Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About isha_rastogi
isha_rastogi
Path Finder
Member since:
05-11-2014
06-05-2020
Community Statistics
| Posts | 44 |
| Solutions | 2 |
| Karma Given | 3 |
| Karma Received | 3 |
| Member Since | 05-11-2014 |
Activity Feed
- Got Karma for Re: How to automatically extract key value pairs after using translatefix. 05-29-2022 11:53 PM
- Karma Re: Need to break the events before certain word. for cpetterborg. 06-05-2020 12:49 AM
- Got Karma for Re: Multivalue value from props transforms fields.conf. 06-05-2020 12:49 AM
- Karma Re: How To monitor data for specific months. for adonio. 06-05-2020 12:48 AM
- Karma Re: How To monitor data for specific months. for adonio. 06-05-2020 12:48 AM
- Got Karma for Override source field in the indexers. 06-05-2020 12:47 AM
- Posted Extract timestamp from the logs on Getting Data In. 04-25-2018 03:35 AM
- Posted Re: Multivalue value from props transforms fields.conf on Splunk Search. 02-28-2018 04:36 AM
- Posted Multivalue value from props transforms fields.conf on Splunk Search. 02-28-2018 02:11 AM
- Tagged Multivalue value from props transforms fields.conf on Splunk Search. 02-28-2018 02:11 AM
- Tagged Multivalue value from props transforms fields.conf on Splunk Search. 02-28-2018 02:11 AM
- Posted Re: DB connect inputs data timestamp is in EST but splunk is recording it in UTC ( splunk servers are in UTC) on All Apps and Add-ons. 01-29-2018 11:06 PM
- Posted Re: DB connect inputs data timestamp is in EST but splunk is recording it in UTC ( splunk servers are in UTC) on All Apps and Add-ons. 11-15-2017 11:28 PM
- Posted DB connect inputs data timestamp is in EST but splunk is recording it in UTC ( splunk servers are in UTC) on All Apps and Add-ons. 11-13-2017 08:05 PM
- Tagged DB connect inputs data timestamp is in EST but splunk is recording it in UTC ( splunk servers are in UTC) on All Apps and Add-ons. 11-13-2017 08:05 PM
- Posted Re: Need to break the events before certain word. on Splunk Search. 09-13-2017 03:24 AM
- Posted Need to break the events before certain word. on Splunk Search. 09-13-2017 02:02 AM
- Tagged Need to break the events before certain word. on Splunk Search. 09-13-2017 02:02 AM
- Posted Re: Change color of pie chart based on percentage automatically on Splunk Search. 09-13-2017 01:45 AM
- Posted Re: Change color of pie chart based on percentage automatically on Splunk Search. 08-27-2017 10:37 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
04-25-2018
03:35 AM
I've logs where events are not starting with time. Log format is
10.100.28.108 - - 2018-04-25--02-31-14 "PUT /mifs/c/i/abc/abc.html?c=1073768600 HTTP/1.1" 200 20 "-" "abc/1.0" 5252
I was trying below but getting error: couldnot use strptime to parse
[ test ]
SHOULD_LINEMERGE=false
NO_BINARY_CHECK=true
TIME_FORMAT=%Y-%m-%d--%H%-M-%S
TIME_PREFIX=\d{1,3}.\d{1,3}.\d{1,3}.\d{1,3}\s-\s-
TZ=America/New_York
... View more
- Tags:
- datetime
- time_prefix
02-28-2018
04:36 AM
1 Karma
able to solve it .. used split in eval command:
eval allowed_ip=split(allowed_ip,",") and it worked perfectly
... View more
02-28-2018
02:11 AM
I've field extracting as: allowed_ip: 10.1.1.10,10.2.2.15,10.3.3.14"
Using makemv in inline gives separate values makemv delim=", " allowed_ip"
I'm trying to implement it on backend instead of writing it inline none of it is working. Used fields.conf:
[allowed_ip]
TOKENIZER=([^\,]+)
Also tried to implement it in props.conf and transforms.conf:
props.conf
[abc:pce:metadata]
EXTRACT-IP = allowed_ip
transforms.conf:
[allowed_ip]
CLEAN_KEYS = 0
MV_ADD = 1
REGEX = (?<IP>[^,]+)
SOURCE_KEY = allowed_ip
... View more
01-29-2018
11:06 PM
I've changed the Oracle query and it the db query have to convert the EST time to UTC.
