About clementros

clementros · ‎01-06-2021

Hi all, I'm trying to calculate the time support team took to respond when a new ticket is created. For now i'm able to calculate the duration between a status new and other next status of the ticket with the command transaction : | transaction "Record Number" startswith="New" endswith=eval(NOT match(_raw,"New")) | table "Record Number", "PI Event Time", duration Next step is to calculate this duration only on working hours. For that i need to substract duration value with weekend or holidays duration if there are between the start and end date ? For holidays i know i should create a lookup table with holidays with the same date format. But i do not know how to do the substraction time only if no working date are between start and end duration Can you help me please ?

kartm2020 · ‎03-12-2020

Hi @clementros It is always recommended to install the same version in both indexers and forwarders. However the issue is with crclength. So you need to increase the initcrclength attribute value 512 or 1024. Try it first 512 if it doesnt works try with 1024. Increase the value by 256. Default value of inicrclength is 256 [monitor:///prddata/JobOutput//.err] index=fileauxnfmerrorlogs sourcetype=fcravd10logfile initCrcLength = 1024 Hope it works. Let me know if you are facing error after you did the above changes. You can also go through the below link. https://docs.splunk.com/Documentation/Splunk/8.0.2/Data/Howlogfilerotationishandled Happy splunking!!!

warwick_chai_po · ‎03-23-2020

Hi Clementros When you say SAP Office Spool what exactly are you refering to? For general print spool files we have out of the box extractor for this, it can monitor any spool output (the actual print contents) and the print spool and output file meta-data (who printed, when, status, number of pages). SAP stores this either in the database or in a file depending on how you have it configured.

woodcock · ‎12-18-2019

Be sure to do something with your duplicate question: https://answers.splunk.com/answers/790422/optimize-rex-command.html

woodcock · ‎12-18-2019

Your problem has nothing to do with limits; your problem is that your RegEx is wrong. Try this: ... | rex field=CDREASON "(?<grammar_error_reason>(?:Can not convert|Can't find the)\s+\w+)\s+(?:from here|segment)"

kamlesh_vaghela · ‎12-05-2019

Great @clementros. Please upvote and accept this answer to close this question.

clementros · ‎11-29-2019

It works than you

arjunpkishore5 · ‎11-27-2019

Use end as the time field and then use a timechart. index="saplogs" sourcetype=SAPCARBOOKING source="CARBOOKING.*.log" | stats min(_time) as start max(_time) as end by source | eval duration=end-start | eval _time=end | timechart avg(duration) as Duration by source

woodcock · ‎12-05-2019

I gave you a complete answer already.

clementros · ‎11-13-2019

Thank you

clementros · ‎10-24-2019

I have this error with every command. For example SELECT * FROM MyTable

clementros · ‎04-23-2019

clementros · ‎03-27-2019

Hi, I have installed alert manager app and followed documentation for installation. I have splunk 7.2.4 on a single instance server and Alert manager 2.2.0 add-on. I also installed Python for scientific Computing in Splunk. After this steps i created an index in my splunk instance : | Name | Type | App | Current Size | Max Size | | alerts | Events | alert_manager | 1MB | 500GB | In the alert manager apps Settings > Global Settings menu, i applied the following configuration : Globals Index: alerts Default Owner: unassigned Default Priority: low Number of incidents show in incident posture: 20 - Save incident results to KVStore (checked) - Index incident results (Not checked) - Automatically close informational events (Not checked) Status to use for automatically closed informational events: auto_info_resolved Alert Action Defaults Impact: low Urgency: low After applied this configuration, i went in my Machine learning toolkit splunk application and i generate an alert with parameter Trigger Actions: When triggered : - Add to Triggered Alerts - Alert Manager Title: Test Impact: low Urgency: low Owner: Unassigned But with all this configuration nothing appear in the alerts index and in the alert manager dashboard. Any idea ?

sduchene_splunk · ‎05-10-2019

Changing the alert permissions from private to app or global solved my issue

clementros · ‎03-25-2019

Hi, I have created an alert with the trigger action "Add to Trigered Alerts". Is there a way to add the link of a specific dashboards in the action column of the Activity > Triggered Alerts page ? For the moment I only have the possibility to access "View results", "Edit search" and delete action. I wonder if it is possible to add another action ? Regards,

nickhills · ‎03-20-2019

I would start with your network/comms team - if you have perimeter firewalls blocking ports, they will likely have to make the changes to allow your traffic to flow. I think debian uses firewalld, but I'm more of an RHEL guy!

nickhills · ‎03-15-2019

You're welcome -source is not mandatory but sometimes I have found it useful to specify it and "quote" the paths to make it clear to Splunk what you are trying to do. Please upvote this answer to help others in the future! All the best.

FrankVl · ‎02-27-2019

I don't think Splunk explicitely logs the size of the files that are ingested, but if those files have unique names and those names are captured in the source field (which is the case by default for file monitor inputs), you could check the license usage by source. That should give a pretty good indication of the file size. index="_internal" source="*license_usage.log" type=Usage | stats sum(b) AS bytes by s To narrow down the results, you could add some filtering for the source (s) field (e.g. s="*.log" ) in the first line depending on the patter of log file names for which you want to check the size.

clementros · ‎02-21-2019

I found a way to do this. index="nbtktfed44971" sourcetype="nbtktfed" -I -c -l -f | join type=outer [ search index="nbtktfed44971" sourcetype="nbtktfed" "Malformed message" | fields Reason] | fields JobName, Reason | table JobName, Reason

splunk_abhishek · ‎04-08-2020

@chrisyoungerjds Thanks mate! your query has helped me to resolve a similar issue as well.. Cheers

woodcock · ‎02-14-2019

Either that or you need to clip out all of the extra junk to reconstruct the original JSON and pass it to spath .

Posts	42
Solutions	2
Karma Given	6
Karma Received	2
Member Since	‎02-13-2019

Online Status	Offline
Date Last Visited	‎01-06-2021 06:30 PM

How to calculate elapsed time only on working hour...

Splunk Forwarder do not send all data

Monitor SAP Office Spool report in Splunk

Optimize rex command

Optimize rex command

Date type issue on extracted fields

Timechart issue

Display date on X axis

Join two lines in the same search

Splunk forwarder - When the log file will be send ...

How to calculate elapsed time only on working hour...

Re: Splunk Forwarder do not send all data

Re: Monitor SAP Office Spool report in Splunk

Re: Optimize rex command

Re: Optimize rex command

Re: Date type issue on extracted fields

Re: Timechart issue

Re: Display date on X axis

Re: Join two lines in the same search

Re: Splunk forwarder - When the log file will be s...

Re: Error in 'dbxquery' error code 126

Re: How to get timechart value even if splunk cont...

Alert manager app - No alerts indexed...

Re: Alert manager apps - List indices must be inte...

Alert - link to specific dashboard

Re: Sendmail - [Errno 101] Network is unreachable ...

Re: When trying to monitor two logs file formal fr...

Re: Is there a way to monitor the size of the file...

Re: Search for different logs lines from the same ...

Re: Rex has exceeded configured match_limit

Re: Fields extraction in file with single and mult...

Join the Conversation