About dfrench151

dfrench151 · ‎10-14-2022

How exactly would I do that?... Would I just rename it to something else, then restart Splunk service? Would it be the inputs.conf file located at this location? S:\Program Files\Splunk\etc\apps\splunk_ta_o365\local Also, I have a suspicion we could have been using this application as well https://splunkbase.splunk.com/app/1739 (IMAP Mailbox)

dfrench151 · ‎10-13-2022

Hello, My Splunk is no longer ingesting emails from our O365 email account anymore. I was not the person to set this up and need assistance in troubleshooting. Can anyone provide assistance/guidance. There is also an error that is showing in regards to the KvStore "KV Store process terminated abnormally (exit code 14, status exited with code 14).", which I'm not sure is related or not. We have a search head cluster setup with 2 indexers that are not clustered.

dfrench151 · ‎04-11-2019

I tried that example as well and for some reason it is still combining all the data into one event.

dfrench151 · ‎04-11-2019

The document is created from a powershell script that pulls data through an API connection with an online application. When the information is indexed, there are not line breaks...: isDraggingObject : True id : afbbdeb7-9fd4-4b53-ab17-742809154ba9 condition : {or, matches System.Object[] (?i)(^.*?host failure alert.*?www\.jennycraig\.com\.au.*?$), matches System.Object[] (?i)(^.*?\bwarning\b.*?www\.jennycraig\.com\.au.*?$)} catch_all : False advanced_condition : {} actions : {route PVG22KK, severity warning} isDraggingObject : True id : 3b5aa785-b854-4e43-900a-225da5786a27 condition : {or, matches System.Object[] (?i)(^.*?\bcritical\b.*?www\.jennycraig\.com\.au.*?$)} catch_all : False advanced_condition : {} actions : {severity critical, route PVG22KK} isDraggingObject : True id : a8420998-fbca-486b-9ff7-d03b9e16536e condition : {or, matches System.Object[] (?i)(^.*?\bcritical\b.*?www\.jennycraig\.com$), matches System.Object[] (?i)(^.*?\bcritical\b.*?locations\.jennycraig\.com)} catch_all : False advanced_condition : {} actions : {severity critical, route PW0VV83} isDraggingObject : True id : d9837013-68c9-42bf-a91f-8dd8a94ca377 condition : {or, matches System.Object[] (?i)(^.*?host failure alert.*?www\.jennycraig\.com$), matches System.Object[] (?i)(^.*?\bwarning\b.*?www\.jennycraig\.com$), matches System.Object[] (?i)(^.*?host failure alert.*?locations\.jennycraig\.com)...} catch_all : False advanced_condition : {} actions : {route PW0VV83, severity warning} isDraggingObject : True id : 20fc7d82-d17d-443e-9802-c8f2df462ce9 condition : {or, equals System.Object[] critical: Page Failure alert on https://uw2pobi11.sonic.jennycraig.com:9503/analytics, equals System.Object[] critical: Page Failure alert on https://uw2pobi11.sonic.jennycraig.com:9501/console, equals System.Object[] critical: Page Failure alert on https://uw2pobi11.sonic.jennycraig.com:9501/em...} catch_all : False advanced_condition : {} actions : {route PO77HX2} I tried out your code in one of the searches and it produced no results.

dfrench151 · ‎04-11-2019

So would this be in the props.conf file? LINE_BREAKER = (?^.\S*^\n<*(?:|\n$|\z))

dfrench151 · ‎04-11-2019

I want this to be completed at the time I index the date. Even 1 should be: isDraggingObject : True id : afbbdeb7-9fd4-4b53-ab17-742809154ba9 condition : {or, matches System.Object(^.?host failure alert.?www.jennycraig.com.au.?$), matches System.Object(^.?\bwarning\b.?www.jennycraig.com.au.?$)} catch_all : False advanced_condition : {} actions : {route PVG22KK, severity warning} Event 2: isDraggingObject : True id : 3b5aa785-b854-4e43-900a-225da5786a27 condition : {or, matches System.Object(^.?\bcritical\b.?www.jennycraig.com.au.*?$)} catch_all : False advanced_condition : {} actions : {severity critical, route PVG22KK} Currently splunk is just grouping everything together into one event.

dfrench151 · ‎04-11-2019

Hello, I am trying to create a regex so that I can have all data in between line breaks as one event. Here is a sample of the data I'm working with: isDraggingObject : True id : afbbdeb7-9fd4-4b53-ab17-742809154ba9 condition : {or, matches System.Object[] (?i)(^.*?host failure alert.*?www\.jennycraig\.com\.au.*?$), matches System.Object[] (?i)(^.*?\bwarning\b.*?www\.jennycraig\.com\.au.*?$)} catch_all : False advanced_condition : {} actions : {route PVG22KK, severity warning} isDraggingObject : True id : 3b5aa785-b854-4e43-900a-225da5786a27 condition : {or, matches System.Object[] (?i)(^.*?\bcritical\b.*?www\.jennycraig\.com\.au.*?$)} catch_all : False advanced_condition : {} actions : {severity critical, route PVG22KK} **isDraggingObject : True id : a8420998-fbca-486b-9ff7-d03b9e16536e condition : {or, matches System.Object[] (?i)(^.*?\bcritical\b.*?www\.jennycraig\.com$), matches System.Object[] (?i)(^.*?\bcritical\b.*?locations\.jennycraig\.com)} catch_all : False advanced_condition : {} actions : {severity critical, route PW0VV83}** The aim is to get all data as one event. Thanks in advance for you help. I've been trying multiple different regex expressions, but just can't figure it out...

dfrench151 · ‎02-17-2019

Hello @vnravikumar , That worked!! Thanks for getting that to me with even more information that would be helpful with adjusting other aspects of the font.

