Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About wellsajs
wellsajs
Explorer
Member since:
05-30-2012
06-05-2020
Community Statistics
| Posts | 11 |
| Solutions | 1 |
| Karma Given | 0 |
| Karma Received | 4 |
| Member Since | 05-30-2012 |
Activity Feed
- Got Karma for Re: Splunk DB connect MSSQL connection params. 06-05-2020 12:46 AM
- Got Karma for Search to only include Business Hours and Exclude weekends. 06-05-2020 12:46 AM
- Got Karma for Search to only include Business Hours and Exclude weekends. 06-05-2020 12:46 AM
- Got Karma for Re: Search to only include Business Hours and Exclude weekends. 06-05-2020 12:46 AM
- Posted JSON format in splunk on Getting Data In. 12-22-2015 04:41 PM
- Tagged JSON format in splunk on Getting Data In. 12-22-2015 04:41 PM
- Posted Re: Excluding public holidays from search data on Splunk Search. 01-01-2013 05:49 PM
- Posted Excluding public holidays from search data on Splunk Search. 12-23-2012 01:56 PM
- Tagged Excluding public holidays from search data on Splunk Search. 12-23-2012 01:56 PM
- Posted Re: Search to only include Business Hours and Exclude weekends on Splunk Search. 12-19-2012 10:53 PM
- Posted Re: Search to only include Business Hours and Exclude weekends on Splunk Search. 12-19-2012 09:56 PM
- Posted Re: Search to only include Business Hours and Exclude weekends on Splunk Search. 12-19-2012 08:09 PM
- Posted Search to only include Business Hours and Exclude weekends on Splunk Search. 12-19-2012 05:17 PM
- Tagged Search to only include Business Hours and Exclude weekends on Splunk Search. 12-19-2012 05:17 PM
- Posted Re: Splunk DB connect MSSQL connection params on Splunk Dev. 12-10-2012 03:37 PM
- Posted Re: Splunk DB connect MSSQL connection params on Splunk Dev. 12-10-2012 03:18 PM
- Posted Splunk DB connect MSSQL connection params on Splunk Dev. 12-09-2012 09:18 PM
- Tagged Splunk DB connect MSSQL connection params on Splunk Dev. 12-09-2012 09:18 PM
- Tagged Splunk DB connect MSSQL connection params on Splunk Dev. 12-09-2012 09:18 PM
- Posted Re: data segregation methods on Security. 12-09-2012 09:10 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 2 | |||
| 0 |
12-22-2015
04:41 PM
I have installed the RESTFUL TA APP in Splunk and have a data set being sucked into Splunk.
The only challenge I am having now is the JSON seems to be getting parsed and interpreted correctly, however I am not able to associate the fields to one another as they are all segregated to some extent.
Below is a sample data set and my end goal is to be able to associate a device.name to a value like result{}..ping_rtt.total as an example, however I am not seeing how this is possible in an easy way.
Any help would be much appreciated.