... View more
11-15-2017
11:28 PM
I've changed the EST time to UTC again in Oracle query, and now splunk is indexing correct time.
... View more
11-13-2017
08:05 PM
We have DB connect installed in Heavy weight forwarder which are in UTC timezone and the db input have TIMEStAMP field in EST. WE are using that Db field as Timestamp but it's always indexing in UTC instead of EST.
I've tried to put below setting sin Indexers and HWF in custom_app/local but no success. I've tried to put same configs in dbconnect app/local/props.conf. Any suggestions where to put the configs
[db_test]
TZ = America/New_York
... View more
09-13-2017
03:24 AM
@cpetterborg I've made necessary changes, please take a look
... View more
09-13-2017
02:02 AM
I've log file something like below,
DA FILE: /archive/attr/ABC/XYZ/20170911/file.log-new*** Files traversed: 128 - and file format matches ***
DA FILE: /archive/attr/ABC/XYZ/20170911/file.log-newCreating the follwing directory for today's date: /mktaccess/archive/attr/abc/xyz/20170911Creating the follwing directory for today's date: /mktaccess/archive/attr/abc/xyz/20170911Creating the follwing directory for today's date: /mktaccess/archive/hello-US/abc/xyz/20170911Creating the follwing directory for today's date: /mktaccess/archive/hello-US/abc/xyz/20170911
Log format is like a paragraph.. It's the stdout and stderr output of a script
I need to break the line after ******* and before Creating. I'm writing something like below
[test]
SHOULD_LINEMERGE=false
NO_BINARY_CHECK=true
BREAK_ONLY_BEFORE=Creating
MUST_BREAK_AFTER=^\d{8}
TIME_FORMAT=%Y%m%d
TIME_PREFIX=(OR\w*\/)+
... View more
09-13-2017
01:45 AM
@niketnilay It worked.
... View more
08-27-2017
10:37 PM
@niketnilay Please find link of the Pie chart
I have only 4 series and 3 series not more than that
... View more
08-27-2017
07:24 AM
@niketn
I've pie chart with version of product installed v100, v200, v300 and apart from this I have remaining instances which don't have product installed. I want color of Remaining would be same color or fixed color no matter what what count is and version slices change color based on count.
Suppose count of v100 is 200, v200 is 500 and v300 is 150. so highest would be green then blue and red but "remaining" should always be black no matter of count even if count is 250
I'm not able to send screenshots of pie chart
Query that I'm using is
earliest=-24h latest=now index=product | stats count by VER | join [|inputlookup names.csv| search Systems="W"] | stats count(Systems) AS Count by VER| append [inputlookup stations.csv | eval VER=Remaining|search Systems=W | stats count as "Total_stations"|join [inputlookup names.csv | search Systems=W|stats count as "deployed_stations"]| eval Count= Total_stations - deployed_stations| eval VER=if(isnull(VER),"Remaining_Stations",VER) | fields - deployed_stations,Total_stations ] | sort - Count
... View more
08-25-2017
08:14 AM
@niketnilay your solution worked, but if I have 4 slices and I want one fix color for version 1 and for version 2, 3, 4 based on percentage. Any idea on how can I fix color for one slice and dynamic color scheme for others
... View more
08-25-2017
03:48 AM
I want to change color of slices of pie chart based on the percentage values. slice that have highest percentage should be green and then less that blue and least red.
