Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About sunilsk1
sunilsk1
Path Finder
Member since:
12-30-2012
06-05-2020
Community Statistics
| Posts | 17 |
| Solutions | 0 |
| Karma Given | 8 |
| Karma Received | 2 |
| Member Since | 12-30-2012 |
Activity Feed
- Karma Can I edit the XML source of my dashboard using the paid Splunk Light edition? for twiggle. 06-05-2020 12:47 AM
- Karma Re: How to use two different fields to create a pie chart? for MuS. 06-05-2020 12:47 AM
- Karma Re: How to search for fields with empty values? for ppablo. 06-05-2020 12:47 AM
- Karma Re: Why search with postprocessing returns no results in dashboard, but the actual search does? for dmaislin_splunk. 06-05-2020 12:47 AM
- Got Karma for Re: How to sort data in chronological order by month, not alphabetically?. 06-05-2020 12:47 AM
- Karma Re: increase the size of a chart for infinitiguy. 06-05-2020 12:46 AM
- Karma Re: How to display the count in piechart as labels for peter_krammer. 06-05-2020 12:46 AM
- Got Karma for Re: Remove Search query from the email Alert. 06-05-2020 12:46 AM
- Karma Remove query from Emails for Hazel. 06-05-2020 12:45 AM
- Posted Re: How to get the field name of the maximum value of several fields? on Splunk Search. 10-05-2018 01:35 PM
- Posted Re: How to sort data in chronological order by month, not alphabetically? on Splunk Search. 09-28-2018 10:18 PM
- Posted Re: Splunk install on MacOS is not working on Installation. 07-13-2018 05:39 AM
- Posted Re: Subtracting two timestamps on Splunk Search. 07-12-2018 10:24 AM
- Posted Re: How to tell the sort command to sort by numerical order instead of lexigraphical? on Splunk Search. 05-07-2016 10:36 PM
- Posted Re: Why search with postprocessing returns no results in dashboard, but the actual search does? on All Apps and Add-ons. 12-10-2015 08:21 AM
- Posted Re: Can I edit the XML source of my dashboard using the paid Splunk Light edition? on Dashboards & Visualizations. 08-28-2015 01:42 PM
- Posted Re: Can I edit the XML source of my dashboard using the paid Splunk Light edition? on Dashboards & Visualizations. 08-28-2015 01:42 PM
- Posted Re: Can I edit the XML source of my dashboard using the paid Splunk Light edition? on Dashboards & Visualizations. 08-28-2015 10:35 AM
- Posted Sendemail using Python SDK on Splunk Dev. 08-27-2013 11:32 AM
- Tagged Sendemail using Python SDK on Splunk Dev. 08-27-2013 11:32 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 |
10-05-2018
01:35 PM
After sorting . pipe the result to "|head 1" to display just the one row you are interested in.
... View more
09-28-2018
10:18 PM
1 Karma
The following converts the month into Y-m format and the numerical sorting helps out.
base search |convert ctime(_time) as Time timeformat=%Y-%m|chart avg(yourfield) over Time by some_other_field|sort Time
... View more
07-13-2018
05:39 AM
Thanks a LOT ! . this Solved for me as well ! !
Adding a little detailed step :
1. Navigate to the directory of your splunk installation cd /Applications/Splunk/lib
2. ln -hfs /usr/lib/libz.1.dylib /Applications/Splunk/lib/libz.1.dylib
3. vi /Applications/Splunk/etc/splunk-launch.conf
4. add the line OPTIMISTIC_ABOUT_FILE_LOCKING = 1
... View more
07-12-2018
10:24 AM
It still not working for . i have this sample log entry where boot-time for each machine in ENV are reported
I have 2016-05,ENV,R1,W,05/25/16 21:00:00.000,05/26/16 02:00:00.000,05/25/16 23:09:00.000,05/26/16 05:12:00.000,183
Where my "Scheduled End Time" : 05/26/16 02:00:00.000
"Actual End Time" : 05/26/18 05:12:00.000
I wanted the difference in minutes between Actual End Time and Scheduled End time. (192 minutes)
I have tried this approach
{search}|eval ac_end='Actual End Time'|convert mktime(ac_end) as ac_time timeformat="%Y-%m-%d %H:%M:%S"
... View more
05-07-2016
10:36 PM
I was able to use the convert num(string) which converts the given value to a number and then use the sort command on this
somesearch that generates the stats name ,myEventCount |convert num(myEventCount) as nummyEventCount|sort -nummyEventCount|table name nummyEventCount
... View more
12-10-2015
08:21 AM
I had a similar issue with my post process searches in my dashboard. I piped the "|fields *" and it helped . the dashboard showed the charts.. thanks
My xml was getting truncated in this textbox so i have uploaded an image.
