Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About cmisztur
cmisztur
Explorer
Member since:
01-26-2016
07-15-2020
Community Statistics
| Posts | 14 |
| Solutions | 0 |
| Karma Given | 4 |
| Karma Received | 1 |
| Member Since | 01-26-2016 |
Activity Feed
- Karma Re: Splunk Thinking - I need max(X) when you see Y happen. for woodcock. 07-15-2020 05:15 PM
- Karma Re: Splunk Thinking - I need max(X) when you see Y happen. for woodcock. 06-05-2020 12:48 AM
- Got Karma for Re: How to write a basic SPLUNK query which returns value A, B, C & D.. 06-05-2020 12:48 AM
- Karma Re: Why am I getting inconsistent search results? for Richfez. 06-05-2020 12:47 AM
- Karma Re: Why am I getting inconsistent search results? for kbecker. 06-05-2020 12:47 AM
- Posted Re: timechart span and transaction rollover into hour (what happens to the duration of the transaction?) on Splunk Search. 04-23-2018 11:17 AM
- Posted Re: timechart span and transaction rollover into hour (what happens to the duration of the transaction?) on Splunk Search. 04-23-2018 11:15 AM
- Posted timechart span and transaction rollover into hour (what happens to the duration of the transaction?) on Splunk Search. 04-23-2018 07:04 AM
- Tagged timechart span and transaction rollover into hour (what happens to the duration of the transaction?) on Splunk Search. 04-23-2018 07:04 AM
- Tagged timechart span and transaction rollover into hour (what happens to the duration of the transaction?) on Splunk Search. 04-23-2018 07:04 AM
- Tagged timechart span and transaction rollover into hour (what happens to the duration of the transaction?) on Splunk Search. 04-23-2018 07:04 AM
- Tagged timechart span and transaction rollover into hour (what happens to the duration of the transaction?) on Splunk Search. 04-23-2018 07:04 AM
- Posted Re: Why does the output for triggered alert scripts in Splunk contain ^ (hats/caret) characters? on Alerting. 07-07-2017 08:37 AM
- Posted Alert on missing events on Alerting. 07-06-2017 09:15 PM
- Tagged Alert on missing events on Alerting. 07-06-2017 09:15 PM
- Posted Re: Dashboarding from a JSON array. on Dashboards & Visualizations. 07-05-2017 06:38 PM
- Posted Re: How to write a basic SPLUNK query which returns value A, B, C & D. on Splunk Search. 07-04-2017 06:43 PM
- Posted Dashboarding from a JSON array. on Dashboards & Visualizations. 07-04-2017 06:38 PM
- Tagged Dashboarding from a JSON array. on Dashboards & Visualizations. 07-04-2017 06:38 PM
- Posted Re: Splunk Thinking - I need max(X) when you see Y happen. on Knowledge Management. 05-16-2017 04:58 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
04-23-2018
11:17 AM
Correct, should split the transaction and fit into the hour it belongs in. So 1m4s into 13th hour, 0m23s into 14th hour.
... View more
04-23-2018
11:15 AM
correct, no ID.
... View more
04-23-2018
07:04 AM
below example sums the duration when a machine is not running.
...
| sort 0 - time
| transaction startswith=running="0" endswith=running="1" keeporphans=f keepevicted=f
| timechart span=1h sum(duration)
first transaction of an hour:
what happens to a transaction that rolls over into the hour?
will it report against 13th hour because the transaction takes the first event's timestamp...
like this one:
thanks
/c
... View more
07-06-2017
09:15 PM
This is more of a comment than question. Based on some other QA this search works great to alert me when an event goes missing.
index="rigs" earliest=-25m latest=-11m
| dedup rig
| stats count AS last_period by rig
| JOIN type=outer rig
[| search index="rigs" earliest=-10m latest=now
| dedup rig
| stats count as this_period by rig ]
| fillnull value=0 this_period last_period
| where last_period>0 AND this_period=0
... View more
- Tags:
- splunk-enterprise
07-04-2017
06:43 PM
1 Karma
wouldn't you want to use xpath or spath to deal with XML?
... View more
07-04-2017
06:38 PM
Below is a sample event ingested over HEC and a query. What I am interested in is creating a dashboard from miner.gpus{}. I want to dashboard miner.gpus{}.eth, miner.gpus{}.temp, and miner.gpus{}.fan. The expected miner.gpus{} count is always 8.
