Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About vnravikumar
vnravikumar
Champion
Member since:
01-07-2019
2 weeks ago
Community Statistics
| Posts | 904 |
| Solutions | 224 |
| Karma Given | 2 |
| Karma Received | 283 |
| Member Since | 01-07-2019 |
Activity Feed
- Got Karma for Re: Why is there a 10000 rows limit?. 09-14-2023 03:17 AM
- Got Karma for Re: Increase width of a multiselect? Of a timepicker?. 04-26-2023 12:49 PM
- Got Karma for Re: How do you remove the first letter of a value?. 04-22-2023 03:19 AM
- Got Karma for Re: How to unset token if I choose other values from dropdown. 04-19-2023 06:32 AM
- Got Karma for Re: Why is there a 10000 rows limit?. 04-05-2023 11:28 PM
- Got Karma for Re: How do you enable/disable (Hide/show) dropdown field based on options in radio buttons?. 11-18-2022 02:24 AM
- Got Karma for Re: How to Horizontally align the radio button in Splunk dashboard. 11-04-2022 02:37 PM
- Got Karma for Re: How do you hide a row depending on 3 rows?. 10-18-2022 07:03 PM
- Got Karma for Re: How to click on table cell to go to a URL referenced in event field (not in row data)?. 10-07-2022 04:03 AM
- Got Karma for Re: Increase width of a multiselect? Of a timepicker?. 09-12-2022 02:26 AM
- Posted Re: Extract a field from a field in splunk? on Splunk Search. 08-09-2022 06:18 AM
- Posted Re: Need help in extracting string after particular word. on Splunk Search. 08-09-2022 06:11 AM
- Got Karma for Re: Single value panel - Display token value. 08-05-2022 04:14 PM
- Got Karma for Re: Fix table header and add vertical scrollbar using CSS and JavaScript. 06-21-2022 03:57 PM
- Got Karma for Re: Filtering on specific multivalue field value. 04-21-2022 09:09 AM
- Got Karma for Re: How to hide table visu when no results are available to dispaly. 03-15-2022 04:21 AM
- Posted Re: How can I put the logo above the dashboard header ? on Dashboards & Visualizations. 03-01-2022 01:50 AM
- Got Karma for Re: How to use conditional comparison of two field values from the same event to populate a third field. 02-03-2022 06:42 AM
- Got Karma for Re: View the parameters, e.g. from limits.conf using the search. 01-14-2022 02:56 PM
- Got Karma for Re: Export to csv on click of button. 10-14-2021 12:28 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 |
08-09-2022
06:18 AM
@pavanae , you can try this | makeresults
| eval code_value ="ABC-123 JHLIK,
ABC-456 LKJF,
ABC-781 klklk,
ABC-22 olsd"
| makemv delim="," code_value
| mvexpand code_value
| eval result=mvindex(split(code_value," "),0)
... View more
08-09-2022
06:11 AM
@labaningombam , you want to extract only after '/v1/locations/' or any multiple conditions there?