DATA SET
{"meta":{"epoch":1450820945,"hash":null,"message":"ok","query":"range=1450820940 - 6m TO 1450820940 - 1m","range":[1450820580,1450820880],"result_count":50,"result_offset":0,"result_total":275,"time":"Wed Dec 23 07:49:05 2015","tz":"Australia/Brisbane","tz_offset":36000},"result":[{".ping_rtt":{"avg":0,"count":6,"max":0,"min":0,"total":0,"vals":[0,0,0,0,0,0]},"device.name":"bffg-vm-server","id":151},{".ping_rtt":{"avg":0,"count":6,"max":0,"min":0,"total":0,"vals":[0,0,0,0,0,0]},"device.name":"ddf-vm-server","id":152},{".ping_rtt":{"avg":0,"count":6,"max":0,"min":0,"total":0,"vals":[0,0,0,0,0,0]},"device.name":"abb-vm-server","id":153},{".ping_rtt":null,"device.name":"test122","id":154},{".ping_rtt":{"avg":27.83333333333333,"count":6,"max":32,"min":22,"total":167,"vals":[27,28,32,27,22,31]},"device.name":"SanJose-core","id":214},{".ping_rtt":{"avg":25.33333333333333,"count":6,"max":31,"min":17,"total":152,"vals":[27,23,27,27,17,31]},"device.name":"NewYork-ups1","id":215},{".ping_rtt":{"avg":37.83333333333334,"count":6,"max":47,"min":32,"total":227,"vals":[37,33,47,37,32,41]},"device.name":"NewYork-ups2","id":216},{".ping_rtt":{"avg":35.33333333333334,"count":6,"max":37,"min":32,"total":212,"vals":[37,33,37,37,32,36]},"device.name":"NewYork-srv1","id":217},{".ping_rtt":{"avg":17.83333333333333,"count":6,"max":26,"min":11,"total":107,"vals":[16,13,19,22,11,26]},"device.name":"NewYork-srv2","id":218},{".ping_rtt":{"avg":58.33333333333334,"count":6,"max":62,"min":53,"total":350,"vals":[57,53,59,62,58,61]},"device.name":"NewYork-srv3","id":219},{".ping_rtt":{"avg":41.16666666666666,"count":6,"max":62,"min":16,"total":247,"vals":[62,48,37,32,16,52]},"device.name":"NewYork-srv4","id":220},{".ping_rtt":{"avg":34.83333333333334,"count":6,"max":39,"min":31,"total":209,"vals":[37,33,39,37,32,31]},"device.name":"NewYork-fw1","id":221},{".ping_rtt":{"avg":35.33333333333334,"count":6,"max":37,"min":32,"total":212,"vals":[37,33,37,37,32,36]},"device.name":"NewYork-fw2","id":222},{".ping_rtt":{"avg":28.33333333333333,"count":6,"max":37,"min":21,"total":170,"vals":[37,28,32,27,25,21]},"device.name":"NewYork-swt4","id":223},{".ping_rtt":{"avg":16.83333333333333,"count":6,"max":21,"min":10,"total":101,"vals":[16,18,19,17,10,21]},"device.name":"NewYork-swt3","id":224},{".ping_rtt":{"avg":47.33333333333334,"count":6,"max":53,"min":41,"total":284,"vals":[47,50,53,51,42,41]},"device.name":"NewYork-swt2","id":225},{".ping_rtt":{"avg":20.66666666666667,"count":6,"max":27,"min":16,"total":124,"vals":[21,18,24,18,27,16]},"device.name":"NewYork-swt1","id":226},{".ping_rtt":{"avg":20.66666666666667,"count":6,"max":25,"min":17,"total":124,"vals":[21,18,22,17,25,21]},"device.name":"NewYork-rtr","id":227},{".ping_rtt":{"avg":35.83333333333334,"count":6,"max":37,"min":33,"total":215,"vals":[37,33,37,36,37,35]},"device.name":"LosAngeles-ups1","id":228},{".ping_rtt":{"avg":null,"count":0,"max":null,"min":null,"total":null,"vals":[null,null,null,null,null,null]},"device.name":"LosAngeles-ups2","id":229},{".ping_rtt":{"avg":17.66666666666667,"count":6,"max":24,"min":15,"total":106,"vals":[16,18,24,17,15,16]},"device.name":"LosAngeles-srv1","id":230},{".ping_rtt":{"avg":32.5,"count":6,"max":40,"min":21,"total":195,"vals":[21,33,38,26,37,40]},"device.name":"LosAngeles-srv2","id":231},{".ping_rtt":{"avg":36.16666666666666,"count":6,"max":43,"min":31,"total":217,"vals":[31,33,43,36,32,42]},"device.name":"LosAngeles-srv3","id":232},{".ping_rtt":{"avg":49.66666666666666,"count":6,"max":56,"min":45,"total":298,"vals":[46,45,53,56,47,51]},"device.name":"LosAngeles-srv4","id":233},{".ping_rtt":{"avg":36.5,"count":6,"max":38,"min":35,"total":219,"vals":[36,38,37,36,37,35]},"device.name":"LosAngeles-fw","id":234},{".ping_rtt":{"avg":55.83333333333334,"count":6,"max":62,"min":48,"total":335,"vals":[