Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- Find Answers
- :
- About Anantha123
Anantha123
Communicator
Member since:
10-12-2018
04-23-2024
Community Statistics
| Posts | 79 |
| Solutions | 7 |
| Karma Given | 1 |
| Karma Received | 10 |
| Member Since | 10-12-2018 |
Activity Feed
- Posted Re: How to calculate size of Index on Splunk Search. 04-23-2024 07:03 AM
- Posted How to reindex a small file? on Splunk Enterprise. 09-20-2023 08:00 AM
- Tagged How to reindex a small file? on Splunk Enterprise. 09-20-2023 08:00 AM
- Tagged How to reindex a small file? on Splunk Enterprise. 09-20-2023 08:00 AM
- Posted How to calculate size of Index on Splunk Search. 09-17-2023 08:48 PM
- Tagged How to calculate size of Index on Splunk Search. 09-17-2023 08:48 PM
- Tagged How to calculate size of Index on Splunk Search. 09-17-2023 08:48 PM
- Tagged How to calculate size of Index on Splunk Search. 09-17-2023 08:48 PM
- Posted How to check continuous increase of values of a field. on Splunk Search. 09-17-2023 08:14 PM
- Tagged How to check continuous increase of values of a field. on Splunk Search. 09-17-2023 08:14 PM
- Got Karma for Re: Alert is not displayed under "Alerts". 11-09-2022 01:05 AM
- Got Karma for Re: Construct map command query in eval statement. 08-08-2022 10:20 AM
- Karma Re: How to write good SPL syntax for efavreau. 06-05-2020 12:51 AM
- Got Karma for Re: How to sort by date for date field that is not the timestamp?. 06-05-2020 12:51 AM
- Got Karma for Re: Does "Lookup Editor app" captures "Lookup Definitions" that we define for Lookup file in settings?. 06-05-2020 12:50 AM
- Got Karma for Re: Splunk User Role: How to choose a particular app as default when I login?. 06-05-2020 12:50 AM
- Got Karma for Re: How to count stats by grouping substring from an URI. 06-05-2020 12:50 AM
- Got Karma for Re: Alert is not displayed under "Alerts". 06-05-2020 12:50 AM
- Got Karma for Re: Multi Field values into Single field value. 06-05-2020 12:50 AM
- Got Karma for Re: Timechart for a span=2hrs not splitting from 00:00. 06-05-2020 12:50 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
09-20-2023
08:00 AM
Hi All,
My file is not reindexing though I used below settings in my inputs configuration file . File is very small (300 char) and wont change often, want file to reindex daily . Kindly help .
crcSalt = <SOURCE> initCrcLength = 256
... View more
Labels
- Labels:
-
using Splunk Enterprise
09-17-2023
08:48 PM
what are the different ways to calculate size of one index ? looking for solutions other than "licence_usage.log". Appreciate your help. Thank you.
... View more
09-17-2023
08:14 PM
Please help me on how I can check if the field value is continuously increasing for 3 hours. tried below query but does not help . Perc_change values are extracted from logs , whereas prev_change and growing are calculated form perc_change values. | streamstats current=f window=1 latest(perc_change) as prev_value | fillnull value=0 | eval growing = if(perc_change< prev_value,1,0) | table _time GB change perc_change prev_value growing getting values as perc_change prev_value growing 60 0 0 35 60 1 33 35 1 150 33 0 expectations : perc_change prev_value growing 60 35 1 35 33 1 33 150 0 150 0 0 I have to send a report if the perc_change values are continuously growing for 3 hours Appreciate your help . Thank you.
... View more
- Tags:
- streamstats
01-23-2020
09:01 AM
Hi,
Try this
index=_audit user!="splunk-system-user" user!="N/A" user=* host=* NOT (action=log* info=fail*) | chart dc(user) as "Splunkers" by user , date_wday
Thanks
Anantha
... View more
01-22-2020
12:19 PM
Try this
| rex field=AbsoluteUri "https://\w+.\w+\w/\w+/(?<uri>[^(\/)|(\s)]+)" | table uri
... View more
01-22-2020
12:02 PM
check the below link
https://answers.splunk.com/answers/134553/how-to-delete-data-index-reset-start-from-scratch.html
Hope this helps.
Thanks
Anantha.