... View more
03-01-2022
01:50 AM
src refers to your app directory
... View more
02-04-2021
02:01 AM
Hi Try this | makeresults
| eval message="\"] id not found for opp : [12345azeAZE\" (A),
\"] id not found for opp : [12345azeAZE\" (A),
\"] id not found for opp : [12345azeAZE\" (A),
\"] id not found for opp : [75895kezWXE\" (B),
\"] id not found for opp : [75895kezWXE\" (B),
\"] id not found for opp : [35856uioAME\" (C),
\"] id not found for opp : [35856uioAME\" (C)"
| makemv delim="," message
| mvexpand message
| rex field=message ":\s\[(?P<test>[^\"]+)"
| stats count by test
... View more
02-04-2021
01:40 AM
1 Karma
Hi Try this rex | makeresults
| eval message=" \"] id not found for opp : [12345azeAZE\""
| rex field=message ":\s\[(?P<test>[^\"]+)"
... View more
12-15-2020
07:38 AM
Hi I moved the Splunk server(ver.8.0.2 stand alone) into a new instance by copying the entire setup(/opt/splunk). Both are running in Centos7 but the issue is when I started the server in a new instance all the data(till yesterday) got removed from the indexes and the server contains only today's data. What could be wrong? I moved the entire setup. Need your help here. Or at least how to restore from /opt/splunk/var/lib/. Thanks,
... View more
Labels
- Labels:
-
indexer
10-23-2020
02:31 AM
1 Karma
Hi Try this | makeresults
| eval hostname = "DOMAIN\host1,host2.xxxx.xx.xxxx"
| makemv delim="," hostname
| mvexpand hostname
| rex field=hostname "(DOMAIN\\\){0,1}(?P<host>[^.]+)"
... View more
10-19-2020
03:38 AM
2 Karma
Hi Try this | rex field=log max_match=0 "\[{0,}\'(?P<output>[^',]+)"
| mvexpand output
| table output
... View more
07-07-2020
08:06 AM
Hi @limalbert Try this <dashboard theme="dark">
<label>temp</label>
<row depends="$hide$">
<html>
<style>
#rk h2{
text-align:center;background-color:#485959;
}
</style>
</html>
</row>
<row>
<panel id="rk">
<title>Temp</title>
<html/>
</panel>
</row>
</dashboard>
... View more
- Tags:
- hi
06-10-2020
01:39 AM
Hi Try this | makeresults
| eval test="\"POST /operation/requiredword\",\"POST /operation/requiredword | error\""
| makemv delim="," test
| mvexpand test
| regex test!="(\| error)"
... View more
05-30-2020
07:20 AM
Hi
Check this
<dashboard>
<label>tablr</label>
<row depends="$hide$">
<html>
<style>
#table1 .table th,#table1 .table td {
text-align: left !important;
font-weight: bold !important;
}
</style>
</html>
</row>
<row>
<panel>
<table id="table1">
<search>
<query>index="_internal" |stats count by sourcetype</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
</search>
<option name="drilldown">none</option>
</table>
</panel>
</row>
<row>
<panel>
<table id="table2">
<search>
<query>index="_internal" |stats count by source</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
</search>
<option name="drilldown">none</option>
</table>
</panel>
</row>
</dashboard>
... View more
05-26-2020
07:46 PM
Hi
Try this
| makeresults
| eval temp="98000020200512 -992.00 0.00 001 01,
98000020200523 830566.00 0.00 001 02,
98000020200515 -7356.00 0.00 001 03,
98000020200516 -18760.00 0.00 001 04,
98000020200518 764074.00 0.00 001 05,
98000020200530 165432.00 0.00 001 06,
98000020200531 98715.00 0.00 001 07,
98000020200511 119993.00 0.00 001 08,
98000020200502 908831.00 0.00 001 09,
12000020200507 -5481.00 0.00 001 10"
| makemv delim="," temp
| mvexpand temp
| eval result= mvindex(split(temp," "),1)
| table result
... View more
05-20-2020
09:06 PM
1 Karma
Hi
You can try with CSS like
<form>
<label>checkbox</label>
<row>
<panel>
<input type="checkbox" token="Registrations" id="chk">
<label></label>
<choice value="Registered Subscribers">Registered Subscribers</choice>
</input>
</panel>
</row>
<row depends="$hide$">
<html>
<style>
#chk div[data-component="splunk-core:/splunkjs/mvc/components/CheckboxGroup"]{
height:150px !important;
}
</style>
</html>
</row>
</form>
... View more
05-20-2020
05:39 AM
Hi
Check this
| makeresults
| eval str="pgn-aemrules,1.1,2020-04-02;pgn-csharp,8.4 (build 15306),2020-02-21;pgn-csharp,8.5 (build 15942),2020-03-16;"
| makemv delim=";" str
| mvexpand str
| rex field=str "(?P<Key>[^,]+),(?P<Version>[^,]+),(?P<Date>\S+)"
| table Key Version Date
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
2 weeks ago
|