56,48,62,56,52,61]},"device.name":"LosAngeles-swt4","id":235},{".ping_rtt":{"avg":36.5,"count":6,"max":38,"min":35,"total":219,"vals":[36,38,37,36,37,35]},"device.name":"LosAngeles-swt3","id":236},{".ping_rtt":{"avg":16.16666666666667,"count":6,"max":18,"min":15,"total":97,"vals":[16,17,18,16,15,15]},"device.name":"LosAngeles-swt2","id":237},{".ping_rtt":{"avg":16.33333333333333,"count":6,"max":18,"min":15,"total":98,"vals":[16,18,18,16,15,15]},"device.name":"LosAngeles-swt1","id":238},{".ping_rtt":{"avg":40.83333333333334,"count":6,"max":47,"min":35,"total":245,"vals":[41,45,41,36,47,35]},"device.name":"LosAngeles-rtr","id":239},{".ping_rtt":{"avg":33.16666666666666,"count":6,"max":37,"min":21,"total":199,"vals":[21,33,37,36,37,35]},"device.name":"Chicago-ups1","id":240},{".ping_rtt":{"avg":36.5,"count":6,"max":38,"min":35,"total":219,"vals":[36,38,37,36,37,35]},"device.name":"Chicago-ups2","id":241},{".ping_rtt":{"avg":20.83333333333333,"count":6,"max":26,"min":15,"total":125,"vals":[26,23,18,21,22,15]},"device.name":"Chicago-srv1","id":242},{".ping_rtt":{"avg":50.33333333333334,"count":6,"max":55,"min":46,"total":302,"vals":[46,55,48,55,52,46]},"device.name":"Chicago-srv2","id":243},{".ping_rtt":{"avg":null,"count":0,"max":null,"min":null,"total":null,"vals":[null,null,null,null,null,null]},"device.name":"Chicago-fw","id":244},{".ping_rtt":{"avg":45,"count":6,"max":52,"min":41,"total":270,"vals":[41,43,48,41,52,45]},"device.name":"Chicago-swt4","id":245},{".ping_rtt":{"avg":16.16666666666667,"count":6,"max":18,"min":15,"total":97,"vals":[16,17,18,16,15,15]},"device.name":"Chicago-swt3","id":246},{".ping_rtt":{"avg":35.33333333333334,"count":6,"max":37,"min":32,"total":212,"vals":[36,32,36,36,37,35]},"device.name":"Chicago-swt1","id":247},{".ping_rtt":{"avg":35.33333333333334,"count":6,"max":39,"min":31,"total":212,"vals":[36,39,34,35,31,37]},"device.name":"Chicago-rtr","id":248},{".ping_rtt":{"avg":18.83333333333333,"count":6,"max":24,"min":12,"total":113,"vals":[12,24,24,15,16,22]},"device.name":"Houston-ups1","id":249},{".ping_rtt":{"avg":37.66666666666666,"count":6,"max":52,"min":31,"total":226,"vals":[31,34,52,46,31,32]},"device.name":"Houston-ups2","id":250},{".ping_rtt":{"avg":31.5,"count":6,"max":37,"min":26,"total":189,"vals":[36,29,31,30,26,37]},"device.name":"Houston-srv1","id":251},{".ping_rtt":{"avg":null,"count":0,"max":null,"min":null,"total":null,"vals":[null,null,null,null,null,null]},"device.name":"Houston-srv2","id":252},{".ping_rtt":{"avg":null,"count":0,"max":null,"min":null,"total":null,"vals":[null,null,null,null,null,null]},"device.name":"Houston-fw","id":253},{".ping_rtt":{"avg":50.16666666666666,"count":6,"max":60,"min":39,"total":301,"vals":[60,44,39,50,56,52]},"device.name":"Houston-swt4","id":254},{".ping_rtt":{"avg":23.5,"count":6,"max":35,"min":17,"total":141,"vals":[35,19,24,20,26,17]},"device.name":"Houston-swt3","id":255},{".ping_rtt":{"avg":37.33333333333334,"count":6,"max":40,"min":35,"total":224,"vals":[40,38,38,35,36,37]},"device.name":"Houston-swt2","id":256},{".ping_rtt":{"avg":55,"count":6,"max":71,"min":35,"total":330,"vals":[65,53,44,35,71,62]},"device.name":"Houston-swt1","id":257},{".ping_rtt":{"avg":22.33333333333333,"count":6,"max":29,"min":15,"total":134,"vals":[19,29,24,15,20,27]},"device.name":"Houston-rtr","id":258},{".ping_rtt":{"avg":17.33333333333333,"count":6,"max":19,"min":15,"total":104,"vals":[19,18,19,15,16,17]},"device.name":"Phoenix-ups1","id":259}],"success":true}
Thanks for your help
... View more
- Tags:
- splunk-enterprise
01-01-2013
05:49 PM
Have you done anything like this in the past. Could you give me some pointers as to how to achieve the lookup
Thanks
J
... View more
12-23-2012
01:56 PM
Hi,
Has any one been able to work out howto incorporate the exclusion of public holidays in searches.