Is there an easy way to create a gauge for every index in the array? Or do I have to manually call out the index using mvindex?
http://imgur.com/a/TvLxb
index="rigs" rig="$miner$"
| spath output=values miner.gpus{}.eth
| eval value=mvindex(values,0)
| stats min(value) as minimum, max(value) as maximum, latest(value) as current
| table current, minimum, maximum
{
"rig": "MINER001",
"miner": {
"runningTime": "675",
"id": 0,
"DCR": {
"totalHashrate": "0",
"shares": "0",
"rejectedShares": "0",
"poolSwitches": "0",
"invalidShares": "0"
},
"version": "9.5 - ETH",
"miner": "claymore",
"pools": [
"us1.ethermine.org:14444"
],
"error": null,
"gpus": [
{
"temp": "83",
"dcr": "off",
"fan": "71",
"eth": "29890",
"index": 0
},
{
"temp": "73",
"dcr": "off",
"fan": "57",
"eth": "29934",
"index": 1
},
{
"temp": "69",
"dcr": "off",
"fan": "52",
"eth": "29940",
"index": 2
},
{
"temp": "74",
"dcr": "off",
"fan": "59",
"eth": "29816",
"index": 3
},
{
"temp": "76",
"dcr": "off",
"fan": "61",
"eth": "29813",
"index": 4
},
{
"temp": "77",
"dcr": "off",
"fan": "63",
"eth": "29895",
"index": 5
},
{
"temp": "73",
"dcr": "off",
"fan": "57",
"eth": "30204",
"index": 6
},
{
"temp": "62",
"dcr": "off",
"fan": "31",
"eth": "30103",
"index": 7
}
],
"isRunning": true,
"ETH": {
"totalHashrate": "239598",
"shares": "2383",
"rejectedShares": "0",
"poolSwitches": "0",
"invalidShares": "0"
}
},
"event_type": "heartbeat",
"uptime": 40860.5487383,
"uptimeUnits": "seconds"
}
... View more
- Tags:
- splunk-enterprise
05-16-2017
04:58 AM
Ohhhhh, I get it, because I'm getting the max(PanCount)
... View more
05-16-2017
04:55 AM
Why does this work? Why does it display 1991 and not 6 if it is getting the last non null?
BASE_SEARCH (PanCount=* OR PanCycleShift=*) | sort - _time | filldown PanCycleShift | stats max(PanCount) BY PanCycleShift
... View more
05-16-2017
04:46 AM
I need to know how many pieces were in the pan when the pan cycled. Which would be the bigger number surrounding the pan cycle event. What most likely happened in this case is that somewhere between 2:04:57 and 2:05:07,
the machine stopped producing pieces and the pan count remained at 1991
OR because of my 10 second data collection interval I never captured the true maximum value and never captured the pan count rolling over to zero
... View more
05-12-2017
12:23 PM
So I’m struggling with something basic here. I just don’t quite understand how Splunk wants to look at the data, once I understand that everything else should fall into place.
In this example, the PanCycleShift=18 event is a step performed by the operator when he opens a big gate and parts fall out.
I am interested in the PanCount value right at/right before PanCycleShift increments, or how many parts were in the pan before he opened the gate.
But, since Kepware IoT Gateway is reporting data changes every 10 seconds (for now), in the below example you can see that a PanCount event traveled with the PanCycleShift event.
I do not want PanCount=6, I want PanCount=1991 as the number of parts that fell out of the gate when PanCycleShift=18 occurred.
How does Splunk want me to think around this problem?
Thanks
Chris
... View more
01-26-2016
06:26 PM
+1 for the Syslog note.
Let me try the line break and see if that is the cause.
I have created a custom source_type and set the event break regex there. I hope that's the same as BREAK_ONLY_BEFORE.
... View more
01-26-2016
02:29 PM
I have configured Kepware IDF for Splunk and am ingesting data over TCP:51112. The source_type I have set ('opc') is arbitrary and does not exist. I have noticed when executing below search, the results are incorrect. The two records for "RunState" get omitted from the below search, and I am assuming that is because that collection of events contains an entry with Quality="bad", which does not meet my criteria.
Am I missing something fundamental, like not creating or setting a source_type?
WorkCenter="CNF59" | search RunState Quality="good"
... View more
