Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Are you a member of the Splunk Community?
Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- Find Answers
- :
- About akelbr
akelbr
Explorer
Member since:
01-14-2019
06-05-2020
Community Statistics
| Posts | 10 |
| Solutions | 0 |
| Karma Given | 2 |
| Karma Received | 0 |
| Member Since | 01-14-2019 |
Activity Feed
- Karma Re: How do you create a table that matches information from 2 different source types? for mayurr98. 06-05-2020 12:50 AM
- Karma Re: Difference between two dates for martin_mueller. 06-05-2020 12:46 AM
- Posted Re: Combining fields from 2 sourcetypes in a stats block on Splunk Search. 02-04-2019 02:24 AM
- Posted Re: Splunk default.xml open link in a new tab on Dashboards & Visualizations. 02-04-2019 02:09 AM
- Posted Re: Combining fields from 2 sourcetypes in a stats block on Splunk Search. 01-18-2019 07:55 AM
- Posted Re: Combining fields from 2 sourcetypes in a stats block on Splunk Search. 01-18-2019 07:54 AM
- Posted Re: Combining fields from 2 sourcetypes in a stats block on Splunk Search. 01-18-2019 05:43 AM
- Posted Re: Combining fields from 2 sourcetypes in a stats block on Splunk Search. 01-18-2019 05:30 AM
- Posted Combining fields from 2 sourcetypes in a stats block on Splunk Search. 01-18-2019 05:28 AM
- Tagged Combining fields from 2 sourcetypes in a stats block on Splunk Search. 01-18-2019 05:28 AM
- Tagged Combining fields from 2 sourcetypes in a stats block on Splunk Search. 01-18-2019 05:28 AM
- Tagged Combining fields from 2 sourcetypes in a stats block on Splunk Search. 01-18-2019 05:28 AM
- Tagged Combining fields from 2 sourcetypes in a stats block on Splunk Search. 01-18-2019 05:28 AM
- Posted Re: How do you create a table that matches information from 2 different source types? on Getting Data In. 01-14-2019 07:08 AM
- Posted Re: How do you create a table that matches information from 2 different source types? on Getting Data In. 01-14-2019 07:06 AM
- Posted How do you create a table that matches information from 2 different source types? on Getting Data In. 01-14-2019 04:17 AM
- Tagged How do you create a table that matches information from 2 different source types? on Getting Data In. 01-14-2019 04:17 AM
- Tagged How do you create a table that matches information from 2 different source types? on Getting Data In. 01-14-2019 04:17 AM
- Tagged How do you create a table that matches information from 2 different source types? on Getting Data In. 01-14-2019 04:17 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 |
02-04-2019
02:24 AM
The solution was to have the data from sourcetype 2 exported to a file and then using a lookup with sourcetype 1.
It works like a charm! The only thing is that I from time to time I need to run the export search to update the file.
Thank you renjithnair for help me on this.
... View more
02-04-2019
02:09 AM
I have used the code below and it is working as you need.
<collection label="Useful Links">
<a href="https://my_web_page/index.html">Page Name</a>
</collection>
... View more
01-18-2019
07:55 AM
InstallDate Machine Name Patch Name ProducName %of CPU %of RAM % of IO
2018-01-01 SERVERA KB1234 Office null null null
2018-01-01 SERVERB KB1234 Office null null null
2018-01-02 SERVERC KB1234 Office null null null
... View more
01-18-2019
07:54 AM
Thank you for you help on this!
I`ve tried to use values(InstallDate ) as InstallDate in the current stats but got the following error:
Error in 'stats' command: The output field 'InstallDate' cannot have the same name as a group-by field.
if use a separated stats, nothing comes up.
About the mvexpand, I`m using because was the way a found to get the same result as the splitrow in pivot.
See below an example of the events:
InstallDate Machine Name Patch Name ProducName %of CPU %of RAM % of IO
2018-01-01 KB1234 Office
2018-01-01 KB1234 Office
2018-01-02 KB1234 Office
... View more
01-18-2019
05:43 AM
Of course! that is the point! 🙂
The InstallDate is not on sourcetype 2.
Said that, I need my calculations based on the InstallDate values.
How can I do that?
Maybe in this case I should use the JOIN with HOST field that is common to both?
... View more
01-18-2019
05:30 AM
Forgot to add: My ultimate goal is to have a list with the KBs installed on the machines and the avg resource used on that day. Trying to find any outstanding value during the patching process.
... View more
01-18-2019
05:28 AM
All,
my query below just returns the values from the first sourcetype (first 3 lines in |stats). The fields from the second sourcetype seems that are not being loaded.
Any clue? I`m sure is something really simple but I can not see it:
index=uberagent (sourcetype=uberAgent:Application:SoftwareUpdateInventory host=*) OR sourcetype=uberAgent:System:SystemPerformanceSummary2
| stats
latest(DisplayName) as "Patch Name"
latest(ProductName) as "Product name"
values(State) as State
avg(CPUUsagePercent) as "CPU"
avg(RAMUsagePercent) as "RAM"
avg(IOPercentDiskTime) as "IO"
by host, InstallDate
| rename host as "Machine Name"
| mvexpand InstallDate
| mvexpand host
| eval "% of CPU" = round((CPU),2)
| eval "% of RAM" = round((CPU),2)
| eval "% of IO" = round((CPU),2)
| eval sortfield=lower(InstallDate)
| table
InstallDate
"Machine Name"
"Patch Name"
"Product name"
State
"% of CPU"
"% of RAM"
"% of IO"
sortfield
| sort limit=0 sortfield
| fields - sortfield
... View more
01-14-2019
07:08 AM
Thank you mayurr98 ! This is exactly what I need.
This multi sourcetypes was something confused for me, but know I can understand it much better.
Thanks again.
... View more
01-14-2019
07:06 AM
Thank you mayurr98! That is exactly what I need.
This multi sourcetypes was a little confused to me but now things are much clear.
... View more
01-14-2019
04:17 AM
Community, need some help to work with 2 different source types .
I'm trying to run a search where I need to match information from 2 sources in 1 table.
What I'm trying to do is:
index=uberagent sourcetype=uberAgent:OnOffTransition:StandbyDetail2
| search host=*
| where TargetStateDisplayName = "Hibernate"
| join host
[ search index=uberagent sourcetype=uberAgent:System:SystemPerformanceSummary2
| stats avg(CPUUsagePercent) as "%CPU Usage"
| stats avg(IOPercentDiskTime) as "%IO Time"
| stats avg(RAMUsagePercent) as "%RAM Usage"
|return "%CPU Usage", "%IO Time", ]
| stats count(TargetStateDisplayName) as "Total Events" by host
| rename TargetStateDisplayName as "Machine Event"
| eval "Machine Event" = "Hibernate"
| rename host as "Machine Name"
| table
"Machine Name"
"Total Events"
"%CPU Usage"
"%RAM Usage"
"%IO Time"
| sort - "Total Events"
| head 15
Note that I already tried to use sourcetype=A OR sourcetype=B, already tried to use the |Append and no success on this.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:04 AM
|