... View more
08-28-2015
01:42 PM
So this means the Splunk light does not have an xml editor for dashboards ?
I suppose there should be a folder within the splunk light setup where the xml gets stored. Can you please this location where i can edit the xml ?
... View more
08-28-2015
01:42 PM
So this means the Splunk light does not have an xml editor for dashboards ?
I suppose there should be a folder within the splunk light setup where the xml gets stored. Can you please this location where i can edit the xml ?
... View more
08-28-2015
10:35 AM
Is it available in the enterprise version ?
Is there a way I can backup these dashboards so that I can share it with others(outside org ).?
... View more
08-27-2013
11:32 AM
I am trying to run the following search using Splunk python sdk. It returns the results but does not send the EMAIL as it does if i run the same search using the Splunk UI.
searchquery_normal = 'search * earliest="8/26/2013:23:40:00" latest="8/26/2013:23:55:00" index=os host=* sourcetype=cpu | lookup chipot fqdn as host | search application_name="New App*" AND physical_environment_name="Production*" AND state="LIVE"| multikv fields pctUser,pctSystem,pctIowait,pctIdle,application_name | search all |eval cpu=100-pctIdle|stats avg(cpu) by host,application_name|rename avg(cpu) as cpualert|where cpualert >20|sort "application_name"|sendemail to="myemailid@domain.com" format=html subject=ALERT_CPU_sentfromPython sendresults=true'
... View more
08-26-2013
10:38 AM
1 Karma
Instead of making any changes to the python script. you can use the following if you need an email everytime the search is executed.
You can disable the Email alert(uncheck the checkbox for Email) and add the following to your Splunk search query -
|sendemail to=" @mailid.com" format=html subject=myresults server=mail.splunk.com sendresults=true
if it throws any error then remove the server info from the search : |sendemail to=" @mailid.com" format=html subject=myresults sendresults=true
If the alert condition is met then the
... View more
08-25-2013
11:58 PM
I have scheduled a email alert and the complete result along with Search query is sent to all my Users.
Is there way that I can send only the Search results and hide the Query and all other log details.
... View more
08-25-2013
11:56 PM
the next issue , I have scheduled the alert and the complete result along with Search query is sent to all my Users.
Is there way that I can send only the Search results and hide the Query and all other log details.
... View more
08-25-2013
11:56 PM
the next issue , I have scheduled the alert and the complete result along with Search query is sent to all my Users.
Is there way that I can send only the Search results and hide the Query and all other log details.
... View more
08-25-2013
11:54 PM
thanks all for yours answer.
This thing worked for me by piping the data out -->
|rename avg(cpu) as cpualert|where cpualert >35
Here's the complete query that worked for me -
index=os host=* sourcetype=cpu | lookup chipotl fqdn as host | search application_name="New apps*" AND physical_environment_name="System T*" AND state="LIVE"| multikv fields pctUser,pctSystem,pctIowait,pctIdle,application_name | search all |sort "Sort" |eval cpu=100-pctIdle|stats avg(cpu) by host,application_name|rename avg(cpu) as cpualert|where cpualert >35
... View more
08-24-2013
11:23 PM
index=os host=* sourcetype=cpu | lookup chipotl fqdn as host | search application_name="New Apps*" AND physical_environment_name="SystemTestWest" AND state="LIVE"| multikv fields pctUser,pctSystem,pctIowait,pctIdle,application_name | search all |sort "Sort" |eval Percent_CPU_Load=100-pctIdle| eval application=application_name |stats avg(Percent_CPU_Load) by host,application_name | where Percent_CPU_Load > 10
I want the results where the CPU is more then 10% . The above Query isn't returning any result Set.
... View more
- Tags:
- cpu
08-24-2013
11:19 PM
Did this work for you ?
I tried the same but do not see any results
... View more