I don't have any range of percentages it will change automatically
... View more
08-07-2017
08:39 AM
I got it working with join. was missing stats command after joining tables. Thanks for your help. I'll try your solution as well it seems like optimized one
... View more
08-07-2017
07:11 AM
I have a table that counts different versions of products and a second table that has the system type, like Laptop, VDI, etc. I can combine both tables by ID, but as it's unique I don't need this individually.
I need to create a chart something like below
Product Version System count
1.1 20
1.2 13
1.3 17
I'm writing the search like this:
earliest=-24h latest=now index=abc source=xyz| dedup ID |stats values(RUNNING_VER) as Version | mvexpand Version |join [search earliest=-24h latest=now index=abc source=pqr | dedup NAME|eval Names=substr(NAME,1,3)|rex field=Names "(?.$)"| search Systems="I" OR Systems="X"|stats count by Systems]
I'm always getting same count if I use this search. Any help would be greatly appreciated.
... View more
06-14-2017
03:07 AM
I think you have selected global, so it's giving all the matches but in TIME_PREFIX we cant use that option
... View more
06-14-2017
03:01 AM
Hi cusello ,
thanks for your fast response. Not working for me as I can see its creating groups for both Group 1 for 50 group 2 for 60
... View more
06-14-2017
02:33 AM
yes, problem here is if either 50 or 60 is present then regex works like charm but if both are present I need to extract it from 60 . But as field 50 is always coming before 60 regex is breaking once it gets matching pattern. I tried using below regex but didn't work as it starts looking for 50 or 60 and whenever 50 comes it breaks never looks for 60
TIME_PREFIX = (60=)|(50=)
... View more
06-14-2017
02:11 AM
I am working in the FIX log messages and have two fields that contain timestamps. I need to check for one field and if that is not present check for other field. I'm facing problem if both of the fields is present.
Ex: I have 50=timestamp | 70=XYZ | 60=timestamp.
I am trying to extract timestamp from 60 if that not present then 52 but not able to write the regex if both are present because 50 is coming before 60 everytime so it's taking 50 field as timestamp.
TIME_PREFIX=(50=|60=)
Any idea how can I do that if both are present.
... View more
05-08-2017
03:18 AM
@somesoni2 - How can I use relative_time to consider average only yesterday's data and earliest and latest =-7d@d and latest=-2d@d
... View more
05-05-2017
04:38 AM
@somesoni2 - What if I have to consider the average till yesterday. Because if i'll take now it will consider today's data which will give incorrect metrics
Can you help me with the earliest and latest of average and today's
For one day I am considering earliest=-24h latest=now which will give me indexing volume for last 24 hours and for average(comparison metrics) it should not include that 24 hours. Not able to put earliesr latest for average and one day
index=_internal source=*license_usage.log type=Usage earliest=-7d@d latest=-24h
| bucket span=1d _time | stats sum(b) as usage by _time idx
| eval period=if(_time
... View more
05-05-2017
01:31 AM
101010 instead of internal it's underscore internal and series!=underscore star series!=*
... View more
05-04-2017
02:20 AM
Can I use something like below to get percentage change?
index=internal source=*metrics.log group=per_index_thruput earliest=-7d latest=now()
NOT (series=* OR series=summary)
| bucket time span=1d
| stats sum(kb) as totalDay by series,_time
| stats avg(totalDay) as avgTotal by series
| eval avgTotalMB=round(avgTotal/1024,2)
| table series avgTotalMB | join type=outer series
[ search index=_internal source=*metrics.log group=per_index_thruput
earliest=@d latest=now NOT (series=* OR series=summary)
| bucket _time span=1h | stats sum(kb) as totalHour by series,_time
| stats avg(totalHour) as avgHour by series
| eval todaysCalcMBD=round(24*avgHour/1024,2)
| table series todaysCalcMBD
]| eval perc_change = (todaysCalcMBD-avgTotalMB)/avgTotalMB| eval perc = perc_change * 100| table series avgTotalMB todaysCalcMBD perc | fillnull value=0
... View more
05-03-2017
10:09 PM
Can you please explain the query little more, "tempscale ".
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:04 AM
|
