. 06-05-2020 12:46 AM
- Karma Re: Distinguish between space and tab - REGEX for Ayn. 06-05-2020 12:46 AM
- Karma Re: Distinguish between space and tab - REGEX for alacercogitatus. 06-05-2020 12:46 AM
- Karma Re: Attempt to setup splundj - Error for alacercogitatus. 06-05-2020 12:46 AM
- Got Karma for Re: Adding one more field to a sub-search.. 06-05-2020 12:46 AM
- Got Karma for Re: why transaction does not create mv-fields?. 06-05-2020 12:46 AM
- Got Karma for Re: why transaction does not create mv-fields?. 06-05-2020 12:46 AM
- Got Karma for Re: get the unique count from the list of numbers. 06-05-2020 12:46 AM
- Got Karma for Re: What type of Splunk license do I have. 06-05-2020 12:46 AM
- Got Karma for Re: Lookup error: Could not find all of the specified lookup fields. 06-05-2020 12:46 AM
- Got Karma for Re: Convert to Timechart. 06-05-2020 12:46 AM
- Got Karma for How to assign each event a fields value extracted from another event. 06-05-2020 12:46 AM
- Posted Re: How can I use the output from a previous search to use as a time range on my next search? on Splunk Search. 12-17-2015 06:53 AM
- Posted Re: Logs Not Being Indexed on Getting Data In. 02-27-2014 06:28 AM
- Posted Re: Results desappearing at finalizing time on Splunk Search. 02-24-2014 02:08 AM
- Posted Results desappearing at finalizing time on Splunk Search. 02-24-2014 12:50 AM
- Posted Re: How to assign each event a fields value extracted from another event on Splunk Search. 02-24-2014 12:46 AM
- Posted How to assign each event a fields value extracted from another event on Splunk Search. 02-19-2014 07:09 AM
- Tagged How to assign each event a fields value extracted from another event on Splunk Search. 02-19-2014 07:09 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 1 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
12-17-2015
06:53 AM
I think you could use your search that identifies the end_time as in this example http://docs.splunk.com/Documentation/Splunk/6.1.2/SearchTutorial/Useasubsearch
... View more
02-27-2014
06:28 AM
Did you have set the sourcetype and the index when you configured Splunk?
Did you edited your local copy of props.conf and trasform.conf?
... View more
02-24-2014
02:08 AM
wich kind of detailed information do you need?
I knew how transaction works, but what's splunk problem to eventually makes a 3 months transaction?
The query is not wrong in syntax, for a single day o few more I get what I need.
... View more
02-24-2014
12:50 AM
Hi!
I'm using this search to calculate the exit rate of each page visited on a web site, count how many time a page was view and count how many time a page is the exit page:
...| where isnotnull(pagename) | eventstats count as visits by pagename | eval cookie=visid_high.visid_low.visit_num | transaction mvlist=t cookie | eval lastpage=mvindex(pagename,-1) | eventstats count as exits by lastpage | table pagename visits lastpage exits | where match(lastpage, pagename) |dedup pagename | eval exit_rate=exits/visits*100
Why this search finds results if I choose a period of 2 days or so, but for 3 months it answers No results found?
The job inspector puts in yellow
| table pagename visits lastpage exits | where match(lastpage, pagename) |dedup pagename | eval exit_rate=exits/visits*100
Thanks
Erica
... View more
02-24-2014
12:46 AM
Thank you, but I wasn't asking how to use lookup, but efficient ways or ideas to how solve my problem
... View more
02-19-2014
07:09 AM
1 Karma
Hi,
I need your help to understand which road to test.
I have raw events like this
11/02/2013 sessionID1 fields1 fields2 ...
11/02/2013 sessionID2 fields1 fields2 ...
and some other event instead
14/02/2013 sessionID1 fields3 field4 userID1 ...
17/02/2013 sessionID2 fields1 fields2 UserID1 ...
userID is populated only when a certain event occurs.
I would like to add the userID also to the event without it, to be albe to identify every action made by each user (in this way I can use transaction on userID).
11/02/2013 sessionID1 fields1 fields2 userID1...
11/02/2013 sessionID2 fields1 fields2 userID1...
14/02/2013 sessionID1 fields3 field4 userID1 ...
17/02/2013 sessionID2 fields1 fields2 userID1 ...
I was thinking to create, somehow outside Splunk, a lookup table with every sessionID connected with its userID.
Any idea to do somethink like this using only Splunk?