dfrench151 · ‎02-17-2019

Hello @niketnilay How would you change the font color as well? Thanks,

dfrench151 · ‎02-17-2019

HI @harishalipaka, Sorry for not getting back to you sooner. I missed your comment. To answer you question, yes, I am trying to query to a string. With the single visual you can change the color if it is in number format, but as soon as you change it to something that is not a number, it turn black. I want to be able to change this color with HTML if possible. The app suggested below looks like it would work great and I will probably end up using that, but I want to also learn how to do this to further my knowledge. Thanks,

dfrench151 · ‎02-05-2019

Hello, I'm trying to change the background color of a label I have created. I created the label by just running the following index=pingdom Name="jennycraig.com.au" | stats count | eval count="CatchPoint Statistics" I want to be able to change the background color and font if possible, but I am unsure of how... I found an article that describes how to do this, but can't get it to work https://answers.splunk.com/answers/566897/how-do-you-change-background-color-for-trellis-vis.html Here is my source code: <row> <panel> <title>CatchPoint Label</title> <single> <search> <query>index=pingdom Name="jennycraig.com.au" | stats count | eval count="CatchPoint Statistics"</query> <earliest>-1h</earliest> <latest>now</latest> <sampleRatio>1</sampleRatio> </search> <option name="colorBy">value</option> <option name="colorMode">block</option> <option name="drilldown">none</option> <option name="height">152</option> <option name="numberPrecision">0</option> <option name="rangeColors">["0x65a637","0xf7bc38","0xd93f3c"]</option> <option name="rangeValues">[30,70]</option> <option name="showSparkline">1</option> <option name="showTrendIndicator">1</option> <option name="trellis.enabled">0</option> <option name="trellis.scales.shared">1</option> <option name="trellis.size">medium</option> <option name="trendColorInterpretation">standard</option> <option name="trendDisplayMode">absolute</option> <option name="unitPosition">after</option> <option name="useColors">1</option> <option name="useThousandSeparators">1</option> </single> </panel> </row> <row>

dfrench151 · ‎01-12-2019

Sorry about that. I re-ran that and it did what I needed. Thank you

dfrench151 · ‎01-12-2019

This only produced that status for up and count unfortunately

dfrench151 · ‎01-12-2019

Hello, I'm trying to add values from rows. See the picture below. What I am pretty much trying to do is add the count from unconfirmed_down status to the up status. The thing is is that the unconfirmed_down status isn't always there depending on the source I am pulling from and could vary from month to month, so I need to have an exception included in case it is not there. I have though have saying add field 1 to field 2, but that could produce incorrect results if that particular status is not there...

dfrench151 · ‎01-12-2019

I have actually figured it out. Instead of trying to have my formula count based on if fields are null for the totals I found that I can just use the addtotals command to get the total number that I need so I can get my percentage. I am still curious though if it is possible to have an If statement within an if statement (i.e. If(x, then Y, else If(x, then, Y, else If(x, then y, then z)))

dfrench151 · ‎01-12-2019

I should also note, I have attempted to nest multiple if statements within an if statement, but I don't think I can do this either, that or I am not correctly writing it out... It would be preferable to have an if statement use the other field if one field has nothing into it, but I don't think you can create variables that update depending on the results

dfrench151 · ‎01-12-2019

Hello, I have information being indexed from a website that does constant ping tests. The information that I am retrieving is the name of the website, the date and time, and status (which is either up, down, unconfirmed_down). I was able to write a command to pull this information and sort by status so that I know how many responses per status. The problem with my code is that if either of the status fields up, down, unconfirmed_down don't have any information in it, my final results end up turning blank. I know this is occurring because when I try to create the total time of the status and any of those blanks then total is empty or null, which doesn't allow me to get the percentage. I have been trying to figure out the best way to calculate the total field. I have been trying to use case and if statements so that if any of those fields are empty then it will only add the other fields together... I know that might be a little confusing but here is the code. index=pingdom Name="appointments.jennycraig.com/set-appointment" | timechart count(status) span=1mon by status | table _time, down, up, unconfirmed_down, total | eval total = case(isnull(down+up+unconfirmed_down),up,up=if(isnull(unconfirmed_down),up+down,up+unconfirmed_down),1=1,up+down+unconfirmed_down) | eval down=down/total*100, down=round(down,3),up=if(isnull(unconfirmed_down),up,(up+unconfirmed_down))/total*100, up=round(up,3) This is one of the variations. I have tried to use if statements within case, but I don' t think that is possible. Does anyone have a better solution to this? Thanks in advance for your assistance in this. I have been putting many hours of thought into this before finally throwing in the towel for help.

Posts	17
Solutions	0
Karma Given	1
Karma Received	2
Member Since	‎01-10-2019

Online Status	Offline
Date Last Visited	‎10-17-2022 11:18 AM

Why is my Splunk not Ingesting Emails?

Regex to Select Data Between Line Breaks

Change background color in Single Value Visual?

Add Values from Rows

Multiple If Statements (Comparing Two Columns)

Re: Why is my Splunk not Ingesting Emails?

Why is my Splunk not Ingesting Emails?

Re: Regex to Select Data Between Line Breaks

Re: Regex to Select Data Between Line Breaks

Re: Regex to Select Data Between Line Breaks

Re: Regex to Select Data Between Line Breaks

Regex to Select Data Between Line Breaks

Re: Change background color in Single Value Visual...

Re: How do you change background color for Trellis...

Re: Change background color in Single Value Visual...

Change background color in Single Value Visual?

Re: Add Values from Rows

Re: Add Values from Rows

Add Values from Rows

Re: Multiple If Statements (Comparing Two Columns)

Re: Multiple If Statements (Comparing Two Columns)

Multiple If Statements (Comparing Two Columns)