... View more
01-22-2020
08:33 AM
Please try with below code
| rex field=Opened "(?[^\s]+)"
| eval "FTime"=strptime(opdate,"%Y-%m-%d")
| table FTime opdate _time
| rename _time as LTime
| eval duration = round((LTime-FTime)/86400)
| table duration
Hope this works
... View more
01-21-2020
10:46 AM
try this
| rename Opened as InTime | eval "FirstAuth"= strftime((InTime ),"%d.%m.%y")
| rename _time as OutTime | eval "LastAuth"= strftime((OutTime ),"%d.%m.%y")
|eval Lastloginduration = round((LastAuth-FirstAuth)/86400)
|table Lastloginduration
... View more
01-16-2020
09:32 AM
1 Karma
try this
| inputlookup AND value=x
…..
| search creationDate="1/*/2020"
this should list all values in lookuptable for all Jan Month.
... View more
12-19-2019
08:38 AM
1 Karma
try giving double $ sign . passed variables should be in $$ sign.
| map search="search [| makeresults | eval evaltest="$$test$$" | return $evaltest]"
... View more
12-12-2019
08:44 AM
Hi,
you have to use "Last seen" for rest of your query and you are evaluating and assigning _time value to this variable
give |sort - "Last seen" | fields - "Last seen" .
Thanks
Anantha.
... View more
12-10-2019
09:44 AM
Hi ,
try this
base query| spath | stats count(**documentType) as DocType, values(**reference) as Reference , values(**name) as Name by **msg| rex field=**msg "Filtered\sstatements\sfor\saccount\s(?P<AccountNo>[^\:]+)" | search DocType > 1 | table AccountNo , Name, Reference, DocType .
Here when we use spath , fields are automatically extracted . Choose the right field name that is under interesting fileds and put in above query and try .
Thanks
Anantha.
... View more
12-10-2019
09:26 AM
@skoelpin : My syntax is not wrong. May be it did not worked in this scenario .It did work for me when I had to take the time difference.
when you assign time to a variable , it is automatically converts to epoch format. I believed Gravi was assigning different _time's to Time1 and Time2 variable.
Thanks
Anantha.
... View more
12-09-2019
11:11 AM
Hi,
Try this once
Let the time be in %H instead of %I format . then
| eval Duration = tostring((Time2 - Time1), "duration") | table Duration .
Thanks
Anantha.
... View more
12-05-2019
10:35 AM
try this
basequery | spath |
you will have all fields from Json expanded . Use the proper field that represents failed , proccessd and succeed from the extracted fields .
Thanks
Anantha.
... View more
11-21-2019
09:16 AM
try this
base search|spath "body.totalTime" | eval body.seconds=body.totalTime*1000 | eval body.minutes=body.seconds*60
|table body.totalTime, body.seconds, body.minutes
... View more
11-19-2019
10:52 AM
1 Karma
Hi,
To combine all fields in to 1 , you can try below query
| eval output=(mvappend(field1, field2, field3, field4, field5, field6, field7, field8, field9, field10)) | mvexpand output | dedup output | table output
... View more
11-19-2019
10:36 AM
1 Karma
Hi Try this
| rex field=_raw "error\smessage\s(?P<ErrorMessage>.*)\s:\smessage\s" | table ErrorMessage
... View more
11-08-2019
11:15 AM
Hi,
Try this
|rex field=_raw \,(?P<Date>[^\s]+) (?P<Time>[^\s]+) | table Date Time
Regards,
Anantha.
... View more
11-08-2019
11:09 AM
Hi,
sorry cant understand Chinese. but can say that the results will be shown 3rd(Statistics) and 4th(Visualisation) tabs.
If you are in "Fast mode" , then you cannot see events . If you want to see the events you have to change to "Verbose Mode".
Hope this helps.
Thanks
Anantha.
... View more
11-08-2019
08:47 AM
Thanks Gaurav . This worked. Actly I aslo tried the same code to initiate the token but was trying to get the value from same Panel. This has to be obtained by different panel (hidden as you mentioned) . Thanks for the help. Wish we had a solution to get token value from same panel .
Thanks
Anantha.
... View more
11-06-2019
07:45 PM
I tried this, but getting "$result.devAppC$" as a result but not value.
... View more
11-05-2019
09:46 AM
Hi All,
I have a requirement, where I need to show Query Result displayed to Panel Title.
index=foo
|timechart count as devAppCount
| eval devAppC=10*devAppCount
| table devAppC
Now I want to show the result of devAppC to Panel Title in UI.
Please help me.
Thanks
Anantha.
... View more
- Tags:
- splunk-cloud
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
04-23-2024
10:49 AM
|
Karma from
