About abhijitp

abhijitp · ‎06-15-2017

I am not able to differentiate the two gps lat long series as shown above in the suggested geostats by option. I don't know how to do it.

abhijitp · ‎06-14-2017

My guess is Splunk can only plot one gps lat long series using geostats in a single query. I tried combing a subquery with another geostats but Splunk did not like it.

abhijitp · ‎06-09-2017

Ok. I have extracted these GPS lat log for various equipments and they are available as : Equipment1 - QueriedLatitude and QueriedLongitude Equipment2 - MatchedLatitude and MatchedLongitude Sample log line: 32.88718,-117.17383,0,0.0,312,32.88718,-117.17383,off road,0,0.0,derived,0,0.0,0,0,null,1.0,2.9 which translates to QueriedLatitude,QueriedLongitude,0,0.0,312,MatchedLatitude,MatchedLongitude,off road,0,0.0,derived,0,0.0,0,0,null,1.0,2.9 geostats allows only one instance of latfield and longfield.

abhijitp · ‎06-08-2017

Thanks somesoni2. my query is sourcetype=geo | geostats count latfield=QueriedLatitude longfield=QueriedLongitude maxzoomlevel=18

abhijitp · ‎06-08-2017

Hi, I need to plot 3 gps lat long series on the same Map in Splunk. eg. FIrst series will be say Equipment A reported GPS Lat Long Second series will be say Equipment B reported GPS Lat long I looked at geostats and it does not mention about multiple gps lat long series capabilities. i tried and it did not like it. I am not really stuck on geostats. Any method to plot multiple (say max upto 4) on the same Map in Splunk is what I looking at? Kindly point me and confirm my assumptions either way : a) Splunk can only plot one gps series and that it b) The way to plot multiple gps series is ..... Thanks a lot, Abhi

abhijitp · ‎06-06-2017

I was able to get down to count=1 for most of the cases. Sometimes it still shows more than 1. This is how i did it. sourcetype=geo | geostats count latfield=QueriedLatitude longfield=QueriedLongitude maxzoomlevel=18 It worked pretty closely for what i am trying to do.

abhijitp · ‎06-05-2017

I am on Splunk 6.4 I need to plot each and every gps lat long in a dashboard without any filtering or clustering. My search query is -> sourcetype=geo | geostats count latfield=QueriedLatitude longfield=QueriedLongitude binspanlat=1 binspanlong=1 in other words, when i see the individual points, i should see count as 1 and not a bigger number. I have screenshots handy but cannot upload them. i have tried these settings also with no success: max clusters = 999 also, this happens to be a very short data set. ideally i would like to plot individual gps points for a data set of multiple magnitudes bigger. I am not sure if it is possible in Splunk. Please help. Thanks, Abhi

abhijitp · ‎05-06-2016

Thanks for your help. I need a way for the lookup table which is stored in a csv file to go back in time more than the actual search to capture the latest information about a unit. eg. I have a lookup table with an entry made say 24 hours ago as shown below. Unit 111 Version 1.1 Time 1:31pm 5/5/2016 If I search using lookup for Versions in the last 4 hours, it will not show the above entry. However, If i stretch it to last 7 days, it shows up properly.

abhijitp · ‎05-06-2016

I am already putting the output of the hourly searches into a csv file.

abhijitp · ‎05-06-2016

Hi jensonthottian, I already have an hourly query that appends the lookup table "only if" any information changes from the previous record. In this case, since there will be not update (except time) the newer entry will be ignored. This needs to be done, otherwise there will be an entry every hour with the updated time in the lookup table which is not helpful and risky as the size will keep on growing. The lookup table should have a more bigger timescale than the actual search criteria.

abhijitp · ‎05-06-2016

Hi, I am looking for a solution for this problem. I have implemented Lookup tables based on time and they are working fine. The issue I am having is that if the lookup table entry falls outside the search timescale it returns with no results. I wanted to see if there a way to stretch the lookup timeline more than the actual search. I know everyone likes the actual search string, but in this case it will not help. eg. I have a lookup table with an entry made say 24 hours ago as shown below. Unit 111 Version 1.1 Time 1:31pm 5/5/2016 If I search using lookup for Versions in the last 4 hours, it will not show the above entry. However, If i stretch it to last 7 days, it shows up properly. So here is my question (i could not find any documentation around it). I need a search than runs on the last 24 hours continuously but it should incorporate lookup entries for the Unit Versions from the last known entry which could be 1 week or even 30 days in the past. Sorry for all text. I am really hoping this is possible. Please help. Thanks a lot, Abhi

abhijitp · ‎04-05-2016

I really love the camaraderie 🙂

abhijitp · ‎04-05-2016

Thanks all the help. It worked as I wanted using this | eval foo=if(sky="blue",foo,null())

abhijitp · ‎04-04-2016

Thanks. Let me try this out.

abhijitp · ‎04-04-2016

I need to fill missing values from search items as NULL (not the string, but actual NULL values) I see options to check if the values is NULL (isnull) or even fill NULL values with a string (fillnull). But what I need is to write the value to be NULL. I searched but could not get an answer. Thanks for all the help in this matter. Abhi

abhijitp · ‎03-11-2016

Awesome. I like the taking over the world part. Let me try these things out.

abhijitp · ‎03-11-2016

Thanks a lot rich7177. Let me try this out & provide feedback.

