Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About vkari
vkari
New Member
Member since:
01-26-2019
06-05-2020
Community Statistics
| Posts | 8 |
| Solutions | 0 |
| Karma Given | 0 |
| Karma Received | 0 |
| Member Since | 01-26-2019 |
Activity Feed
- Posted Re: Response Time Calculation between 2 different events on Splunk Search. 01-27-2019 08:41 PM
- Posted Re: How to get average response time (95%,99% and 100%) on Splunk Search. 01-27-2019 08:41 PM
- Posted Re: Conditional Join/Subsearch on Splunk Search. 01-27-2019 08:38 PM
- Posted Re: How to get stats from different events? on Splunk Search. 01-27-2019 11:46 AM
- Posted How to get stats from different events? on Splunk Search. 01-27-2019 09:59 AM
- Tagged How to get stats from different events? on Splunk Search. 01-27-2019 09:59 AM
- Tagged How to get stats from different events? on Splunk Search. 01-27-2019 09:59 AM
- Posted Re: How do i percentage for PROCESSED and STARTED on below query on Splunk Dev. 01-26-2019 09:02 PM
- Posted Re: How do i percentage for PROCESSED and STARTED on below query on Splunk Dev. 01-26-2019 08:14 PM
- Posted How do i percentage for PROCESSED and STARTED on below query on Splunk Dev. 01-26-2019 07:07 PM
- Tagged How do i percentage for PROCESSED and STARTED on below query on Splunk Dev. 01-26-2019 07:07 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 |
01-27-2019
08:41 PM
index=myindex1
eventName=5000 --->have b(starting time and ending time ) and reference id
eventName=5001 --->have (starting time and ending time ) and reference id
here my condition if both event names - reference id are same then,
event 5000 stating time and event 5001 ending time and total duration of time and average time I need to show in dashboards
can you please provide query
... View more
01-27-2019
08:41 PM
index=myindex1
eventName=5000 --->have b(starting time and ending time ) and reference id
eventName=5001 --->have (starting time and ending time ) and reference id
here my condition if both event names - reference id are same then,
event 5000 stating time and event 5001 ending time and total duration of time and average time I need to show in dashboards
can you please provide query
... View more
01-27-2019
08:38 PM
index=myindex1
eventName=5000 --->have b(starting time and ending time ) and reference id
eventName=5001 --->have (starting time and ending time ) and reference id
here my condition if both event names - reference id are same then,
event 5000 stating time and event 5001 ending time and total duration of time and average time I need to show in dashboards
can you please provide query
... View more
01-27-2019
11:46 AM
The query won't work for me
Here my business modal starts, eventName=505 reference ID will create here from 505 "EventStreamData start time " and with the same reference ID some of the requests only going through eventName=507, here(507) verification status=PROCESSED then "EventStreamData end time " end time from here
both starting times to end time average Time needs to be displayed
Index= caudit eventName=505
|search "EventStreamData.args.verificationId"="8387be8f"
|EventStreamData.requestContext.eventStartTime=*
Index= caudit eventName=507
|search "EventStreamData.args.verificationId"="8387be8f"
|EventStreamData.response.verificationStatus"=PROCESSED
|EventStreamData.requestContext.eventEndTime=*
... View more
01-27-2019
09:59 AM
How do i get different events names and same reference ID stat time from one event and end time from one event and average for total time for span of time?
eventName 505 (startTime) - ----507 with PROCESSED status(endtime) . total avarage time
=================================================================
Index= caudit eventName=505
|search "EventStreamData.args.verificationId"="8387be8f"
|EventStreamData.requestContext.eventStartTime=*
Index= caudit eventName=507
|search "EventStreamData.args.verificationId"="8387be8f"
|EventStreamData.response.verificationStatus"=PROCESSED
|EventStreamData.requestContext.eventEndTime=*
the result will be :
start time. End time . average time
12:00: 00 12.00: 30 . .000000xxx
... View more
01-26-2019
09:02 PM
Fist query not help to me second time you gave me and fist one its working fine
i need one more help !
index=audit eventName=501 |“EventStreamData.response.verificationStatus”=PROCESSED then here
| spath "EventStreamData.eventContext.startTime" | search "EventStreamData.eventContext.startTime"="*"
index=audit eventName=503 |"EventStreamData.eventContext.endTime" | search "EventStreamData.eventContext.endTime"="*"
and Stat time and end time average time
... View more
01-26-2019
07:07 PM
index=ciaudit eventname=*
| spath "EventStreamData.response.verificationStatus"
| search "EventStreamData.response.verificationStatus"=PROCESSED OR "EventStreamData.response.verificationStatus"=STARTED
| rename "EventStreamData.response.verificationStatus" as verificationStatus
| stats count by verificationStatus
I got the results like below in a tale formate....! but i need do add percentage for count results ...?
verificationStatus count
PROCESSED 2
STARTED 187
Stated /processed *100
... View more
- Tags:
- splunk-enterprise
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:04 AM
|
