Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About maxzintel
maxzintel
Path Finder
Member since:
11-09-2018
06-05-2020
Community Statistics
| Posts | 12 |
| Solutions | 0 |
| Karma Given | 3 |
| Karma Received | 3 |
| Member Since | 11-09-2018 |
Activity Feed
- Karma Re: Return date string from a subsearch for somesoni2. 06-05-2020 12:50 AM
- Karma Re: How do you compare 2 multivalued fields from different indices? for martin_mueller. 06-05-2020 12:50 AM
- Karma Re: How do you compare 2 multivalued fields from different indices? for DalJeanis. 06-05-2020 12:50 AM
- Got Karma for Re: How do you compare 2 multivalued fields from different indices?. 06-05-2020 12:50 AM
- Got Karma for Re: How to change the width of panels in xml?. 06-05-2020 12:49 AM
- Got Karma for Re: How to change the width of panels in xml?. 06-05-2020 12:49 AM
- Posted Re: How to change the width of panels in xml? on Dashboards & Visualizations. 02-18-2020 06:41 AM
- Posted Re: How to change the width of panels in xml? on Dashboards & Visualizations. 01-31-2020 08:52 AM
- Posted Re: Return date string from a subsearch on Splunk Search. 04-01-2019 01:51 PM
- Posted Re: Return date string from a subsearch on Splunk Search. 04-01-2019 12:52 PM
- Posted Return date string from a subsearch on Splunk Search. 04-01-2019 09:07 AM
- Tagged Return date string from a subsearch on Splunk Search. 04-01-2019 09:07 AM
- Tagged Return date string from a subsearch on Splunk Search. 04-01-2019 09:07 AM
- Tagged Return date string from a subsearch on Splunk Search. 04-01-2019 09:07 AM
- Tagged Return date string from a subsearch on Splunk Search. 04-01-2019 09:07 AM
- Tagged Return date string from a subsearch on Splunk Search. 04-01-2019 09:07 AM
- Posted Re: How do you compare 2 multivalued fields from different indices? on Splunk Search. 11-13-2018 12:47 PM
- Posted Re: How do you compare 2 multivalued fields from different indices? on Splunk Search. 11-13-2018 12:44 PM
- Posted Re: How do you compare 2 multivalued fields from different indices? on Splunk Search. 11-13-2018 11:54 AM
- Posted Re: How do you compare 2 multivalued fields from different indices? on Splunk Search. 11-13-2018 08:28 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 |
02-18-2020
06:41 AM
@SpeschLOne for some reason I cannot see the end of your comment. However, we found a workaround as well. We had to create a file /opt/splunk/etc/apps/search/appserver/static/{someName}.css . In it we added the custom css required to resize the panels and then referenced that in the form element on line 1 of the XML. After deleting all the ghost panels that aren’t working anymore everything worked as expected.
... View more
01-31-2020
08:52 AM
2 Karma
FYI: It looks like this solution does not work on Splunk 7.3.3. Unsure why yet, will update if I figure it out. We had implemented it previously and it worked as expected, now Splunk seems to ignore the css override and equally spaces the panels anyways.
... View more
04-01-2019
01:51 PM
You are right. Since there were no events in the specified range (earliest=-1d@d latest=@d) I believe I was unable to get any timestamps to run relative_time() against. Thanks a bunch again! This was very helpful.
... View more
04-01-2019
12:52 PM
Works like a charm! Thank you. Any idea why this method works and my original one did not?
... View more
04-01-2019
09:07 AM
Hi all,
I am attempting to rename a column titled 'Yesterday' with yesterday's date. The goal is it would look like this: 'Yesterday (2019-03-31 UTC)'.
My initial solution to this was using a subsearch to output a strftime date that was converting the relative_time Unix timestamp of the end of yesterday. Code:
| rename Yesterday as [search index=example (earliest=-1d@d latest=@d)
| eval endOfYesterday=relative_time(now(), "-1d@d")
| eval endDate=strftime(endOfYesterday, "%Y-%m-%d")
| eval yesterdayFieldName="\"Yesterday (".endDate." UTC)\""
| return $yesterdayFieldName]
As of recently, this was working. Outside of a subsearch/rename, it still outputs the correct values. I haven't altered the search at all since then. The only things I can think of that changed between then and now that are possibly relevant is that we updated from Splunk Enterprise 7.2.1 to 7.2.4, and the US had daylight savings time.
Other potentially relevant info: I can pass an integer through the return (like stats count as num and swapping endDate for num in yesterdayFieldName) and it works. The error message I get is:
Error in 'rename' command: Usage: rename [old_name AS/TO/-> new_name]+.
If anyone has any insight into what may be happening here or workarounds I can try, it would be much appreciated! Thank you in advance.
... View more
11-13-2018
12:47 PM
1 Karma
Thank you very much! This fits well with what Martin was explaining, and the detail, explanation, and example code is much appreciated!
... View more
11-13-2018
12:44 PM
Spot on. I will add in an ID to make the search more effective. Thank you very much for your time and assistance @martin_mueller !
... View more
11-13-2018
11:54 AM
I currently do not have a request ID field that linking the two events together. My thinking was that if I am exclusively plotting the values of each over time, it would show their relationship just as well as creating some sort of link. That being said, it is possible I do not fully understand the value in adding in a request ID field.
How would a request ID field assist in getting the output I am looking for?
... View more
11-13-2018
08:28 AM
So, let's say the application front-end reports latency of 500ms for a given event. An API (with events being logged in B) takes that front-end request and processes it, Splunk logs this as an event and reports the API response_time=50ms. I believe this means that the request spent 450ms (the difference between the 2 values) traveling through proxies and gateways and whatnot. I am trying to run a Linear Regression as a proof of concept against these two values to show they are directly related.
Sample events (only showing relevant fields):
Index A - Front End
11/13/18
11:01:16.000 AM
{
latency: 1189
}
Index B - API
11/13/18
11:00:56.735 AM
{
method: GET
response_length: 9
response_status: 200
response_time: 0
}
So here, these events were produced via the same request. From this, I can tell that the API is not responsible for any of the latency experienced on the front-end (via response_time: 0). Thus, the latency is likely due to the request routing.
... View more
11-13-2018
06:03 AM
In other words, each front-end event that reports network latency should have a correlating event in the API index.
... View more
11-13-2018
06:01 AM
@martin_mueller Sorry for the delayed reply! Index A logs front-end events, Index B logs events from our API's. The latency reported by each should be different but directly related, with their difference being latency caused by the request traversing the internet.
... View more
11-09-2018
01:42 PM
I am attempting to correlate network latency fields from different indices. Basically, I would like to end up with a table with 2 columns, with each column being populated with every recorded value for network latency in each of the indices.
I have tried using subsearches like so:
index=indexA | eval "latencyFromIndexB"=[search index=indexB | return <count> $latencyB]+0 | fields "latencyFromIndexA" "latencyFromIndexB"
But, I have been unable to get multiple values to return from the subsearch in a useful way. Depending on the exact method, latencyFromIndexB either lists a single value or the same value over and over, presumably from the first event it finds.
End result will hopefully look something like this:
latencyA | latencyB
12312 | 545
324 | 2123
etc...
Thank you in advance if you are able to assist me!
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:04 AM
|