abhijitp · ‎03-11-2016

Also, is this the best way to implement the solution? I mentioned lookup tables as I am comfortable. But if there a better and more efficient solution, please point me to it. I am all for learning and try it out. I will provide feedback on them too. Thanks.

abhijitp · ‎03-11-2016

Thanks rich7177. Please let me try this out. I will provide feedback as to how it goes.

abhijitp · ‎03-11-2016

Hello, I am a trying to implement Serial Number decoding in Splunk in anyway possible. For eg. I have 100 test units each with a Serial Number like ABCDEF001. There is a significance for each and every letter of the Serial Number. A - year B - month C - day D - type of unit E - config type F - plant type 001 - running number for serial number I already have Dashboards that do timecharts based on the whole Serial Number - like say Data transmission times for each and every unit. Now need to take it further, by decoding each & every character of the Serial Number. So the final analysis will be like these units manufactured in say year 2012 in the between 10 and 20 of month of January with this particular config exhibit these typical Data transmission times. I am familiar with lookups and have them implemented. I searched around briefly and did not get a reliable solution to implement this Serial Number decoder. I will try out the solutions recommended here and provide feedback. Please help. Thanks, Abhi

abhijitp · ‎03-01-2016

Thanks muebel. I just tried this out on our production system and it worked exactly as expected. Thanks.

abhijitp · ‎02-29-2016

Thanks muebel. Let me try this out. I will report back my findings shortly.

abhijitp · ‎02-29-2016

Hi, I have around 100 test units in Splunk. I started off with creating tags for them to describe and quickly categorize them. Eg. 1Camera, 2Camera, 3Camera and 4Camera. I first created these tags and they worked fine. 2Camera is the bulk of them, around 80 units. I am tagging them based on the Serial Number. Field Value pair is -> SerialNumber=abcd1234 Tag name is -> 2Camera Then carrying forward this concept, I created another category of tags with a different variable like Transport mode - Wireless or Cellular based on the same Serial Number. Field Value pair is -> SerialNumber=abcd1234 Tag name is -> Wireless In this, the original tags for 2Camera system "disappear" from the Splunk tags. I have re-created them more than 10 times, but they just disappear. I input the 80 units and they do not get updated in Splunk. I have also tried 10 at a time, but when I change the permissions so that everyone can see them, they disappear after around 20. I now have a very tough time re-creating the original tags for 2Camera systems. I am noticing that these tags disappear after say 20 of them have been re-created. Is there a limit as to how many tags can be defined in Splunk? For some reason, I am thinking it is 20. I was not able to confirm it. Is there a limit on how multiple tags can be defined in Splunk actively? Please help. Thanks a lot, Abhi

abhijitp · ‎01-21-2016

This worked perfectly the way I wanted. Thanks a lot somesoni2. Abhi

abhijitp · ‎01-21-2016

I am taking steps to have the above implemented in our environment. I have the field extractions in place and they work fine for SNum (Serial Number) and FW_Version (Firmware Version). I am using '_time' to keep track of the last known FW_Version seen in the log. I am enclosing my search string index=Firmware_QA sourcetype=SecureCRT_log | dedup SNum sortby FW_Version | table SNum FW_Version _time | append [outputlookup FW_Version_SecureCRT.csv] I am using the 'dedup' to get only unique values in the table for SNum (Serial Number) which can be tied to FW_Version (Firmware Version). I only want to append to the FW_Version_SecureCRT.csv only if - a) there is a valid FW_Version seen in the table (most of the times it is empty as the log does not have a FW_Version in the selected time range) b) if there is a value, confirm if this value is different from the one already in the csv file for that SNum Thanks a lot for all the help.

Posts	28
Solutions	1
Karma Given	3
Karma Received	2
Member Since	‎01-08-2016

Online Status	Offline
Date Last Visited	‎06-05-2020 02:04 AM

Is there a way to plot 2 or more gps lat long seri...

How to plot each and every gps lat long

Is there a way to have different timescale for loo...

I need to fill missing values in a search as NULL

How to implement a Serial Number decoder in Splunk...

Is there a limit to how many tags can be defined i...

Is there a method to capture & save specific data ...

Re: Is there a way to plot 2 or more gps lat long ...

Re: Is there a way to plot 2 or more gps lat long ...

Re: Is there a way to plot 2 or more gps lat long ...

Re: Is there a way to plot 2 or more gps lat long ...

Is there a way to plot 2 or more gps lat long seri...

Re: How to plot each and every gps lat long

How to plot each and every gps lat long

Re: Is there a way to have different timescale for...

Re: Is there a way to have different timescale for...

Re: Is there a way to have different timescale for...

Is there a way to have different timescale for loo...

Re: I need to fill missing values in a search as N...

Re: I need to fill missing values in a search as N...

Re: I need to fill missing values in a search as N...

I need to fill missing values in a search as NULL

Re: How to implement a Serial Number decoder in Sp...

Re: How to implement a Serial Number decoder in Sp...

Re: How to implement a Serial Number decoder in Sp...

Re: How to implement a Serial Number decoder in Sp...

How to implement a Serial Number decoder in Splunk...

Re: Is there a limit to how many tags can be defin...

Re: Is there a limit to how many tags can be defin...

Is there a limit to how many tags can be defined i...

Re: Is there a method to capture & save specific d...

Re: Is there a method to capture & save specific d...