I am trying to work out the logic of doing such a task as I have a requirement to do this for a certain type of data set.
Any help or direction would be most appreciated
Cheers
J
... View more
- Tags:
- search
12-19-2012
10:53 PM
Thanks very much for taken the time to explain things and provide a solution, much appreciated
... View more
12-19-2012
09:56 PM
1 Karma
Hi
Thanks, this worked like a charm. I started to try different methods and it would seem the below is slightly faster is there a reason for this ?
date_wday!="saturday" AND date_wday!="sunday"
| eval myHour=strftime(_time, "%H")
| eval myMinute=strftime(_time, "%M")
| where ( (myHour <= 18 AND myMinute >= 00) AND (myHour > 5 AND myMinute <= 59) )
... View more
12-19-2012
08:09 PM
Hi
When I run the below
date_hour>=6 date_hour<=18 date_wday!="sunday" date_wday!="saturday"
I get nothing as Splunk tells me "No matching events found" my timepicker is the last 7 days and with out this filter i get thousands of events over each of the last 7 days.
So not sure why that is not working
Cheers
J
... View more
12-19-2012
05:17 PM
2 Karma
Hi All
I am trying to generate a search that only includes Business hours and also excludes weekends.
I have tried any combinations and still cannot get it working.
I have tried the below which I thought would work but it did not give me the results I wanted
((date_hour<=18 AND date_hour>=6) OR (date_wday!="sunday" AND date_wday!="saturday"))
Cheers for any help
J
... View more
- Tags:
- search
12-10-2012
03:37 PM
1 Karma
Hi
I found a solution to my issue, as MSSQL 2008 was running as a named instance, I needed to find out the dynamically allocated TCP port. The below URL helped me find this information via the Windows Registry.
http://sqlserverpedia.com/blog/sql-server-bloggers/what-tcp-port-is-sql-server-running-under/
I hope this helps out other people who had the same issue as I have had.
Cheers
J
... View more
12-10-2012
03:18 PM
I forgot to mention I tried using the host option as well and I also used the port option as well and still could not connect. The error I get is connection refused.
Also I made a slight typo
Server = SQLSERVER\BETA
Database = ServiceDesk
Cheers
J
... View more
12-09-2012
09:18 PM
Hi
I am having issues connecting to a Microsoft MSSQL server using the Splunk DB connect app.
I have tested connectivity from a GUI windows client to the database and it works fine but the connection string maybe the issue in SPLUNK , as I have not seen any examples in the docs that show you how to connect with these params.
Database = SQLSERVER\BETA.ServiceDesk
I have tried many different combinations to try and connect, but cannot get splunk to successfully connect.
In the GUI Client the params below work
Server = SQLSERVER\BETA
Username = test
Password = ********
This takes me straight into the correct database. any help would be greatly appreciated.
Cheers
J
... View more
12-09-2012
09:10 PM
if you tag your data via the forwarders which I assume are in your various regions, then this tag could then be used to segment your data into the different indexes and then use RBAC via the AD groups to finely control access to the data.
... View more