Thanks a lot for any suggestion
... View more
- Tags:
- lookup
- transaction
02-18-2014
06:36 AM
Using the drilldown options you can connect to dashboard. You can find a lot of documentation to start, for example see here
http://docs.splunk.com/Documentation/Splunk/latest/Viz/Dynamicdrilldownindashboardsandforms
... View more
02-18-2014
06:22 AM
try
(host=A AND "ER"=XXW) OR (host=B AND "EMPCODE"=ABC AND ) | eventstats sum(field)total ,count("user") as Count|eval Average=total /Count| timechart span=1h Average
or
(host=A AND "ER"=XXW) OR (host=B AND "EMPCODE"=ABC AND ) | timechart span=1h eval(sum(field)/count("user")) as Average
... View more
02-18-2014
03:24 AM
1 Karma
You should change stats in eventstats, in this way you keep _time fild along the search. After that you can use timechart, you can also use math inline with it
timechart span=1h eval(total/Count) as Average.
... View more
01-07-2014
09:01 AM
See this conversation, the file you havo to delete or edit after the first attempt of path is .splunkhome
http://answers.splunk.com/answers/117569/attempt-to-setup-splundj-error
... View more
01-07-2014
08:48 AM
After using alacercogitatus suggestion, I couldn't figured out wich was the right path. Maybe will be usefull to other:
$SPLUNK_HOME is the directory into which you installed Splunk (on windows $SPLUNK_HOME defaults to "\Program Files\Splunk")
so the path Splunk expected was \Program Files\Splunk, with no C:\
... View more
01-07-2014
07:21 AM
to exctract field, are you using automated key-value exctraction or you wrote a trasformation?
... View more
01-07-2014
07:13 AM
Hi everyone,
I followed the Web Framework guide and used the command (on windows)
splunkdj setup
The setup process asks you to specify where Splunk is installed, I specified a path. I thought it was the right one, but instead it sais that the path doesn't exist.
The problem is that now I have no idea how to fix the error. Every time I rerun the
splunkdj setup
Splunk doesn't ask me for a path, but it immediately warns about the non existing path.
Any help?
Thank you all.
... View more
01-03-2014
07:22 AM
That's the file:
{
"debug": false,
"mount": "dj",
"node": "C:\Program Files\Splunk\bin\node.exe",
"proxy_path": "/en-US/splunkd/__raw",
"proxy_port": 0,
"python": "C:\Program Files\Splunk\bin\python.exe",
...
}
what should I correct?
I at first delated it, but no luck, same error and quastion asked
... View more
01-03-2014
07:03 AM
I can't, every time I rerun I get the error, without the process asking me the question
... View more
01-03-2014
06:21 AM
Hi everyone,
I followed the Web Framework guide to enable it.
The setup process asks you to specify where Splunk is installed,
I specified a path. I thought it was the right one, but instead it sais that the path oesn't exist.
The problem is that I can't find a way to fix the path, it seems setted and now, even after a reboot, the setup doesn't ask me for it and gives the error.
Any idea?
Thank you.
... View more
01-03-2014
06:09 AM
I suggest also to add the path to setup the web framework. Taht's not very clear
... View more
11-08-2013
06:39 AM
Hi!
I would like to know how the correlation percentage between fields is obtained and so on.
Is it possible?
I know that I can read the Python script of some commend like X11, but I couldn't find Correlate.
Thank you,
Erica
... View more
10-18-2013
12:25 AM
Yes, it was working, but testing on the same file I had to cancel all the index and the data
... View more
10-16-2013
08:43 AM
1 Karma
You can check inside the Splunk windows in Licensing, in Splunk 6 it's under Options in the Splunk Bar, while in the previous version of Splunk it's in the Manager.
Or with a text editor you can open a file the folder \Splunk\etc\licences ...(this depend to your installation).
... View more
10-15-2013
08:54 AM
Hi,
I'm trying to not have in my events the header of a txt file separated by tab (I suppose it's at index time), after that I extract field at search time. The problem is that everything I tried left the header in the event.
Any key?
Here my code in props.conf and transfomrs.conf:
props.conf
[mysourcetype]
NO_BINARY_CHECK = 1
pulldown_type = 1
TRANSFORMS-NoHeader = NoHeader
REPORT -mysourcetypeextract = extract_mysourcetype
transforms.conf
[extract_mysourcetype]
DELIMS = "\t"
FIELDS = personid, email, createdate, time_window_web
[NoHeader]
REGEX = ^"Personid".*
DEST_KEY = queue
FORMAT = nullQueue
and the first lines of my log file
"Personid" "Email" "Createdate" "Time Window Web"
"0000000" "[email protected]" "00/00/1900" "00:00"
I really don't know what to do, I've tried all the answer on the site 🙂
Thank you for the help
Erica
... View more
10-14-2013
12:03 AM
1 Karma
Hi,
Something like
stats count(Numbers) as Times by Numbers
gets you what you were looking for?
... View more
